Something went wrong. Try again.
Reads and writes the Ogg container format in Zig: pages, packets, grouping and chaining, with a page layer that allocates nothing.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230// SPDX-FileCopyrightText: © 2026 Jeffrey C. Ollie <jeff@ocjtech.us>// SPDX-License-Identifier: MIT
//! Run the fuzz targets in `src/tests/fuzz.zig` against input this makes up.//!//! Zig has a fuzzer of its own and those targets are written for it://! `zig build fuzz --fuzz` runs them with coverage feedback, which is what//! turns a random byte string into one that reaches a branch nobody has//! reached before.//!//! This is the loop around those same targets without it: it makes an input,//! hands it to one of them, and says so when one comes back with an error. It//! makes up for the missing coverage with the corpus: most of what it runs is a//! mutation of a seed that is already an Ogg stream, so the inputs arrive//! looking like the thing under test rather than like noise. It is also the//! easy way to replay one input and watch it fail, and a bounded run of it is//! cheap enough for every push.//!//! ```console//! $ zig build fuzz-run # thirty seconds of each//! $ zig build fuzz-run -- --seconds 300 --target decode//! $ zig build fuzz-run -- --seed 12345 # run it again exactly//! $ zig build fuzz-run -- --input fuzz-findings/decode-1.bin//! ```//!//! An input is a byte string that `std.testing.Smith` reads as a stream of//! decisions, so a failure is reported as those bytes and written to a file//! under `fuzz-findings/`. Feeding one back is what `--input` is for, and a//! shape worth keeping belongs in the corpus in `src/tests/fuzz.zig`, where//! `zig build test` will run it every time.
const std = @import("std");const targets = @import("fuzz_targets");
const Smith = std.testing.Smith;
const usage = \\Usage: zig build fuzz-run -- [options] \\ \\ --seconds <n> How long to run each target. Default 30. \\ --target <name> Only this target. One of: demux, pages, resync, roundtrip. \\ --seed <n> The seed for the input generator. Default: the clock. \\ --input <path> Run one input from a file and stop. \\ --quiet Only report failures. \\;
/// The longest input made up from scratch or grown to by mutation.const max_input = 96 * 1024;
pub fn main(init: std.process.Init) !void { const gpa = init.gpa; const io = init.io;
var seconds: u64 = 30; var only: ?[]const u8 = null; var seed: ?u64 = null; var input_path: ?[]const u8 = null; var quiet = false;
var args = init.minimal.args.iterate(); defer args.deinit(); _ = args.skip(); while (args.next()) |arg| { if (std.mem.eql(u8, arg, "--seconds")) { seconds = try std.fmt.parseInt(u64, args.next() orelse return fail("--seconds wants a number"), 10); } else if (std.mem.eql(u8, arg, "--target")) { only = args.next() orelse return fail("--target wants a name"); } else if (std.mem.eql(u8, arg, "--seed")) { seed = try std.fmt.parseInt(u64, args.next() orelse return fail("--seed wants a number"), 10); } else if (std.mem.eql(u8, arg, "--input")) { input_path = args.next() orelse return fail("--input wants a path"); } else if (std.mem.eql(u8, arg, "--quiet")) { quiet = true; } else if (std.mem.eql(u8, arg, "-h") or std.mem.eql(u8, arg, "--help")) { std.debug.print("{s}", .{usage}); return; } else { std.debug.print("{s}", .{usage}); return fail("unexpected argument"); } }
targets.backing = gpa;
if (input_path) |path| { const file = try std.Io.Dir.cwd().openFile(io, path, .{}); defer file.close(io); var buffer: [max_input]u8 = undefined; var reader: std.Io.File.Reader = .init(file, io, &buffer); const bytes = try reader.interface.allocRemaining(gpa, .limited(max_input)); defer gpa.free(bytes);
var failures: usize = 0; for (targets.targets) |target| { if (only) |name| if (!std.mem.eql(u8, name, target.name)) continue; var smith: Smith = .{ .in = bytes }; target.run({}, &smith) catch |err| { std.debug.print("{s}: {t}\n", .{ target.name, err }); failures += 1; }; } if (failures != 0) std.process.exit(1); std.debug.print("no target objected to {s}\n", .{path}); return; }
const chosen_seed = seed orelse @as(u64, @bitCast(@as(i64, @truncate(std.Io.Timestamp.now(io, .awake).nanoseconds)))); var prng: std.Random.DefaultPrng = .init(chosen_seed); const random = prng.random(); std.debug.print("seed {d}\n", .{chosen_seed});
