Upload Kmake

deps/zlib/contrib/tests/fuzzers/BUILD.gn

@@ -0,0 +1,45 @@
+# Copyright 2017 The Chromium Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//testing/libfuzzer/fuzzer_test.gni")
+
+# root BUILD depends on this target. Needed for package discovery
+group("fuzzers") {
+}
+
+fuzzer_test("zlib_uncompress_fuzzer") {
+  sources = [ "uncompress_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+}
+
+fuzzer_test("zlib_inflate_fuzzer") {
+  sources = [ "inflate_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+}
+
+fuzzer_test("zlib_inflate_with_header_fuzzer") {
+  sources = [ "inflate_with_header_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+}
+
+fuzzer_test("zlib_streaming_inflate_fuzzer") {
+  sources = [ "streaming_inflate_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+  libfuzzer_options = [ "max_len=256000" ]
+}
+
+fuzzer_test("zlib_deflate_set_dictionary_fuzzer") {
+  sources = [ "deflate_set_dictionary_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+}
+
+fuzzer_test("zlib_compress_fuzzer") {
+  sources = [ "compress_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+}
+
+fuzzer_test("zlib_deflate_fuzzer") {
+  sources = [ "deflate_fuzzer.cc" ]
+  deps = [ "../../../:zlib" ]
+}

deps/zlib/contrib/tests/fuzzers/OWNERS

@@ -0,0 +1,2 @@
+cblume@chromium.org
+hans@chromium.org

deps/zlib/contrib/tests/fuzzers/compress_fuzzer.cc

@@ -0,0 +1,46 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include <vector>
+
+#include "zlib.h"
+
+// Fuzzer builds often have NDEBUG set, so roll our own assert macro.
+#define ASSERT(cond)                                                           \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      fprintf(stderr, "%s:%d Assert failed: %s\n", __FILE__, __LINE__, #cond); \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  FuzzedDataProvider fdp(data, size);
+  const int level = fdp.PickValueInArray({-1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9});
+  const std::vector<uint8_t> src = fdp.ConsumeRemainingBytes<uint8_t>();
+
+  const unsigned long compress_bound = compressBound(src.size());
+  std::vector<uint8_t> compressed;
+  compressed.resize(compress_bound);
+
+  unsigned long compressed_size = compress_bound;
+  int ret = compress2(compressed.data(), &compressed_size, src.data(),
+                      src.size(), level);
+  ASSERT(ret == Z_OK);
+  ASSERT(compressed_size <= compress_bound);
+  compressed.resize(compressed_size);
+
+  std::vector<uint8_t> uncompressed;
+  uncompressed.resize(src.size());
+  unsigned long uncompressed_size = uncompressed.size();
+  ret = uncompress(uncompressed.data(), &uncompressed_size, compressed.data(),
+                   compressed.size());
+  ASSERT(ret == Z_OK);
+  ASSERT(uncompressed_size == src.size());
+  ASSERT(uncompressed == src);
+
+  return 0;
+}

