| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCanvas.h" | 9 #include "SkCanvas.h" |
| 10 #include "SkCodec.h" | 10 #include "SkCodec.h" |
| (...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 59 | 59 |
| 60 int fuzz_api(SkData* bytes) { | 60 int fuzz_api(SkData* bytes) { |
| 61 const char* name = FLAGS_name.isEmpty() ? "" : FLAGS_name[0]; | 61 const char* name = FLAGS_name.isEmpty() ? "" : FLAGS_name[0]; |
| 62 | 62 |
| 63 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 63 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
| 64 auto fuzzable = r->factory(); | 64 auto fuzzable = r->factory(); |
| 65 if (0 == strcmp(name, fuzzable.name)) { | 65 if (0 == strcmp(name, fuzzable.name)) { |
| 66 SkDebugf("Fuzzing %s...\n", fuzzable.name); | 66 SkDebugf("Fuzzing %s...\n", fuzzable.name); |
| 67 Fuzz fuzz(bytes); | 67 Fuzz fuzz(bytes); |
| 68 fuzzable.fn(&fuzz); | 68 fuzzable.fn(&fuzz); |
| 69 SkDebugf("Success!"); | 69 SkDebugf("[terminated] Success!\n"); |
| 70 return 0; | 70 return 0; |
| 71 } | 71 } |
| 72 } | 72 } |
| 73 | 73 |
| 74 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n
:\n"); | 74 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n
:\n"); |
| 75 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 75 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
| 76 auto fuzzable = r->factory(); | 76 auto fuzzable = r->factory(); |
| 77 SkDebugf("\t%s\n", fuzzable.name); | 77 SkDebugf("\t%s\n", fuzzable.name); |
| 78 } | 78 } |
| 79 return 1; | 79 return 1; |
| 80 } | 80 } |
| 81 | 81 |
| 82 static void dump_png(SkBitmap bitmap) { | 82 static void dump_png(SkBitmap bitmap) { |
| 83 if (!FLAGS_dump.isEmpty()) { | 83 if (!FLAGS_dump.isEmpty()) { |
| 84 SkImageEncoder::EncodeFile(FLAGS_dump[0], bitmap, SkImageEncoder::kPNG_T
ype, 100); | 84 SkImageEncoder::EncodeFile(FLAGS_dump[0], bitmap, SkImageEncoder::kPNG_T
ype, 100); |
| 85 SkDebugf("Dumped to %s\n", FLAGS_dump[0]); | 85 SkDebugf("Dumped to %s\n", FLAGS_dump[0]); |
| 86 } | 86 } |
| 87 } | 87 } |
| 88 | 88 |
| 89 int fuzz_img(SkData* bytes) { | 89 int fuzz_img(SkData* bytes) { |
| 90 SkDebugf("Decoding\n"); |
| 90 SkAutoTDelete<SkCodec> codec(SkCodec::NewFromData(bytes)); | 91 SkAutoTDelete<SkCodec> codec(SkCodec::NewFromData(bytes)); |
| 91 if (nullptr == codec.get()) { | 92 if (nullptr == codec.get()) { |
| 92 SkDebugf("Couldn't create codec."); | 93 SkDebugf("[terminated] Couldn't create codec.\n"); |
| 93 return 3; | 94 return 3; |
| 94 } | 95 } |
| 95 | 96 |
| 96 SkImageInfo decodeInfo = codec->getInfo(); | 97 SkImageInfo decodeInfo = codec->getInfo(); |
| 97 // Construct a color table for the decode if necessary | 98 // Construct a color table for the decode if necessary |
| 98 SkAutoTUnref<SkColorTable> colorTable(nullptr); | 99 SkAutoTUnref<SkColorTable> colorTable(nullptr); |
| 99 SkPMColor* colorPtr = nullptr; | 100 SkPMColor* colorPtr = nullptr; |
| 100 int* colorCountPtr = nullptr; | 101 int* colorCountPtr = nullptr; |
| 101 int maxColors = 256; | 102 int maxColors = 256; |
| 102 if (kIndex_8_SkColorType == decodeInfo.colorType()) { | 103 if (kIndex_8_SkColorType == decodeInfo.colorType()) { |
| 103 SkPMColor colors[256]; | 104 SkPMColor colors[256]; |
| 104 colorTable.reset(new SkColorTable(colors, maxColors)); | 105 colorTable.reset(new SkColorTable(colors, maxColors)); |
| 105 colorPtr = const_cast<SkPMColor*>(colorTable->readColors()); | 106 colorPtr = const_cast<SkPMColor*>(colorTable->readColors()); |
| 106 colorCountPtr = &maxColors; | 107 colorCountPtr = &maxColors; |
| 107 } | 108 } |
| 108 | 109 |
| 109 SkBitmap bitmap; | 110 SkBitmap bitmap; |
| 110 SkMallocPixelRef::ZeroedPRFactory zeroFactory; | 111 SkMallocPixelRef::ZeroedPRFactory zeroFactory; |
| 111 SkCodec::Options options; | 112 SkCodec::Options options; |
| 112 options.fZeroInitialized = SkCodec::kYes_ZeroInitialized; | 113 options.fZeroInitialized = SkCodec::kYes_ZeroInitialized; |
| 113 | 114 |
| 114 if (!bitmap.tryAllocPixels(decodeInfo, &zeroFactory, nullptr)) { | 115 if (!bitmap.tryAllocPixels(decodeInfo, &zeroFactory, nullptr)) { |
| 115 SkDebugf("Could not allocate memory. Image might be too large (%d x %d)
