AuroraMiddleware/brotli
1
0
Fork 0
mirror of https://github.com/google/brotli.git synced 2024-11-21 19:20:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent fuzzer timeouts on compression-bomb samples (#522)

Browse Source 
* Prevent fuzzer timeouts on compression-bomb samples.

* Fix fuzzer lanucher
This commit is contained in:
Eugene Kliuchnikov 2017-03-10 16:01:49 +01:00 committed by GitHub
parent 52ce8670eb
commit 1ff78b877f
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fuzz/decode_fuzzer.cc
View File

@ -16,6 +16,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
const int kBufferSize = 1024;
uint8_t* buffer = new uint8_t[kBufferSize];
/* The biggest "magic number" in brotli is 16MiB - 16, so no need to check
the cases with much longer output. */
const size_t total_out_limit = (addend == 0) ? (1 << 26) : (1 << 24);
size_t total_out = 0;
BrotliDecoderState* state = BrotliDecoderCreateInstance(0, 0, 0);
if (addend == 0)
@ -31,10 +36,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
while (result == BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT) {
size_t avail_out = kBufferSize;
uint8_t* next_out = buffer;
size_t total_out;
result = BrotliDecoderDecompressStream(
state, &avail_in, &next_in, &avail_out, &next_out, &total_out);
if (total_out > total_out_limit)
break;
}
if (total_out > total_out_limit)
break;
if (result != BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT)
break;
}

2
fuzz/test_fuzzer.sh
View File

@ -17,7 +17,7 @@ ar rvs decode_fuzzer.a decode_fuzzer.o
c++ ../fuzz/run_decode_fuzzer.cc -o run_decode_fuzzer -lasan decode_fuzzer.a ./libbrotlidec.a ./libbrotlicommon.a
mkdir decode_corpora
unzip ../java/integration/fuzz_data.zip -d decode_corpora
unzip ../java/org/brotli/integration/fuzz_data.zip -d decode_corpora
for f in `ls decode_corpora`
do