[fuzzer] Add a fuzzer for frame info functions
Add a fuzzer that fuzzes all helper functions that take compressed input. This fuzzer caught one out of bounds read in `ZSTD_decompressBound()`.dev
parent
450feb0f95
commit
09caa4d800
|
@ -69,7 +69,8 @@ FUZZ_TARGETS := \
|
||||||
stream_decompress \
|
stream_decompress \
|
||||||
block_decompress \
|
block_decompress \
|
||||||
dictionary_round_trip \
|
dictionary_round_trip \
|
||||||
dictionary_decompress
|
dictionary_decompress \
|
||||||
|
zstd_frame_info
|
||||||
|
|
||||||
all: $(FUZZ_TARGETS)
|
all: $(FUZZ_TARGETS)
|
||||||
|
|
||||||
|
@ -100,6 +101,9 @@ dictionary_round_trip: $(FUZZ_HEADERS) $(FUZZ_OBJ) dictionary_round_trip.o
|
||||||
dictionary_decompress: $(FUZZ_HEADERS) $(FUZZ_OBJ) dictionary_decompress.o
|
dictionary_decompress: $(FUZZ_HEADERS) $(FUZZ_OBJ) dictionary_decompress.o
|
||||||
$(CXX) $(FUZZ_TARGET_FLAGS) $(FUZZ_OBJ) dictionary_decompress.o $(LIB_FUZZING_ENGINE) -o $@
|
$(CXX) $(FUZZ_TARGET_FLAGS) $(FUZZ_OBJ) dictionary_decompress.o $(LIB_FUZZING_ENGINE) -o $@
|
||||||
|
|
||||||
|
zstd_frame_info: $(FUZZ_HEADERS) $(FUZZ_OBJ) zstd_frame_info.o
|
||||||
|
$(CXX) $(FUZZ_TARGET_FLAGS) $(FUZZ_OBJ) zstd_frame_info.o $(LIB_FUZZING_ENGINE) -o $@
|
||||||
|
|
||||||
libregression.a: $(FUZZ_HEADERS) $(PRGDIR)/util.h $(PRGDIR)/util.c regression_driver.o
|
libregression.a: $(FUZZ_HEADERS) $(PRGDIR)/util.h $(PRGDIR)/util.c regression_driver.o
|
||||||
$(AR) $(FUZZ_ARFLAGS) $@ regression_driver.o
|
$(AR) $(FUZZ_ARFLAGS) $@ regression_driver.o
|
||||||
|
|
||||||
|
|
|
@ -36,6 +36,7 @@ TARGETS = [
|
||||||
'block_decompress',
|
'block_decompress',
|
||||||
'dictionary_round_trip',
|
'dictionary_round_trip',
|
||||||
'dictionary_decompress',
|
'dictionary_decompress',
|
||||||
|
'zstd_frame_info',
|
||||||
]
|
]
|
||||||
ALL_TARGETS = TARGETS + ['all']
|
ALL_TARGETS = TARGETS + ['all']
|
||||||
FUZZ_RNG_SEED_SIZE = 4
|
FUZZ_RNG_SEED_SIZE = 4
|
||||||
|
|
|
@ -0,0 +1,43 @@
|
||||||
|
/*
|
||||||
|
* Copyright (c) 2016-present, Facebook, Inc.
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* This source code is licensed under both the BSD-style license (found in the
|
||||||
|
* LICENSE file in the root directory of this source tree) and the GPLv2 (found
|
||||||
|
* in the COPYING file in the root directory of this source tree).
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
* This fuzz target fuzzes all of the helper functions that consume compressed
|
||||||
|
* input.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stddef.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include "fuzz_helpers.h"
|
||||||
|
#include "zstd_helpers.h"
|
||||||
|
|
||||||
|
int LLVMFuzzerTestOneInput(const uint8_t *src, size_t size)
|
||||||
|
{
|
||||||
|
ZSTD_frameHeader zfh;
|
||||||
|
/* Consume the seed to be compatible with the corpora of other decompression
|
||||||
|
* fuzzers.
|
||||||
|
*/
|
||||||
|
FUZZ_seed(&src, &size);
|
||||||
|
/* You can fuzz any helper functions here that are fast, and take zstd
|
||||||
|
* compressed data as input. E.g. don't expect the input to be a dictionary,
|
||||||
|
* so don't fuzz ZSTD_getDictID_fromDict().
|
||||||
|
*/
|
||||||
|
ZSTD_getFrameContentSize(src, size);
|
||||||
|
ZSTD_getDecompressedSize(src, size);
|
||||||
|
ZSTD_findFrameCompressedSize(src, size);
|
||||||
|
ZSTD_getDictID_fromFrame(src, size);
|
||||||
|
ZSTD_findDecompressedSize(src, size);
|
||||||
|
ZSTD_decompressBound(src, size);
|
||||||
|
ZSTD_frameHeaderSize(src, size);
|
||||||
|
ZSTD_isFrame(src, size);
|
||||||
|
ZSTD_getFrameHeader(&zfh, src, size);
|
||||||
|
ZSTD_getFrameHeader_advanced(&zfh, src, size, ZSTD_f_zstd1);
|
||||||
|
return 0;
|
||||||
|
}
|
Loading…
Reference in New Issue