tests/ossfuzz/fuzz_decode_stream.c

   1 // SPDX-License-Identifier: 0BSD
   2
   3 ///////////////////////////////////////////////////////////////////////////////
   4 //
   5 /// \file       fuzz_decode_stream.c
   6 /// \brief      Fuzz test program for single threaded .xz decoding
   7 //
   8 //  Authors:    Lasse Collin
   9 //              Maksym Vatsyk
  10 //
  11 ///////////////////////////////////////////////////////////////////////////////
  12
  13 #include <inttypes.h>
  14 #include <stdlib.h>
  15 #include <stdio.h>
  16 #include "lzma.h"
  17 #include "fuzz_common.h"
  18
  19
  20 extern int
  21 LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
  22 {
  23         lzma_stream strm = LZMA_STREAM_INIT;
  24         // Initialize a .xz decoder using the memory usage limit
  25         // defined in fuzz_common.h
  26         //
  27         // Enable support for concatenated .xz files which is used when
  28         // decompressing regular .xz files (instead of data embedded inside
  29         // some other file format). Integrity checks on the uncompressed
  30         // data are ignored to make fuzzing more effective (incorrect check
  31         // values won't prevent the decoder from processing more input).
  32         //
  33         // The flag LZMA_IGNORE_CHECK doesn't disable verification of
  34         // header CRC32 values. Those checks are disabled when liblzma is
  35         // built with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
  36         lzma_ret ret = lzma_stream_decoder(&strm, MEM_LIMIT,
  37                         LZMA_CONCATENATED | LZMA_IGNORE_CHECK);
  38
  39         if (ret != LZMA_OK) {
  40                 // This should never happen unless the system has
  41                 // no free memory or address space to allow the small
  42                 // allocations that the initialization requires.
  43                 fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret);
  44                 abort();
  45         }
  46
  47         fuzz_code(&strm, inbuf, inbuf_size);
  48
  49         // Free the allocated memory.
  50         lzma_end(&strm);
  51
  52         return 0;
  53 }