deps/zlib/contrib/tests/fuzzers/deflate_fuzzer.cc

@@ -0,0 +1,134 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <vector>
+
+#include "zlib.h"
+
+// Fuzzer builds often have NDEBUG set, so roll our own assert macro.
+#define ASSERT(cond)                                                           \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      fprintf(stderr, "%s:%d Assert failed: %s\n", __FILE__, __LINE__, #cond); \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  FuzzedDataProvider fdp(data, size);
+  int level = fdp.PickValueInArray({-1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9});
+  int windowBits = fdp.PickValueInArray({9, 10, 11, 12, 13, 14, 15});
+  int memLevel = fdp.PickValueInArray({1, 2, 3, 4, 5, 6, 7, 8, 9});
+  int strategy = fdp.PickValueInArray(
+      {Z_DEFAULT_STRATEGY, Z_FILTERED, Z_HUFFMAN_ONLY, Z_RLE, Z_FIXED});
+
+   if (fdp.ConsumeBool()) {
+    // Gzip wrapper.
+    windowBits += 16;
+  } else if (fdp.ConsumeBool()) {
+    // Raw deflate.
+    windowBits *= -1;
+  } else {
+    // Default: zlib wrapper.
+  }
+
+  std::vector<uint8_t> src;
+  std::vector<uint8_t> compressed;
+  static const int kMinChunk = 1;
+  static const int kMaxChunk = 512 * 1024;
+
+  z_stream stream;
+  stream.zalloc = Z_NULL;
+  stream.zfree = Z_NULL;
+  int ret =
+      deflateInit2(&stream, level, Z_DEFLATED, windowBits, memLevel, strategy);
+  ASSERT(ret == Z_OK);
+
+  // Stream with random-sized input and output buffers.
+  while (fdp.ConsumeBool()) {
+    if (fdp.ConsumeBool()) {
+      // Check that copying the stream's state works. Gating this behind
+      // ConsumeBool() allows to interleave deflateCopy() with deflate() calls
+      // to better stress the code.
+      z_stream stream2;
+      ASSERT(deflateCopy(&stream2, &stream) == Z_OK);
+      ret = deflateEnd(&stream);
+      ASSERT(ret == Z_OK || Z_DATA_ERROR);
+      memset(&stream, 0xff, sizeof(stream));
+
+      ASSERT(deflateCopy(&stream, &stream2) == Z_OK);
+      ret = deflateEnd(&stream2);
+      ASSERT(ret == Z_OK || Z_DATA_ERROR);
+    }
+
+    std::vector<uint8_t> src_chunk = fdp.ConsumeBytes<uint8_t>(
+        fdp.ConsumeIntegralInRange(kMinChunk, kMaxChunk));
+    std::vector<uint8_t> out_chunk(
+        fdp.ConsumeIntegralInRange(kMinChunk, kMaxChunk));
+    stream.next_in = src_chunk.data();
+    stream.avail_in = src_chunk.size();
+    stream.next_out = out_chunk.data();
+    stream.avail_out = out_chunk.size();
+    ret = deflate(&stream, Z_NO_FLUSH);
+    ASSERT(ret == Z_OK || ret == Z_BUF_ERROR);
+
+    src.insert(src.end(), src_chunk.begin(), src_chunk.end() - stream.avail_in);
+    compressed.insert(compressed.end(), out_chunk.begin(),
+                      out_chunk.end() - stream.avail_out);
+  }
+  // Finish up.
+  while (true) {
+    std::vector<uint8_t> out_chunk(
+        fdp.ConsumeIntegralInRange(kMinChunk, kMaxChunk));
+    stream.next_in = Z_NULL;
+    stream.avail_in = 0;
+    stream.next_out = out_chunk.data();
+    stream.avail_out = out_chunk.size();
+    ret = deflate(&stream, Z_FINISH);
+    compressed.insert(compressed.end(), out_chunk.begin(),
+                      out_chunk.end() - stream.avail_out);
+    if (ret == Z_STREAM_END) {
+      break;
+    }
+    ASSERT(ret == Z_OK || Z_BUF_ERROR);
+  }
+  deflateEnd(&stream);
+
+  // Check deflateBound().
+  // Use a newly initialized stream since computing the bound on a "used" stream
+  // may not yield a correct result (https://github.com/madler/zlib/issues/944).
+  z_stream bound_stream;
+  bound_stream.zalloc = Z_NULL;
+  bound_stream.zfree = Z_NULL;
+  ret = deflateInit2(&bound_stream, level, Z_DEFLATED, windowBits, memLevel,
+                     strategy);
+  ASSERT(ret == Z_OK);
+  size_t deflate_bound = deflateBound(&bound_stream, src.size());
+  ASSERT(compressed.size() <= deflate_bound);
+  deflateEnd(&bound_stream);
+
+  // Verify that the data decompresses correctly.
+  ret = inflateInit2(&stream, windowBits);
+  ASSERT(ret == Z_OK);
+  // Make room for at least one byte so it's never empty.
+  std::vector<uint8_t> decompressed(src.size() + 1);
+  stream.next_in = compressed.data();
+  stream.avail_in = compressed.size();
+  stream.next_out = decompressed.data();
+  stream.avail_out = decompressed.size();
+  ret = inflate(&stream, Z_FINISH);
+  ASSERT(ret == Z_STREAM_END);
+  decompressed.resize(decompressed.size() - stream.avail_out);
+  inflateEnd(&stream);
+
+  ASSERT(decompressed == src);
+
+  return 0;
+}

