round_trip_stream_fuzzer.c File Reference

#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include "fuzz_helpers.h"
#include "lz4.h"
#include "lz4hc.h"

Go to the source code of this file.

Classes
struct	const_cursor_t
struct	cursor_t
struct	state_t

Macros
#define	LZ4_STATIC_LINKING_ONLY
#define	LZ4_HC_STATIC_LINKING_ONLY

Typedefs
typedef void(*	round_trip_t) (state_t *state)

Functions
cursor_t	cursor_create (size_t size)
void	cursor_free (cursor_t cursor)
state_t	state_create (char const *data, size_t size, uint32_t seed)
void	state_free (state_t state)
static void	state_reset (state_t *state, uint32_t seed)
static void	state_decompress (state_t *state, char const *src, int srcSize)
static void	state_checkRoundTrip (state_t const *state)
static size_t	state_trimDict (state_t *state)
static void	state_prefixRoundTrip (state_t *state)
static void	state_extDictRoundTrip (state_t *state)
static void	state_randomRoundTrip (state_t *state, round_trip_t rt0, round_trip_t rt1)
static void	state_loadDictRoundTrip (state_t *state)
static void	state_attachDictRoundTrip (state_t *state)
static void	state_prefixHCRoundTrip (state_t *state)
static void	state_extDictHCRoundTrip (state_t *state)
static void	state_loadDictHCRoundTrip (state_t *state)
static void	state_attachDictHCRoundTrip (state_t *state)
int	LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)

Variables
round_trip_t	roundTrips []

Macro Definition Documentation

LZ4_HC_STATIC_LINKING_ONLY

#define LZ4_HC_STATIC_LINKING_ONLY

Definition at line 15 of file round_trip_stream_fuzzer.c.

LZ4_STATIC_LINKING_ONLY

#define LZ4_STATIC_LINKING_ONLY

This fuzz target performs a lz4 streaming round-trip test (compress & decompress), compares the result with the original, and calls abort() on corruption.

Definition at line 13 of file round_trip_stream_fuzzer.c.

Typedef Documentation

round_trip_t

typedef void(* round_trip_t) (state_t *state)

Definition at line 51 of file round_trip_stream_fuzzer.c.

Function Documentation

cursor_create()

cursor_t cursor_create

(

size_t

size

)

Definition at line 41 of file round_trip_stream_fuzzer.c.

{
  cursor_t cursor;
  cursor.buf = (char*)malloc(size);
  cursor.size = size;
  cursor.pos = 0;
  FUZZ_ASSERT(cursor.buf);
  return cursor;
}

References cursor_t::buf, FUZZ_ASSERT, malloc(), cursor_t::pos, and cursor_t::size.

Referenced by state_create(), state_extDictHCRoundTrip(), and state_extDictRoundTrip().

cursor_free()

void cursor_free

(

cursor_t

cursor

)

Definition at line 53 of file round_trip_stream_fuzzer.c.

{
    free(cursor.buf);
}

References cursor_t::buf, and free().

Referenced by state_extDictHCRoundTrip(), state_extDictRoundTrip(), and state_free().

LLVMFuzzerTestOneInput()

int LLVMFuzzerTestOneInput	(	const uint8_t *	data,
		size_t	size
	)

This fuzz target attempts to compress the fuzzed data with the simple compression function with an output buffer that may be too small to ensure that the compressor never crashes.

This fuzz target attempts to decompress the fuzzed data with the simple decompression function to ensure the decompressor never crashes.

This fuzz target performs a lz4 round-trip test (compress & decompress), compares the result with the original, and calls abort() on corruption.

Definition at line 285 of file round_trip_stream_fuzzer.c.

