[COMPRESS-720] Integrate OSS-Fuzz fuzzers and enable CIFuzz

.github/workflows/cifuzz.yml

@@ -0,0 +1,27 @@
+name: CIFuzz
+on: [pull_request]
+permissions: {}
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Build Fuzzers
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'apache-commons-compress'
+        dry-run: false
+    - name: Run Fuzzers
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'apache-commons-compress'
+        fuzz-seconds: 600
+        dry-run: false
+    - name: Upload Crash
+      uses: actions/upload-artifact@v4
+      if: failure() && steps.build.outcome == 'success'
+      with:
+        name: artifacts
+        path: ./out/artifacts

pom.xml

@@ -406,6 +406,15 @@ Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <testExcludes>
+            <testExclude>org/apache/commons/compress/fuzz/**</testExclude>
+          </testExcludes>
+        </configuration>
+      </plugin>
     </plugins>
   </build>
   <reporting>
@@ -603,6 +612,30 @@ Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
         </plugins>
       </build>
     </profile>
+    <profile>
+      <id>fuzz</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-compiler-plugin</artifactId>
+            <configuration>
+              <testExcludes>
+                <testExclude>none</testExclude>
+              </testExcludes>
+            </configuration>
+          </plugin>
+          <plugin>
+            <artifactId>maven-surefire-plugin</artifactId>
+            <configuration>
+              <includes>
+                <include>**/*Fuzzer.java</include>
+              </includes>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
   </profiles>
   <developers>
     <developer>

src/test/java/org/apache/commons/compress/fuzz/AbstractTests.java

@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.commons.compress.fuzz;
+
+import java.io.IOException;
+import java.util.logging.LogManager;
+
+import org.apache.commons.compress.archivers.ArchiveEntry;
+import org.apache.commons.compress.archivers.ArchiveInputStream;
+import org.apache.commons.compress.compressors.CompressorInputStream;
+
+/**
+ * Class with common functionality shared among fuzzing harnesses.
+ */
+public abstract class AbstractTests {
+    public static void fuzzerInitialize() {
+        LogManager.getLogManager().reset();
+    }
+
+    /**
+     * Fuzz archiver streams by reading every entry.
+     */
+    public static void fuzzArchiveInputStream(ArchiveInputStream is) throws IOException {
+        ArchiveEntry entry;
+        while ((entry = is.getNextEntry()) != null) {
+            is.read(new byte[1024]);
+        }
+        is.close();
+    }
+
+    /**
+     * Fuzz compressor streams by reading them.
+     */
+    public static void fuzzCompressorInputStream(CompressorInputStream is) throws IOException {
+        is.read(new byte[1024]);
+        is.close();
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/ArchiverArFuzzer.java

@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import org.apache.commons.compress.archivers.ar.ArArchiveInputStream;
+
+public class ArchiverArFuzzer extends AbstractTests {
+    public static void fuzzerTestOneInput(byte[] data) {
+        try {
+            fuzzArchiveInputStream(new ArArchiveInputStream(new ByteArrayInputStream(data)));
+        } catch (IOException ignored) {
+        }
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/ArchiverArjFuzzer.java

@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import org.apache.commons.compress.archivers.arj.ArjArchiveInputStream;
+
+public class ArchiverArjFuzzer extends AbstractTests {
+    public static void fuzzerTestOneInput(byte[] data) {
+        try {
+            fuzzArchiveInputStream(new ArjArchiveInputStream(new ByteArrayInputStream(data)));
+        } catch (IOException ignored) {
+        }
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/ArchiverCpioFuzzer.java

@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import org.apache.commons.compress.archivers.cpio.CpioArchiveInputStream;
+
+public class ArchiverCpioFuzzer extends AbstractTests {
+    public static void fuzzerTestOneInput(byte[] data) {
+        try {
+            fuzzArchiveInputStream(new CpioArchiveInputStream(new ByteArrayInputStream(data)));
+        } catch (IllegalArgumentException | IOException ignored) {
+        }
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/ArchiverDumpFuzzer.java

@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import org.apache.commons.compress.archivers.dump.DumpArchiveInputStream;
+
+public class ArchiverDumpFuzzer extends AbstractTests {
+    public static void fuzzerTestOneInput(byte[] data) {
+        try {
+            fuzzArchiveInputStream(new DumpArchiveInputStream(new ByteArrayInputStream(data)));
+        } catch (IOException ignored) {
+        }
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/ArchiverTarStreamFuzzer.java

@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
+
+public class ArchiverTarStreamFuzzer extends AbstractTests {
+    public static void fuzzerTestOneInput(byte[] data) {
+        try {
+            fuzzArchiveInputStream(new TarArchiveInputStream(new ByteArrayInputStream(data)));
+        } catch (IOException ignored) {
+        }
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/ArchiverZipStreamFuzzer.java

@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
+
+public class ArchiverZipStreamFuzzer extends AbstractTests {
+    public static void fuzzerTestOneInput(byte[] data) {
+        try {
+            fuzzArchiveInputStream(new ZipArchiveInputStream(new ByteArrayInputStream(data)));
+        } catch (IOException ignored) {
+        }
+    }
+}

src/test/java/org/apache/commons/compress/fuzz/BaseTests.java

@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.commons.compress.fuzz;
+
+/**
+ * Temporary shim to maintain compatibility with legacy OSS-Fuzz build scripts
+ * which hardcode the class name "BaseTests".
+ * 
+ * TODO: Remove this class once the oss-fuzz project configuration is updated
+ * to use AbstractTests.
+ */
+public abstract class BaseTests extends AbstractTests {
+}