History

add clang libFuzzer support

lieff committed 8 years ago

Commit f3b33b01 parent 0b82f032 files · +43 −22Browse files

Unified · Split

2 files
  1. minimp3_test.c +36 −22
  2. scripts/fuzz_libfuzzer.sh +7 −0
minimp3_test.c+36−22
@@ -48,14 +48,12 @@ static unsigned char *preload(FILE *file, int *data_size) · 47 unmodified lines
4848 return data;
4949 }
5050
51−static void decode_file(FILE *file_mp3, FILE *file_ref, FILE *file_out, const int wave_out)
51+static void decode_file(const unsigned char *buf_mp3, int mp3_size, const unsigned char *buf_ref, int ref_size, FILE *file_out, const int wave_out)
5252 {
5353 static mp3dec_t mp3d;
5454 mp3dec_frame_info_t info = { 0, };
55− int i, data_bytes, samples, total_samples = 0, maxdiff = 0, mp3_size, ref_size;
55+ int i, data_bytes, samples, total_samples = 0, maxdiff = 0;
5656 double MSE = 0.0, psnr;
57− unsigned char *buf_mp3 = preload(file_mp3, &mp3_size), *buf_ref = preload(file_ref, &ref_size);
58− unsigned char *alloc_buf_mp3 = buf_mp3, *alloc_buf_ref = buf_ref;
5957
6058 mp3dec_init(&mp3d);
6159 #ifndef MINIMP3_NO_WAV
@@ -87,7 +85,7 @@ static void decode_file(FILE *file_mp3, FILE *file_ref, FILE *file_out, const in · 25 unmodified lines
8785 buf_mp3 += info.frame_bytes;
8886 mp3_size -= info.frame_bytes;
8987 } while (info.frame_bytes);
90−
88+#ifndef LIBFUZZER
9189 MSE /= total_samples ? total_samples : 1;
9290 if (0 == MSE)
9391 psnr = 99.0;
@@ -99,6 +97,7 @@ static void decode_file(FILE *file_mp3, FILE *file_ref, FILE *file_out, const in · 5 unmodified lines
9997 printf("PSNR compliance failed\n");
10098 exit(1);
10199 }
100+#endif
102101 #ifndef MINIMP3_NO_WAV
103102 if (wave_out && file_out)
104103 {
@@ -107,17 +106,16 @@ static void decode_file(FILE *file_mp3, FILE *file_ref, FILE *file_out, const in · 2 unmodified lines
107106 fwrite(wav_header(info.hz, info.channels, 16, data_bytes), 1, 44, file_out);
108107 }
109108 #endif
110− if (alloc_buf_mp3)
111− free(alloc_buf_mp3);
112− if (alloc_buf_ref)
113− free(alloc_buf_ref);
114− fclose(file_mp3);
115− if (file_ref)
116− fclose(file_ref);
117− if (file_out)
118− fclose(file_out);
119109 }
120110
111+#ifdef LIBFUZZER
112+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
113+{
114+ decode_file(Data, Size, 0, 0, 0, 0);
115+ return 0;
116+}
117+#else
118+
121119 #ifdef __arm__
122120 int main2(int argc, char *argv[]);
123121 int main2(int argc, char *argv[])
@@ -125,31 +123,46 @@ int main2(int argc, char *argv[]) · 1 unmodified line
125123 int main(int argc, char *argv[])
126124 #endif
127125 {
128−#ifdef __AFL_HAVE_MANUAL_CONTROL
129− __AFL_INIT();
130− while (__AFL_LOOP(1000)) {
131−#endif
132− char *input_file_name = (argc > 1) ? argv[1] : NULL;
126+ int wave_out = 0, ref_size, mp3_size;
133127 char *ref_file_name = (argc > 2) ? argv[2] : NULL;
134128 char *output_file_name = (argc > 3) ? argv[3] : NULL;
135− int wave_out = 0;
136−#ifndef MINIMP3_NO_WAV
129+ FILE *file_out = NULL;
137130 if (output_file_name)
138131 {
132+ file_out = fopen(output_file_name, "wb");
133+#ifndef MINIMP3_NO_WAV
139134 char *ext = strrchr(output_file_name, '.');
140135 if (ext && !strcasecmp(ext + 1, "wav"))
141136 wave_out = 1;
137+#endif
142138 }
139+ FILE *file_ref = fopen(ref_file_name, "rb");
140+ unsigned char *buf_ref = preload(file_ref, &ref_size);
141+ if (file_ref)
142+ fclose(file_ref);
143+#ifdef __AFL_HAVE_MANUAL_CONTROL
144+ __AFL_INIT();
145+ while (__AFL_LOOP(1000)) {
143146 #endif
147+ char *input_file_name = (argc > 1) ? argv[1] : NULL;
144148 if (!input_file_name)
145149 {
146150 printf("error: no file names given\n");
147151 return 1;
148152 }
149− decode_file(fopen(input_file_name, "rb"), fopen(ref_file_name, "rb"), output_file_name ? fopen(output_file_name, "wb") : NULL, wave_out);
153+ FILE *file_mp3 = fopen(input_file_name, "rb");
154+ unsigned char *buf_mp3 = preload(file_mp3, &mp3_size);
155+ fclose(file_mp3);
156+ decode_file(buf_mp3, mp3_size, buf_ref, ref_size, file_out, wave_out);
157+ if (buf_mp3)
158+ free(buf_mp3);
150159 #ifdef __AFL_HAVE_MANUAL_CONTROL
151160 }
152161 #endif
162+ if (buf_ref)
163+ free(buf_ref);
164+ if (file_out)
165+ fclose(file_out);
153166 return 0;
154167 }
155168
@@ -250,3 +263,4 @@ int main() · 94 unmodified lines
250263 return 0;
251264 }
252265 #endif
266+#endif
scripts/fuzz_libfuzzer.sh+7−0
@@ -0,0 +1,7 @@
1+_FILENAME=${0##*/}
2+CUR_DIR=${0/${_FILENAME}}
3+CUR_DIR=$(cd $(dirname ${CUR_DIR}); pwd)/$(basename ${CUR_DIR})/
4+
5+pushd $CUR_DIR/..
6+
7+clang-5.0 -g -fsanitize=address,undefined -fsanitize-coverage=trace-pc-guard -DFUZZ -DLIBFUZZER -o minimp3_libfuzz minimp3_test.c -lFuzzer -lstdc++ -lm

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t