From 567b4e098baad783870bf6514a984c4b021d5056 Mon Sep 17 00:00:00 2001 From: Yann Collet Date: Fri, 28 Jun 2019 20:23:12 -0700 Subject: moved noisy-src decoder test into cBuffer_exact so that it can also catch any potential read out-of-bound in the input buffer (none reported so far, just a precaution for the future). --- tests/fuzzer.c | 68 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/tests/fuzzer.c b/tests/fuzzer.c index db26b72..368b28b 100644 --- a/tests/fuzzer.c +++ b/tests/fuzzer.c @@ -563,36 +563,8 @@ static int FUZ_test(U32 seed, U32 nbCycles, const U32 startCycle, const double c FUZ_CHECKTEST(decodedBuffer[blockSize-10], "LZ4_decompress_safe overrun specified output buffer size"); } - free(cBuffer_exact); - } - - /* Test decoding with input size being one byte too short => must fail */ - FUZ_DISPLAYTEST(); - { int const r = LZ4_decompress_safe(compressedBuffer, decodedBuffer, compressedSize-1, blockSize); - FUZ_CHECKTEST(r>=0, "LZ4_decompress_safe should have failed, due to input size being one byte too short (blockSize=%i, result=%i, compressedSize=%i)", blockSize, r, compressedSize); - } - - /* Test decoding with input size being one byte too large => must fail */ - FUZ_DISPLAYTEST(); - decodedBuffer[blockSize] = 0; - { int const r = LZ4_decompress_safe(compressedBuffer, decodedBuffer, compressedSize+1, blockSize); - FUZ_CHECKTEST(r>=0, "LZ4_decompress_safe should have failed, due to input size being too large"); - } - FUZ_CHECKTEST(decodedBuffer[blockSize], "LZ4_decompress_safe overrun specified output buffer size"); - - /* Test partial decoding => must work */ - FUZ_DISPLAYTEST("test LZ4_decompress_safe_partial"); - { size_t const missingBytes = FUZ_rand(&randState) % (unsigned)blockSize; - int const targetSize = (int)((size_t)blockSize - missingBytes); - char const sentinel = decodedBuffer[targetSize] = block[targetSize] ^ 0x5A; - int const decResult = LZ4_decompress_safe_partial(compressedBuffer, decodedBuffer, compressedSize, targetSize, blockSize); - FUZ_CHECKTEST(decResult<0, "LZ4_decompress_safe_partial failed despite valid input data (error:%i)", decResult); - FUZ_CHECKTEST(decResult != targetSize, "LZ4_decompress_safe_partial did not regenerated required amount of data (%i < %i <= %i)", decResult, targetSize, blockSize); - FUZ_CHECKTEST(decodedBuffer[targetSize] != sentinel, "LZ4_decompress_safe_partial overwrite beyond requested size (though %i <= %i <= %i)", decResult, targetSize, blockSize); - } + /* noisy src decompression test */ - /* noisy src decompression test */ - { /* insert noise into src */ { U32 const maxNbBits = FUZ_highbit32((U32)compressedSize); size_t pos = 0; @@ -611,21 +583,49 @@ static int FUZ_test(U32 seed, U32 nbCycles, const U32 startCycle, const double c size_t const rNoiseLength = (FUZ_rand(&randState) & mask) + 1; size_t const noiseLength = MIN(rNoiseLength, (size_t)compressedSize-pos); size_t const noiseStart = FUZ_rand(&randState) % (COMPRESSIBLE_NOISE_LENGTH - noiseLength); - memcpy(compressedBuffer + pos, (const char*)CNBuffer + noiseStart, noiseLength); + memcpy(cBuffer_exact + pos, (const char*)CNBuffer + noiseStart, noiseLength); pos += noiseLength; } } } /* decompress noisy source */ - FUZ_DISPLAYTEST("decompress noisy source \n"); + FUZ_DISPLAYTEST("decompress noisy source "); { U32 const endMark = 0xA9B1C3D6; memcpy(decodedBuffer+blockSize, &endMark, sizeof(endMark)); - { int const decompressResult = LZ4_decompress_safe(compressedBuffer, decodedBuffer, compressedSize, blockSize); + { int const decompressResult = LZ4_decompress_safe(cBuffer_exact, decodedBuffer, compressedSize, blockSize); /* result *may* be an unlikely success, but even then, it must strictly respect dst buffer boundaries */ FUZ_CHECKTEST(decompressResult > blockSize, "LZ4_decompress_safe on noisy src : result is too large : %u > %u (dst buffer)", (unsigned)decompressResult, (unsigned)blockSize); } { U32 endCheck; memcpy(&endCheck, decodedBuffer+blockSize, sizeof(endCheck)); FUZ_CHECKTEST(endMark!=endCheck, "LZ4_decompress_safe on noisy src : dst buffer overflow"); - } } } /* noisy src decompression test */ + } } /* noisy src decompression test */ + + free(cBuffer_exact); + } + + /* Test decoding with input size being one byte too short => must fail */ + FUZ_DISPLAYTEST(); + { int const r = LZ4_decompress_safe(compressedBuffer, decodedBuffer, compressedSize-1, blockSize); + FUZ_CHECKTEST(r>=0, "LZ4_decompress_safe should have failed, due to input size being one byte too short (blockSize=%i, result=%i, compressedSize=%i)", blockSize, r, compressedSize); + } + + /* Test decoding with input size being one byte too large => must fail */ + FUZ_DISPLAYTEST(); + decodedBuffer[blockSize] = 0; + { int const r = LZ4_decompress_safe(compressedBuffer, decodedBuffer, compressedSize+1, blockSize); + FUZ_CHECKTEST(r>=0, "LZ4_decompress_safe should have failed, due to input size being too large"); + } + FUZ_CHECKTEST(decodedBuffer[blockSize], "LZ4_decompress_safe overrun specified output buffer size"); + + /* Test partial decoding => must work */ + FUZ_DISPLAYTEST("test LZ4_decompress_safe_partial"); + { size_t const missingBytes = FUZ_rand(&randState) % (unsigned)blockSize; + int const targetSize = (int)((size_t)blockSize - missingBytes); + char const sentinel = decodedBuffer[targetSize] = block[targetSize] ^ 0x5A; + int const decResult = LZ4_decompress_safe_partial(compressedBuffer, decodedBuffer, compressedSize, targetSize, blockSize); + FUZ_CHECKTEST(decResult<0, "LZ4_decompress_safe_partial failed despite valid input data (error:%i)", decResult); + FUZ_CHECKTEST(decResult != targetSize, "LZ4_decompress_safe_partial did not regenerated required amount of data (%i < %i <= %i)", decResult, targetSize, blockSize); + FUZ_CHECKTEST(decodedBuffer[targetSize] != sentinel, "LZ4_decompress_safe_partial overwrite beyond requested size (though %i <= %i <= %i)", decResult, targetSize, blockSize); + } /* Test Compression with limited output size */ @@ -713,7 +713,7 @@ static int FUZ_test(U32 seed, U32 nbCycles, const U32 startCycle, const double c blockContinueCompressedSize = LZ4_compress_fast_continue(&LZ4dictBody, block, compressedBuffer, blockSize, (int)compressedBufferSize, 1); FUZ_CHECKTEST(blockContinueCompressedSize==0, "LZ4_compress_fast_continue failed"); - FUZ_DISPLAYTEST("test LZ4_compress_fast_continue() with dictionary but with an output buffer too short by one byte"); + FUZ_DISPLAYTEST("LZ4_compress_fast_continue() with dictionary and output buffer too short by one byte"); LZ4_loadDict(&LZ4dictBody, dict, dictSize); ret = LZ4_compress_fast_continue(&LZ4dictBody, block, compressedBuffer, blockSize, blockContinueCompressedSize-1, 1); FUZ_CHECKTEST(ret>0, "LZ4_compress_fast_continue using ExtDict should fail : one missing byte for output buffer : %i written, %i buffer", ret, blockContinueCompressedSize); -- cgit v0.12