Add decoder fuzzing

fuzz/Cargo.toml

@@ -4,10 +4,14 @@ name = "lzma-fuzz"
 version = "0.0.1"
 authors = ["Automatically generated"]
 publish = false
+edition = "2018"
 
 [package.metadata]
 cargo-fuzz = true
 
+[dependencies]
+xz2 = "0.1.6"
+
 [dependencies.lzma-rs]
 path = ".."
 [dependencies.libfuzzer-sys]
@@ -28,3 +32,27 @@ path = "fuzz_targets/roundtrip_lzma2.rs"
 [[bin]]
 name = "roundtrip_xz"
 path = "fuzz_targets/roundtrip_xz.rs"
+
+[[bin]]
+name = "decompress_lzma"
+path = "fuzz_targets/decompress_lzma.rs"
+
+[[bin]]
+name = "decompress_lzma2"
+path = "fuzz_targets/decompress_lzma2.rs"
+
+[[bin]]
+name = "decompress_xz"
+path = "fuzz_targets/decompress_xz.rs"
+
+[[bin]]
+name = "compare_xz"
+path = "fuzz_targets/compare_xz.rs"
+
+[[bin]]
+name = "interop_xz_decode"
+path = "fuzz_targets/interop_xz_decode.rs"
+
+[[bin]]
+name = "interop_xz_encode"
+path = "fuzz_targets/interop_xz_encode.rs"

fuzz/README.md

@@ -0,0 +1,18 @@
+This directory contains fuzzing targets to verify implementation correctness: 
+
+- `roundtrip_*` targets check that we can successfully decode what we've encoded.
+- `decompress_*` targets check that we don't panic or abort on decoding a crafted file.
+- `compare_*` targets check that we produce identical output to liblzma on decompression.
+
+The command to run fuzzer is:
+
+`cargo +nightly fuzz run --release -s none <fuzzing_target>`
+
+For example,
+
+`cargo +nightly fuzz run --release -s none compare_xz`
+
+We use `-s none` because this crate does not contain unsafe code, so we don't
+need sanitizers to detect memory or concurrency errors for us.
+
+For more info see `cargo +nightly fuzz help`

fuzz/fuzz_targets/compare_xz.rs

@@ -0,0 +1,36 @@
+#![no_main]
+#[macro_use]
+extern crate libfuzzer_sys;
+
+use lzma_rs::error::Result;
+use std::io::Read;
+use xz2::stream;
+
+fn decode_xz_lzmars(compressed: &[u8]) -> Result<Vec<u8>> {
+    let mut bf = std::io::Cursor::new(compressed);
+    let mut decomp: Vec<u8> = Vec::new();
+    lzma_rs::xz_decompress(&mut bf, &mut decomp)?;
+    Ok(decomp)
+}
+
+fn decode_xz_xz2(compressed: &[u8]) -> Result<Vec<u8>> {
+    let bf = std::io::Cursor::new(compressed);
+    let mut decomp: Vec<u8> = Vec::new();
+    // create new XZ decompression stream with 8Gb memory limit and checksum verification disabled
+    let xz_stream =
+        stream::Stream::new_stream_decoder(8 * 1024 * 1024 * 1024, stream::IGNORE_CHECK)
+            .expect("Failed to create stream");
+    xz2::bufread::XzDecoder::new_stream(bf, xz_stream).read_to_end(&mut decomp)?;
+    Ok(decomp)
+}
+
+fuzz_target!(|data: &[u8]| {
+    let result_lzmars = decode_xz_lzmars(data);
+    let result_xz2 = decode_xz_xz2(data);
+    match (result_lzmars, result_xz2) {
+        (Err(_), Err(_)) => (), // both failed, so behavior matches
+        (Ok(_), Err(_)) => panic!("lzma-rs succeeded but xz2 failed"),
+        (Err(_), Ok(_)) => panic!("xz2 succeeded but lzma-rs failed"),
+        (Ok(a), Ok(b)) => assert!(a == b),
+    }
+});

fuzz/fuzz_targets/decompress_lzma.rs

@@ -0,0 +1,17 @@
+#![no_main]
+#[macro_use]
+extern crate libfuzzer_sys;
+
+use lzma_rs::error::Result;
+
+fn decode_lzma(compressed: &[u8]) -> Result<Vec<u8>> {
+    let mut bf = std::io::Cursor::new(compressed);
+
+    let mut decomp: Vec<u8> = Vec::new();
+    lzma_rs::lzma_decompress(&mut bf, &mut decomp)?;
+    Ok(decomp)
+}
+
+fuzz_target!(|data: &[u8]| {
+    let _decomp = decode_lzma(data);
+});

