Tests: Add fuzz_decode_alone OSS-Fuzz target
This fuzz target that handles LZMA alone decoding. A new fuzz dictionary .dict was also created with common LZMA header values to help speed up the discovery of valid headers.
This commit is contained in:
parent
37581a77ad
commit
7ca8c9869d
|
@ -0,0 +1,3 @@
|
|||
[libfuzzer]
|
||||
max_len = 4096
|
||||
dict = fuzz_lzma.dict
|
|
@ -0,0 +1,22 @@
|
|||
# first 5 header bytes of .lzma archives based on the info from
|
||||
# https://github.com/tukaani-project/xz/blob/master/doc/lzma-file-format.txt
|
||||
|
||||
# byte 0 value (properties=0x5d) is created by encoding
|
||||
# common values (lc=3, lp=0, pb=2) using the algorithm,
|
||||
# described in the documentation above
|
||||
|
||||
|
||||
# compression preset 1 (dictionary size = 0x00100000)
|
||||
"\x5d\x00\x00\x10\x00"
|
||||
# compression preset 2 (dictionary size = 0x00200000)
|
||||
"\x5d\x00\x00\x20\x00"
|
||||
# compression preset 3, 4 (dictionary size = 0x00400000)
|
||||
"\x5d\x00\x00\x40\x00"
|
||||
# compression preset 5, 6 (dictionary size = 0x00800000)
|
||||
"\x5d\x00\x00\x80\x00"
|
||||
# compression preset 7 (dictionary size = 0x01000000)
|
||||
"\x5d\x00\x00\x00\x01"
|
||||
# compression preset 8 (dictionary size = 0x02000000)
|
||||
"\x5d\x00\x00\x00\x02"
|
||||
# compression preset 9 (dictionary size = 0x04000000)
|
||||
"\x5d\x00\x00\x00\x04"
|
|
@ -0,0 +1,41 @@
|
|||
///////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
/// \file fuzz_decode_auto.c
|
||||
/// \brief Fuzz test program for liblzma lzma_auto_decoder()
|
||||
//
|
||||
// Author: Maksym Vatsyk
|
||||
//
|
||||
// Based on Lasse Collin's original fuzzer for liblzma
|
||||
//
|
||||
// This file has been put into the public domain.
|
||||
// You can do whatever you want with this file.
|
||||
//
|
||||
///////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
#include <inttypes.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include "lzma.h"
|
||||
#include "fuzz_common.h"
|
||||
|
||||
|
||||
extern int
|
||||
LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
|
||||
{
|
||||
lzma_stream strm = LZMA_STREAM_INIT;
|
||||
// Initialize a LZMA alone decoder using the memory usage limit
|
||||
// defined in fuzz_common.h
|
||||
if (lzma_alone_decoder(&strm, MEM_LIMIT) != LZMA_OK) {
|
||||
// This should never happen unless the system has
|
||||
// no free memory or address space to allow the small
|
||||
// allocations that the initialization requires.
|
||||
fprintf(stderr, "lzma_alone_decoder() failed\n");
|
||||
abort();
|
||||
}
|
||||
|
||||
fuzz_code(&strm, inbuf, inbuf_size);
|
||||
|
||||
// Free the allocated memory.
|
||||
lzma_end(&strm);
|
||||
return 0;
|
||||
}
|
Loading…
Reference in New Issue