deps/zlib/contrib/tests/fuzzers/deflate_set_dictionary_fuzzer.cc

@@ -0,0 +1,43 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <cassert>
+#include <vector>
+
+#include "zlib.h"
+
+static Bytef buffer[256 * 1024] = {0};
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // We need to strip the 'const' for zlib.
+  std::vector<unsigned char> input_buffer{data, data + size};
+
+  uLongf buffer_length = static_cast<uLongf>(sizeof(buffer));
+
+  z_stream stream;
+  stream.next_in = input_buffer.data();
+  stream.avail_in = size;
+  stream.total_in = size;
+  stream.next_out = buffer;
+  stream.avail_out = buffer_length;
+  stream.total_out = buffer_length;
+  stream.zalloc = Z_NULL;
+  stream.zfree = Z_NULL;
+
+  if (Z_OK != deflateInit(&stream, Z_DEFAULT_COMPRESSION)) {
+    deflateEnd(&stream);
+    assert(false);
+  }
+
+  auto deflate_set_dictionary_result =
+      deflateSetDictionary(&stream, data, size);
+  deflateEnd(&stream);
+  if (Z_OK != deflate_set_dictionary_result)
+    assert(false);
+
+  return 0;
+}

deps/zlib/contrib/tests/fuzzers/inflate_fuzzer.cc

@@ -0,0 +1,41 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <cassert>
+#include <vector>
+
+#include "zlib.h"
+
+static Bytef buffer[256 * 1024] = {0};
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // We need to strip the 'const' for zlib
+  std::vector<unsigned char> input_buffer{data, data+size};
+
+  uLongf buffer_length = static_cast<uLongf>(sizeof(buffer));
+
+  z_stream stream;
+  stream.next_in = input_buffer.data();
+  stream.avail_in = size;
+  stream.total_in = size;
+  stream.next_out = buffer;
+  stream.avail_out = buffer_length;
+  stream.total_out = buffer_length;
+  stream.zalloc = Z_NULL;
+  stream.zfree = Z_NULL;
+
+  if (Z_OK != inflateInit(&stream)) {
+    inflateEnd(&stream);
+    assert(false);
+  }
+
+  inflate(&stream, Z_NO_FLUSH);
+  inflateEnd(&stream);
+
+  return 0;
+}

deps/zlib/contrib/tests/fuzzers/inflate_with_header_fuzzer.cc

@@ -0,0 +1,95 @@
+// Copyright 2022 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <algorithm>
+#include <memory>
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include "zlib.h"
+
+// Fuzzer builds often have NDEBUG set, so roll our own assert macro.
+#define ASSERT(cond)                                                           \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      fprintf(stderr, "%s:%d Assert failed: %s\n", __FILE__, __LINE__, #cond); \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+static void chunked_inflate(gz_header* header,
+                            uint8_t* data,
+                            size_t size,
+                            size_t in_chunk_size,
+                            size_t out_chunk_size) {
+  z_stream stream;
+  stream.next_in = data;
+  stream.avail_in = 0;
+  stream.zalloc = Z_NULL;
+  stream.zfree = Z_NULL;
+
+  static const int kDefaultWindowBits = MAX_WBITS;
+  static const int kGzipOrZlibHeader = 32;
+  ASSERT(inflateInit2(&stream, kDefaultWindowBits + kGzipOrZlibHeader) == Z_OK);
+  ASSERT(inflateGetHeader(&stream, header) == Z_OK);
+
+  auto out_buffer = std::make_unique<uint8_t[]>(out_chunk_size);
+  while (true) {
+    stream.next_in = &data[stream.total_in];
+    stream.avail_in =
+        std::min(in_chunk_size, size - static_cast<size_t>(stream.total_in));
+    stream.next_out = out_buffer.get();
+    stream.avail_out = out_chunk_size;
+
+    if (inflate(&stream, stream.avail_in == 0 ? Z_SYNC_FLUSH : Z_NO_FLUSH) !=
+        Z_OK) {
+      break;
+    }
+  }
+
+  inflateEnd(&stream);
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size > 250 * 1024) {
+    // Cap the input size so the fuzzer doesn't time out. For example,
+    // crbug.com/1362206 saw timeouts with 450 KB input, so use a limit that's
+    // well below that but still large enough to hit most code.
+    return 0;
+  }
+
+  FuzzedDataProvider fdp(data, size);
+
+  // Fuzz zlib's inflate() with inflateGetHeader() enabled, various sizes for
+  // the gz_header field sizes, and various-sized chunks for input/output. This
+  // would have found CVE-2022-37434 which was a heap buffer read overflow when
+  // filling in gz_header's extra field.
+
+  gz_header header;
+  header.extra_max = fdp.ConsumeIntegralInRange(0, 100000);
+  header.name_max = fdp.ConsumeIntegralInRange(0, 100000);
+  header.comm_max = fdp.ConsumeIntegralInRange(0, 100000);
+
+  auto extra_buf = std::make_unique<uint8_t[]>(header.extra_max);
+  auto name_buf = std::make_unique<uint8_t[]>(header.name_max);
+  auto comment_buf = std::make_unique<uint8_t[]>(header.comm_max);
+
+  header.extra = extra_buf.get();
+  header.name = name_buf.get();
+  header.comment = comment_buf.get();
+
+  size_t in_chunk_size = fdp.ConsumeIntegralInRange(1, 4097);
+  size_t out_chunk_size = fdp.ConsumeIntegralInRange(1, 4097);
+  std::vector<uint8_t> remaining_data = fdp.ConsumeRemainingBytes<uint8_t>();
+
+  chunked_inflate(&header, remaining_data.data(), remaining_data.size(),
+                  in_chunk_size, out_chunk_size);
+
+  return 0;
+}

