// Copyright 2018 Google Inc.

//

// Licensed under the Apache License, Version 2.0 (the "License");

// you may not use this file except in compliance with the License.

// You may obtain a copy of the License at

//

//      http://www.apache.org/licenses/LICENSE-2.0

//

// Unless required by applicable law or agreed to in writing, software

// distributed under the License is distributed on an "AS IS" BASIS,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

// See the License for the specific language governing permissions and

// limitations under the License.

// Adapter utility from fuzzer input to a temporary file, for fuzzing APIs that

// require a file instead of an input buffer.

#ifndef FUZZER_TEMP_FILE_H_

#define FUZZER_TEMP_FILE_H_

#include <stdint.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

// Pure-C interface for creating and cleaning up temporary files.

static char* fuzzer_get_tmpfile(const uint8_t* data, size_t size) {

  char* filename_buffer = strdup("/tmp/generate_temporary_file.XXXXXX");

  if (!filename_buffer) {

    perror("Failed to allocate file name buffer.");

    abort();

  }

  const int file_descriptor = mkstemp(filename_buffer);

  if (file_descriptor < 0) {

    perror("Failed to make temporary file.");

    abort();

  }

  FILE* file = fdopen(file_descriptor, "wb");

  if (!file) {

    perror("Failed to open file descriptor.");

    close(file_descriptor);

    abort();

  }

  const size_t bytes_written = fwrite(data, sizeof(uint8_t), size, file);

  if (bytes_written < size) {

    close(file_descriptor);

    fprintf(stderr, "Failed to write all bytes to file (%zu out of %zu)",

            bytes_written, size);

    abort();

  }

  fclose(file);

  return filename_buffer;

}

filestorage_read_file_fuzzer.cc:fuzzer_get_tmpfile(unsigned char const*, unsigned long)

Line

Count

Source

29

1

static char* fuzzer_get_tmpfile(const uint8_t* data, size_t size) {

30

1

  char* filename_buffer = strdup("/tmp/generate_temporary_file.XXXXXX");

31

1

  if (!filename_buffer) {

32

0

    perror("Failed to allocate file name buffer.");

33

0

    abort();

34

0

  }

35

1

  const int file_descriptor = mkstemp(filename_buffer);

36

1

  if (file_descriptor < 0) {

37

0

    perror("Failed to make temporary file.");

38

0

    abort();

39

0

  }

40

1

  FILE* file = fdopen(file_descriptor, "wb");

41

1

  if (!file) {

42

0

    perror("Failed to open file descriptor.");

43

0

    close(file_descriptor);

44

0

    abort();

45

0

  }

46

1

  const size_t bytes_written = fwrite(data, sizeof(uint8_t), size, file);

47

1

  if (bytes_written < size) {

48

0

    close(file_descriptor);

49

0

    fprintf(stderr, "Failed to write all bytes to file (%zu out of %zu)",

50

0

            bytes_written, size);

51

0

    abort();

52

0

  }

53

1

  fclose(file);

54

1

  return filename_buffer;

55

1

}

imread_fuzzer.cc:fuzzer_get_tmpfile(unsigned char const*, unsigned long)

Line

Count

Source

29

4.59k

static char* fuzzer_get_tmpfile(const uint8_t* data, size_t size) {

30

4.59k

  char* filename_buffer = strdup("/tmp/generate_temporary_file.XXXXXX");

31

4.59k

  if (!filename_buffer) {

32

0

    perror("Failed to allocate file name buffer.");

33

0

    abort();

34

0

  }

35

4.59k

  const int file_descriptor = mkstemp(filename_buffer);

36

4.59k

  if (file_descriptor < 0) {

37

0

    perror("Failed to make temporary file.");

38

0

    abort();

39

0

  }

40

4.59k

  FILE* file = fdopen(file_descriptor, "wb");

41

4.59k

  if (!file) {

42

0

    perror("Failed to open file descriptor.");

43

0

    close(file_descriptor);

44

0

    abort();

45

0

  }

46

4.59k

  const size_t bytes_written = fwrite(data, sizeof(uint8_t), size, file);

47

4.59k

  if (bytes_written < size) {

48

0

    close(file_descriptor);

49

0

    fprintf(stderr, "Failed to write all bytes to file (%zu out of %zu)",

50

0

            bytes_written, size);

51

0

    abort();

52

0

  }

53

4.59k

  fclose(file);

54

4.59k

  return filename_buffer;

55

4.59k

}

static void fuzzer_release_tmpfile(char* filename) {

  if (unlink(filename) != 0) {

    perror("WARNING: Failed to delete temporary file.");

  }

  free(filename);

}

filestorage_read_file_fuzzer.cc:fuzzer_release_tmpfile(char*)

Line

Count

Source

57

1

static void fuzzer_release_tmpfile(char* filename) {

58

1

  if (unlink(filename) != 0) {

59

0

    perror("WARNING: Failed to delete temporary file.");

60

0

  }

61

1

  free(filename);

62

1

}

imread_fuzzer.cc:fuzzer_release_tmpfile(char*)

Line

Count

Source

57

4.59k

static void fuzzer_release_tmpfile(char* filename) {

58

4.59k

  if (unlink(filename) != 0) {

59

0

    perror("WARNING: Failed to delete temporary file.");

60

0

  }

61

4.59k

  free(filename);

62

4.59k

}

// C++ RAII object for creating temporary files.

#ifdef __cplusplus

class FuzzerTemporaryFile {

 public:

  FuzzerTemporaryFile(const uint8_t* data, size_t size)

      : filename_(fuzzer_get_tmpfile(data, size)) {}

  ~FuzzerTemporaryFile() { fuzzer_release_tmpfile(filename_); }

  const char* filename() const { return filename_; }

 private:

  char* filename_;

};

#endif

#endif  // FUZZER_TEMP_FILE_H_