Tests: Add a fuzz test program and a config file for OSS-Fuzz.

Thanks to Bhargava Shastry and Github user pdknsk.

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 86084e17c21141242dd7745acb60bc3e47c44a5d..4116b81a2ab5cc10d45fbcac8793fcc6d778f7b3 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -7,6 +7,7 @@
 
 EXTRA_DIST = \
        files \
+       ossfuzz \
        tests.h \
        test_files.sh \
        test_compress.sh \

diff --git a/tests/ossfuzz/Makefile b/tests/ossfuzz/Makefile
new file mode 100644 (file)
index 0000000..67ddbe5
--- /dev/null
+++ b/tests/ossfuzz/Makefile
@@ -0,0 +1,7 @@
+fuzz: fuzz.c
+       $(CC) $(CFLAGS) -c fuzz.c -I ../../src/liblzma/api/
+       $(CXX) $(CXXFLAGS) -lFuzzingEngine fuzz.o -o $(OUT)/fuzz \
+             ../../src/liblzma/.libs/liblzma.a
+
+clean:
+       rm -f *.o

diff --git a/tests/ossfuzz/config/fuzz.dict b/tests/ossfuzz/config/fuzz.dict
new file mode 100644 (file)
index 0000000..932d67c
--- /dev/null
+++ b/tests/ossfuzz/config/fuzz.dict
@@ -0,0 +1,2 @@
+"\xFD7zXZ\x00"
+"YZ"

diff --git a/tests/ossfuzz/config/fuzz.options b/tests/ossfuzz/config/fuzz.options
new file mode 100644 (file)
index 0000000..d59dfc1
--- /dev/null
+++ b/tests/ossfuzz/config/fuzz.options
@@ -0,0 +1,2 @@
+[libfuzzer]
+dict = fuzz.dict

diff --git a/tests/ossfuzz/fuzz.c b/tests/ossfuzz/fuzz.c
new file mode 100644 (file)
index 0000000..6d89930
--- /dev/null
+++ b/tests/ossfuzz/fuzz.c
@@ -0,0 +1,82 @@
+///////////////////////////////////////////////////////////////////////////////
+//
+/// \file       fuzz.c
+/// \brief      Fuzz test program for liblzma
+//
+//  Author:     Lasse Collin
+//
+//  This file has been put into the public domain.
+//  You can do whatever you want with this file.
+//
+///////////////////////////////////////////////////////////////////////////////
+
+#include <inttypes.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "lzma.h"
+
+
+// Output buffer for decompressed data. This is write only; nothing cares
+// about the actual data written here.
+static uint8_t outbuf[4096];
+
+
+extern int
+LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
+{
+       // Some header values can make liblzma allocate a lot of RAM
+       // (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
+       // prevent extreme allocations when fuzzing.
+       const uint64_t memlimit = 300 << 20; // 300 MiB
+
+       // Initialize a .xz decoder using the above memory usage limit.
+       // Enable support for concatenated .xz files which is used when
+       // decompressing regular .xz files (instead of data embedded inside
+       // some other file format). Integrity checks on the uncompressed
+       // data are ignored to make fuzzing more effective (incorrect check
+       // values won't prevent the decoder from processing more input).
+       //
+       // The flag LZMA_IGNORE_CHECK doesn't disable verification of header
+       // CRC32 values. Those checks are disabled when liblzma is built
+       // with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
+       lzma_stream strm = LZMA_STREAM_INIT;
+       lzma_ret ret = lzma_stream_decoder(&strm, memlimit,
+                       LZMA_CONCATENATED | LZMA_IGNORE_CHECK);
+       if (ret != LZMA_OK) {
+               // This should never happen unless the system has
+               // no free memory or address space to allow the small
+               // allocations that the initialization requires.
+               fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret);
+               abort();
+       }
+
+       // Give the whole input buffer at once to liblzma.
+       // Output buffer isn't initialized as liblzma only writes to it.
+       strm.next_in = inbuf;
+       strm.avail_in = inbuf_size;
+       strm.next_out = outbuf;
+       strm.avail_out = sizeof(outbuf);
+
+       while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) {
+               if (strm.avail_out == 0) {
+                       // outbuf became full. We don't care about the
+                       // uncompressed data there, so we simply reuse
+                       // the outbuf and overwrite the old data.
+                       strm.next_out = outbuf;
+                       strm.avail_out = sizeof(outbuf);
+               }
+       }
+
+       // LZMA_PROG_ERROR should never happen as long as the code calling
+       // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
+       // of a bug in either this function or in liblzma.
+       if (ret == LZMA_PROG_ERROR) {
+               fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
+               abort();
+       }
+
+       // Free the allocated memory.
+       lzma_end(&strm);
+
+       return 0;
+}