Coverage Report

Created: 2025-11-11 06:41

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/miniz/tests/small_fuzzer.c
Line
Count
Source
1
/* Derived from zlib fuzzers at http://github.com/google/oss-fuzz/tree/master/projects/zlib,
2
 * see ossfuzz.sh for full license text.
3
 */
4
5
#include <stdio.h>
6
#include <stddef.h>
7
#include <stdint.h>
8
#include <string.h>
9
#include <stdlib.h>
10
#include <inttypes.h>
11
12
#include "miniz.h"
13
14
#define CHECK_ERR(err, msg)                              \
15
519M
    {                                                    \
16
519M
        if (err != Z_OK)                                 \
17
519M
        {                                                \
18
0
            fprintf(stderr, "%s error: %d\n", msg, err); \
19
0
            exit(1);                                     \
20
0
        }                                                \
21
519M
    }
22
23
static const uint8_t *data;
24
static size_t dataLen;
25
static alloc_func zalloc = NULL;
26
static free_func zfree = NULL;
27
28
/* Test deflate() with small buffers */
29
void test_deflate(unsigned char *compr, size_t comprLen)
30
1.77k
{
31
1.77k
    z_stream c_stream; /* compression stream */
32
1.77k
    int err;
33
1.77k
    unsigned long len = dataLen;
34
35
1.77k
    c_stream.zalloc = zalloc;
36
1.77k
    c_stream.zfree = zfree;
37
1.77k
    c_stream.opaque = NULL;
38
39
1.77k
    err = deflateInit(&c_stream, Z_DEFAULT_COMPRESSION);
40
1.77k
    CHECK_ERR(err, "deflateInit");
41
42
1.77k
    c_stream.next_in = (Bytef *)data;
43
1.77k
    c_stream.next_out = compr;
44
45
314M
    while (c_stream.total_in != len && c_stream.total_out < comprLen)
46
314M
    {
47
314M
        c_stream.avail_in = c_stream.avail_out = 1; /* force small buffers */
48
314M
        err = deflate(&c_stream, Z_NO_FLUSH);
49
314M
        CHECK_ERR(err, "deflate small 1");
50
314M
    }
51
52
    /* Finish the stream, still forcing small buffers: */
53
1.77k
    for (;;)
54
11.1M
    {
55
11.1M
        c_stream.avail_out = 1;
56
11.1M
        err = deflate(&c_stream, Z_FINISH);
57
11.1M
        if (err == Z_STREAM_END)
58
1.77k
            break;
59
11.1M
        CHECK_ERR(err, "deflate small 2");
60
11.1M
    }
61
62
1.77k
    err = deflateEnd(&c_stream);
63
1.77k
    CHECK_ERR(err, "deflateEnd");
64
1.77k
}
65
66
/* Test inflate() with small buffers */
67
void test_inflate(unsigned char *compr, size_t comprLen, unsigned char *uncompr, size_t uncomprLen)
68
1.77k
{
69
1.77k
    int err;
70
1.77k
    z_stream d_stream; /* decompression stream */
71
72
1.77k
    d_stream.zalloc = zalloc;
73
1.77k
    d_stream.zfree = zfree;
74
1.77k
    d_stream.opaque = NULL;
75
76
1.77k
    d_stream.next_in = compr;
77
1.77k
    d_stream.avail_in = 0;
78
1.77k
    d_stream.next_out = uncompr;
79
80
1.77k
    err = inflateInit(&d_stream);
81
1.77k
    CHECK_ERR(err, "inflateInit");
82
83
193M
    while (d_stream.total_out < uncomprLen && d_stream.total_in < comprLen)
84
193M
    {
85
193M
        d_stream.avail_in = d_stream.avail_out = 1; /* force small buffers */
86
193M
        err = inflate(&d_stream, Z_NO_FLUSH);
87
193M
        if (err == Z_STREAM_END)
88
0
            break;
89
193M
        CHECK_ERR(err, "inflate");
90
193M
    }
91
92
1.77k
    err = inflateEnd(&d_stream);
93
1.77k
    CHECK_ERR(err, "inflateEnd");
94
95
1.77k
    if (memcmp(uncompr, data, dataLen))
96
0
    {
97
0
        fprintf(stderr, "bad inflate\n");
98
0
        exit(1);
99
0
    }
100
1.77k
}
101
102
int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size)
103
4.97k
{
104
4.97k
    size_t comprLen = compressBound(size);
105
4.97k
    size_t uncomprLen = size;
106
4.97k
    uint8_t *compr, *uncompr;
107
108
    /* Discard inputs larger than 1Mb. */
109
4.97k
    static size_t kMaxSize = 1024 * 1024;
110
111
4.97k
    if (size < 1 || size > kMaxSize)
112
5
        return 0;
113
114
4.97k
    data = d;
115
4.97k
    dataLen = size;
116
4.97k
    compr = calloc(1, comprLen);
117
4.97k
    uncompr = calloc(1, uncomprLen);
118
119
4.97k
    test_deflate(compr, comprLen);
120
4.97k
    test_inflate(compr, comprLen, uncompr, uncomprLen);
121
122
4.97k
    free(compr);
123
4.97k
    free(uncompr);
124
125
4.97k
    return 0;
126
4.97k
}