Coverage Report

Created: 2026-04-12 06:36

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/miniz/tests/small_fuzzer.c
Line
Count
Source
1
/* Derived from zlib fuzzers at http://github.com/google/oss-fuzz/tree/master/projects/zlib,
2
 * see ossfuzz.sh for full license text.
3
 */
4
5
#include <stdio.h>
6
#include <stddef.h>
7
#include <stdint.h>
8
#include <string.h>
9
#include <stdlib.h>
10
#include <inttypes.h>
11
12
#include "miniz.h"
13
14
#define CHECK_ERR(err, msg)                              \
15
638M
    {                                                    \
16
638M
        if (err != Z_OK)                                 \
17
638M
        {                                                \
18
0
            fprintf(stderr, "%s error: %d\n", msg, err); \
19
0
            exit(1);                                     \
20
0
        }                                                \
21
638M
    }
22
23
static const uint8_t *data;
24
static size_t dataLen;
25
static alloc_func zalloc = NULL;
26
static free_func zfree = NULL;
27
28
/* Test deflate() with small buffers */
29
void test_deflate(unsigned char *compr, size_t comprLen)
30
2.38k
{
31
2.38k
    z_stream c_stream; /* compression stream */
32
2.38k
    int err;
33
2.38k
    unsigned long len = dataLen;
34
35
2.38k
    c_stream.zalloc = zalloc;
36
2.38k
    c_stream.zfree = zfree;
37
2.38k
    c_stream.opaque = NULL;
38
39
2.38k
    err = deflateInit(&c_stream, Z_DEFAULT_COMPRESSION);
40
2.38k
    CHECK_ERR(err, "deflateInit");
41
42
2.38k
    c_stream.next_in = (Bytef *)data;
43
2.38k
    c_stream.next_out = compr;
44
45
387M
    while (c_stream.total_in != len && c_stream.total_out < comprLen)
46
387M
    {
47
387M
        c_stream.avail_in = c_stream.avail_out = 1; /* force small buffers */
48
387M
        err = deflate(&c_stream, Z_NO_FLUSH);
49
387M
        CHECK_ERR(err, "deflate small 1");
50
387M
    }
51
52
    /* Finish the stream, still forcing small buffers: */
53
2.38k
    for (;;)
54
18.1M
    {
55
18.1M
        c_stream.avail_out = 1;
56
18.1M
        err = deflate(&c_stream, Z_FINISH);
57
18.1M
        if (err == Z_STREAM_END)
58
2.38k
            break;
59
18.1M
        CHECK_ERR(err, "deflate small 2");
60
18.1M
    }
61
62
2.38k
    err = deflateEnd(&c_stream);
63
2.38k
    CHECK_ERR(err, "deflateEnd");
64
2.38k
}
65
66
/* Test inflate() with small buffers */
67
void test_inflate(unsigned char *compr, size_t comprLen, unsigned char *uncompr, size_t uncomprLen)
68
2.38k
{
69
2.38k
    int err;
70
2.38k
    z_stream d_stream; /* decompression stream */
71
72
2.38k
    d_stream.zalloc = zalloc;
73
2.38k
    d_stream.zfree = zfree;
74
2.38k
    d_stream.opaque = NULL;
75
76
2.38k
    d_stream.next_in = compr;
77
2.38k
    d_stream.avail_in = 0;
78
2.38k
    d_stream.next_out = uncompr;
79
80
2.38k
    err = inflateInit(&d_stream);
81
2.38k
    CHECK_ERR(err, "inflateInit");
82
83
233M
    while (d_stream.total_out < uncomprLen && d_stream.total_in < comprLen)
84
233M
    {
85
233M
        d_stream.avail_in = d_stream.avail_out = 1; /* force small buffers */
86
233M
        err = inflate(&d_stream, Z_NO_FLUSH);
87
233M
        if (err == Z_STREAM_END)
88
0
            break;
89
233M
        CHECK_ERR(err, "inflate");
90
233M
    }
91
92
2.38k
    err = inflateEnd(&d_stream);
93
2.38k
    CHECK_ERR(err, "inflateEnd");
94
95
2.38k
    if (memcmp(uncompr, data, dataLen))
96
0
    {
97
0
        fprintf(stderr, "bad inflate\n");
98
0
        exit(1);
99
0
    }
100
2.38k
}
101
102
int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size)
103
6.10k
{
104
6.10k
    size_t comprLen = compressBound(size);
105
6.10k
    size_t uncomprLen = size;
106
6.10k
    uint8_t *compr, *uncompr;
107
108
    /* Discard inputs larger than 1Mb. */
109
6.10k
    static size_t kMaxSize = 1024 * 1024;
110
111
6.10k
    if (size < 1 || size > kMaxSize)
112
5
        return 0;
113
114
6.10k
    data = d;
115
6.10k
    dataLen = size;
116
6.10k
    compr = calloc(1, comprLen);
117
6.10k
    uncompr = calloc(1, uncomprLen);
118
119
6.10k
    test_deflate(compr, comprLen);
120
6.10k
    test_inflate(compr, comprLen, uncompr, uncomprLen);
121
122
6.10k
    free(compr);
123
6.10k
    free(uncompr);
124
125
6.10k
    return 0;
126
6.10k
}