57 lines
1.8 KiB
C
57 lines
1.8 KiB
C
|
///////////////////////////////////////////////////////////////////////////////
|
||
|
|
//
|
||
|
|
/// \file fuzz_decode_auto.c
|
||
|
|
/// \brief Fuzz test program for liblzma lzma_auto_decoder()
|
||
|
|
//
|
||
|
|
// Author: Maksym Vatsyk
|
||
|
|
//
|
||
|
|
// This file has been put into the public domain.
|
||
|
|
// You can do whatever you want with this file.
|
||
|
|
//
|
||
|
|
///////////////////////////////////////////////////////////////////////////////
|
||
|
|
|
||
|
|
#include <inttypes.h>
|
||
|
|
#include <stdlib.h>
|
||
|
|
#include <stdio.h>
|
||
|
|
#include "lzma.h"
|
||
|
|
|
||
|
|
// Some header values can make liblzma allocate a lot of RAM
|
||
|
|
// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
|
||
|
|
// prevent extreme allocations when fuzzing.
|
||
|
|
#define MEM_LIMIT (300 << 20) // 300 MiB
|
||
|
|
|
||
|
|
|
||
|
|
// Output buffer for decompressed data. This is write only; nothing cares
|
||
|
|
// about the actual data written here.
|
||
|
|
static uint8_t outbuf[4096];
|
||
|
|
|
||
|
|
|
||
|
|
static void
|
||
|
|
fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) {
|
||
|
|
// Give the whole input buffer at once to liblzma.
|
||
|
|
// Output buffer isn't initialized as liblzma only writes to it.
|
||
|
|
stream->next_in = inbuf;
|
||
|
|
stream->avail_in = inbuf_size;
|
||
|
|
stream->next_out = outbuf;
|
||
|
|
stream->avail_out = sizeof(outbuf);
|
||
|
|
|
||
|
|
lzma_ret ret;
|
||
|
|
while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) {
|
||
|
|
if (stream->avail_out == 0) {
|
||
|
|
// outbuf became full. We don't care about the
|
||
|
|
// uncompressed data there, so we simply reuse
|
||
|
|
// the outbuf and overwrite the old data.
|
||
|
|
stream->next_out = outbuf;
|
||
|
|
stream->avail_out = sizeof(outbuf);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// LZMA_PROG_ERROR should never happen as long as the code calling
|
||
|
|
// the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
|
||
|
|
// of a bug in either this function or in liblzma.
|
||
|
|
if (ret == LZMA_PROG_ERROR) {
|
||
|
|
fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
|
||
|
|
abort();
|
||
|
|
}
|
||
|
|
}
|