programs/cmp_guess.c

@@ -35,6 +35,13 @@
 
 #define CMP_GUESS_MAX_CAL_STEPS 20274
 
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+/* Redefine (f)printf to do nothing */
+__extension__
+#define printf(...) do {} while (0)
+#define fprintf(...) do {} while (0)
+#endif
+
 
 /* how often the model is updated before it is rested */
 static int num_model_updates = CMP_GUESS_N_MODEL_UPDATE_DEF;

programs/cmp_io.c

@@ -292,9 +292,11 @@ int write_data_to_file(const void *buf, uint32_t buf_size, const char *output_pr
 	}
 
 	if (flags & CMP_IO_VERBOSE_EXTRA && !(flags & CMP_IO_BINARY)) {
+#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 		printf("\n");
 		fwrite(output_file_data, 1, output_file_size, stdout);
 		printf("\n");
+#endif
 	}
 
 	free(tmp_buf);
@@ -499,6 +501,12 @@ int case_insensitive_compare(const char *s1, const char *s2)
 {
 	size_t i;
 
+	if(s1 == NULL)
+		abort();
+
+	if(s2 == NULL)
+		abort();
+
 	for (i = 0;  ; ++i) {
 		unsigned int x1 = (unsigned char)s1[i];
 		unsigned int x2 = (unsigned char)s2[i];

programs/cmp_tool.c

@@ -153,6 +153,7 @@ static uint32_t model_counter;
 __extension__
 #define printf(...) do {} while (0)
 #define fprintf(...) do {} while (0)
+#define fflush(...) do {} while (0)
 
 int CMP_MAIN(int argc, char **argv);
 
@@ -649,7 +650,7 @@ static int guess_cmp_pars(struct rdcu_cfg *rcfg, struct cmp_par *chunk_par,
 
 	printf("Search for a good set of compression parameters (level: %d) ... ", guess_level);
 	fflush(stdout);
-	if (!case_insensitive_compare(guess_option, "rdcu")) {
+	if (guess_option && !case_insensitive_compare(guess_option, "rdcu")) {
 		if (add_rdcu_pars)
 			data_type = DATA_TYPE_IMAGETTE_ADAPTIVE;
 		else
@@ -658,7 +659,7 @@ static int guess_cmp_pars(struct rdcu_cfg *rcfg, struct cmp_par *chunk_par,
 			rcfg->cmp_mode = CMP_GUESS_DEF_MODE_MODEL;
 		else
 			rcfg->cmp_mode = CMP_GUESS_DEF_MODE_DIFF;
-	} else if (!case_insensitive_compare(guess_option, "chunk")) {
+	} else if (guess_option && !case_insensitive_compare(guess_option, "chunk")) {
 		data_type = DATA_TYPE_CHUNK;
 	} else {
 		data_type = DATA_TYPE_IMAGETTE;

test/fuzz/fuzz_cmp_tool.c

@@ -59,7 +59,8 @@ static int gen_argv(FUZZ_dataProducer_t *producer, char **argv, const char *data
 
 	/* Add optional arguments no the end so they have higher priority */
 	end = argc-1;
-	add_argument_with_file(argv, end--, "-o", "/tmp/fuzz-output-cmp_tool");
+	/* TODO: How to clean up written stuff by the cmp_tool? */
+	add_argument_with_file(argv, end--, "-o", FUZZ_TMP_DIR "/fuzz-output-cmp_tool");
 	if (FUZZ_dataProducer_uint32Range(producer, 0, 1))
 		add_argument_with_file(argv, end--, "-d", data_file);
 	if (FUZZ_dataProducer_uint32Range(producer, 0, 1))

test/fuzz/fuzz_data_producer.h

@@ -29,13 +29,21 @@
 #ifndef FUZZ_DATA_PRODUCER_H
 #define FUZZ_DATA_PRODUCER_H
 
+
 #include <stddef.h>
 #include <stdint.h>
-#include <stdio.h>
 #include <stdlib.h>
 
 #include <cmp_chunk.h>
 
+
+#ifdef __APPLE__
+#  define FUZZ_TMP_DIR "/tmp"
+#else
+#  define FUZZ_TMP_DIR "/dev/shm"
+#endif
+
+
 /* Struct used for maintaining the state of the data */
 typedef struct FUZZ_dataProducer_s FUZZ_dataProducer_t;
 
@@ -47,14 +55,14 @@ void FUZZ_dataProducer_free(FUZZ_dataProducer_t *producer);
 
 /* Returns value between [min, max] */
 uint32_t FUZZ_dataProducer_uint32Range(FUZZ_dataProducer_t *producer, uint32_t min,
-                                  uint32_t max);
+				  uint32_t max);
 
 /* Returns a uint32 value */
 uint32_t FUZZ_dataProducer_uint32(FUZZ_dataProducer_t *producer);
 
 /* Returns a signed value between [min, max] */
 int32_t FUZZ_dataProducer_int32Range(FUZZ_dataProducer_t *producer,
-                                    int32_t min, int32_t max);
+				    int32_t min, int32_t max);
 
 /* Provides compression parameters */
 void FUZZ_dataProducer_cmp_par(FUZZ_dataProducer_t *producer, struct cmp_par *cmp_par);
@@ -69,12 +77,16 @@ void FUZZ_dataProducer_rollBack(FUZZ_dataProducer_t *producer, size_t remainingB
 int FUZZ_dataProducer_empty(FUZZ_dataProducer_t *producer);
 
 /* Restricts the producer to only the last newSize bytes of data.
-If newSize > current data size, nothing happens. Returns the number of bytes
-the producer won't use anymore, after contracting. */
+ * If newSize > current data size, nothing happens. Returns the number of bytes
+ * the producer won't use anymore, after contracting.
+ */
 size_t FUZZ_dataProducer_contract(FUZZ_dataProducer_t *producer, size_t newSize);
 
-/* Restricts the producer to use only the last X bytes of data, where X is
- a random number in the interval [0, data_size]. Returns the size of the
- remaining data the producer won't use anymore (the prefix). */
+/* Restricts the producer to use only the last X bytes of data, where X is a
+ * random number in the interval [0, data_size]. Returns the size of the
+ * remaining data the producer won't use anymore (the prefix).
+ */
 size_t FUZZ_dataProducer_reserveDataPrefix(FUZZ_dataProducer_t *producer);
+
+
 #endif // FUZZ_DATA_PRODUCER_H

test/fuzz/fuzz_helpers.c

@@ -30,6 +30,7 @@
 #include <errno.h>
 
 #include "fuzz_helpers.h"
+#include "fuzz_data_producer.h"
 
 
 void *FUZZ_malloc(size_t size)
@@ -61,11 +62,7 @@ char *FUZZ_buf_to_file(const uint8_t *buf, size_t size)
 	int fd, ret_close;
 	size_t pos = 0;
 
-#ifdef __APPLE__
-	char *path_name = strdup("/tmp/fuzz-XXXXXX");
-#else
-	char *path_name = strdup("/dev/shm/fuzz-XXXXXX");
-#endif
+	char *path_name = strdup(FUZZ_TMP_DIR "/fuzz-XXXXXX");
 
 	FUZZ_ASSERT(path_name != NULL);