fuzz/fuzz_targets/decompress_lzma2.rs

@@ -0,0 +1,17 @@
+#![no_main]
+#[macro_use]
+extern crate libfuzzer_sys;
+
+use lzma_rs::error::Result;
+
+fn decode_lzma2(compressed: &[u8]) -> Result<Vec<u8>> {
+    let mut bf = std::io::Cursor::new(compressed);
+
+    let mut decomp: Vec<u8> = Vec::new();
+    lzma_rs::lzma2_decompress(&mut bf, &mut decomp)?;
+    Ok(decomp)
+}
+
+fuzz_target!(|data: &[u8]| {
+    let _decomp = decode_lzma2(data);
+});

fuzz/fuzz_targets/decompress_xz.rs

@@ -0,0 +1,17 @@
+#![no_main]
+#[macro_use]
+extern crate libfuzzer_sys;
+
+use lzma_rs::error::Result;
+
+fn decode_xz(compressed: &[u8]) -> Result<Vec<u8>> {
+    let mut bf = std::io::Cursor::new(compressed);
+
+    let mut decomp: Vec<u8> = Vec::new();
+    lzma_rs::xz_decompress(&mut bf, &mut decomp)?;
+    Ok(decomp)
+}
+
+fuzz_target!(|data: &[u8]| {
+    let _decomp = decode_xz(data);
+});

fuzz/fuzz_targets/interop_xz_decode.rs

@@ -0,0 +1,30 @@
+#![no_main]
+#[macro_use]
+extern crate libfuzzer_sys;
+
+use lzma_rs::error::Result;
+use std::io::Read;
+
+fn decode_xz_lzmars(compressed: &[u8]) -> Result<Vec<u8>> {
+    let mut bf = std::io::Cursor::new(compressed);
+    let mut decomp: Vec<u8> = Vec::new();
+    lzma_rs::xz_decompress(&mut bf, &mut decomp)?;
+    Ok(decomp)
+}
+
+fn encode_xz_xz2(data: &[u8]) -> Result<Vec<u8>> {
+    let bf = std::io::Cursor::new(data);
+    let mut compressed: Vec<u8> = Vec::new();
+    xz2::bufread::XzEncoder::new(bf, 6).read_to_end(&mut compressed)?;
+    Ok(compressed)
+}
+
+fuzz_target!(|data: &[u8]| {
+    let compressed = encode_xz_xz2(data).expect("liblzma failed to compress data");
+    let decoded =
+        decode_xz_lzmars(&compressed).expect("We've failed to decompress what liblzma compressed");
+    assert!(
+        data == decoded.as_slice(),
+        "Decompressed data is different from the original"
+    );
+});

fuzz/fuzz_targets/interop_xz_encode.rs

@@ -0,0 +1,34 @@
+#![no_main]
+#[macro_use]
+extern crate libfuzzer_sys;
+
+use lzma_rs::error::Result;
+use std::io::Read;
+use xz2::stream;
+
+fn encode_xz_lzmars(x: &[u8]) -> Result<Vec<u8>> {
+    let mut compressed: Vec<u8> = Vec::new();
+    lzma_rs::xz_compress(&mut std::io::BufReader::new(x), &mut compressed)?;
+    Ok(compressed)
+}
+
+fn decode_xz_xz2(compressed: &[u8]) -> Result<Vec<u8>> {
+    let bf = std::io::Cursor::new(compressed);
+    let mut decomp: Vec<u8> = Vec::new();
+    // create new XZ decompression stream with 8Gb memory limit and checksum verification disabled
+    let xz_stream =
+        stream::Stream::new_stream_decoder(8 * 1024 * 1024 * 1024, stream::IGNORE_CHECK)
+            .expect("Failed to create stream");
+    xz2::bufread::XzDecoder::new_stream(bf, xz_stream).read_to_end(&mut decomp)?;
+    Ok(decomp)
+}
+
+fuzz_target!(|data: &[u8]| {
+    let compressed = encode_xz_lzmars(data).expect("Compression failed");
+    let decoded =
+        decode_xz_xz2(&compressed).expect("liblzma failed to decompress what we've compressed");
+    assert!(
+        data == decoded.as_slice(),
+        "Decompressed data is different from the original"
+    );
+});

fuzz/fuzz_targets/roundtrip_lzma.rs

@@ -1,7 +1,6 @@
 #![no_main]
 #[macro_use]
 extern crate libfuzzer_sys;
-extern crate lzma_rs;
 
 use lzma_rs::error::Result;
 

fuzz/fuzz_targets/roundtrip_lzma2.rs

@@ -1,7 +1,6 @@
 #![no_main]
 #[macro_use]
 extern crate libfuzzer_sys;
-extern crate lzma_rs;
 
 use lzma_rs::error::Result;
 

fuzz/fuzz_targets/roundtrip_xz.rs

@@ -1,7 +1,6 @@
 #![no_main]
 #[macro_use]
 extern crate libfuzzer_sys;
-extern crate lzma_rs;
 
 use lzma_rs::error::Result;