1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
#include <stddef.h>
#include <unistd.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <string.h>
#include "mpg123.h"
static char* fuzzer_get_tmpfile(const uint8_t* data, size_t size) {
char* filename_buffer = strdup("/tmp/generate_temporary_file.XXXXXX");
if (!filename_buffer) {
perror("Failed to allocate file name buffer.");
abort();
}
const int file_descriptor = mkstemp(filename_buffer);
if (file_descriptor < 0) {
perror("Failed to make temporary file.");
abort();
}
FILE* file = fdopen(file_descriptor, "wb");
if (!file) {
perror("Failed to open file descriptor.");
close(file_descriptor);
abort();
}
const size_t bytes_written = fwrite(data, sizeof(uint8_t), size, file);
if (bytes_written < size) {
close(file_descriptor);
fprintf(stderr, "Failed to write all bytes to file (%zu out of %zu)",
bytes_written, size);
abort();
}
fclose(file);
return filename_buffer;
}
static void fuzzer_release_tmpfile(char* filename) {
if (unlink(filename) != 0) {
perror("WARNING: Failed to delete temporary file.");
}
free(filename);
}
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
static bool initialized = false;
if (!initialized) {
mpg123_init();
initialized = true;
}
char* filename = fuzzer_get_tmpfile(data, size);
if (filename == NULL) {
return 0;
}
size_t outmemorysize = size * 2; // Guess based on the size of data.
unsigned char* outmemory = (unsigned char*)malloc(outmemorysize);
if (outmemory == NULL) {
fuzzer_release_tmpfile(filename);
return 0;
}
int error;
mpg123_handle* handle = mpg123_new(NULL, &error);
if (handle == NULL || mpg123_param(handle,
MPG123_ADD_FLAGS, MPG123_QUIET, 0.) != MPG123_OK) {
free(outmemory);
fuzzer_release_tmpfile(filename);
return 0;
}
if (mpg123_open(handle, filename) == MPG123_OK) {
int read_error;
do {
size_t decoded_size;
read_error = mpg123_read(handle, outmemory, outmemorysize, &decoded_size);
} while (read_error == MPG123_OK && mpg123_tellframe(handle) <= 10000
&& mpg123_tell_stream(handle) <= 1<<20);
}
mpg123_close(handle);
mpg123_delete(handle);
free(outmemory);
fuzzer_release_tmpfile(filename);
return 0;
}
|
