deflate-ruby 0.1.0

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/deflate_compress/fuzz.c

@@ -0,0 +1,95 @@
+#include <assert.h>
+#include <libdeflate.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+static void
+alloc_guarded_buffer(size_t size, uint8_t **start_ret, uint8_t **end_ret)
+{
+	const size_t pagesize = sysconf(_SC_PAGESIZE);
+	const size_t nr_pages = (size + pagesize - 1) / pagesize;
+	uint8_t *base_addr, *start, *end;
+
+	/* Allocate buffer and guard pages. */
+	base_addr = mmap(NULL, (nr_pages + 2) * pagesize, PROT_READ|PROT_WRITE,
+			 MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+	assert(base_addr != (uint8_t *)MAP_FAILED);
+	start = base_addr + pagesize;
+	end = start + (nr_pages * pagesize);
+
+	/* Unmap the guard pages. */
+	munmap(base_addr, pagesize);
+	munmap(end, pagesize);
+
+	*start_ret = start;
+	*end_ret = end;
+}
+
+static void
+free_guarded_buffer(uint8_t *start, uint8_t *end)
+{
+	munmap(start, end - start);
+}
+
+/* Fuzz the DEFLATE compression and decompression round trip. */
+int LLVMFuzzerTestOneInput(const uint8_t *in, size_t insize)
+{
+	int level;
+	bool use_bound;
+	struct libdeflate_compressor *c;
+	struct libdeflate_decompressor *d;
+	size_t csize_avail;
+	uint8_t *ubuf_start, *ubuf_end, *ubuf;
+	uint8_t *cbuf_start, *cbuf_end, *cbuf;
+	uint8_t *dbuf_start, *dbuf_end, *dbuf;
+	size_t csize;
+	enum libdeflate_result res;
+
+	if (insize < 2)
+		return 0;
+
+	level = in[0] % 13;
+	use_bound = in[1] % 2;
+	in += 2;
+	insize -= 2;
+
+	c = libdeflate_alloc_compressor(level);
+	d = libdeflate_alloc_decompressor();
+
+	/* Use guard pages to make all input/output buffer overflows segfault */
+
+	alloc_guarded_buffer(insize, &ubuf_start, &ubuf_end);
+	ubuf = ubuf_end - insize;
+	memcpy(ubuf, in, insize);
+
+	csize_avail = use_bound ? libdeflate_deflate_compress_bound(c, insize) :
+				  insize;
+	alloc_guarded_buffer(csize_avail, &cbuf_start, &cbuf_end);
+	cbuf = cbuf_end - csize_avail;
+
+	alloc_guarded_buffer(insize, &dbuf_start, &dbuf_end);
+	dbuf = dbuf_end - insize;
+
+	csize = libdeflate_deflate_compress(c, ubuf, insize, cbuf, csize_avail);
+	if (csize != 0) {
+		assert(csize <= csize_avail);
+		memmove(cbuf_end - csize, cbuf, csize);
+		res = libdeflate_deflate_decompress(d, cbuf_end - csize, csize,
+						    dbuf, insize, NULL);
+		assert(res == LIBDEFLATE_SUCCESS);
+		assert(memcmp(in, dbuf, insize) == 0);
+	} else {
+		assert(!use_bound);
+	}
+
+	libdeflate_free_compressor(c);
+	libdeflate_free_decompressor(d);
+	free_guarded_buffer(ubuf_start, ubuf_end);
+	free_guarded_buffer(cbuf_start, cbuf_end);
+	free_guarded_buffer(dbuf_start, dbuf_end);
+	return 0;
+}

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/deflate_decompress/corpus/0

@@ -0,0 +1,3 @@
+u�1
+�@Eg�Bl5
+��V���6j��X{�i=���l=����l�����?t���D

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/deflate_decompress/fuzz.c

@@ -0,0 +1,62 @@
+#include <assert.h>
+#include <libdeflate.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+static void
+alloc_guarded_buffer(size_t size, uint8_t **start_ret, uint8_t **end_ret)
+{
+	const size_t pagesize = sysconf(_SC_PAGESIZE);
+	const size_t nr_pages = (size + pagesize - 1) / pagesize;
+	uint8_t *base_addr, *start, *end;
+
+	/* Allocate buffer and guard pages. */
+	base_addr = mmap(NULL, (nr_pages + 2) * pagesize, PROT_READ|PROT_WRITE,
+			 MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+	assert(base_addr != (uint8_t *)MAP_FAILED);
+	start = base_addr + pagesize;
+	end = start + (nr_pages * pagesize);
+
+	/* Unmap the guard pages. */
+	munmap(base_addr, pagesize);
+	munmap(end, pagesize);
+
+	*start_ret = start;
+	*end_ret = end;
+}
+
+static void
+free_guarded_buffer(uint8_t *start, uint8_t *end)
+{
+	munmap(start, end - start);
+}
+
+/* Fuzz DEFLATE decompression. */
+int LLVMFuzzerTestOneInput(const uint8_t *in, size_t insize)
+{
+	size_t outsize_avail = 3 * insize;
+	uint8_t *cbuf_start, *cbuf_end, *cbuf;
+	uint8_t *dbuf_start, *dbuf_end, *dbuf;
+	struct libdeflate_decompressor *d;
+
+	/* Use guard pages to make all input/output buffer overflows segfault */
+
+	alloc_guarded_buffer(insize, &cbuf_start, &cbuf_end);
+	cbuf = cbuf_end - insize;
+	memcpy(cbuf, in, insize);
+
+	alloc_guarded_buffer(outsize_avail, &dbuf_start, &dbuf_end);
+	dbuf = dbuf_end - outsize_avail;
+
+	d = libdeflate_alloc_decompressor();
+	libdeflate_deflate_decompress(d, cbuf, insize, dbuf, outsize_avail,
+				      NULL);
+	libdeflate_free_decompressor(d);
+	free_guarded_buffer(cbuf_start, cbuf_end);
+	free_guarded_buffer(dbuf_start, dbuf_end);
+	return 0;
+}

