tests/ossfuzz/fuzz.c

///////////////////////////////////////////////////////////////////////////////
//
/// \file       fuzz.c
/// \brief      Fuzz test program for liblzma
//
//  Author:     Lasse Collin
//
//  This file has been put into the public domain.
//  You can do whatever you want with this file.
//
///////////////////////////////////////////////////////////////////////////////

#include <inttypes.h>
#include <stdlib.h>
#include <stdio.h>
#include "lzma.h"


// Output buffer for decompressed data. This is write only; nothing cares
// about the actual data written here.
static uint8_t outbuf[4096];


extern int
LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
{
	// Some header values can make liblzma allocate a lot of RAM
	// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
	// prevent extreme allocations when fuzzing.
	const uint64_t memlimit = 300 << 20; // 300 MiB

	// Initialize a .xz decoder using the above memory usage limit.
	// Enable support for concatenated .xz files which is used when
	// decompressing regular .xz files (instead of data embedded inside
	// some other file format). Integrity checks on the uncompressed
	// data are ignored to make fuzzing more effective (incorrect check
	// values won't prevent the decoder from processing more input).
	//
	// The flag LZMA_IGNORE_CHECK doesn't disable verification of header
	// CRC32 values. Those checks are disabled when liblzma is built
	// with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
	lzma_stream strm = LZMA_STREAM_INIT;
	lzma_ret ret = lzma_stream_decoder(&strm, memlimit,
			LZMA_CONCATENATED | LZMA_IGNORE_CHECK);
	if (ret != LZMA_OK) {
		// This should never happen unless the system has
		// no free memory or address space to allow the small
		// allocations that the initialization requires.
		fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret);
		abort();
	}

	// Give the whole input buffer at once to liblzma.
	// Output buffer isn't initialized as liblzma only writes to it.
	strm.next_in = inbuf;
	strm.avail_in = inbuf_size;
	strm.next_out = outbuf;
	strm.avail_out = sizeof(outbuf);

	while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) {
		if (strm.avail_out == 0) {
			// outbuf became full. We don't care about the
			// uncompressed data there, so we simply reuse
			// the outbuf and overwrite the old data.
			strm.next_out = outbuf;
			strm.avail_out = sizeof(outbuf);
		}
	}

	// LZMA_PROG_ERROR should never happen as long as the code calling
	// the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
	// of a bug in either this function or in liblzma.
	if (ret == LZMA_PROG_ERROR) {
		fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
		abort();
	}

	// Free the allocated memory.
	lzma_end(&strm);

	return 0;
}