Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

mpg123: limit fuzzer runtime (#2832) 

* mpg123: limit runtime of decode_fuzzer

To avoid spurious timeout reports, the test shall end after 10000 MPEG frames
or 1 MiB of data, which should both be reasonable numbers. The timeout
report motivating this had 500K with 140k bad frames. The limit of
10000 frames corresponds to a normal radio song as MP3 stream.

* mpg123: limit runtime of read_fuzzer

This applies the same logic as the decode fuzzer: stop decoding after
10000 MPEG frames or 1 MiB of input data. We could debate a bigger
limit on the data size, but we do want compact testcases, right?
This commit is contained in:
Thomas Orgis 2019-09-16 16:06:25 +02:00 committed by jonathanmetzman
parent 9e6a3ca660
commit 356f2b9476
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
projects/mpg123/decode_fuzzer.cc
View File

@ -36,7 +36,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
FuzzedDataProvider provider(data, size);
while ((decode_ret != MPG123_ERR)) {
if (decode_ret == MPG123_NEED_MORE) {
if (provider.remaining_bytes() == 0) {
if (provider.remaining_bytes() == 0
|| mpg123_tellframe(handle) > 10000
|| mpg123_tell_stream(handle) > 1<<20) {
break;
}
const size_t next_size = provider.ConsumeIntegralInRange<size_t>(

3
projects/mpg123/read_fuzzer.c
View File

@ -75,7 +75,8 @@ int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
do {
size_t decoded_size;
read_error = mpg123_read(handle, outmemory, outmemorysize, &decoded_size);
} while (read_error == MPG123_OK);
} while (read_error == MPG123_OK && mpg123_tellframe(handle) <= 10000
&& mpg123_tell_stream(handle) <= 1<<20);
}
mpg123_close(handle);