From cf178685aca107aa37c748de11da01562e78c46c Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 15 Jun 2024 11:41:34 +0200 Subject: Adding upstream version 5.6.2. Signed-off-by: Daniel Baumann --- tests/ossfuzz/fuzz_common.h | 55 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 tests/ossfuzz/fuzz_common.h (limited to 'tests/ossfuzz/fuzz_common.h') diff --git a/tests/ossfuzz/fuzz_common.h b/tests/ossfuzz/fuzz_common.h new file mode 100644 index 0000000..4537f1b --- /dev/null +++ b/tests/ossfuzz/fuzz_common.h @@ -0,0 +1,55 @@ +// SPDX-License-Identifier: 0BSD + +/////////////////////////////////////////////////////////////////////////////// +// +/// \file fuzz_common.h +/// \brief Common macros and functions needed by the fuzz targets +// +// Authors: Maksym Vatsyk +// Lasse Collin +// +/////////////////////////////////////////////////////////////////////////////// + +#include +#include +#include +#include "lzma.h" + +// Some header values can make liblzma allocate a lot of RAM +// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to +// prevent extreme allocations when fuzzing. +#define MEM_LIMIT (300 << 20) // 300 MiB + + +static void +fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) { + // Output buffer for decompressed data. This is write only; nothing + // cares about the actual data written here. + uint8_t outbuf[4096]; + + // Give the whole input buffer at once to liblzma. + // Output buffer isn't initialized as liblzma only writes to it. + stream->next_in = inbuf; + stream->avail_in = inbuf_size; + stream->next_out = outbuf; + stream->avail_out = sizeof(outbuf); + + lzma_ret ret; + while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) { + if (stream->avail_out == 0) { + // outbuf became full. We don't care about the + // uncompressed data there, so we simply reuse + // the outbuf and overwrite the old data. + stream->next_out = outbuf; + stream->avail_out = sizeof(outbuf); + } + } + + // LZMA_PROG_ERROR should never happen as long as the code calling + // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign + // of a bug in either this function or in liblzma. + if (ret == LZMA_PROG_ERROR) { + fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n"); + abort(); + } +} -- cgit v1.2.3