{
    uint32_t seed = FUZZ_seed(&data, &size);
    state_t state = state_create((char const*)data, size, seed);
    const int n = sizeof(roundTrips) / sizeof(round_trip_t);
    int i;
 
    for (i = 0; i < n; ++i) {
        DEBUGLOG(2, "Round trip %d", i);
        state_reset(&state, seed);
        roundTrips[i](&state);
        state_checkRoundTrip(&state);
    }
 
    state_free(state);
 
    return 0;
}

References arch, assert(), count, cs_close(), cs_disasm(), cs_disasm_iter(), cs_free(), cs_group_name(), cs_insn_name(), cs_malloc(), cs_open(), CS_OPT_DETAIL, CS_OPT_ON, cs_option(), cs_reg_name(), DEBUGLOG, test_evm::detail, err, FUZZ_seed(), handle, i, int, LLVMFuzzerInit(), LLVMFuzzerReturnOneInput(), n, NULL, outfile, platforms, printf(), PRIx64, roundTrips, snprintf, state_checkRoundTrip(), state_create(), state_free(), and state_reset().

Referenced by main().

state_attachDictHCRoundTrip()

static void state_attachDictHCRoundTrip ( state_t *  state )

static

Definition at line 260 of file round_trip_stream_fuzzer.c.

{
    char const* dict = state->data.buf;
    size_t const dictSize = state_trimDict(state);
    LZ4_streamHC_t* dictStream = LZ4_createStreamHC();
    LZ4_setCompressionLevel(dictStream, state->level);
    LZ4_loadDictHC(dictStream, dict, dictSize);
    LZ4_attach_HC_dictionary(state->cstreamHC, dictStream);
    LZ4_setStreamDecode(state->dstream, dict, dictSize);
    state_randomRoundTrip(state, state_prefixHCRoundTrip,
                          state_extDictHCRoundTrip);
    LZ4_freeStreamHC(dictStream);
}

References LZ4_attach_HC_dictionary(), LZ4_createStreamHC(), LZ4_freeStreamHC(), LZ4_loadDictHC(), LZ4_setCompressionLevel(), LZ4_setStreamDecode(), state_extDictHCRoundTrip(), state_prefixHCRoundTrip(), state_randomRoundTrip(), and state_trimDict().

state_attachDictRoundTrip()

static void state_attachDictRoundTrip ( state_t *  state )

static

Definition at line 197 of file round_trip_stream_fuzzer.c.

{
    char const* dict = state->data.buf;
    size_t const dictSize = state_trimDict(state);
    LZ4_stream_t* dictStream = LZ4_createStream();
    LZ4_loadDict(dictStream, dict, dictSize);
    LZ4_attach_dictionary(state->cstream, dictStream);
    LZ4_setStreamDecode(state->dstream, dict, dictSize);
    state_randomRoundTrip(state, state_prefixRoundTrip, state_extDictRoundTrip);
    LZ4_freeStream(dictStream);
}

References LZ4_attach_dictionary(), LZ4_createStream(), LZ4_freeStream(), LZ4_loadDict(), LZ4_setStreamDecode(), state_extDictRoundTrip(), state_prefixRoundTrip(), state_randomRoundTrip(), and state_trimDict().

state_checkRoundTrip()

static void state_checkRoundTrip ( state_t const *  state )

static

Definition at line 113 of file round_trip_stream_fuzzer.c.

{
    char const* data = state->data.buf;
    size_t const size = state->data.size;
    FUZZ_ASSERT_MSG(size == state->roundTrip.pos, "Incorrect size!");
    FUZZ_ASSERT_MSG(!memcmp(data, state->roundTrip.buf, size), "Corruption!");
}

References FUZZ_ASSERT_MSG.

Referenced by LLVMFuzzerTestOneInput().

state_create()

state_t state_create	(	char const *	data,
		size_t	size,
		uint32_t	seed
	)

Definition at line 58 of file round_trip_stream_fuzzer.c.

