Added fuzzy testing

flif/src/components/metadata.rs

@@ -3,6 +3,9 @@ use error::*;
 use inflate::inflate_bytes;
 use numbers::FlifReadExt;
 
+// maximum size of the comressed metadata chunk to prevent DoS attack
+const MAX_METADATA_CHUNK: usize = 1<<20;
+
 #[derive(Copy, Clone, Debug)]
 pub enum ChunkType {
     Iccp,
@@ -59,9 +62,16 @@ impl Metadata {
         };
 
         let chunk_size = reader.read_varint()?;
+        if chunk_size > MAX_METADATA_CHUNK {
+            Err(Error::InvalidMetadata(format!(
+                "requested chunk size ({} bytes) is bigger than the limit ({} bytes)",
+                chunk_size, MAX_METADATA_CHUNK
+            )))?
+        }
         let mut deflated_chunk = vec![0; chunk_size];
         reader.read_exact(&mut deflated_chunk)?;
-        let inflated_chunk = inflate_bytes(&deflated_chunk).map_err(Error::InvalidMetadata)?;
+        let inflated_chunk = inflate_bytes(&deflated_chunk)
+            .map_err(Error::InvalidMetadata)?;
 
         Ok(MetadataType::Optional(Metadata {
             chunk_type,

flif/tests/fuzz.rs

@@ -0,0 +1,20 @@
+extern crate flif;
+
+use flif::Flif;
+use std::io::{Cursor, Read};
+
+/// Tests an issue found in [#15](https://github.com/dgriffen/flif.rs/issues/15)
+#[test]
+fn fuzz_artifacts() {
+    let paths = std::fs::read_dir("../fuzz/artifacts/fuzz_flif/").unwrap();
+
+    for path in paths {
+        let path = path.unwrap().path();
+        println!("Artifact: {}", path.display());
+        let mut data = Vec::new();
+        let mut file = std::fs::File::open(path).unwrap();
+        file.read_to_end(&mut data).unwrap();
+        // temporarily disabled
+        //let _ = Flif::decode(Cursor::new(&data)).map(|img| img.get_raw_pixels());
+    }
+}

fuzz/.gitignore

@@ -0,0 +1,4 @@
+
+target
+corpus
+//artifacts

fuzz/Cargo.toml

@@ -0,0 +1,22 @@
+
+[package]
+name = "flif-fuzz"
+version = "0.0.1"
+authors = ["Automatically generated"]
+publish = false
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies.flif]
+path = "../flif/"
+[dependencies.libfuzzer-sys]
+git = "https://github.com/rust-fuzz/libfuzzer-sys.git"
+
+# Prevent this from interfering with workspaces
+[workspace]
+members = ["."]
+
+[[bin]]
+name = "fuzz_flif"
+path = "fuzz_targets/fuzz_flif.rs"

fuzz/fuzz_targets/fuzz_flif.rs

@@ -0,0 +1,9 @@
+#![no_main]
+#[macro_use] extern crate libfuzzer_sys;
+extern crate flif;
+
+use std::io::Cursor;
+
+fuzz_target!(|data: &[u8]| {
+    let _ = flif::Flif::decode(Cursor::new(data)).map(|img| img.get_raw_pixels());
+});