ddidderr/zstd-rs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[oss-fuzz] Fix simple_round_trip fuzzer with overlapping decompression

Browse Source 
When `ZSTD_c_maxBlockSize` is set, we weren't computing the
decompression margin correctly, leading to `dstSize_tooSmall` errors.
Fix that computation.

This is just a bug in the fuzzer, not a bug in the library itself.

Credit to OSS-Fuzz
This commit is contained in:
Nick Terrell
2023-04-13 10:14:29 -07:00
committed by Nick Terrell
parent 0f255ff4fa
commit e72e13ac6c
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/fuzz/simple_round_trip.c
+10 -3
View File
@@ -27,7 +27,7 @@
static ZSTD_CCtx *cctx = NULL; static ZSTD_CCtx *cctx = NULL;
static ZSTD_DCtx *dctx = NULL; static ZSTD_DCtx *dctx = NULL;
static size_t getDecompressionMargin(void const* compressed, size_t cSize, size_t srcSize, int hasSmallBlocks) static size_t getDecompressionMargin(void const* compressed, size_t cSize, size_t srcSize, int hasSmallBlocks, int maxBlockSize)
{ {
size_t margin = ZSTD_decompressionMargin(compressed, cSize); size_t margin = ZSTD_decompressionMargin(compressed, cSize);
if (!hasSmallBlocks) { if (!hasSmallBlocks) {
@@ -37,7 +37,12 @@ static size_t getDecompressionMargin(void const* compressed, size_t cSize, size_
ZSTD_frameHeader zfh; ZSTD_frameHeader zfh;
size_t marginM; size_t marginM;
FUZZ_ZASSERT(ZSTD_getFrameHeader(&zfh, compressed, cSize)); FUZZ_ZASSERT(ZSTD_getFrameHeader(&zfh, compressed, cSize));
marginM = ZSTD_DECOMPRESSION_MARGIN(srcSize, zfh.blockSizeMax); if (maxBlockSize == 0) {
maxBlockSize = zfh.blockSizeMax;
} else {
maxBlockSize = MIN(maxBlockSize, (int)zfh.blockSizeMax);
}
marginM = ZSTD_DECOMPRESSION_MARGIN(srcSize, maxBlockSize);
if (marginM < margin) if (marginM < margin)
margin = marginM; margin = marginM;
} }
@@ -52,12 +57,14 @@ static size_t roundTripTest(void *result, size_t resultCapacity,
size_t cSize; size_t cSize;
size_t dSize; size_t dSize;
int targetCBlockSize = 0; int targetCBlockSize = 0;
int maxBlockSize = 0;
if (FUZZ_dataProducer_uint32Range(producer, 0, 1)) { if (FUZZ_dataProducer_uint32Range(producer, 0, 1)) {
size_t const remainingBytes = FUZZ_dataProducer_remainingBytes(producer); size_t const remainingBytes = FUZZ_dataProducer_remainingBytes(producer);
FUZZ_setRandomParameters(cctx, srcSize, producer); FUZZ_setRandomParameters(cctx, srcSize, producer);
cSize = ZSTD_compress2(cctx, compressed, compressedCapacity, src, srcSize); cSize = ZSTD_compress2(cctx, compressed, compressedCapacity, src, srcSize);
FUZZ_ZASSERT(cSize); FUZZ_ZASSERT(cSize);
FUZZ_ZASSERT(ZSTD_CCtx_getParameter(cctx, ZSTD_c_targetCBlockSize, &targetCBlockSize)); FUZZ_ZASSERT(ZSTD_CCtx_getParameter(cctx, ZSTD_c_targetCBlockSize, &targetCBlockSize));
FUZZ_ZASSERT(ZSTD_CCtx_getParameter(cctx, ZSTD_c_maxBlockSize, &maxBlockSize));
// Compress a second time and check for determinism // Compress a second time and check for determinism
{ {
size_t const cSize0 = cSize; size_t const cSize0 = cSize;
@@ -89,7 +96,7 @@ static size_t roundTripTest(void *result, size_t resultCapacity,
FUZZ_ASSERT_MSG(!FUZZ_memcmp(src, result, dSize), "Corruption!"); FUZZ_ASSERT_MSG(!FUZZ_memcmp(src, result, dSize), "Corruption!");
{ {
size_t margin = getDecompressionMargin(compressed, cSize, srcSize, targetCBlockSize); size_t margin = getDecompressionMargin(compressed, cSize, srcSize, targetCBlockSize, maxBlockSize);
size_t const outputSize = srcSize + margin; size_t const outputSize = srcSize + margin;
char* const output = (char*)FUZZ_malloc(outputSize); char* const output = (char*)FUZZ_malloc(outputSize);
char* const input = output + outputSize - cSize; char* const input = output + outputSize - cSize;