/src/xz/tests/ossfuzz/fuzz_decode_stream.c
Line | Count | Source (jump to first uncovered line) |
1 | | // SPDX-License-Identifier: 0BSD |
2 | | |
3 | | /////////////////////////////////////////////////////////////////////////////// |
4 | | // |
5 | | /// \file fuzz_decode_stream.c |
6 | | /// \brief Fuzz test program for single threaded .xz decoding |
7 | | // |
8 | | // Authors: Lasse Collin |
9 | | // Maksym Vatsyk |
10 | | // |
11 | | /////////////////////////////////////////////////////////////////////////////// |
12 | | |
13 | | #include <inttypes.h> |
14 | | #include <stdlib.h> |
15 | | #include <stdio.h> |
16 | | #include "lzma.h" |
17 | | #include "fuzz_common.h" |
18 | | |
19 | | |
20 | | extern int |
21 | | LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size) |
22 | 13.7k | { |
23 | 13.7k | lzma_stream strm = LZMA_STREAM_INIT; |
24 | | // Initialize a .xz decoder using the memory usage limit |
25 | | // defined in fuzz_common.h |
26 | | // |
27 | | // Enable support for concatenated .xz files which is used when |
28 | | // decompressing regular .xz files (instead of data embedded inside |
29 | | // some other file format). Integrity checks on the uncompressed |
30 | | // data are ignored to make fuzzing more effective (incorrect check |
31 | | // values won't prevent the decoder from processing more input). |
32 | | // |
33 | | // The flag LZMA_IGNORE_CHECK doesn't disable verification of |
34 | | // header CRC32 values. Those checks are disabled when liblzma is |
35 | | // built with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION. |
36 | 13.7k | lzma_ret ret = lzma_stream_decoder(&strm, MEM_LIMIT, |
37 | 13.7k | LZMA_CONCATENATED | LZMA_IGNORE_CHECK); |
38 | | |
39 | 13.7k | if (ret != LZMA_OK) { |
40 | | // This should never happen unless the system has |
41 | | // no free memory or address space to allow the small |
42 | | // allocations that the initialization requires. |
43 | 0 | fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret); |
44 | 0 | abort(); |
45 | 0 | } |
46 | | |
47 | 13.7k | fuzz_code(&strm, inbuf, inbuf_size); |
48 | | |
49 | | // Free the allocated memory. |
50 | 13.7k | lzma_end(&strm); |
51 | | |
52 | 13.7k | return 0; |
53 | 13.7k | } |