Tests: Move common OSS-Fuzz target code to .h file.

diff --git a/tests/ossfuzz/fuzz_common.h b/tests/ossfuzz/fuzz_common.h
new file mode 100644 (file)
index 0000000..ce3f934
--- /dev/null
+++ b/tests/ossfuzz/fuzz_common.h
@@ -0,0 +1,56 @@
+///////////////////////////////////////////////////////////////////////////////
+//
+/// \file       fuzz_decode_auto.c
+/// \brief      Fuzz test program for liblzma lzma_auto_decoder()
+//
+//  Author:     Maksym Vatsyk
+//
+//  This file has been put into the public domain.
+//  You can do whatever you want with this file.
+//
+///////////////////////////////////////////////////////////////////////////////
+
+#include <inttypes.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "lzma.h"
+
+// Some header values can make liblzma allocate a lot of RAM
+// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
+// prevent extreme allocations when fuzzing.
+#define MEM_LIMIT (300 << 20) // 300 MiB
+
+
+// Output buffer for decompressed data. This is write only; nothing cares
+// about the actual data written here.
+static uint8_t outbuf[4096];
+
+
+static void
+fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) {
+       // Give the whole input buffer at once to liblzma.
+       // Output buffer isn't initialized as liblzma only writes to it.
+       stream->next_in = inbuf;
+       stream->avail_in = inbuf_size;
+       stream->next_out = outbuf;
+       stream->avail_out = sizeof(outbuf);
+
+       lzma_ret ret;
+       while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) {
+               if (stream->avail_out == 0) {
+                       // outbuf became full. We don't care about the
+                       // uncompressed data there, so we simply reuse
+                       // the outbuf and overwrite the old data.
+                       stream->next_out = outbuf;
+                       stream->avail_out = sizeof(outbuf);
+               }
+       }
+
+       // LZMA_PROG_ERROR should never happen as long as the code calling
+       // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
+       // of a bug in either this function or in liblzma.
+       if (ret == LZMA_PROG_ERROR) {
+               fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
+               abort();
+       }
+}

diff --git a/tests/ossfuzz/fuzz_decode_stream.c b/tests/ossfuzz/fuzz_decode_stream.c
index 6d89930288c661a6dff4f86633872d16a5eeff31..1da8ecb32e9cb3d0aabbc2a3ec2c90006aa3721f 100644 (file)
--- a/tests/ossfuzz/fuzz_decode_stream.c
+++ b/tests/ossfuzz/fuzz_decode_stream.c
@@ -1,10 +1,11 @@
 ///////////////////////////////////////////////////////////////////////////////
 //
-/// \file       fuzz.c
+/// \file       fuzz_decode_stream.c
 /// \brief      Fuzz test program for liblzma
 //
 //  Author:     Lasse Collin
 //
+//
 //  This file has been put into the public domain.
 //  You can do whatever you want with this file.
 //
@@ -14,66 +15,36 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include "lzma.h"
-
-
-// Output buffer for decompressed data. This is write only; nothing cares
-// about the actual data written here.
-static uint8_t outbuf[4096];
+#include "fuzz_common.h"
 
 
 extern int
 LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
 {
-       // Some header values can make liblzma allocate a lot of RAM
-       // (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
-       // prevent extreme allocations when fuzzing.
-       const uint64_t memlimit = 300 << 20; // 300 MiB
-
-       // Initialize a .xz decoder using the above memory usage limit.
+       lzma_stream strm = LZMA_STREAM_INIT;
+       // Initialize a LZMA alone decoder using the memory usage limit
+       // defined in fuzz_common.h
+       //
        // Enable support for concatenated .xz files which is used when
        // decompressing regular .xz files (instead of data embedded inside
        // some other file format). Integrity checks on the uncompressed
        // data are ignored to make fuzzing more effective (incorrect check
        // values won't prevent the decoder from processing more input).
        //
-       // The flag LZMA_IGNORE_CHECK doesn't disable verification of header
-       // CRC32 values. Those checks are disabled when liblzma is built
-       // with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
-       lzma_stream strm = LZMA_STREAM_INIT;
-       lzma_ret ret = lzma_stream_decoder(&strm, memlimit,
-                       LZMA_CONCATENATED | LZMA_IGNORE_CHECK);
-       if (ret != LZMA_OK) {
+       // The flag LZMA_IGNORE_CHECK doesn't disable verification of
+       // header CRC32 values. Those checks are disabled when liblzma is
+       // built with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
+
+       if (lzma_stream_decoder(&strm, MEM_LIMIT,
+                       LZMA_CONCATENATED | LZMA_IGNORE_CHECK) != LZMA_OK) {
                // This should never happen unless the system has
                // no free memory or address space to allow the small
                // allocations that the initialization requires.
-               fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret);
+               fprintf(stderr, "lzma_stream_decoder() failed\n");
                abort();
        }
 
-       // Give the whole input buffer at once to liblzma.
-       // Output buffer isn't initialized as liblzma only writes to it.
-       strm.next_in = inbuf;
-       strm.avail_in = inbuf_size;
-       strm.next_out = outbuf;
-       strm.avail_out = sizeof(outbuf);
-
-       while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) {
-               if (strm.avail_out == 0) {
-                       // outbuf became full. We don't care about the
-                       // uncompressed data there, so we simply reuse
-                       // the outbuf and overwrite the old data.
-                       strm.next_out = outbuf;
-                       strm.avail_out = sizeof(outbuf);
-               }
-       }
-
-       // LZMA_PROG_ERROR should never happen as long as the code calling
-       // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
-       // of a bug in either this function or in liblzma.
-       if (ret == LZMA_PROG_ERROR) {
-               fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
-               abort();
-       }
+       fuzz_code(&strm, inbuf, inbuf_size);
 
        // Free the allocated memory.
        lzma_end(&strm);