{
    state_t state;
 
    state.seed = seed;
 
    state.data.buf = (char const*)data;
    state.data.size = size;
    state.data.pos = 0;
 
    /* Extra margin because we are streaming. */
    state.compressed = cursor_create(1024 + 2 * LZ4_compressBound(size));
    state.roundTrip = cursor_create(size);
 
    state.cstream = LZ4_createStream();
    FUZZ_ASSERT(state.cstream);
    state.cstreamHC = LZ4_createStreamHC();
    FUZZ_ASSERT(state.cstream);
    state.dstream = LZ4_createStreamDecode();
    FUZZ_ASSERT(state.dstream);
 
    return state;
}

References cursor_create(), FUZZ_ASSERT, LZ4_compressBound(), LZ4_createStream(), LZ4_createStreamDecode(), and LZ4_createStreamHC().

Referenced by LLVMFuzzerTestOneInput().

state_decompress()

static void state_decompress ( state_t *  state, char const *  src, int  srcSize  )

static

Definition at line 103 of file round_trip_stream_fuzzer.c.

{
    char* dst = state->roundTrip.buf + state->roundTrip.pos;
    int const dstCapacity = state->roundTrip.size - state->roundTrip.pos;
    int const dSize = LZ4_decompress_safe_continue(state->dstream, src, dst,
                                                   srcSize, dstCapacity);
    FUZZ_ASSERT(dSize >= 0);
    state->roundTrip.pos += dSize;
}

References dst, FUZZ_ASSERT, LZ4_decompress_safe_continue(), src, and srcSize.

Referenced by state_extDictHCRoundTrip(), state_extDictRoundTrip(), state_prefixHCRoundTrip(), and state_prefixRoundTrip().

state_extDictHCRoundTrip()

static void state_extDictHCRoundTrip ( state_t *  state )

static

Definition at line 226 of file round_trip_stream_fuzzer.c.

{
    int i = 0;
    cursor_t data2 = cursor_create(state->data.size);
    DEBUGLOG(2, "extDictHC");
    memcpy(data2.buf, state->data.buf, state->data.size);
    while (state->data.pos != state->data.size) {
        char const* data = (i++ & 1) ? state->data.buf : data2.buf;
        char const* src = data + state->data.pos;
        char* dst = state->compressed.buf + state->compressed.pos;
        int const srcRemaining = state->data.size - state->data.pos;
        int const srcSize = FUZZ_rand32(&state->seed, 0, srcRemaining);
        int const dstCapacity = state->compressed.size - state->compressed.pos;
        int const cSize = LZ4_compress_HC_continue(state->cstreamHC, src, dst,
                                                   srcSize, dstCapacity);
        FUZZ_ASSERT(cSize > 0);
        DEBUGLOG(2, "srcSize = %d", srcSize);
        state->data.pos += srcSize;
        state->compressed.pos += cSize;
        state_decompress(state, dst, cSize);
    }
    cursor_free(data2);
}

References cursor_t::buf, cursor_create(), cursor_free(), DEBUGLOG, dst, FUZZ_ASSERT, FUZZ_rand32(), i, LZ4_compress_HC_continue(), memcpy(), src, srcSize, and state_decompress().

Referenced by state_attachDictHCRoundTrip(), and state_loadDictHCRoundTrip().

state_extDictRoundTrip()

static void state_extDictRoundTrip ( state_t *  state )

static

Definition at line 156 of file round_trip_stream_fuzzer.c.

{
    int i = 0;
    cursor_t data2 = cursor_create(state->data.size);
    memcpy(data2.buf, state->data.buf, state->data.size);
    while (state->data.pos != state->data.size) {
        char const* data = (i++ & 1) ? state->data.buf : data2.buf;
        char const* src = data + state->data.pos;
        char* dst = state->compressed.buf + state->compressed.pos;
        int const srcRemaining = state->data.size - state->data.pos;
        int const srcSize = FUZZ_rand32(&state->seed, 0, srcRemaining);
        int const dstCapacity = state->compressed.size - state->compressed.pos;
        int const cSize = LZ4_compress_fast_continue(state->cstream, src, dst,
                                                     srcSize, dstCapacity, 0);
        FUZZ_ASSERT(cSize > 0);
        state->data.pos += srcSize;
        state->compressed.pos += cSize;
        state_decompress(state, dst, cSize);
    }
    cursor_free(data2);
}

References cursor_t::buf, cursor_create(), cursor_free(), dst, FUZZ_ASSERT, FUZZ_rand32(), i, LZ4_compress_fast_continue(), memcpy(), src, srcSize, and state_decompress().

