Coverage Report

Created: 2025-07-01 07:02

/src/gzio_fuzzer.c
Line
Count
Source (jump to first uncovered line)
1
/********************************************************************************
2
 * Copyright 2025 Google LLC
3
 *
4
 * Licensed under the Apache License, Version 2.0 (the "License");
5
 * you may not use this file except in compliance with the License.
6
 * You may obtain a copy of the License at
7
 *
8
 *      http://www.apache.org/licenses/LICENSE-2.0
9
 *
10
 * Unless required by applicable law or agreed to in writing, software
11
 * distributed under the License is distributed on an "AS IS" BASIS,
12
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
 * See the License for the specific language governing permissions and
14
 * limitations under the License.
15
 *
16
 *******************************************************************************/
17
#include <stdio.h>
18
#include <stddef.h>
19
#include <stdint.h>
20
#include <string.h>
21
#include <assert.h>
22
#include <stdlib.h>
23
#include <inttypes.h>
24
#include "zlib.h"
25
26
#undef gzgetc
27
28
0
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t dataLen) {
29
30
0
    gzFile file;
31
0
    char fname[] = "gzio.XXXXXX";
32
0
    close(mkstemp(fname));
33
0
    unsigned mode_sz = (dataLen ? (--dataLen, *data++) | 2 : 8) & 0xF;
34
0
    char mode[mode_sz];
35
0
    memcpy(mode, data, dataLen >= mode_sz ? mode_sz - 1: dataLen);
36
0
    mode[mode_sz - 1] = 0;
37
0
    file = gzopen(fname, mode);
38
39
    /* Chain I/O operations on a file opened with random mode the nature of the
40
     * operation and their operand are controlled by the fuzzer
41
     */
42
0
    int op_count = 2; //< Number of operations chained.
43
0
    while(op_count--) {
44
0
      switch((--dataLen, (*data)%19)) {
45
0
        case 0: {
46
0
          char c = dataLen ? (--dataLen, (char)*data++) : 'c';
47
0
          if(gzputc(file, c) < 0) {
48
0
            goto exit;
49
0
          }
50
0
          break;
51
0
        }
52
0
        case 1: {
53
0
          unsigned sz = dataLen ? ((--dataLen, *data++)&0xF) + 1 : 8;
54
0
          char input[sz];
55
0
          memcpy(input, data, dataLen >= sz ? sz - 1: dataLen);
56
0
          input[sz - 1] = 0;
57
0
          if(gzputs(file, input) < 0)
58
0
            goto exit;
59
0
          break;
60
0
        }
61
0
        case 2: {
62
0
          unsigned sz = dataLen ? ((--dataLen, *data++)&0xF) + 1 : 8;
63
0
          unsigned nitems = dataLen ? ((--dataLen, *data++)&0xF) + 1 : 8;
64
0
          unsigned count = sz * nitems;
65
0
          char input[count];
66
0
          memcpy(input, data, dataLen >= count ? count - 1: dataLen);
67
0
          input[count - 1] = 0;
68
0
          if(gzfwrite(input, sz, nitems, file) <= 0)
69
0
            goto exit;
70
0
          break;
71
0
        }
72
0
        case 3: {
73
0
          unsigned sz = dataLen ? (--dataLen, *data++) : 8;
74
0
          char uncompr[sz];
75
0
          if(gzread(file, uncompr, sz) < 0)
76
0
            goto exit;
77
0
          break;
78
0
        }
79
0
        case 4: {
80
0
          int whences[5] = {SEEK_CUR, SEEK_SET, SEEK_END, 18};
81
0
          int whence = dataLen ? (--dataLen, whences[(*data++)%6]) : SEEK_CUR;
82
0
          long offset = dataLen >= sizeof(long) ? (*(long*)data &0xFF) + 1: 1L;
83
0
          if(gzseek(file, offset, whence) < 0)
84
0
            goto exit;
85
0
          break;
86
0
        }
87
0
        case 5:
88
0
          gztell(file);
89
0
          break;
90
0
        case 6:
91
0
          gzgetc(file);
