Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCanvas.h" | 9 #include "SkCanvas.h" |
| 10 #include "SkCodec.h" | 10 #include "SkCodec.h" |
| (...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 59 | 59 |
| 60 int fuzz_api(SkData* bytes) { | 60 int fuzz_api(SkData* bytes) { |
| 61 const char* name = FLAGS_name.isEmpty() ? "" : FLAGS_name[0]; | 61 const char* name = FLAGS_name.isEmpty() ? "" : FLAGS_name[0]; |
| 62 | 62 |
| 63 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 63 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
| 64 auto fuzzable = r->factory(); | 64 auto fuzzable = r->factory(); |
| 65 if (0 == strcmp(name, fuzzable.name)) { | 65 if (0 == strcmp(name, fuzzable.name)) { |
| 66 SkDebugf("Fuzzing %s...\n", fuzzable.name); | 66 SkDebugf("Fuzzing %s...\n", fuzzable.name); |
| 67 Fuzz fuzz(bytes); | 67 Fuzz fuzz(bytes); |
| 68 fuzzable.fn(&fuzz); | 68 fuzzable.fn(&fuzz); |
| 69 SkDebugf("Success!"); | |
|
mtklein
2016/01/27 19:34:44
Add \n?
| |
| 69 return 0; | 70 return 0; |
| 70 } | 71 } |
| 71 } | 72 } |
| 72 | 73 |
| 73 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n :\n"); | 74 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n :\n"); |
| 74 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 75 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
| 75 auto fuzzable = r->factory(); | 76 auto fuzzable = r->factory(); |
| 76 SkDebugf("\t%s\n", fuzzable.name); | 77 SkDebugf("\t%s\n", fuzzable.name); |
| 77 } | 78 } |
| 78 return 1; | 79 return 1; |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 146 return 3; | 147 return 3; |
| 147 } | 148 } |
| 148 SkDebugf("Rendering\n"); | 149 SkDebugf("Rendering\n"); |
| 149 SkBitmap bitmap; | 150 SkBitmap bitmap; |
| 150 if (!FLAGS_dump.isEmpty()) { | 151 if (!FLAGS_dump.isEmpty()) { |
| 151 SkIRect size = pic->cullRect().roundOut(); | 152 SkIRect size = pic->cullRect().roundOut(); |
| 152 bitmap.allocN32Pixels(size.width(), size.height()); | 153 bitmap.allocN32Pixels(size.width(), size.height()); |
| 153 } | 154 } |
| 154 SkCanvas canvas(bitmap); | 155 SkCanvas canvas(bitmap); |
| 155 canvas.drawPicture(pic); | 156 canvas.drawPicture(pic); |
| 156 SkDebugf("Decoded and rendered an SkPicture!\n"); | 157 SkDebugf("Success! Decoded and rendered an SkPicture!\n"); |
| 157 dump_png(bitmap); | 158 dump_png(bitmap); |
| 158 return 0; | 159 return 0; |
| 159 } | 160 } |
| 160 | 161 |
| 161 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} | 162 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} |
| 162 | 163 |
| 163 void Fuzz::signalBug () { raise(SIGSEGV); } | 164 void Fuzz::signalBug () { raise(SIGSEGV); } |
| 164 void Fuzz::signalBoring() { exit(0); } | 165 void Fuzz::signalBoring() { exit(0); } |
| 165 | 166 |
| 166 template <typename T> | 167 template <typename T> |
| 167 T Fuzz::nextT() { | 168 T Fuzz::nextT() { |
| 168 if (fNextByte + sizeof(T) > fBytes->size()) { | 169 if (fNextByte + sizeof(T) > fBytes->size()) { |
| 169 this->signalBoring(); | 170 this->signalBoring(); |
| 170 } | 171 } |
| 171 | 172 |
| 172 T val; | 173 T val; |
| 173 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); | 174 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); |
| 174 fNextByte += sizeof(T); | 175 fNextByte += sizeof(T); |
| 175 return val; | 176 return val; |
| 176 } | 177 } |
| 177 | 178 |
| 178 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } | 179 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } |
| 179 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } | 180 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } |
| 180 float Fuzz::nextF() { return this->nextT<float >(); } | 181 float Fuzz::nextF() { return this->nextT<float >(); } |
| 181 | 182 |
| OLD | NEW |