From d98bf492247b99c067b1dfec2199c3b5db80b09e Mon Sep 17 00:00:00 2001 From: Nick Terrell Date: Fri, 27 Jan 2017 15:42:36 -0800 Subject: [PATCH] Fix segfault in zstreamtest MT It was reading beyond the end of the input buffer because no errors were detected. Once that was fixed, it wasn't making forward progress because no errors were detected and it was waiting for input. --- tests/zstreamtest.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/zstreamtest.c b/tests/zstreamtest.c index bef8734c..e451535c 100644 --- a/tests/zstreamtest.c +++ b/tests/zstreamtest.c @@ -933,10 +933,13 @@ static int fuzzerTests_MT(U32 seed, U32 nbTests, unsigned startTest, double comp size_t const randomCSrcSize = FUZ_randomLength(&lseed, maxSampleLog); size_t const randomDstSize = FUZ_randomLength(&lseed, maxSampleLog); size_t const adjustedDstSize = MIN(dstBufferSize - outBuff.pos, randomDstSize); + size_t const adjustedCSrcSize = MIN(cSize - inBuff.pos, randomCSrcSize); outBuff.size = outBuff.pos + adjustedDstSize; - inBuff.size = inBuff.pos + randomCSrcSize; + inBuff.size = inBuff.pos + adjustedCSrcSize; { size_t const decompressError = ZSTD_decompressStream(zd, &outBuff, &inBuff); if (ZSTD_isError(decompressError)) break; /* error correctly detected */ + /* No forward progress possible */ + if (outBuff.pos < outBuff.size && inBuff.pos == cSize) break; } } } } DISPLAY("\r%u fuzzer tests completed \n", testNb);