Skip to content

[bzip2] Stream decompressor output and export seed corpus - #15944

Open
carrerasdarren-cell wants to merge 1 commit into
google:masterfrom
carrerasdarren-cell:fix/bzip2-streaming-decompress-fuzzer
Open

[bzip2] Stream decompressor output and export seed corpus#15944
carrerasdarren-cell wants to merge 1 commit into
google:masterfrom
carrerasdarren-cell:fix/bzip2-streaming-decompress-fuzzer

Conversation

@carrerasdarren-cell

Copy link
Copy Markdown

Summary

  • stream decompressor output through a fixed 4 KiB scratch buffer instead of limiting output to twice the compressed input size
  • bound valid output processing at 16 MiB and stop if the decompressor makes no progress
  • write the existing decompression seed archive to $OUT so OSS-Fuzz retains it

Rationale

BZ2_bzBuffToBuffDecompress currently receives an output capacity of 2 * input_size. Valid bzip2 streams can expand far beyond that ratio, so the target returns BZ_OUTBUFF_FULL before exercising the rest of the stream. All three upstream quick-test samples exceed the current limit:

Seed Compressed Decompressed Ratio
sample1.bz2 32,348 98,696 3.05x
sample2.bz2 73,732 212,340 2.88x
sample3.bz2 235 120,244 511.68x

A deterministic 1 MiB zero-filled input compresses to 45 bytes. The old 90-byte output buffer returns BZ_OUTBUFF_FULL (-8); the streaming path reaches BZ_STREAM_END (4) after producing all 1,048,576 bytes.

The build script also creates bzip2_decompress_target_seed_corpus.zip in the container working directory after cd bzip2, rather than in $OUT. The archive is therefore absent from the build artifacts.

Verification

  • python3 infra/helper.py build_fuzzers bzip2 --sanitizer address --clean
  • python3 infra/helper.py build_fuzzers bzip2 --sanitizer undefined
  • python3 infra/helper.py check_build bzip2 --sanitizer undefined
  • replayed the exported 34-file seed corpus under UBSan with no failures
  • replayed a 408-file evolved corpus under Linux ASan/UBSan with no failures

For a deterministic -runs=0 replay of the same exported corpus, the old target initialized at 450 edges / 1,344 features; the streaming target initialized at 464 edges / 1,574 features.

@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown

carrerasdarren-cell is a new contributor to projects/bzip2. The PR must be approved by known contributors before it can be merged. The past contributors are: OwenSanzas, arthurscchan, hunsche, fanquake, swirsz, cvediver, Dor1s, sylvestre, posidron (unverified), bshastry (unverified), tysmith (unverified)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant