system/serenity
system/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity synced 2024-10-15 04:13:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Lagom: Add a fuzzer for LZMA decompression

Browse source
This commit is contained in:
Tim Schumacher 2023-03-07 18:36:36 +01:00 committed by Idan Horowitz
parent 858c44ae1b
commit 123e9fa5d0
2 changed files with 37 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Meta/Lagom/Fuzzers/CMakeLists.txt
View file

@ -35,6 +35,7 @@ add_simple_fuzzer(FuzzGzipDecompression LibCompress)
add_simple_fuzzer(FuzzICCProfile LibGfx)
add_simple_fuzzer(FuzzICOLoader LibGfx)
add_simple_fuzzer(FuzzJPEGLoader LibGfx)
add_simple_fuzzer(FuzzLzmaDecompression LibArchive LibCompress)
add_simple_fuzzer(FuzzMatroskaReader LibVideo)
add_simple_fuzzer(FuzzMD5 LibCrypto)
add_simple_fuzzer(FuzzMP3Loader LibAudio)

36
Meta/Lagom/Fuzzers/FuzzLzmaDecompression.cpp Normal file
View file

@ -0,0 +1,36 @@
/*
* Copyright (c) 2023, Tim Schumacher <timschumi@gmx.de>.
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/MemoryStream.h>
#include <LibCompress/Lzma.h>
extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size)
{
// LibFuzzer has a default memory limit of 2048 MB, so limit the dictionary size to a
// reasonable number to make sure that we don't actually run into it by allocating a
// huge dictionary. The chosen value is double of what the largest dictionary in the
// specifications test files is, so it should be more than enough for fuzzing everything
// that we would want to fuzz.
constexpr size_t largest_reasonable_dictionary_size = 16 * MiB;
if (size >= sizeof(Compress::LzmaHeader)) {
auto const* header = reinterpret_cast<Compress::LzmaHeader const*>(data);
if (header->dictionary_size() > largest_reasonable_dictionary_size)
return -1;
}
auto stream = make<FixedMemoryStream>(ReadonlyBytes { data, size });
auto decompressor_or_error = Compress::LzmaDecompressor::create_from_container(move(stream));
if (decompressor_or_error.is_error())
return 0;
auto decompressor = decompressor_or_error.release_value();
while (!decompressor->is_eof()) {
auto maybe_error = decompressor->discard(4096);
if (maybe_error.is_error())
break;
}
return 0;
}