ddidderr/zstd-rs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[fuzzer] Fuzz long range matching & new API

Browse Source
This commit is contained in:
Nick Terrell
2017-09-14 14:48:08 -07:00
parent 9712d5ebe6
commit 39357c41cb
6 changed files with 209 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/fuzz/stream_round_trip.c
+60 -55
View File
@@ -12,16 +12,16 @@
* compares the result with the original, and calls abort() on corruption.
*/
#define ZSTD_STATIC_LINKING_ONLY
#include <stddef.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "fuzz_helpers.h"
#include "zstd.h"
#include "zstd_helpers.h"
static const int kMaxClevel = 19;
static ZSTD_CStream *cstream = NULL;
ZSTD_CCtx *cctx = NULL;
static ZSTD_DCtx *dctx = NULL;
static uint8_t* cBuf = NULL;
static uint8_t* rBuf = NULL;
@@ -30,84 +30,89 @@ static uint32_t seed;
static ZSTD_outBuffer makeOutBuffer(uint8_t *dst, size_t capacity)
{
ZSTD_outBuffer buffer = { dst, 0, 0 };
ZSTD_outBuffer buffer = { dst, 0, 0 };
FUZZ_ASSERT(capacity > 0);
buffer.size = (FUZZ_rand(&seed) % capacity) + 1;
FUZZ_ASSERT(buffer.size <= capacity);
FUZZ_ASSERT(capacity > 0);
buffer.size = (FUZZ_rand(&seed) % capacity) + 1;
FUZZ_ASSERT(buffer.size <= capacity);
return buffer;
return buffer;
}
static ZSTD_inBuffer makeInBuffer(const uint8_t **src, size_t *size)
{
ZSTD_inBuffer buffer = { *src, 0, 0 };
ZSTD_inBuffer buffer = { *src, 0, 0 };
FUZZ_ASSERT(*size > 0);
buffer.size = (FUZZ_rand(&seed) % *size) + 1;
FUZZ_ASSERT(buffer.size <= *size);
*src += buffer.size;
*size -= buffer.size;
FUZZ_ASSERT(*size > 0);
buffer.size = (FUZZ_rand(&seed) % *size) + 1;
FUZZ_ASSERT(buffer.size <= *size);
*src += buffer.size;
*size -= buffer.size;
return buffer;
return buffer;
}
static size_t compress(uint8_t *dst, size_t capacity,
const uint8_t *src, size_t srcSize)
{
int cLevel = FUZZ_rand(&seed) % kMaxClevel;
size_t dstSize = 0;
FUZZ_ASSERT(!ZSTD_isError(ZSTD_initCStream(cstream, cLevel)));
ZSTD_CCtx_reset(cctx);
FUZZ_setRandomParameters(cctx, &seed);
while (srcSize > 0) {
ZSTD_inBuffer in = makeInBuffer(&src, &srcSize);
/* Mode controls the action. If mode == -1 we pick a new mode */
int mode = -1;
while (in.pos < in.size) {
ZSTD_outBuffer out = makeOutBuffer(dst, capacity);
/* Previous action finished, pick a new mode. */
if (mode == -1) mode = FUZZ_rand(&seed) % 10;
switch (mode) {
case 0: /* fall-though */
case 1: /* fall-though */
case 2: {
size_t const ret = ZSTD_flushStream(cstream, &out);
FUZZ_ASSERT_MSG(!ZSTD_isError(ret), ZSTD_getErrorName(ret));
if (ret == 0) mode = -1;
break;
}
case 3: {
size_t ret = ZSTD_endStream(cstream, &out);
FUZZ_ASSERT_MSG(!ZSTD_isError(ret), ZSTD_getErrorName(ret));
/* Reset the compressor when the frame is finished */
if (ret == 0) {
cLevel = FUZZ_rand(&seed) % kMaxClevel;
ret = ZSTD_initCStream(cstream, cLevel);
FUZZ_ASSERT(!ZSTD_isError(ret));
ZSTD_outBuffer out = makeOutBuffer(dst, capacity);
/* Previous action finished, pick a new mode. */
if (mode == -1) mode = FUZZ_rand(&seed) % 10;
switch (mode) {
case 0: /* fall-though */
case 1: /* fall-though */
case 2: {
size_t const ret =
ZSTD_compress_generic(cctx, &out, &in, ZSTD_e_flush);
FUZZ_ZASSERT(ret);
if (ret == 0)
mode = -1;
break;
}
case 3: {
size_t ret =
ZSTD_compress_generic(cctx, &out, &in, ZSTD_e_end);
FUZZ_ZASSERT(ret);
/* Reset the compressor when the frame is finished */
if (ret == 0) {
ZSTD_CCtx_reset(cctx);
FUZZ_setRandomParameters(cctx, &seed);
mode = -1;
}
break;
}
default: {
size_t const ret =
ZSTD_compress_generic(cctx, &out, &in, ZSTD_e_continue);
FUZZ_ZASSERT(ret);
mode = -1;
}
break;
}
default: {
size_t const ret = ZSTD_compressStream(cstream, &out, &in);
FUZZ_ASSERT_MSG(!ZSTD_isError(ret), ZSTD_getErrorName(ret));
mode = -1;
}
}
dst += out.pos;
dstSize += out.pos;
capacity -= out.pos;
dst += out.pos;
dstSize += out.pos;
capacity -= out.pos;
}
}
for (;;) {
ZSTD_inBuffer in = {NULL, 0, 0};
ZSTD_outBuffer out = makeOutBuffer(dst, capacity);
size_t const ret = ZSTD_endStream(cstream, &out);
FUZZ_ASSERT_MSG(!ZSTD_isError(ret), ZSTD_getErrorName(ret));
size_t const ret = ZSTD_compress_generic(cctx, &out, &in, ZSTD_e_end);
FUZZ_ZASSERT(ret);
dst += out.pos;
dstSize += out.pos;
capacity -= out.pos;
if (ret == 0) break;
if (ret == 0)
break;
}
return dstSize;
}
@@ -128,9 +133,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *src, size_t size)
bufSize = neededBufSize;
FUZZ_ASSERT(cBuf && rBuf);
}
if (!cstream) {
cstream = ZSTD_createCStream();
FUZZ_ASSERT(cstream);
if (!cctx) {
cctx = ZSTD_createCCtx();
FUZZ_ASSERT(cctx);
}
if (!dctx) {
dctx = ZSTD_createDCtx();
@@ -147,7 +152,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *src, size_t size)
}
#ifndef STATEFUL_FUZZING
ZSTD_freeCStream(cstream); cstream = NULL;
ZSTD_freeCCtx(cctx); cctx = NULL;
ZSTD_freeDCtx(dctx); dctx = NULL;
#endif
return 0;