Coverage Report

Created: 2025-07-01 07:02

/src/example_dict_fuzzer.c
Line
Count
Source (jump to first uncovered line)
1
#include <stdio.h>
2
#include <stddef.h>
3
#include <stdint.h>
4
#include <string.h>
5
#include <assert.h>
6
#include <stdlib.h>
7
#include <inttypes.h>
8
#include "zlib.h"
9
10
0
#define CHECK_ERR(err, msg) { \
11
0
    if (err != Z_OK) { \
12
0
        fprintf(stderr, "%s error: %d\n", msg, err); \
13
0
        return 0; \
14
0
    } \
15
0
}
16
17
static const uint8_t *data;
18
static size_t dataLen;
19
static alloc_func zalloc = NULL;
20
static free_func zfree = NULL;
21
static size_t dictionaryLen = 0;
22
static unsigned long dictId; /* Adler32 value of the dictionary */
23
24
/* ===========================================================================
25
 * Test deflate() with preset dictionary
26
 */
27
int test_dict_deflate(unsigned char **compr, size_t *comprLen)
28
0
{
29
0
    z_stream c_stream; /* compression stream */
30
0
    int err;
31
0
    int level = data[0] % 11 - 1; /* [-1..9]
32
      compression levels
33
      #define Z_NO_COMPRESSION         0
34
      #define Z_BEST_SPEED             1
35
      #define Z_BEST_COMPRESSION       9
36
      #define Z_DEFAULT_COMPRESSION  (-1) */
37
38
0
    int method = Z_DEFLATED; /* The deflate compression method (the only one
39
                                supported in this version) */
40
0
    int windowBits = 8 + data[0] % 8; /* The windowBits parameter is the base
41
      two logarithm of the window size (the size of the history buffer).  It
42
      should be in the range 8..15 for this version of the library. */
43
0
    int memLevel = 1 + data[0] % 9;   /* memLevel=1 uses minimum memory but is
44
      slow and reduces compression ratio; memLevel=9 uses maximum memory for
45
      optimal speed. */
46
0
    int strategy = data[0] % 5;       /* [0..4]
47
      #define Z_FILTERED            1
48
      #define Z_HUFFMAN_ONLY        2
49
      #define Z_RLE                 3
50
      #define Z_FIXED               4
51
      #define Z_DEFAULT_STRATEGY    0 */
52
53
    /* deflate would fail for no-compression or for speed levels. */
54
0
    if (level == 0 || level == 1)
55
0
      level = -1;
56
57
0
    c_stream.zalloc = zalloc;
58
0
    c_stream.zfree = zfree;
59
0
    c_stream.opaque = (void *)0;
60
61
0
    err = deflateInit2(&c_stream, level, method, windowBits, memLevel, strategy);
62
0
    CHECK_ERR(err, "deflateInit");
63
64
0
    err = deflateSetDictionary(
65
0
        &c_stream, (const unsigned char *)data, dictionaryLen);
66
0
    CHECK_ERR(err, "deflateSetDictionary");
67
68
    /* deflateBound does not provide enough space for low compression levels. */
69
0
    *comprLen = 100 + 2 * deflateBound(&c_stream, dataLen);
70
0
    *compr = (uint8_t *)calloc(1, *comprLen);
71
72
0
    dictId = c_stream.adler;
73
0
    c_stream.next_out = *compr;
74
0
    c_stream.avail_out = (unsigned int)(*comprLen);
75
76
0
    c_stream.next_in = (Bytef *)data;
77
0
    c_stream.avail_in = dataLen;
78
79
0
    err = deflate(&c_stream, Z_FINISH);
80
0
    if (err != Z_STREAM_END) {
81
0
        fprintf(stderr, "deflate dict should report Z_STREAM_END\n");
82
0
        return 0;
83
0
    }
84
0
    err = deflateEnd(&c_stream);
85
0
    CHECK_ERR(err, "deflateEnd");
86
0
    return 0;
87
0
}
88
89
/* ===========================================================================
90
 * Test inflate() with a preset dictionary
91
 */
92
0
int test_dict_inflate(unsigned char *compr, size_t comprLen) {
93
0
  int err;
94
0
  z_stream d_stream; /* decompression stream */
95
0
  unsigned char *uncompr;
96
97
0
  d_stream.zalloc = zalloc;
98
0
  d_stream.zfree = zfree;
99
0
  d_stream.opaque = (void *)0;
100
101
0
  d_stream.next_in = compr;
102
0
  d_stream.avail_in = (unsigned int)comprLen;
103
104
0
  err = inflateInit(&d_stream);
105
0
  CHECK_ERR(err, "inflateInit");
106
107
0
  uncompr = (uint8_t *)calloc(1, dataLen);
108
0
  d_stream.next_out = uncompr;
109
0
  d_stream.avail_out = (unsigned int)dataLen;
110
111
0
  for (;;) {
112
0
    err = inflate(&d_stream, Z_NO_FLUSH);
113
0
    if (err == Z_STREAM_END)
114
0
      break;
115
0
    if (err == Z_NEED_DICT) {
116
0
      if (d_stream.adler != dictId) {
117
0
        fprintf(stderr, "unexpected dictionary");
118
0
        return 0;
119
0
      }
120
0
      err = inflateSetDictionary(
121
0
          &d_stream, (const unsigned char *)data, dictionaryLen);
122
0
    }
123
0
    CHECK_ERR(err, "inflate with dict");
124
0
  }
125
126
0
  err = inflateEnd(&d_stream);
127
0
  CHECK_ERR(err, "inflateEnd");
128
129
0
  if (memcmp(uncompr, data, dataLen)) {
130
0
    fprintf(stderr, "bad inflate with dict\n");
131
0
    return 0;
132
0
  }
133
134
0
  free(uncompr);
135
0
  return 0;
136
0
}
137
138
int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size) {
139
  size_t comprLen = 0;
140
  uint8_t *compr;
141
142
  /* Discard inputs larger than 100Kb. */
143
  static size_t kMaxSize = 100 * 1024;
144
145
  if (size < 1 || size > kMaxSize)
146
    return 0;
147
148
  data = d;
149
  dataLen = size;
150
151
  /* Set up the contents of the dictionary.  The size of the dictionary is
152
     intentionally selected to be of unusual size.  To help cover more corner
153
     cases, the size of the dictionary is read from the input data.  */
154
  dictionaryLen = data[0];
155
  if (dictionaryLen > dataLen)
156
    dictionaryLen = dataLen;
157
158
  test_dict_deflate(&compr, &comprLen);
159
  test_dict_inflate(compr, comprLen);
160
161
  free(compr);
162
163
  /* This function must return 0. */
164
  return 0;
165
}