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/fuzz.sh

@@ -0,0 +1,108 @@
+#!/bin/bash
+
+set -e -u -o pipefail
+
+cd "$(dirname "$0")"
+
+read -r -a AVAILABLE_TARGETS < <(echo */fuzz.c | sed 's@/fuzz.c@@g')
+
+usage()
+{
+	cat << EOF
+Usage: $0 [OPTION]... FUZZ_TARGET
+
+Fuzz libdeflate with LLVM's libFuzzer.
+
+Options:
+   --asan          Enable AddressSanitizer
+   --max-len=LEN   Maximum length of generated inputs (default: $MAX_LEN)
+   --msan          Enable MemorySanitizer
+   --time=SECONDS  Stop after the given time has passed
+   --ubsan         Enable UndefinedBehaviorSanitizer
+
+Available fuzz targets: ${AVAILABLE_TARGETS[*]}
+EOF
+}
+
+die()
+{
+	echo "$*" 1>&2
+	exit 1
+}
+
+run_cmd()
+{
+	echo "$*"
+	"$@"
+}
+
+EXTRA_SANITIZERS=
+EXTRA_FUZZER_ARGS=()
+MAX_LEN=65536
+
+longopts_array=(
+asan
+help
+max-len:
+msan
+time:
+ubsan
+)
+longopts=$(echo "${longopts_array[@]}" | tr ' ' ',')
+
+if ! options=$(getopt -o "" -l "$longopts" -- "$@"); then
+	usage 1>&2
+	exit 1
+fi
+eval set -- "$options"
+while true; do
+	case "$1" in
+	--asan)
+		EXTRA_SANITIZERS+=",address"
+		;;
+	--help)
+		usage
+		exit 0
+		;;
+	--max-len)
+		MAX_LEN=$2
+		shift
+		;;
+	--msan)
+		EXTRA_SANITIZERS+=",memory"
+		;;
+	--time)
+		EXTRA_FUZZER_ARGS+=("-max_total_time=$2")
+		shift
+		;;
+	--ubsan)
+		EXTRA_SANITIZERS+=",undefined"
+		;;
+	--)
+		shift
+		break
+		;;
+	*)
+		echo 1>&2 "Invalid option '$1'"
+		usage 1>&2
+		exit 1
+	esac
+	shift
+done
+EXTRA_FUZZER_ARGS+=("-max_len=$MAX_LEN")
+
+if (( $# != 1 )); then
+	echo 1>&2 "No fuzz target specified!"
+	usage 1>&2
+	exit 1
+fi
+TARGET=$1
+if [ ! -e "$TARGET/fuzz.c" ]; then
+	echo 1>&2 "'$TARGET' is not a valid fuzz target!"
+	usage 1>&2
+	exit 1
+fi
+run_cmd clang -g -O1 -fsanitize=fuzzer$EXTRA_SANITIZERS \
+	-Wall -Werror -DLIBDEFLATE_ENABLE_ASSERTIONS=1 -I ../../ \
+	../../lib/*{,/*}.c "$TARGET/fuzz.c" -o "$TARGET/fuzz"
+run_cmd "$TARGET/fuzz" "${EXTRA_FUZZER_ARGS[@]}" "$TARGET/corpus"

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/gzip_decompress/fuzz.c

@@ -0,0 +1,19 @@
+#include <libdeflate.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/* Fuzz gzip decompression. */
+int LLVMFuzzerTestOneInput(const uint8_t *in, size_t insize)
+{
+	size_t outsize_avail = 3 * insize;
+	uint8_t *out;
+	struct libdeflate_decompressor *d;
+
+	out = malloc(outsize_avail);
+
+	d = libdeflate_alloc_decompressor();
+	libdeflate_gzip_decompress(d, in, insize, out, outsize_avail, NULL);
+	libdeflate_free_decompressor(d);
+	free(out);
+	return 0;
+}

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/zlib_decompress/corpus/0

@@ -0,0 +1,3 @@
+x�u�1
+�@Eg�Bl5
+��V���6j��X{�i=���l=����l�����?t���D

data/ext/deflate_ruby/libdeflate/scripts/libFuzzer/zlib_decompress/fuzz.c

@@ -0,0 +1,19 @@
+#include <libdeflate.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/* Fuzz zlib decompression. */
+int LLVMFuzzerTestOneInput(const uint8_t *in, size_t insize)
+{
+	size_t outsize_avail = 3 * insize;
+	uint8_t *out;
+	struct libdeflate_decompressor *d;
+
+	out = malloc(outsize_avail);
+
+	d = libdeflate_alloc_decompressor();
+	libdeflate_zlib_decompress(d, in, insize, out, outsize_avail, NULL);
+	libdeflate_free_decompressor(d);
+	free(out);
+	return 0;
+}