Coverage Report

Created: 2026-04-12 06:47

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/example_dict_fuzzer.c
Line
Count
Source
1
#include <stdio.h>
2
#include <stddef.h>
3
#include <stdint.h>
4
#include <string.h>
5
#include <assert.h>
6
#include <stdlib.h>
7
#include <inttypes.h>
8
#include "zlib.h"
9
10
24.7k
#define CHECK_ERR(err, msg) { \
11
24.7k
    if (err != Z_OK) { \
12
0
        fprintf(stderr, "%s error: %d\n", msg, err); \
13
0
        return 0; \
14
0
    } \
15
24.7k
}
16
17
static const uint8_t *data;
18
static size_t dataLen;
19
static alloc_func zalloc = NULL;
20
static free_func zfree = NULL;
21
static size_t dictionaryLen = 0;
22
static unsigned long dictId; /* Adler32 value of the dictionary */
23
24
/* ===========================================================================
25
 * Test deflate() with preset dictionary
26
 */
27
int test_dict_deflate(unsigned char **compr, size_t *comprLen)
28
4.17k
{
29
4.17k
    z_stream c_stream; /* compression stream */
30
4.17k
    int err;
31
4.17k
    int level = data[0] % 11 - 1; /* [-1..9]
32
      compression levels
33
      #define Z_NO_COMPRESSION         0
34
      #define Z_BEST_SPEED             1
35
      #define Z_BEST_COMPRESSION       9
36
      #define Z_DEFAULT_COMPRESSION  (-1) */
37
38
4.17k
    int method = Z_DEFLATED; /* The deflate compression method (the only one
39
                                supported in this version) */
40
4.17k
    int windowBits = 8 + data[0] % 8; /* The windowBits parameter is the base
41
      two logarithm of the window size (the size of the history buffer).  It
42
      should be in the range 8..15 for this version of the library. */
43
4.17k
    int memLevel = 1 + data[0] % 9;   /* memLevel=1 uses minimum memory but is
44
      slow and reduces compression ratio; memLevel=9 uses maximum memory for
45
      optimal speed. */
46
4.17k
    int strategy = data[0] % 5;       /* [0..4]
47
      #define Z_FILTERED            1
48
      #define Z_HUFFMAN_ONLY        2
49
      #define Z_RLE                 3
50
      #define Z_FIXED               4
51
      #define Z_DEFAULT_STRATEGY    0 */
52
53
    /* deflate would fail for no-compression or for speed levels. */
54
4.17k
    if (level == 0 || level == 1)
55
612
      level = -1;
56
57
4.17k
    c_stream.zalloc = zalloc;
58
4.17k
    c_stream.zfree = zfree;
59
4.17k
    c_stream.opaque = (void *)0;
60
61
4.17k
    err = deflateInit2(&c_stream, level, method, windowBits, memLevel, strategy);
62
4.17k
    CHECK_ERR(err, "deflateInit");
63
64
4.17k
    err = deflateSetDictionary(
65
4.17k
        &c_stream, (const unsigned char *)data, dictionaryLen);
66
4.17k
    CHECK_ERR(err, "deflateSetDictionary");
67
68
    /* deflateBound does not provide enough space for low compression levels. */
69
4.17k
    *comprLen = 100 + 2 * deflateBound(&c_stream, dataLen);
70
4.17k
    *compr = (uint8_t *)calloc(1, *comprLen);
71
72
4.17k
    dictId = c_stream.adler;
73
4.17k
    c_stream.next_out = *compr;
74
4.17k
    c_stream.avail_out = (unsigned int)(*comprLen);
75
76
4.17k
    c_stream.next_in = (Bytef *)data;
77
4.17k
    c_stream.avail_in = dataLen;
78
79
4.17k
    err = deflate(&c_stream, Z_FINISH);
80
4.17k
    if (err != Z_STREAM_END) {
81
0
        fprintf(stderr, "deflate dict should report Z_STREAM_END\n");
82
0
        return 0;
83
0
    }
84
4.17k
    err = deflateEnd(&c_stream);
85
4.17k
    CHECK_ERR(err, "deflateEnd");
86
4.17k
    return 0;
87
4.17k
}
88
89
/* ===========================================================================
90
 * Test inflate() with a preset dictionary
91
 */
92
4.17k
int test_dict_inflate(unsigned char *compr, size_t comprLen) {
93
4.17k
  int err;
94
4.17k
  z_stream d_stream; /* decompression stream */
95
4.17k
  unsigned char *uncompr;
96
97
4.17k
  d_stream.zalloc = zalloc;
98
4.17k
  d_stream.zfree = zfree;
99
4.17k
  d_stream.opaque = (void *)0;
100
101
4.17k
  d_stream.next_in = compr;
102
4.17k
  d_stream.avail_in = (unsigned int)comprLen;
103
104
4.17k
  err = inflateInit(&d_stream);
105
4.17k
  CHECK_ERR(err, "inflateInit");
106
107
4.17k
  uncompr = (uint8_t *)calloc(1, dataLen);
108
4.17k
  d_stream.next_out = uncompr;
109
4.17k
  d_stream.avail_out = (unsigned int)dataLen;
110
111
8.06k
  for (;;) {
112
8.06k
    err = inflate(&d_stream, Z_NO_FLUSH);
113
8.06k
    if (err == Z_STREAM_END)
114
4.17k
      break;
115
3.89k
    if (err == Z_NEED_DICT) {
116
3.89k
      if (d_stream.adler != dictId) {
117
0
        fprintf(stderr, "unexpected dictionary");
118
0
        return 0;
119
0
      }
120
3.89k
      err = inflateSetDictionary(
121
3.89k
          &d_stream, (const unsigned char *)data, dictionaryLen);
122
3.89k
    }
123
3.89k
    CHECK_ERR(err, "inflate with dict");
124
3.89k
  }
125
126
4.17k
  err = inflateEnd(&d_stream);
127
4.17k
  CHECK_ERR(err, "inflateEnd");
128
129
4.17k
  if (memcmp(uncompr, data, dataLen)) {
130
0
    fprintf(stderr, "bad inflate with dict\n");
131
0
    return 0;
132
0
  }
133
134
4.17k
  free(uncompr);
135
4.17k
  return 0;
136
4.17k
}
137
138
4.18k
int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size) {
139
4.18k
  size_t comprLen = 0;
140
4.18k
  uint8_t *compr;
141
142
  /* Discard inputs larger than 100Kb. */
143
4.18k
  static size_t kMaxSize = 100 * 1024;
144
145
4.18k
  if (size < 1 || size > kMaxSize)
146
10
    return 0;
147
148
4.17k
  data = d;
149
4.17k
  dataLen = size;
150
151
  /* Set up the contents of the dictionary.  The size of the dictionary is
152
     intentionally selected to be of unusual size.  To help cover more corner
153
     cases, the size of the dictionary is read from the input data.  */
154
4.17k
  dictionaryLen = data[0];
155
4.17k
  if (dictionaryLen > dataLen)
156
1.15k
    dictionaryLen = dataLen;
157
158
4.17k
  test_dict_deflate(&compr, &comprLen);
159
4.17k
  test_dict_inflate(compr, comprLen);
160
161
4.17k
  free(compr);
162
163
  /* This function must return 0. */
164
4.17k
  return 0;
165
4.18k
}