1 #include <stdio.h>
2 #include <stddef.h>
3 #include <stdint.h>
4 #include <string.h>
5 #include <assert.h>
6 #include <stdlib.h>
7 #include <inttypes.h>
8 #include "zlib.h"
9
10 #define CHECK_ERR(err, msg) { \
11 if (err != Z_OK) { \
12 fprintf(stderr, "%s error: %d\n", msg, err); \
13 exit(1); \
14 } \
15 }
16
17 static const uint8_t *data;
18 static size_t dataLen;
19 static alloc_func zalloc = NULL;
20 static free_func zfree = NULL;
21 static size_t dictionaryLen = 0;
22 static unsigned long dictId; /* Adler32 value of the dictionary */
23
24 /* ===========================================================================
25 * Test deflate() with preset dictionary
26 */
test_dict_deflate(unsigned char ** compr,size_t * comprLen)27 void test_dict_deflate(unsigned char **compr, size_t *comprLen)
28 {
29 z_stream c_stream; /* compression stream */
30 int err;
31 int level = data[0] % 11 - 1; /* [-1..9]
32 compression levels
33 #define Z_NO_COMPRESSION 0
34 #define Z_BEST_SPEED 1
35 #define Z_BEST_COMPRESSION 9
36 #define Z_DEFAULT_COMPRESSION (-1) */
37
38 int method = Z_DEFLATED; /* The deflate compression method (the only one
39 supported in this version) */
40 int windowBits = 8 + data[0] % 8; /* The windowBits parameter is the base
41 two logarithm of the window size (the size of the history buffer). It
42 should be in the range 8..15 for this version of the library. */
43 int memLevel = 1 + data[0] % 9; /* memLevel=1 uses minimum memory but is
44 slow and reduces compression ratio; memLevel=9 uses maximum memory for
45 optimal speed. */
46 int strategy = data[0] % 5; /* [0..4]
47 #define Z_FILTERED 1
48 #define Z_HUFFMAN_ONLY 2
49 #define Z_RLE 3
50 #define Z_FIXED 4
51 #define Z_DEFAULT_STRATEGY 0 */
52
53 /* deflate would fail for no-compression or for speed levels. */
54 if (level == 0 || level == 1)
55 level = -1;
56
57 c_stream.zalloc = zalloc;
58 c_stream.zfree = zfree;
59 c_stream.opaque = (void *)0;
60
61 err = deflateInit2(&c_stream, level, method, windowBits, memLevel, strategy);
62 CHECK_ERR(err, "deflateInit");
63
64 err = deflateSetDictionary(
65 &c_stream, (const unsigned char *)data, dictionaryLen);
66 CHECK_ERR(err, "deflateSetDictionary");
67
68 /* deflateBound does not provide enough space for low compression levels. */
69 *comprLen = 100 + 2 * deflateBound(&c_stream, dataLen);
70 *compr = (uint8_t *)calloc(1, *comprLen);
71
72 dictId = c_stream.adler;
73 c_stream.next_out = *compr;
74 c_stream.avail_out = (unsigned int)(*comprLen);
75
76 c_stream.next_in = (Bytef *)data;
77 c_stream.avail_in = dataLen;
78
79 err = deflate(&c_stream, Z_FINISH);
80 if (err != Z_STREAM_END) {
81 fprintf(stderr, "deflate dict should report Z_STREAM_END\n");
82 exit(1);
83 }
84 err = deflateEnd(&c_stream);
85 CHECK_ERR(err, "deflateEnd");
86 }
87
88 /* ===========================================================================
89 * Test inflate() with a preset dictionary
90 */
test_dict_inflate(unsigned char * compr,size_t comprLen)91 void test_dict_inflate(unsigned char *compr, size_t comprLen) {
92 int err;
93 z_stream d_stream; /* decompression stream */
94 unsigned char *uncompr;
95
96 d_stream.zalloc = zalloc;
97 d_stream.zfree = zfree;
98 d_stream.opaque = (void *)0;
99
100 d_stream.next_in = compr;
101 d_stream.avail_in = (unsigned int)comprLen;
102
103 err = inflateInit(&d_stream);
104 CHECK_ERR(err, "inflateInit");
105
106 uncompr = (uint8_t *)calloc(1, dataLen);
107 d_stream.next_out = uncompr;
108 d_stream.avail_out = (unsigned int)dataLen;
109
110 for (;;) {
111 err = inflate(&d_stream, Z_NO_FLUSH);
112 if (err == Z_STREAM_END)
113 break;
114 if (err == Z_NEED_DICT) {
115 if (d_stream.adler != dictId) {
116 fprintf(stderr, "unexpected dictionary");
117 exit(1);
118 }
119 err = inflateSetDictionary(
120 &d_stream, (const unsigned char *)data, dictionaryLen);
121 }
122 CHECK_ERR(err, "inflate with dict");
123 }
124
125 err = inflateEnd(&d_stream);
126 CHECK_ERR(err, "inflateEnd");
127
128 if (memcmp(uncompr, data, dataLen)) {
129 fprintf(stderr, "bad inflate with dict\n");
130 exit(1);
131 }
132
133 free(uncompr);
134 }
135
LLVMFuzzerTestOneInput(const uint8_t * d,size_t size)136 int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size) {
137 size_t comprLen = 0;
138 uint8_t *compr;
139
140 /* Discard inputs larger than 100Kb. */
141 static size_t kMaxSize = 100 * 1024;
142
143 if (size < 1 || size > kMaxSize)
144 return 0;
145
146 data = d;
147 dataLen = size;
148
149 /* Set up the contents of the dictionary. The size of the dictionary is
150 intentionally selected to be of unusual size. To help cover more corner
151 cases, the size of the dictionary is read from the input data. */
152 dictionaryLen = data[0];
153 if (dictionaryLen > dataLen)
154 dictionaryLen = dataLen;
155
156 test_dict_deflate(&compr, &comprLen);
157 test_dict_inflate(compr, comprLen);
158
159 free(compr);
160
161 /* This function must return 0. */
162 return 0;
163 }
164