Line | Count | Source (jump to first uncovered line) |
1 | | #include <stddef.h> |
2 | | #include <unistd.h> |
3 | | #include <stdint.h> |
4 | | #include <stdio.h> |
5 | | #include <stdlib.h> |
6 | | #include <stdbool.h> |
7 | | #include <string.h> |
8 | | |
9 | | #include "mpg123.h" |
10 | | |
11 | 6.05k | static char* fuzzer_get_tmpfile(const uint8_t* data, size_t size) { |
12 | 6.05k | char* filename_buffer = strdup("/tmp/generate_temporary_file.XXXXXX"); |
13 | 6.05k | if (!filename_buffer) { |
14 | 0 | perror("Failed to allocate file name buffer."); |
15 | 0 | abort(); |
16 | 0 | } |
17 | 6.05k | const int file_descriptor = mkstemp(filename_buffer); |
18 | 6.05k | if (file_descriptor < 0) { |
19 | 0 | perror("Failed to make temporary file."); |
20 | 0 | abort(); |
21 | 0 | } |
22 | 6.05k | FILE* file = fdopen(file_descriptor, "wb"); |
23 | 6.05k | if (!file) { |
24 | 0 | perror("Failed to open file descriptor."); |
25 | 0 | close(file_descriptor); |
26 | 0 | abort(); |
27 | 0 | } |
28 | 6.05k | const size_t bytes_written = fwrite(data, sizeof(uint8_t), size, file); |
29 | 6.05k | if (bytes_written < size) { |
30 | 0 | close(file_descriptor); |
31 | 0 | fprintf(stderr, "Failed to write all bytes to file (%zu out of %zu)", |
32 | 0 | bytes_written, size); |
33 | 0 | abort(); |
34 | 0 | } |
35 | 6.05k | fclose(file); |
36 | 6.05k | return filename_buffer; |
37 | 6.05k | } |
38 | | |
39 | 6.05k | static void fuzzer_release_tmpfile(char* filename) { |
40 | 6.05k | if (unlink(filename) != 0) { |
41 | 0 | perror("WARNING: Failed to delete temporary file."); |
42 | 0 | } |
43 | 6.05k | free(filename); |
44 | 6.05k | } |
45 | | |
46 | 6.05k | int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
47 | 6.05k | static bool initialized = false; |
48 | 6.05k | if (!initialized) { |
49 | 1 | mpg123_init(); |
50 | 1 | initialized = true; |
51 | 1 | } |
52 | 6.05k | char* filename = fuzzer_get_tmpfile(data, size); |
53 | 6.05k | if (filename == NULL) { |
54 | 0 | return 0; |
55 | 0 | } |
56 | | |
57 | 6.05k | size_t outmemorysize = size * 2; // Guess based on the size of data. |
58 | 6.05k | unsigned char* outmemory = (unsigned char*)malloc(outmemorysize); |
59 | 6.05k | if (outmemory == NULL) { |
60 | 0 | fuzzer_release_tmpfile(filename); |
61 | 0 | return 0; |
62 | 0 | } |
63 | | |
64 | 6.05k | int error; |
65 | 6.05k | mpg123_handle* handle = mpg123_new(NULL, &error); |
66 | 6.05k | if (handle == NULL || mpg123_param(handle, |
67 | 6.05k | MPG123_ADD_FLAGS, MPG123_QUIET, 0.) != MPG123_OK) { |
68 | 0 | free(outmemory); |
69 | 0 | fuzzer_release_tmpfile(filename); |
70 | 0 | return 0; |
71 | 0 | } |
72 | | |
73 | 6.05k | if (mpg123_open(handle, filename) == MPG123_OK) { |
74 | 6.05k | int read_error; |
75 | 6.05k | do { |
76 | 6.05k | size_t decoded_size; |
77 | 6.05k | read_error = mpg123_read(handle, outmemory, outmemorysize, &decoded_size); |
78 | 6.05k | } while (read_error == MPG123_OK && mpg123_tellframe(handle) <= 10000 |
79 | 6.05k | && mpg123_tell_stream(handle) <= 1<<20); |
80 | 6.05k | } |
81 | | |
82 | 6.05k | mpg123_close(handle); |
83 | 6.05k | mpg123_delete(handle); |
84 | 6.05k | free(outmemory); |
85 | 6.05k | fuzzer_release_tmpfile(filename); |
86 | 6.05k | return 0; |
87 | 6.05k | } |