1 /* fuzzer_tool_flac
2 * Copyright (C) 2023 Xiph.Org Foundation
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * - Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 *
11 * - Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * - Neither the name of the Xiph.org Foundation nor the names of its
16 * contributors may be used to endorse or promote products derived from
17 * this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR
23 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h> /* for memcpy */
35 #define FUZZ_TOOL_METAFLAC
36 #define fprintf(...)
37 #define printf(...)
38 #include "../src/metaflac/main.c"
39 #include "common.h"
40
41 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
42
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)43 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
44 {
45 size_t size_left = size;
46 size_t arglen;
47 char * argv[64];
48 char exename[] = "metaflac";
49 char filename[] = "/tmp/fuzzXXXXXX";
50 char filename_stdin[] = "/tmp/fuzzXXXXXX";
51 int numarg = 0, maxarg;
52 int file_to_fuzz;
53 int tmp_stdout, tmp_stdin;
54 fpos_t pos_stdout;
55 bool use_stdin = false;
56
57 share__opterr = 0;
58 share__optind = 0;
59
60
61 if(size < 2)
62 return 0;
63
64 maxarg = data[0] & 15;
65 use_stdin = data[0] & 16;
66 size_left--;
67
68 argv[0] = exename;
69 numarg++;
70
71 /* Check whether input is zero delimited */
72 while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) {
73 argv[numarg++] = (char *)data+(size-size_left);
74 size_left -= arglen + 1;
75 }
76
77 /* Create file to feed directly */
78 file_to_fuzz = mkstemp(filename);
79 if (file_to_fuzz < 0)
80 abort();
81 if(use_stdin) {
82 write(file_to_fuzz,data+(size-size_left),size_left/2);
83 size_left -= size_left/2;
84 }
85 else
86 write(file_to_fuzz,data+(size-size_left),size_left);
87 close(file_to_fuzz);
88
89 argv[numarg++] = filename;
90
91 /* Create file to feed to stdin */
92 if(use_stdin) {
93 file_to_fuzz = mkstemp(filename_stdin);
94 if (file_to_fuzz < 0)
95 abort();
96 write(file_to_fuzz,data+(size-size_left),size_left);
97 close(file_to_fuzz);
98 }
99
100 /* redirect stdout */
101 fflush(stdout);
102 fgetpos(stdout,&pos_stdout);
103 tmp_stdout = dup(fileno(stdout));
104 freopen("/dev/null","w",stdout);
105
106 /* redirect stdin */
107 tmp_stdin = dup(fileno(stdin));
108 if(use_stdin)
109 freopen(filename_stdin,"r",stdin);
110 else {
111 freopen("/dev/null","r",stdin);
112 argv[numarg++] = filename;
113 }
114
115 main_to_fuzz(numarg,argv);
116
117 /* restore stdout */
118 fflush(stdout);
119 dup2(tmp_stdout, fileno(stdout));
120 close(tmp_stdout);
121 clearerr(stdout);
122 fsetpos(stdout,&pos_stdout);
123
124 /* restore stdin */
125 dup2(tmp_stdin, fileno(stdin));
126 close(tmp_stdin);
127 clearerr(stdin);
128
129 unlink(filename);
130
131 if(use_stdin)
132 unlink(filename_stdin);
133
134 return 0;
135 }
136
137