tests/ossfuzz/fuzz_common.h

   1 // SPDX-License-Identifier: 0BSD
   2
   3 ///////////////////////////////////////////////////////////////////////////////
   4 //
   5 /// \file       fuzz_common.h
   6 /// \brief      Common macros and functions needed by the fuzz targets
   7 //
   8 //  Authors:    Maksym Vatsyk
   9 //              Lasse Collin
  10 //
  11 ///////////////////////////////////////////////////////////////////////////////
  12
  13 #include <inttypes.h>
  14 #include <stdlib.h>
  15 #include <stdio.h>
  16 #include "lzma.h"
  17
  18 // Some header values can make liblzma allocate a lot of RAM
  19 // (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
  20 // prevent extreme allocations when fuzzing.
  21 #define MEM_LIMIT (300 << 20) // 300 MiB
  22
  23
  24 static void
  25 fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) {
  26         // Output buffer for decompressed data. This is write only; nothing
  27         // cares about the actual data written here.
  28         uint8_t outbuf[4096];
  29
  30         // Give the whole input buffer at once to liblzma.
  31         // Output buffer isn't initialized as liblzma only writes to it.
  32         stream->next_in = inbuf;
  33         stream->avail_in = inbuf_size;
  34         stream->next_out = outbuf;
  35         stream->avail_out = sizeof(outbuf);
  36
  37         lzma_ret ret;
  38         while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) {
  39                 if (stream->avail_out == 0) {
  40                         // outbuf became full. We don't care about the
  41                         // uncompressed data there, so we simply reuse
  42                         // the outbuf and overwrite the old data.
  43                         stream->next_out = outbuf;
  44                         stream->avail_out = sizeof(outbuf);
  45                 }
  46         }
  47
  48         // LZMA_PROG_ERROR should never happen as long as the code calling
  49         // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
  50         // of a bug in either this function or in liblzma.
  51         if (ret == LZMA_PROG_ERROR) {
  52                 fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
  53                 abort();
  54         }
  55 }