Referenced by state_attachDictRoundTrip(), and state_loadDictRoundTrip().

state_free()

void state_free

(

state_t

state

)

Definition at line 82 of file round_trip_stream_fuzzer.c.

{
    cursor_free(state.compressed);
    cursor_free(state.roundTrip);
    LZ4_freeStream(state.cstream);
    LZ4_freeStreamHC(state.cstreamHC);
    LZ4_freeStreamDecode(state.dstream);
}

References cursor_free(), LZ4_freeStream(), LZ4_freeStreamDecode(), and LZ4_freeStreamHC().

Referenced by LLVMFuzzerTestOneInput().

state_loadDictHCRoundTrip()

static void state_loadDictHCRoundTrip ( state_t *  state )

static

Definition at line 250 of file round_trip_stream_fuzzer.c.

{
    char const* dict = state->data.buf;
    size_t const dictSize = state_trimDict(state);
    LZ4_loadDictHC(state->cstreamHC, dict, dictSize);
    LZ4_setStreamDecode(state->dstream, dict, dictSize);
    state_randomRoundTrip(state, state_prefixHCRoundTrip,
                          state_extDictHCRoundTrip);
}

References LZ4_loadDictHC(), LZ4_setStreamDecode(), state_extDictHCRoundTrip(), state_prefixHCRoundTrip(), state_randomRoundTrip(), and state_trimDict().

state_loadDictRoundTrip()

static void state_loadDictRoundTrip ( state_t *  state )

static

Definition at line 188 of file round_trip_stream_fuzzer.c.

{
    char const* dict = state->data.buf;
    size_t const dictSize = state_trimDict(state);
    LZ4_loadDict(state->cstream, dict, dictSize);
    LZ4_setStreamDecode(state->dstream, dict, dictSize);
    state_randomRoundTrip(state, state_prefixRoundTrip, state_extDictRoundTrip);
}

References LZ4_loadDict(), LZ4_setStreamDecode(), state_extDictRoundTrip(), state_prefixRoundTrip(), state_randomRoundTrip(), and state_trimDict().

state_prefixHCRoundTrip()

static void state_prefixHCRoundTrip ( state_t *  state )

static

Definition at line 209 of file round_trip_stream_fuzzer.c.

{
    while (state->data.pos != state->data.size) {
        char const* src = state->data.buf + state->data.pos;
        char* dst = state->compressed.buf + state->compressed.pos;
        int const srcRemaining = state->data.size - state->data.pos;
        int const srcSize = FUZZ_rand32(&state->seed, 0, srcRemaining);
        int const dstCapacity = state->compressed.size - state->compressed.pos;
        int const cSize = LZ4_compress_HC_continue(state->cstreamHC, src, dst,
                                                   srcSize, dstCapacity);
        FUZZ_ASSERT(cSize > 0);
        state->data.pos += srcSize;
        state->compressed.pos += cSize;
        state_decompress(state, dst, cSize);
    }
}

References dst, FUZZ_ASSERT, FUZZ_rand32(), LZ4_compress_HC_continue(), src, srcSize, and state_decompress().

Referenced by state_attachDictHCRoundTrip(), and state_loadDictHCRoundTrip().

state_prefixRoundTrip()

static void state_prefixRoundTrip ( state_t *  state )

static

Definition at line 139 of file round_trip_stream_fuzzer.c.