", | 116 SkDebugf("[terminated] Could not allocate memory. Image might be too la
rge (%d x %d)", |
| 116 decodeInfo.width(), decodeInfo.height()); | 117 decodeInfo.width(), decodeInfo.height()); |
| 117 return 4; | 118 return 4; |
| 118 } | 119 } |
| 119 | 120 |
| 120 switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(),
&options, | 121 switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(),
&options, |
| 121 colorPtr, colorCountPtr)) { | 122 colorPtr, colorCountPtr)) { |
| 122 case SkCodec::kSuccess: | 123 case SkCodec::kSuccess: |
| 123 SkDebugf("Success!\n"); | 124 SkDebugf("[terminated] Success!\n"); |
| 124 break; | 125 break; |
| 125 case SkCodec::kIncompleteInput: | 126 case SkCodec::kIncompleteInput: |
| 126 SkDebugf("Partial Success\n"); | 127 SkDebugf("[terminated] Partial Success\n"); |
| 127 break; | 128 break; |
| 128 case SkCodec::kInvalidConversion: | 129 case SkCodec::kInvalidConversion: |
| 129 SkDebugf("Incompatible colortype conversion"); | 130 SkDebugf("[terminated] Incompatible colortype conversion\n"); |
| 130 return 5; | 131 return 5; |
| 131 default: | 132 default: |
| 132 // Everything else is considered a failure. | 133 // Everything else is considered a failure. |
| 133 SkDebugf("Couldn't getPixels."); | 134 SkDebugf("[terminated] Couldn't getPixels.\n"); |
| 134 return 6; | 135 return 6; |
| 135 } | 136 } |
| 136 | 137 |
| 137 dump_png(bitmap); | 138 dump_png(bitmap); |
| 138 return 0; | 139 return 0; |
| 139 } | 140 } |
| 140 | 141 |
| 141 int fuzz_skp(SkData* bytes) { | 142 int fuzz_skp(SkData* bytes) { |
| 142 SkMemoryStream stream(bytes); | 143 SkMemoryStream stream(bytes); |
| 143 SkDebugf("Decoding\n"); | 144 SkDebugf("Decoding\n"); |
| 144 SkAutoTUnref<SkPicture> pic(SkPicture::CreateFromStream(&stream)); | 145 SkAutoTUnref<SkPicture> pic(SkPicture::CreateFromStream(&stream)); |
| 145 if (!pic) { | 146 if (!pic) { |
| 146 SkDebugf("Couldn't decode as a picture.\n"); | 147 SkDebugf("[terminated] Couldn't decode as a picture.\n"); |
| 147 return 3; | 148 return 3; |
| 148 } | 149 } |
| 149 SkDebugf("Rendering\n"); | 150 SkDebugf("Rendering\n"); |
| 150 SkBitmap bitmap; | 151 SkBitmap bitmap; |
| 151 if (!FLAGS_dump.isEmpty()) { | 152 if (!FLAGS_dump.isEmpty()) { |
| 152 SkIRect size = pic->cullRect().roundOut(); | 153 SkIRect size = pic->cullRect().roundOut(); |
| 153 bitmap.allocN32Pixels(size.width(), size.height()); | 154 bitmap.allocN32Pixels(size.width(), size.height()); |
| 154 } | 155 } |
| 155 SkCanvas canvas(bitmap); | 156 SkCanvas canvas(bitmap); |
| 156 canvas.drawPicture(pic); | 157 canvas.drawPicture(pic); |
| 157 SkDebugf("Success! Decoded and rendered an SkPicture!\n"); | 158 SkDebugf("[terminated] Success! Decoded and rendered an SkPicture!\n"); |
| 158 dump_png(bitmap); | 159 dump_png(bitmap); |
| 159 return 0; | 160 return 0; |
| 160 } | 161 } |
| 161 | 162 |
| 162 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} | 163 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} |
| 163 | 164 |
| 164 void Fuzz::signalBug () { raise(SIGSEGV); } | 165 void Fuzz::signalBug () { raise(SIGSEGV); } |
| 165 void Fuzz::signalBoring() { exit(0); } | 166 void Fuzz::signalBoring() { exit(0); } |
| 166 | 167 |
| 167 template <typename T> | 168 template <typename T> |
| 168 T Fuzz::nextT() { | 169 T Fuzz::nextT() { |
| 169 if (fNextByte + sizeof(T) > fBytes->size()) { | 170 if (fNextByte + sizeof(T) > fBytes->size()) { |
| 170 this->signalBoring(); | 171 this->signalBoring(); |
| 171 } | 172 } |
| 172 | 173 |
| 173 T val; | 174 T val; |
| 174 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); | 175 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); |
| 175 fNextByte += sizeof(T); | 176 fNextByte += sizeof(T); |
| 176 return val; | 177 return val; |
| 177 } | 178 } |
| 178 | 179 |
| 179 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } | 180 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } |
| 180 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } | 181 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } |
| 181 float Fuzz::nextF() { return this->nextT<float >(); } | 182 float Fuzz::nextF() { return this->nextT<float >(); } |
| 182 | 183 |
| OLD | NEW |