-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This function was seriously flawed: * It didn't do output bounds checks * It produced invalid sequences when an uncompressed or RLE block was emitted * It produced invalid sequences when the block splitter was enabled * It produced invalid sequences when ZSTD_c_targetCBlockSize was enabled I've attempted to fix these issues, but this function is just a bad idea, so I've marked it as deprecated and unsafe. We should replace it with `ZSTD_extractSequences()` which operates on a compressed frame.
- Loading branch information
Showing
8 changed files
with
231 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| /* | ||
| * Copyright (c) Meta Platforms, Inc. and affiliates. | ||
| * All rights reserved. | ||
| * | ||
| * This source code is licensed under both the BSD-style license (found in the | ||
| * LICENSE file in the root directory of this source tree) and the GPLv2 (found | ||
| * in the COPYING file in the root directory of this source tree). | ||
| * You may select, at your option, one of the above-listed licenses. | ||
| */ | ||
|
|
||
| #define ZSTD_STATIC_LINKING_ONLY | ||
|
|
||
| #include <stddef.h> | ||
| #include <stdint.h> | ||
| #include <string.h> | ||
| #include <stdlib.h> | ||
|
|
||
| #include "fuzz_data_producer.h" | ||
| #include "fuzz_helpers.h" | ||
| #include "zstd_helpers.h" | ||
|
|
||
| /** | ||
| * This fuzz target ensures that ZSTD_generateSequences() does not crash and | ||
| * if it succeeds that ZSTD_compressSequences() round trips. | ||
| */ | ||
|
|
||
| static void testRoundTrip(ZSTD_CCtx* cctx, ZSTD_Sequence const* seqs, size_t nbSeqs, const void* src, size_t srcSize) { | ||
| /* Compress the sequences with block delimiters */ | ||
| const size_t compressBound = ZSTD_compressBound(srcSize); | ||
| void* dst = FUZZ_malloc(compressBound); | ||
| FUZZ_ASSERT(dst); | ||
|
|
||
| size_t compressedSize = ZSTD_compressSequences(cctx, dst, compressBound, seqs, nbSeqs, src, srcSize); | ||
| FUZZ_ZASSERT(compressedSize); | ||
|
|
||
| void* decompressed = FUZZ_malloc(srcSize); | ||
| FUZZ_ASSERT(srcSize == 0 || decompressed); | ||
| size_t decompressedSize = ZSTD_decompress(decompressed, srcSize, dst, compressedSize); | ||
| FUZZ_ZASSERT(decompressedSize); | ||
| FUZZ_ASSERT(decompressedSize == srcSize); | ||
| if (srcSize != 0) { | ||
| FUZZ_ASSERT(!memcmp(src, decompressed, srcSize)); | ||
| } | ||
|
|
||
| free(decompressed); | ||
| free(dst); | ||
| } | ||
|
|
||
| int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | ||
|
|
||
| FUZZ_dataProducer_t *producer = FUZZ_dataProducer_create(data, size); | ||
| size = FUZZ_dataProducer_reserveDataPrefix(producer); | ||
|
|
||
| ZSTD_CCtx* cctx = ZSTD_createCCtx(); | ||
| FUZZ_ASSERT(cctx); | ||
|
|
||
| const size_t seqsCapacity = FUZZ_dataProducer_uint32Range(producer, 0, 2 * ZSTD_sequenceBound(size)); | ||
| ZSTD_Sequence* seqs = (ZSTD_Sequence*)FUZZ_malloc(sizeof(ZSTD_Sequence) * seqsCapacity); | ||
| FUZZ_ASSERT(seqsCapacity == 0 || seqs); | ||
|
|
||
| FUZZ_setRandomParameters(cctx, size, producer); | ||
| FUZZ_ZASSERT(ZSTD_CCtx_setParameter(cctx, ZSTD_c_targetCBlockSize, 0)); | ||
| FUZZ_ZASSERT(ZSTD_CCtx_setParameter(cctx, ZSTD_c_nbWorkers, 0)); | ||
|
|
||
| const size_t nbSeqs = ZSTD_generateSequences(cctx, seqs, seqsCapacity, data, size); | ||
| if (ZSTD_isError(nbSeqs)) { | ||
| /* Allowed to error if the destination is too small */ | ||
| if (ZSTD_getErrorCode(nbSeqs) == ZSTD_error_dstSize_tooSmall) { | ||
| FUZZ_ASSERT(seqsCapacity < ZSTD_sequenceBound(size)); | ||
| } | ||
| } else { | ||
| /* Ensure we round trip with and without block delimiters*/ | ||
|
|
||
| FUZZ_ZASSERT(ZSTD_CCtx_setParameter(cctx, ZSTD_c_blockDelimiters, ZSTD_sf_explicitBlockDelimiters)); | ||
| testRoundTrip(cctx, seqs, nbSeqs, data, size); | ||
|
|
||
| const size_t nbMergedSeqs = ZSTD_mergeBlockDelimiters(seqs, nbSeqs); | ||
| FUZZ_ASSERT(nbMergedSeqs <= nbSeqs); | ||
| FUZZ_ZASSERT(ZSTD_CCtx_reset(cctx, ZSTD_reset_session_only)); | ||
| FUZZ_ZASSERT(ZSTD_CCtx_setParameter(cctx, ZSTD_c_blockDelimiters, ZSTD_sf_noBlockDelimiters)); | ||
| testRoundTrip(cctx, seqs, nbMergedSeqs, data, size); | ||
| } | ||
|
|
||
| free(seqs); | ||
| ZSTD_freeCCtx(cctx); | ||
| FUZZ_dataProducer_free(producer); | ||
| return 0; | ||
| } |
Oops, something went wrong.
731f4b7There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello, for this issue, what would you expect is the outcome if hitting it? Does the compression fail, or does it succeed resulting in a corrupted compressed buffer? For example, an invalid offset. If an invalid compressed block results, is it possible to remedy the issue through manipulating the compressed block?