{
    while (state->data.pos != state->data.size) {
        char const* src = state->data.buf + state->data.pos;
        char* dst = state->compressed.buf + state->compressed.pos;
        int const srcRemaining = state->data.size - state->data.pos;
        int const srcSize = FUZZ_rand32(&state->seed, 0, srcRemaining);
        int const dstCapacity = state->compressed.size - state->compressed.pos;
        int const cSize = LZ4_compress_fast_continue(state->cstream, src, dst,
                                                     srcSize, dstCapacity, 0);
        FUZZ_ASSERT(cSize > 0);
        state->data.pos += srcSize;
        state->compressed.pos += cSize;
        state_decompress(state, dst, cSize);
    }
}

References dst, FUZZ_ASSERT, FUZZ_rand32(), LZ4_compress_fast_continue(), src, srcSize, and state_decompress().

Referenced by state_attachDictRoundTrip(), and state_loadDictRoundTrip().

state_randomRoundTrip()

static void state_randomRoundTrip ( state_t *  state, round_trip_t  rt0, round_trip_t  rt1  )

static

Definition at line 178 of file round_trip_stream_fuzzer.c.

{
    if (FUZZ_rand32(&state->seed, 0, 1)) {
      rt0(state);
    } else {
      rt1(state);
    }
}

References FUZZ_rand32().

Referenced by state_attachDictHCRoundTrip(), state_attachDictRoundTrip(), state_loadDictHCRoundTrip(), and state_loadDictRoundTrip().

state_reset()

static void state_reset ( state_t *  state, uint32_t  seed  )

static

Definition at line 91 of file round_trip_stream_fuzzer.c.

{
    state->level = FUZZ_rand32(&seed, LZ4HC_CLEVEL_MIN, LZ4HC_CLEVEL_MAX);
    LZ4_resetStream_fast(state->cstream);
    LZ4_resetStreamHC_fast(state->cstreamHC, state->level);
    LZ4_setStreamDecode(state->dstream, NULL, 0);
    state->data.pos = 0;
    state->compressed.pos = 0;
    state->roundTrip.pos = 0;
    state->seed = seed;
}

References FUZZ_rand32(), LZ4_resetStream_fast(), LZ4_resetStreamHC_fast(), LZ4_setStreamDecode(), LZ4HC_CLEVEL_MAX, LZ4HC_CLEVEL_MIN, and NULL.

Referenced by LLVMFuzzerTestOneInput().

state_trimDict()

static size_t state_trimDict ( state_t *  state )

static

Picks a dictionary size and trims the dictionary off of the data. We copy the dictionary to the roundTrip so our validation passes.

Definition at line 125 of file round_trip_stream_fuzzer.c.

{
    /* 64 KB is the max dict size, allow slightly beyond that to test trim. */
    uint32_t maxDictSize = MIN(70 * 1024, state->data.size);
    size_t const dictSize = FUZZ_rand32(&state->seed, 0, maxDictSize);
    DEBUGLOG(2, "dictSize = %zu", dictSize);
    FUZZ_ASSERT(state->data.pos == 0);
    FUZZ_ASSERT(state->roundTrip.pos == 0);
    memcpy(state->roundTrip.buf, state->data.buf, dictSize);
    state->data.pos += dictSize;
    state->roundTrip.pos += dictSize;
    return dictSize;
}

References DEBUGLOG, FUZZ_ASSERT, FUZZ_rand32(), memcpy(), and MIN.

Referenced by state_attachDictHCRoundTrip(), state_attachDictRoundTrip(), state_loadDictHCRoundTrip(), and state_loadDictRoundTrip().

Variable Documentation

roundTrips

round_trip_t roundTrips[]

Initial value:

= {
  &state_prefixRoundTrip,
  &state_extDictRoundTrip,
  &state_loadDictRoundTrip,
  &state_attachDictRoundTrip,
  &state_prefixHCRoundTrip,
  &state_extDictHCRoundTrip,
  &state_loadDictHCRoundTrip,
  &state_attachDictHCRoundTrip,
}

Definition at line 274 of file round_trip_stream_fuzzer.c.

Referenced by LLVMFuzzerTestOneInput().