/src/miniz/tests/flush_fuzzer.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* Derived from zlib fuzzers at http://github.com/google/oss-fuzz/tree/master/projects/zlib, |
2 | | * see ossfuzz.sh for full license text. |
3 | | */ |
4 | | |
5 | | #include <stdio.h> |
6 | | #include <stddef.h> |
7 | | #include <stdint.h> |
8 | | #include <string.h> |
9 | | #include <stdlib.h> |
10 | | #include <inttypes.h> |
11 | | |
12 | | #include "miniz.h" |
13 | | |
14 | | #define CHECK_ERR(err, msg) \ |
15 | 5.07k | { \ |
16 | 5.07k | if (err != Z_OK) \ |
17 | 5.07k | { \ |
18 | 0 | fprintf(stderr, "%s error: %d\n", msg, err); \ |
19 | 0 | exit(1); \ |
20 | 0 | } \ |
21 | 5.07k | } |
22 | | |
23 | | static const uint8_t *data; |
24 | | static size_t dataLen; |
25 | | static alloc_func zalloc = NULL; |
26 | | static free_func zfree = NULL; |
27 | | |
28 | | void test_flush(unsigned char *compr, size_t *comprLen) |
29 | 1.69k | { |
30 | 1.69k | z_stream c_stream; /* compression stream */ |
31 | 1.69k | int err; |
32 | 1.69k | unsigned int len = dataLen; |
33 | | |
34 | 1.69k | c_stream.zalloc = zalloc; |
35 | 1.69k | c_stream.zfree = zfree; |
36 | 1.69k | c_stream.opaque = NULL; |
37 | | |
38 | 1.69k | err = deflateInit(&c_stream, Z_DEFAULT_COMPRESSION); |
39 | 1.69k | CHECK_ERR(err, "deflateInit"); |
40 | | |
41 | 1.69k | c_stream.next_in = (Bytef *)data; |
42 | 1.69k | c_stream.next_out = compr; |
43 | 1.69k | c_stream.avail_in = 3; |
44 | 1.69k | c_stream.avail_out = (unsigned int)*comprLen; |
45 | 1.69k | err = deflate(&c_stream, Z_FULL_FLUSH); |
46 | 1.69k | CHECK_ERR(err, "deflate flush 1"); |
47 | | |
48 | 1.69k | compr[3]++; /* force an error in first compressed block */ |
49 | 1.69k | c_stream.avail_in = len - 3; |
50 | | |
51 | 1.69k | err = deflate(&c_stream, Z_FINISH); |
52 | | |
53 | 1.69k | if (err != Z_STREAM_END) |
54 | 0 | { |
55 | 0 | CHECK_ERR(err, "deflate flush 2"); |
56 | 0 | } |
57 | | |
58 | 1.69k | err = deflateEnd(&c_stream); |
59 | 1.69k | CHECK_ERR(err, "deflateEnd"); |
60 | | |
61 | 1.69k | *comprLen = (size_t)c_stream.total_out; |
62 | 1.69k | } |
63 | | |
64 | | int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size) |
65 | 1.69k | { |
66 | 1.69k | size_t comprLen = 100 + 2 * compressBound(size); |
67 | 1.69k | size_t uncomprLen = size; |
68 | 1.69k | uint8_t *compr, *uncompr; |
69 | | |
70 | | /* Discard inputs larger than 1Mb. */ |
71 | 1.69k | static const size_t kMaxSize = 1024 * 1024; |
72 | | |
73 | | /* This test requires at least 3 bytes of input data. */ |
74 | 1.69k | if (size <= 3 || size > kMaxSize) |
75 | 3 | return 0; |
76 | | |
77 | 1.69k | data = d; |
78 | 1.69k | dataLen = size; |
79 | 1.69k | compr = calloc(1, comprLen); |
80 | 1.69k | uncompr = calloc(1, uncomprLen); |
81 | | |
82 | 1.69k | test_flush(compr, &comprLen); |
83 | | |
84 | 1.69k | free(compr); |
85 | 1.69k | free(uncompr); |
86 | | |
87 | 1.69k | return 0; |
88 | 1.69k | } |