/src/miniz/tests/flush_fuzzer.c
Line  | Count  | Source  | 
1  |  | /* Derived from zlib fuzzers at http://github.com/google/oss-fuzz/tree/master/projects/zlib,  | 
2  |  |  * see ossfuzz.sh for full license text.  | 
3  |  |  */  | 
4  |  |  | 
5  |  | #include <stdio.h>  | 
6  |  | #include <stddef.h>  | 
7  |  | #include <stdint.h>  | 
8  |  | #include <string.h>  | 
9  |  | #include <stdlib.h>  | 
10  |  | #include <inttypes.h>  | 
11  |  |  | 
12  |  | #include "miniz.h"  | 
13  |  |  | 
14  |  | #define CHECK_ERR(err, msg)                              \  | 
15  | 4.94k  |     {                                                    \ | 
16  | 4.94k  |         if (err != Z_OK)                                 \  | 
17  | 4.94k  |         {                                                \ | 
18  | 0  |             fprintf(stderr, "%s error: %d\n", msg, err); \  | 
19  | 0  |             exit(1);                                     \  | 
20  | 0  |         }                                                \  | 
21  | 4.94k  |     }  | 
22  |  |  | 
23  |  | static const uint8_t *data;  | 
24  |  | static size_t dataLen;  | 
25  |  | static alloc_func zalloc = NULL;  | 
26  |  | static free_func zfree = NULL;  | 
27  |  |  | 
28  |  | void test_flush(unsigned char *compr, size_t *comprLen)  | 
29  | 1.64k  | { | 
30  | 1.64k  |     z_stream c_stream; /* compression stream */  | 
31  | 1.64k  |     int err;  | 
32  | 1.64k  |     unsigned int len = dataLen;  | 
33  |  |  | 
34  | 1.64k  |     c_stream.zalloc = zalloc;  | 
35  | 1.64k  |     c_stream.zfree = zfree;  | 
36  | 1.64k  |     c_stream.opaque = NULL;  | 
37  |  |  | 
38  | 1.64k  |     err = deflateInit(&c_stream, Z_DEFAULT_COMPRESSION);  | 
39  | 1.64k  |     CHECK_ERR(err, "deflateInit");  | 
40  |  |  | 
41  | 1.64k  |     c_stream.next_in = (Bytef *)data;  | 
42  | 1.64k  |     c_stream.next_out = compr;  | 
43  | 1.64k  |     c_stream.avail_in = 3;  | 
44  | 1.64k  |     c_stream.avail_out = (unsigned int)*comprLen;  | 
45  | 1.64k  |     err = deflate(&c_stream, Z_FULL_FLUSH);  | 
46  | 1.64k  |     CHECK_ERR(err, "deflate flush 1");  | 
47  |  |  | 
48  | 1.64k  |     compr[3]++; /* force an error in first compressed block */  | 
49  | 1.64k  |     c_stream.avail_in = len - 3;  | 
50  |  |  | 
51  | 1.64k  |     err = deflate(&c_stream, Z_FINISH);  | 
52  |  |  | 
53  | 1.64k  |     if (err != Z_STREAM_END)  | 
54  | 0  |     { | 
55  | 0  |         CHECK_ERR(err, "deflate flush 2");  | 
56  | 0  |     }  | 
57  |  |  | 
58  | 1.64k  |     err = deflateEnd(&c_stream);  | 
59  | 1.64k  |     CHECK_ERR(err, "deflateEnd");  | 
60  |  |  | 
61  | 1.64k  |     *comprLen = (size_t)c_stream.total_out;  | 
62  | 1.64k  | }  | 
63  |  |  | 
64  |  | int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size)  | 
65  | 1.65k  | { | 
66  | 1.65k  |     size_t comprLen = 100 + 2 * compressBound(size);  | 
67  | 1.65k  |     size_t uncomprLen = size;  | 
68  | 1.65k  |     uint8_t *compr, *uncompr;  | 
69  |  |  | 
70  |  |     /* Discard inputs larger than 1Mb. */  | 
71  | 1.65k  |     static const size_t kMaxSize = 1024 * 1024;  | 
72  |  |  | 
73  |  |     /* This test requires at least 3 bytes of input data. */  | 
74  | 1.65k  |     if (size <= 3 || size > kMaxSize)  | 
75  | 3  |         return 0;  | 
76  |  |  | 
77  | 1.64k  |     data = d;  | 
78  | 1.64k  |     dataLen = size;  | 
79  | 1.64k  |     compr = calloc(1, comprLen);  | 
80  | 1.64k  |     uncompr = calloc(1, uncomprLen);  | 
81  |  |  | 
82  | 1.64k  |     test_flush(compr, &comprLen);  | 
83  |  |  | 
84  | 1.64k  |     free(compr);  | 
85  | 1.64k  |     free(uncompr);  | 
86  |  |  | 
87  | 1.64k  |     return 0;  | 
88  | 1.65k  | }  |