summaryrefslogtreecommitdiff
path: root/oss-fuzz
diff options
context:
space:
mode:
Diffstat (limited to 'oss-fuzz')
-rw-r--r--oss-fuzz/fuzzer_decoder.cc1
-rw-r--r--oss-fuzz/fuzzer_encoder.cc1
-rw-r--r--oss-fuzz/fuzzer_encoder_v2.cc45
-rw-r--r--oss-fuzz/fuzzer_metadata.cc10
-rw-r--r--oss-fuzz/fuzzer_seek.cc10
5 files changed, 54 insertions, 13 deletions
diff --git a/oss-fuzz/fuzzer_decoder.cc b/oss-fuzz/fuzzer_decoder.cc
index 4afe11b9..b04e2a00 100644
--- a/oss-fuzz/fuzzer_decoder.cc
+++ b/oss-fuzz/fuzzer_decoder.cc
@@ -29,6 +29,7 @@
#include "FLAC++/decoder.h"
#include "FLAC++/metadata.h"
+#include "fuzzer_common.h"
template <> FLAC__MetadataType fuzzing::datasource::Base::Get<FLAC__MetadataType>(const uint64_t id) {
(void)id;
diff --git a/oss-fuzz/fuzzer_encoder.cc b/oss-fuzz/fuzzer_encoder.cc
index f38bdf26..ceaabbb4 100644
--- a/oss-fuzz/fuzzer_encoder.cc
+++ b/oss-fuzz/fuzzer_encoder.cc
@@ -29,6 +29,7 @@
#include <fuzzing/memory.hpp>
#include "FLAC++/encoder.h"
+#include "fuzzer_common.h"
#define SAMPLE_VALUE_LIMIT (1024*1024*10)
diff --git a/oss-fuzz/fuzzer_encoder_v2.cc b/oss-fuzz/fuzzer_encoder_v2.cc
index 6b5fc779..b00bc623 100644
--- a/oss-fuzz/fuzzer_encoder_v2.cc
+++ b/oss-fuzz/fuzzer_encoder_v2.cc
@@ -36,6 +36,7 @@
extern "C" {
#include "share/private.h"
}
+#include "fuzzer_common.h"
/* This C++ fuzzer uses the FLAC and not FLAC++ because the latter lacks a few
* hidden functions like FLAC__stream_encoder_disable_constant_subframes. It
@@ -52,6 +53,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
FLAC__bool encoder_valid = true;
FLAC__StreamEncoder *encoder = 0;
+ FLAC__StreamEncoderState state;
FLAC__StreamMetadata *metadata[16] = {NULL};
unsigned num_metadata = 0;
FLAC__StreamMetadata_VorbisComment_Entry VorbisCommentField;
@@ -63,6 +65,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
FLAC__bool data_bools[24];
+ /* Set alloc threshold. This check was added later and no spare config
+ * bytes were left, so we're reusing the sample rate as that of little
+ * consequence to the encoder and decoder except reading the frame header */
+
+ if(size < 3)
+ return 0;
+ alloc_check_threshold = data[2];
+ alloc_check_counter = 0;
+
/* allocate the encoder */
if((encoder = FLAC__stream_encoder_new()) == NULL) {
fprintf(stderr, "ERROR: allocating encoder\n");
@@ -154,7 +165,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
encoder_valid &= FLAC__stream_encoder_disable_verbatim_subframes(encoder, data_bools[12]);
}
- /* data_bools[14..15] are spare */
+ /* Disable alloc check if requested */
+ if(data_bools[14])
+ alloc_check_threshold = INT32_MAX;
+
+ /* data_bools[15] are spare */
/* add metadata */
if(encoder_valid && (metadata_mask & 1)) {
@@ -196,13 +211,17 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
if(!FLAC__metadata_object_vorbiscomment_entry_from_name_value_pair(&VorbisCommentField, "COMMENTARY", "Nothing to 🤔 report"))
encoder_valid = false;
else {
- FLAC__metadata_object_vorbiscomment_append_comment(metadata[num_metadata], VorbisCommentField, false);
-
- /* Insert a vorbis comment at the first index */
- if(!FLAC__metadata_object_vorbiscomment_entry_from_name_value_pair(&VorbisCommentField, "COMMENTARY", "Still nothing to report 🤔🤣"))
- encoder_valid = false;
+ if(FLAC__metadata_object_vorbiscomment_append_comment(metadata[num_metadata], VorbisCommentField, false)) {
+
+ /* Insert a vorbis comment at the first index */