92
0
          break;
93
0
        case 7: {
94
0
          char c = dataLen ? (--dataLen, (char)*data++) : 'c';
95
0
          if(gzungetc(c, file) < 0)
96
0
            goto exit;
97
0
          break;
98
0
        }
99
0
        case 8: {
100
0
          unsigned sz = dataLen ? (--dataLen, *data++) : 8;
101
0
          char uncompr[sz];
102
0
          if(gzgets(file, uncompr, sz) < 0)
103
0
            goto exit;
104
0
          break;
105
0
        }
106
0
        case 9: {
107
0
          int level = dataLen ? (--dataLen, *data++) : 1;
108
0
          int strat = dataLen ? (--dataLen, *data++) : 2;
109
0
          if(gzsetparams(file, level, strat) < 0)
110
0
            goto exit;
111
0
          break;
112
0
        }
113
0
        case 10: {
114
0
          int flush = dataLen ? (--dataLen, *data++) : 1;
115
0
          gzflush(file, flush); break;
116
0
        }
117
0
        case 11: {
118
0
          static const char formats [][4] = { "%d", "%f", "%c", "%s" };
119
0
          int nformat = dataLen ? (--dataLen, *data++)%5 : 1;
120
0
          switch(nformat) {
121
0
            case 0: {
122
0
              int value = dataLen >= sizeof(int) ? *(int*)data : 1;
123
0
              gzprintf(file, formats[nformat], value);
124
0
              break;
125
0
            }
126
0
            case 1: {
127
0
              float value = dataLen >= sizeof(float) ? *(float*)data : 1;
128
0
              gzprintf(file, formats[nformat], value);
129
0
              break;
130
0
            }
131
0
            case 2: {
132
0
              char value = dataLen >= sizeof(char) ? *(char*)data : 1;
133
0
              gzprintf(file, formats[nformat], value);
134
0
              break;
135
0
            }
136
0
            case 3: {
137
0
             unsigned sz = dataLen ? ((--dataLen, *data++)&0xF)+1 : 8;
138
0
             char input[sz];
139
0
             memcpy(input, data, dataLen >= sz ? sz - 1: dataLen);
140
0
             input[sz - 1] = 0;
141
0
             gzprintf(file, formats[nformat], input);
142
0
             break;
143
0
            }
144
0
            default: {
145
0
             unsigned sz = dataLen ? ((--dataLen, *data++)&0xF)+1 : 8;
146
0
             char input[sz] = {};
147
0
             memcpy(input, data, dataLen >= sz ? sz - 1: dataLen);
148
0
             for(int i = 0; i < sz - 1; ++i)
149
0
               if(input[i] == '%') input[i] = '!';
150
0
             gzprintf(file, input);
151
0
             break;
152
0
            }
153
0
          };
154
0
          break;
155
0
        }
156
0
        case 12: {
157
0
          gzoffset(file);
158
0
          break;
159
0
        }
160
0
        case 13: {
161
0
          gzrewind(file);
162
0
          break;
163
0
        }
164
0
        case 14: {
165
0
          gzeof(file);
166
0
          break;
167
0
        }
168
0
        case 15: {
169
0
          gzdirect(file);
170
0
          break;
171
0
        }
172
0
        case 16: {
173
0
          unsigned sz = dataLen ? ((--dataLen, *data++))|1 : 128;
174
0
          if(gzbuffer(file, sz) <0)
175
0
            goto exit;
176
0
          break;
177
0
        }
178
0
        case 17: {
179
0
          int errnum;
180
0
          gzerror(file, &errnum);
181
0
          break;
182
0
        }
183
0
        case 18: {
184
0
          gzclearerr(file);
185
0
          break;
186
0
        }
187
0
      }
188
0
    }
189
0
    gzclose(file);
190
0
    remove(fname);
191
0
  return 0;
192
0
exit:
193
0
    gzclose(file);
194
0
    remove(fname);
195
0
  return -1;
196
0
}