lib/lz4
1
0
Fork 0
mirror of https://github.com/lz4/lz4.git synced 2026-10-24 01:48:57 +03:00
Code Activity

ossfuzz: unit test for the fuzz data producer

Browse Source 
`make -C ossfuzz test` checks that FUZZ_dataProducer_retrieve32()
reads 32-bit values from the end of input,
and that FUZZ_dataProducer_range32() can produce any value of its range.

This test fails on current dev :
FUZZ_dataProducer_retrieve32() only returns a single byte,
so range32() never produces values > 255.
This commit is contained in:
Yann Collet
2026-10-08 12:57:07 -07:00
parent 9298a19c59
commit 07eea33feb
3 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ossfuzz/.gitignore vendored
View File

@@ -13,6 +13,7 @@ round_trip_frame_fuzzer
round_trip_frame_uncompressed_fuzzer
# test artefacts
fuzz_data_producer_test
# local tests

9
ossfuzz/Makefile
View File

@@ -72,9 +72,18 @@ endif
%_fuzzer_clean:
$(RM) $*_fuzzer $*_fuzzer.o standaloneengine.o
# Unit test of the fuzzer helpers (not a fuzzer)
.PHONY: test
test: fuzz_data_producer_test
./fuzz_data_producer_test$(EXT)
fuzz_data_producer_test: fuzz_data_producer_test.o fuzz_data_producer.o
$(CC) $(LZ4_CFLAGS) $(LDFLAGS) $^ -o $@$(EXT)
.PHONY: clean
clean: compress_fuzzer_clean decompress_fuzzer_clean \
compress_frame_fuzzer_clean compress_frame_stream_fuzzer_clean compress_hc_fuzzer_clean \
decompress_frame_fuzzer_clean round_trip_frame_fuzzer_clean \
round_trip_fuzzer_clean round_trip_hc_fuzzer_clean round_trip_stream_fuzzer_clean
$(RM) fuzz_data_producer_test fuzz_data_producer_test.o fuzz_data_producer.o
$(MAKE) -C $(LZ4DIR) clean

48
ossfuzz/fuzz_data_producer_test.c Normal file
View File

@@ -0,0 +1,48 @@
/**
* Unit test of the fuzz data producer (this is not a fuzzer).
* Values are consumed from the end of the input :
* 32-bit values are read from 4 bytes, in little-endian order.
*/
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include "fuzz_helpers.h"
#include "fuzz_data_producer.h"
static uint32_t range32_of(const uint8_t* data, size_t size, uint32_t min, uint32_t max)
{
FUZZ_dataProducer_t* const producer = FUZZ_dataProducer_create(data, size);
uint32_t const value = FUZZ_dataProducer_range32(producer, min, max);
FUZZ_dataProducer_free(producer);
return value;
}
int main(void)
{
{ uint8_t const data[] = { 0xAA, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 };
FUZZ_dataProducer_t* const producer = FUZZ_dataProducer_create(data, sizeof(data));
FUZZ_ASSERT(FUZZ_dataProducer_retrieve32(producer) == 0x08070605);
FUZZ_ASSERT(FUZZ_dataProducer_remainingBytes(producer) == 5);
FUZZ_ASSERT(FUZZ_dataProducer_retrieve32(producer) == 0x04030201);
FUZZ_ASSERT(FUZZ_dataProducer_remainingBytes(producer) == 1);
/* less than 4 bytes left : a single byte is consumed */
FUZZ_ASSERT(FUZZ_dataProducer_retrieve32(producer) == 0xAA);
FUZZ_ASSERT(FUZZ_dataProducer_remainingBytes(producer) == 0);
/* nothing left */
FUZZ_ASSERT(FUZZ_dataProducer_retrieve32(producer) == 0);
FUZZ_dataProducer_free(producer);
}
/* range32() can produce any value within its range, not just small ones */
{ uint8_t const seed[] = { 0x45, 0x23, 0x01, 0x00 }; /* 0x00012345 == 74565 */
FUZZ_ASSERT(range32_of(seed, sizeof(seed), 1000, 1999) == 1000 + 74565 % 1000);
}
{ uint8_t const seed[] = { 0xFF, 0xFF, 0xFF, 0x7F };
FUZZ_ASSERT(range32_of(seed, sizeof(seed), 0, 0xFFFFFFFF) == 0x7FFFFFFF);
}
printf("fuzz_data_producer_test : OK \n");
return 0;
}