1 /* fuzzer_tool_flac
2 * Copyright (C) 2023 Xiph.Org Foundation
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * - Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 *
11 * - Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * - Neither the name of the Xiph.org Foundation nor the names of its
16 * contributors may be used to endorse or promote products derived from
17 * this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR
23 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 #include <stdlib.h>
33 #include <string.h> /* for memcpy */
34 #define FUZZ_TOOL_FLAC
35 #define fprintf(...)
36 #define printf(...)
37 #include "../src/flac/main.c"
38 #include "common.h"
39
40 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
41
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)42 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
43 {
44 size_t size_left = size;
45 size_t arglen;
46 char * argv[67];
47 char exename[] = "flac";
48 char filename[] = "/tmp/fuzzXXXXXX";
49 int numarg = 0, maxarg;
50 int file_to_fuzz;
51 int tmp_stdout, tmp_stdin;
52 fpos_t pos_stdout;
53 bool use_stdin = false;
54
55 /* reset global vars */
56 flac__utils_verbosity_ = 0;
57 share__opterr = 0;
58 share__optind = 0;
59
60 if(size < 2)
61 return 0;
62
63 maxarg = data[0] & 63;
64 use_stdin = data[0] & 64;
65 size_left--;
66
67 argv[0] = exename;
68 numarg++;
69
70 /* Check whether input is zero delimited */
71 while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) {
72 argv[numarg++] = (char *)data+(size-size_left);
73 size_left -= arglen + 1;
74 }
75
76 file_to_fuzz = mkstemp(filename);
77
78 if (file_to_fuzz < 0)
79 abort();
80 write(file_to_fuzz,data+(size-size_left),size_left);
81 close(file_to_fuzz);
82
83 /* redirect stdout */
84 fflush(stdout);
85 fgetpos(stdout,&pos_stdout);
86 tmp_stdout = dup(fileno(stdout));
87 freopen("/dev/null","w",stdout);
88
89 /* redirect stdin */
90 tmp_stdin = dup(fileno(stdin));
91
92 if(use_stdin)
93 freopen(filename,"r",stdin);
94 else {
95 freopen("/dev/null","r",stdin);
96 argv[numarg++] = filename;
97 }
98
99 main_to_fuzz(numarg,argv);
100
101 /* restore stdout */
102 fflush(stdout);
103 dup2(tmp_stdout, fileno(stdout));
104 close(tmp_stdout);
105 clearerr(stdout);
106 fsetpos(stdout,&pos_stdout);
107
108 /* restore stdin */
109 dup2(tmp_stdin, fileno(stdin));
110 close(tmp_stdin);
111 clearerr(stdin);
112
113 unlink(filename);
114
115 return 0;
116 }
117
118