Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCanvas.h" | 9 #include "SkCanvas.h" |
| 10 #include "SkCodec.h" | 10 #include "SkCodec.h" |
| 11 #include "SkCommandLineFlags.h" | 11 #include "SkCommandLineFlags.h" |
| 12 #include "SkData.h" | 12 #include "SkData.h" |
| 13 #include "SkForceLinking.h" | 13 #include "SkForceLinking.h" |
| 14 #include "SkImage.h" | 14 #include "SkImage.h" |
| 15 #include "SkImageEncoder.h" | 15 #include "SkImageEncoder.h" |
| 16 #include "SkMallocPixelRef.h" | 16 #include "SkMallocPixelRef.h" |
| 17 #include "SkPicture.h" | 17 #include "SkPicture.h" |
| 18 #include "SkStream.h" | 18 #include "SkStream.h" |
| 19 | 19 |
| 20 #include <signal.h> | 20 #include <signal.h> |
| 21 #include <stdlib.h> | 21 #include <stdlib.h> |
| 22 | 22 |
| 23 __SK_FORCE_IMAGE_DECODER_LINKING; | 23 __SK_FORCE_IMAGE_DECODER_LINKING; |
| 24 | 24 |
| 25 DEFINE_string2(bytes, b, "", "A path to a file. This can be the fuzz bytes or a binary to parse."); | 25 DEFINE_string2(bytes, b, "", "A path to a file. This can be the fuzz bytes or a binary to parse."); |
| 26 DEFINE_string2(name, n, "", "If --type is 'api', run the DEF_FUZZ API fuzz with this name."); | 26 DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name."); |
| 27 | 27 |
| 28 DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image', 'skp', or 'api'."); | 28 DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image', 'skp', or 'api'."); |
| 29 DEFINE_string2(dump, d, "", "If not empty, dump 'image' or 'skp' types as a PNG with this name."); | 29 DEFINE_string2(dump, d, "", "If not empty, dump 'image' or 'skp' types as a PNG with this name."); |
| 30 | 30 |
| 31 static int printUsage(const char* name) { | 31 static int printUsage(const char* name) { |
| 32 SkDebugf("Usage: %s -t <type> -b <path/to/file> [-n api_fuzz_name]\n", name) ; | 32 SkDebugf("Usage: %s -t <type> -b <path/to/file> [-n api-to-fuzz]\n", name); |
| 33 return 1; | 33 return 1; |
| 34 } | 34 } |
| 35 | 35 |
| 36 static int fuzz_api(SkData*); | 36 static int fuzz_api(SkData*); |
| 37 static int fuzz_img(SkData*); | 37 static int fuzz_img(SkData*); |
| 38 static int fuzz_skp(SkData*); | 38 static int fuzz_skp(SkData*); |
| 39 | 39 |
| 40 int main(int argc, char** argv) { | 40 int main(int argc, char** argv) { |
| 41 SkCommandLineFlags::Parse(argc, argv); | 41 SkCommandLineFlags::Parse(argc, argv); |
| 42 | 42 |
| 43 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]; | 43 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]; |
| 44 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); | 44 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); |
| 45 if (!bytes) { | 45 if (!bytes) { |
| 46 SkDebugf("Could not read %s\n", path); | 46 SkDebugf("Could not read %s\n", path); |
| 47 return 2; | 47 return 2; |
| 48 } | 48 } |
| 49 | 49 |
| 50 switch (FLAGS_type[0][0]) { | 50 switch (FLAGS_type[0][0]) { |
|
kjlubick
2016/01/21 13:57:31
This segfaults if --type is empty. Can you print
mtklein
2016/01/21 14:00:53
Done.
| |
| 51 case 'a': return fuzz_api(bytes); | 51 case 'a': return fuzz_api(bytes); |
| 52 case 'i': return fuzz_img(bytes); | 52 case 'i': return fuzz_img(bytes); |
| 53 case 's': return fuzz_skp(bytes); | 53 case 's': return fuzz_skp(bytes); |
| 54 } | 54 } |
| 55 return printUsage(argv[0]); | 55 return printUsage(argv[0]); |
| 56 } | 56 } |
| 57 | 57 |
| 58 int fuzz_api(SkData* bytes) { | 58 int fuzz_api(SkData* bytes) { |
| 59 const char* name = FLAGS_name.isEmpty() ? "" : FLAGS_name[0]; | |
| 60 | |
| 59 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 61 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
| 60 auto fuzzable = r->factory(); | 62 auto fuzzable = r->factory(); |
| 61 if (0 == strcmp(FLAGS_name[0], fuzzable.name)) { | 63 if (0 == strcmp(name, fuzzable.name)) { |
| 62 SkDebugf("Fuzzing %s...\n", fuzzable.name); | 64 SkDebugf("Fuzzing %s...\n", fuzzable.name); |
| 63 Fuzz fuzz(bytes); | 65 Fuzz fuzz(bytes); |
| 64 fuzzable.fn(&fuzz); | 66 fuzzable.fn(&fuzz); |
| 65 return 0; | 67 return 0; |
| 66 } | 68 } |
| 67 } | 69 } |
| 68 SkDebugf("API fuzz %s not found\n", FLAGS_name[0]); | 70 |
| 71 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n :\n"); | |
| 72 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | |
| 73 auto fuzzable = r->factory(); | |
| 74 SkDebugf("\t%s\n", fuzzable.name); | |
| 75 } | |
| 69 return 1; | 76 return 1; |
| 70 } | 77 } |
| 71 | 78 |
| 72 static void dump_png(SkBitmap bitmap) { | 79 static void dump_png(SkBitmap bitmap) { |
| 73 if (!FLAGS_dump.isEmpty()) { | 80 if (!FLAGS_dump.isEmpty()) { |
| 74 SkImageEncoder::EncodeFile(FLAGS_dump[0], bitmap, SkImageEncoder::kPNG_T ype, 100); | 81 SkImageEncoder::EncodeFile(FLAGS_dump[0], bitmap, SkImageEncoder::kPNG_T ype, 100); |
| 75 SkDebugf("Dumped to %s\n", FLAGS_dump[0]); | 82 SkDebugf("Dumped to %s\n", FLAGS_dump[0]); |
| 76 } | 83 } |
| 77 } | 84 } |
| 78 | 85 |
| (...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 163 T val; | 170 T val; |
| 164 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); | 171 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); |
| 165 fNextByte += sizeof(T); | 172 fNextByte += sizeof(T); |
| 166 return val; | 173 return val; |
| 167 } | 174 } |
| 168 | 175 |
| 169 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } | 176 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } |
| 170 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } | 177 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } |
| 171 float Fuzz::nextF() { return this->nextT<float >(); } | 178 float Fuzz::nextF() { return this->nextT<float >(); } |
| 172 | 179 |
| OLD | NEW |