const buffer = try gpa.alloc(u8, max_input); defer gpa.free(buffer);
var failures: usize = 0; for (targets.targets) |target| { if (only) |name| if (!std.mem.eql(u8, name, target.name)) continue;
const deadline = std.Io.Timestamp.now(io, .awake).nanoseconds + @as(i128, seconds) * std.time.ns_per_s; var runs: u64 = 0; var refusals: u64 = 0;
while (std.Io.Timestamp.now(io, .awake).nanoseconds < deadline) { const input = makeInput(random, buffer, target.corpus); var smith: Smith = .{ .in = input }; runs += 1; target.run({}, &smith) catch |err| { failures += 1; std.debug.print("\n{s}: {t} on {d} bytes\n", .{ target.name, err, input.len }); try save(io, target.name, failures, input); refusals += 1; if (refusals > 16) { std.debug.print("{s}: too many failures, moving on\n", .{target.name}); break; } }; } if (!quiet) std.debug.print("{s}: {d} runs in {d} s\n", .{ target.name, runs, seconds }); }
if (failures != 0) { std.debug.print("{d} failing inputs, saved under fuzz-findings/\n", .{failures}); std.process.exit(1); }}
fn fail(message: []const u8) error{BadUsage} { std.debug.print("zig-ogg fuzz: {s}\n", .{message}); return error.BadUsage;}
/// Build one input: usually a mutated seed, sometimes a splice of two, and now/// and then a byte string owing nothing to any of them.fn makeInput(random: std.Random, buffer: []u8, corpus: []const []const u8) []u8 { if (corpus.len == 0 or random.uintLessThan(u8, 16) == 0) { const length = random.uintAtMost(usize, @min(buffer.len, 4096)); random.bytes(buffer[0..length]); return buffer[0..length]; }
const seed_bytes = corpus[random.uintLessThan(usize, corpus.len)]; var length = @min(seed_bytes.len, buffer.len); @memcpy(buffer[0..length], seed_bytes[0..length]);
// Now and then, staple a second seed on the end, which is how a stream // grows frames it did not start with. if (random.uintLessThan(u8, 4) == 0) { const other = corpus[random.uintLessThan(usize, corpus.len)]; const room = @min(other.len, buffer.len - length); @memcpy(buffer[length..][0..room], other[0..room]); length += room; }
const edits = random.uintAtMost(usize, 24) + 1; for (0..edits) |_| { if (length == 0) break; switch (random.uintLessThan(u8, 8)) { // Flip one bit, which is the edit most likely to leave a stream // that still parses far enough to be interesting. 0, 1, 2 => { const at = random.uintLessThan(usize, length); buffer[at] ^= @as(u8, 1) << random.int(u3); }, 3, 4 => buffer[random.uintLessThan(usize, length)] = random.int(u8), // A byte from the ends of the range, which is where the format's // reserved and forbidden values live. 5 => { const at = random.uintLessThan(usize, length); buffer[at] = ([_]u8{ 0x00, 0x01, 0x7f, 0x80, 0xfe, 0xff })[random.uintLessThan(usize, 6)]; }, 6 => { // Cut the input short, which is what a truncated file is. A // small cut rather than a uniform one: two dozen edits each // able to halve the input leave almost every run testing a // handful of bytes, which is how a fuzzer comes to report // millions of iterations and have covered nothing. length -= random.uintAtMost(usize, @min(length, 64)); }, else => { // Copy a run from one place to another, so that a structure // the format expects once turns up twice. if (length < 4) continue; const run = random.uintAtMost(usize, @min(64, length)); if (run == 0) continue; const from = random.uintAtMost(usize, length - run); const to = random.uintAtMost(usize, length - run); std.mem.copyForwards(u8, buffer[to..][0..run], buffer[from..][0..run]); }, } } return buffer[0..length];}
fn save(io: std.Io, name: []const u8, number: usize, input: []const u8) !void { const directory = std.Io.Dir.cwd().createDirPathOpen(io, "fuzz-findings", .{}) catch return; defer directory.close(io);
var path_buffer: [64]u8 = undefined; const path = std.fmt.bufPrint(&path_buffer, "{s}-{d}.bin", .{ name, number }) catch return; const file = directory.createFile(io, path, .{}) catch return; defer file.close(io); var write_buffer: [4096]u8 = undefined; var writer: std.Io.File.Writer = .init(file, io, &write_buffer); try writer.interface.writeAll(input); try writer.interface.flush(); std.debug.print(" saved to fuzz-findings/{s}\n", .{path});}