From 62ad30f225b48e298c97e3e9a904aaee9a1c6c5b Mon Sep 17 00:00:00 2001 From: James Bonfield Date: Mon, 12 Oct 2026 15:04:48 +0100 Subject: [PATCH 1/2] Remove MSSSE3 and MPOPCNT from "make fuzz" target These were removed in f1335646024dfe7e20048782020a926c53a89d8b Signed-off-by: James Bonfield --- htscodecs/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htscodecs/Makefile.am b/htscodecs/Makefile.am index e4a347d..3dd5e96 100644 --- a/htscodecs/Makefile.am +++ b/htscodecs/Makefile.am @@ -104,7 +104,7 @@ libcodecsfuzz_a_SOURCES = $(libhtscodecs_base_src) libcodecsfuzz_a_CFLAGS = -fsanitize=fuzzer -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION libcodecsfuzz_a-htscodecs.$(OBJEXT): version.h libcodecsfuzz_sse4_a_SOURCES = rANS_static32x16pr_sse4.c -libcodecsfuzz_sse4_a_CFLAGS = $(libcodecsfuzz_a_CFLAGS) @MSSE4_1@ @MSSSE3@ @MPOPCNT@ +libcodecsfuzz_sse4_a_CFLAGS = $(libcodecsfuzz_a_CFLAGS) @MSSE4_1@ libcodecsfuzz_avx2_a_SOURCES = rANS_static32x16pr_avx2.c libcodecsfuzz_avx2_a_CFLAGS = $(libcodecsfuzz_a_CFLAGS) @MAVX2@ libcodecsfuzz_avx512_a_SOURCES = rANS_static32x16pr_avx512.c From 39a5cc89b99622be7bfa4fac34fb4ae87c7d2538 Mon Sep 17 00:00:00 2001 From: James Bonfield Date: Mon, 12 Oct 2026 15:14:22 +0100 Subject: [PATCH 2/2] Protect against large inputs to the fuzz testers These buffer overruns are in the fuzz testing harness and the bugs do not affect the library itself. Fixes #155 Co-Authored-By: Jason Gross (@JasonGross) Assisted-by: Claude:claude-3.7-sonnet Antrophic Signed-off-by: James Bonfield --- tests/fqzcomp_qual_fuzzrt.c | 4 ++++ tests/tokenise_name3_fuzzrt.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/fqzcomp_qual_fuzzrt.c b/tests/fqzcomp_qual_fuzzrt.c index f398841..db75ba0 100644 --- a/tests/fqzcomp_qual_fuzzrt.c +++ b/tests/fqzcomp_qual_fuzzrt.c @@ -103,6 +103,10 @@ fqz_slice *fake_slice(size_t buf_len, int nrec) { int LLVMFuzzerTestOneInput(uint8_t *in, size_t in_size) { size_t c_size, u_size; + // fake_slice() may need one slice_len[] entry per input byte + if (in_size > MAX_REC) + return -1; + int mode = 0; for (mode = 0; mode < 3; mode++) { int mval[3] = {0,1,in_size}; diff --git a/tests/tokenise_name3_fuzzrt.c b/tests/tokenise_name3_fuzzrt.c index 878546e..e55c7a8 100644 --- a/tests/tokenise_name3_fuzzrt.c +++ b/tests/tokenise_name3_fuzzrt.c @@ -61,7 +61,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *in, size_t in_sz) { char in2[8192]; // 4096 is default max size for libfuzzer anyway - if (in_sz > 8192) + if (in_sz+1 > sizeof(in2)) // +1 for nul below return -1; // Turn newlines to nuls so we can do round-trip testing