+ if(!FLAC__metadata_object_vorbiscomment_entry_from_name_value_pair(&VorbisCommentField, "COMMENTARY", "Still nothing to report 🤔🤣"))
+ encoder_valid = false;
+ else
+ if(!FLAC__metadata_object_vorbiscomment_insert_comment(metadata[num_metadata++], 0, VorbisCommentField, false))
+ free(VorbisCommentField.entry);
+ }
else
- FLAC__metadata_object_vorbiscomment_insert_comment(metadata[num_metadata++], 0, VorbisCommentField, false);
+ free(VorbisCommentField.entry);
}
}
}
@@ -262,11 +281,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
}
}
- if(FLAC__stream_encoder_get_state(encoder) != FLAC__STREAM_ENCODER_OK &&
- FLAC__stream_encoder_get_state(encoder) != FLAC__STREAM_ENCODER_UNINITIALIZED &&
- FLAC__stream_encoder_get_state(encoder) != FLAC__STREAM_ENCODER_CLIENT_ERROR){
+ state = FLAC__stream_encoder_get_state(encoder);
+ if(!(state == FLAC__STREAM_ENCODER_OK ||
+ state == FLAC__STREAM_ENCODER_UNINITIALIZED ||
+ state == FLAC__STREAM_ENCODER_CLIENT_ERROR ||
+ ((state == FLAC__STREAM_ENCODER_MEMORY_ALLOCATION_ERROR ||
+ state == FLAC__STREAM_ENCODER_FRAMING_ERROR) &&
+ alloc_check_threshold < INT32_MAX))) {
fprintf(stderr,"-----\nERROR: stream encoder returned %s\n-----\n",FLAC__stream_encoder_get_resolved_state_string(encoder));
- if(FLAC__stream_encoder_get_state(encoder) == FLAC__STREAM_ENCODER_VERIFY_MISMATCH_IN_AUDIO_DATA) {
+ if(state == FLAC__STREAM_ENCODER_VERIFY_MISMATCH_IN_AUDIO_DATA) {
uint32_t frame_number, channel, sample_number;
FLAC__int32 expected, got;
FLAC__stream_encoder_get_verify_decoder_error_stats(encoder, NULL, &frame_number, &channel, &sample_number, &expected, &got);
diff --git a/oss-fuzz/fuzzer_metadata.cc b/oss-fuzz/fuzzer_metadata.cc
index 3379ecaf..7d3cb5ea 100644
--- a/oss-fuzz/fuzzer_metadata.cc
+++ b/oss-fuzz/fuzzer_metadata.cc
@@ -34,8 +34,9 @@
#include <cstring> /* for memcpy */
#include <unistd.h>
#include "FLAC++/metadata.h"
+#include "fuzzer_common.h"
-#define CONFIG_LENGTH 1
+#define CONFIG_LENGTH 2
#define min(x,y) (x<y?x:y)
@@ -60,6 +61,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
command_length = data[0] >> 4;
+ if(data[1] < 128) /* Use MSB as on/off */
+ alloc_check_threshold = data[1];
+ else
+ alloc_check_threshold = INT32_MAX;
+ alloc_check_counter = 0;
+
+
/* Leave at least one byte as input */
if(command_length >= size - 1 - CONFIG_LENGTH)
command_length = size - 1 - CONFIG_LENGTH;
diff --git a/oss-fuzz/fuzzer_seek.cc b/oss-fuzz/fuzzer_seek.cc
index ed3df38e..023ac405 100644
--- a/oss-fuzz/fuzzer_seek.cc
+++ b/oss-fuzz/fuzzer_seek.cc
@@ -32,6 +32,7 @@
#include <cstdlib>
#include <cstring> /* for memcpy */
#include "FLAC/stream_decoder.h"
+#include "fuzzer_common.h"
#if 0 /* set to 1 to debug */
#define FPRINTF_DEBUG_ONLY(...) fprintf(__VA_ARGS__)
@@ -39,7 +40,7 @@
#define FPRINTF_DEBUG_ONLY(...)
#endif
-#define CONFIG_LENGTH 1
+#define CONFIG_LENGTH 2
static FLAC__StreamDecoderWriteStatus write_callback(const FLAC__StreamDecoder *decoder, const FLAC__Frame *frame, const FLAC__int32 *const buffer[], void *client_data)
{
@@ -60,6 +61,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
uint8_t command_length;
FLAC__bool init_bools[16], ogg;
+ if(size > 2 && data[1] < 128) /* Use MSB as on/off */
+ alloc_check_threshold = data[1];
+ else
+ alloc_check_threshold = INT32_MAX;
+ alloc_check_counter = 0;
+
+
/* allocate the decoder */
if((decoder = FLAC__stream_decoder_new()) == NULL) {
fprintf(stderr, "ERROR: allocating decoder\n");
View Lorry Controller Status