deps/zlib/contrib/tests/fuzzers/streaming_inflate_fuzzer.cc

@@ -0,0 +1,74 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "zlib.h"
+
+// Fuzzer builds often have NDEBUG set, so roll our own assert macro.
+#define ASSERT(cond)                                                           \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      fprintf(stderr, "%s:%d Assert failed: %s\n", __FILE__, __LINE__, #cond); \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Deflate data.
+  z_stream comp_strm;
+  comp_strm.zalloc = Z_NULL;
+  comp_strm.zfree = Z_NULL;
+  comp_strm.opaque = Z_NULL;
+  int ret = deflateInit(&comp_strm, Z_DEFAULT_COMPRESSION);
+  ASSERT(ret == Z_OK);
+
+  size_t comp_buf_cap = deflateBound(&comp_strm, size);
+  uint8_t* comp_buf = (uint8_t*)malloc(comp_buf_cap);
+  ASSERT(comp_buf != nullptr);
+  comp_strm.next_out = comp_buf;
+  comp_strm.avail_out = comp_buf_cap;
+  comp_strm.next_in = (unsigned char*)data;
+  comp_strm.avail_in = size;
+  ret = deflate(&comp_strm, Z_FINISH);
+  ASSERT(ret == Z_STREAM_END);
+  size_t comp_sz = comp_buf_cap - comp_strm.avail_out;
+
+  // Inflate comp_buf one chunk at a time.
+  z_stream decomp_strm;
+  decomp_strm.zalloc = Z_NULL;
+  decomp_strm.zfree = Z_NULL;
+  decomp_strm.opaque = Z_NULL;
+  ret = inflateInit(&decomp_strm);
+  ASSERT(ret == Z_OK);
+  decomp_strm.next_in = comp_buf;
+  decomp_strm.avail_in = comp_sz;
+
+  while (decomp_strm.avail_in > 0) {
+    uint8_t decomp_buf[1024];
+    decomp_strm.next_out = decomp_buf;
+    decomp_strm.avail_out = sizeof(decomp_buf);
+    ret = inflate(&decomp_strm, Z_FINISH);
+    ASSERT(ret == Z_OK || ret == Z_STREAM_END || ret == Z_BUF_ERROR);
+
+    // Verify the output bytes.
+    size_t num_out = sizeof(decomp_buf) - decomp_strm.avail_out;
+    for (size_t i = 0; i < num_out; i++) {
+      ASSERT(decomp_buf[i] == data[decomp_strm.total_out - num_out + i]);
+    }
+  }
+
+  ret = deflateEnd(&comp_strm);
+  ASSERT(ret == Z_OK);
+  free(comp_buf);
+
+  inflateEnd(&decomp_strm);
+  ASSERT(ret == Z_OK);
+
+  return 0;
+}

deps/zlib/contrib/tests/fuzzers/uncompress_fuzzer.cc

@@ -0,0 +1,21 @@
+// Copyright 2015 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "zlib.h"
+
+static Bytef buffer[256 * 1024] = {0};
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  uLongf buffer_length = static_cast<uLongf>(sizeof(buffer));
+  if (Z_OK !=
+      uncompress(buffer, &buffer_length, data, static_cast<uLong>(size))) {
+    return 0;
+  }
+  return 0;
+}