Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Exercise ZSTD_findDecompressedSize() in the simple decompression fuzzer #3959

Merged
merged 2 commits into from Mar 12, 2024
Merged

Exercise ZSTD_findDecompressedSize() in the simple decompression fuzzer #3959

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9e8da5f
Improve decompression fuzzer
embg Mar 8, 2024
6a84c64
Fix legacy frame header fuzzer crash, add unit test
embg Mar 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 9 additions & 0 deletions lib/decompress/zstd_decompress.c
View file
Open in desktop
Expand Up @@ -1093,6 +1093,15 @@ size_t ZSTD_decompressMultiFrame(ZSTD_DCtx* dctx,
decodedSize = ZSTD_decompressLegacy(dst, dstCapacity, src, frameSize, dict, dictSize);
if (ZSTD_isError(decodedSize)) return decodedSize;

{
unsigned long long const expectedSize = ZSTD_getFrameContentSize(src, srcSize);
RETURN_ERROR_IF(expectedSize == ZSTD_CONTENTSIZE_ERROR, corruption_detected, "Corrupted frame header!");
if (expectedSize != ZSTD_CONTENTSIZE_UNKNOWN) {
RETURN_ERROR_IF(expectedSize != decodedSize, corruption_detected,
"Frame header size does not match decoded size!");
}
}

assert(decodedSize <= dstCapacity);
dst = (BYTE*)dst + decodedSize;
dstCapacity -= decodedSize;
Expand Down
8 changes: 7 additions & 1 deletion tests/fuzz/simple_decompress.c
View file
Open in desktop
Expand Up @@ -37,7 +37,13 @@ int LLVMFuzzerTestOneInput(const uint8_t *src, size_t size)
size_t const bufSize = FUZZ_dataProducer_uint32Range(producer, 0, 10 * size);
void *rBuf = FUZZ_malloc(bufSize);

ZSTD_decompressDCtx(dctx, rBuf, bufSize, src, size);
size_t const dSize = ZSTD_decompressDCtx(dctx, rBuf, bufSize, src, size);
if (!ZSTD_isError(dSize)) {
/* If decompression was successful, the content size from the frame header(s) should be valid. */
size_t const expectedSize = ZSTD_findDecompressedSize(src, size);
FUZZ_ASSERT(expectedSize != ZSTD_CONTENTSIZE_ERROR);
FUZZ_ASSERT(expectedSize == ZSTD_CONTENTSIZE_UNKNOWN || expectedSize == dSize);
}
free(rBuf);

FUZZ_dataProducer_free(producer);
Expand Down
9 changes: 9 additions & 0 deletions tests/zstreamtest.c
View file
Open in desktop
Expand Up @@ -2408,6 +2408,15 @@ static int basicUnitTests(U32 seed, double compressibility, int bigTests)
}
DISPLAYLEVEL(3, "OK \n");

DISPLAYLEVEL(3, "test%3i : Decoder should reject invalid frame header on legacy frames: ", testNb++);
{
const unsigned char compressed[] = { 0x26,0xb5,0x2f,0xfd,0x50,0x91,0xfd,0xd8,0xb5 };
const size_t compressedSize = 9;
size_t const dSize = ZSTD_decompress(NULL, 0, compressed, compressedSize);
CHECK(!ZSTD_isError(dSize), "must reject when legacy frame header is invalid");
}
DISPLAYLEVEL(3, "OK \n");

_end:
FUZ_freeDictionary(dictionary);
ZSTD_freeCStream(zc);
Expand Down