| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCanvas.h" | 9 #include "SkCanvas.h" |
| 10 #include "SkCodec.h" | 10 #include "SkCodec.h" |
| 11 #include "SkCommandLineFlags.h" | 11 #include "SkCommandLineFlags.h" |
| 12 #include "SkData.h" | 12 #include "SkData.h" |
| 13 #include "SkForceLinking.h" | 13 #include "SkForceLinking.h" |
| 14 #include "SkImage.h" | 14 #include "SkImage.h" |
| 15 #include "SkImageEncoder.h" | 15 #include "SkImageEncoder.h" |
| 16 #include "SkMallocPixelRef.h" | 16 #include "SkMallocPixelRef.h" |
| 17 #include "SkPicture.h" | 17 #include "SkPicture.h" |
| 18 #include "SkStream.h" | 18 #include "SkStream.h" |
| 19 | 19 |
| 20 #include <cmath> |
| 20 #include <signal.h> | 21 #include <signal.h> |
| 21 #include <stdlib.h> | 22 #include <stdlib.h> |
| 22 | 23 |
| 23 // TODO(kjlubick): Remove once http://crrev.com/1671193002 lands | 24 // TODO(kjlubick): Remove once http://crrev.com/1671193002 lands |
| 24 __SK_FORCE_IMAGE_DECODER_LINKING; | 25 __SK_FORCE_IMAGE_DECODER_LINKING; |
| 25 | 26 |
| 26 DEFINE_string2(bytes, b, "", "A path to a file. This can be the fuzz bytes or a
binary to parse."); | 27 DEFINE_string2(bytes, b, "", "A path to a file. This can be the fuzz bytes or a
binary to parse."); |
| 27 DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name."); | 28 DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name."); |
| 28 | 29 |
| 29 DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image_scale',
'image_mode', 'skp', or 'api'."); | 30 DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image_scale',
'image_mode', 'skp', or 'api'."); |
| (...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 107 static void dump_png(SkBitmap bitmap) { | 108 static void dump_png(SkBitmap bitmap) { |
| 108 if (!FLAGS_dump.isEmpty()) { | 109 if (!FLAGS_dump.isEmpty()) { |
| 109 SkImageEncoder::EncodeFile(FLAGS_dump[0], bitmap, SkImageEncoder::kPNG_T
ype, 100); | 110 SkImageEncoder::EncodeFile(FLAGS_dump[0], bitmap, SkImageEncoder::kPNG_T
ype, 100); |
| 110 SkDebugf("Dumped to %s\n", FLAGS_dump[0]); | 111 SkDebugf("Dumped to %s\n", FLAGS_dump[0]); |
| 111 } | 112 } |
| 112 } | 113 } |
| 113 | 114 |
| 114 int fuzz_img(SkData* bytes, uint8_t scale, uint8_t mode) { | 115 int fuzz_img(SkData* bytes, uint8_t scale, uint8_t mode) { |
| 115 // We can scale 1x, 2x, 4x, 8x, 16x | 116 // We can scale 1x, 2x, 4x, 8x, 16x |
| 116 scale = scale % 5; | 117 scale = scale % 5; |
| 117 float fscale = pow(2.0f, scale); | 118 float fscale = (float)pow(2.0f, scale); |
| 118 SkDebugf("Scaling factor: %d\n", fscale); | 119 SkDebugf("Scaling factor: %f\n", fscale); |
| 119 | 120 |
| 120 // We have 4 different modes of decoding, just like DM. | 121 // We have 4 different modes of decoding, just like DM. |
| 121 mode = mode % 4; | 122 mode = mode % 4; |
| 122 SkDebugf("Mode: %d\n", mode); | 123 SkDebugf("Mode: %d\n", mode); |
| 123 | 124 |
| 124 // This is mostly copied from DMSrcSink's CodecSrc::draw method. | 125 // This is mostly copied from DMSrcSink's CodecSrc::draw method. |
| 125 SkDebugf("Decoding\n"); | 126 SkDebugf("Decoding\n"); |
| 126 SkAutoTDelete<SkCodec> codec(SkCodec::NewFromData(bytes)); | 127 SkAutoTDelete<SkCodec> codec(SkCodec::NewFromData(bytes)); |
| 127 if (nullptr == codec.get()) { | 128 if (nullptr == codec.get()) { |
| 128 SkDebugf("[terminated] Couldn't create codec.\n"); | 129 SkDebugf("[terminated] Couldn't create codec.\n"); |
| (...skipping 257 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 386 this->signalBoring(); | 387 this->signalBoring(); |
| 387 } | 388 } |
| 388 | 389 |
| 389 T val; | 390 T val; |
| 390 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); | 391 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); |
| 391 fNextByte += sizeof(T); | 392 fNextByte += sizeof(T); |
| 392 return val; | 393 return val; |
| 393 } | 394 } |
| 394 | 395 |
| 395 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } | 396 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } |
| 397 bool Fuzz::nextBool() { return nextB()&1; } |
| 396 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } | 398 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } |
| 397 float Fuzz::nextF() { return this->nextT<float >(); } | 399 float Fuzz::nextF() { return this->nextT<float >(); } |
| 398 | 400 |
| 401 |
| 402 uint32_t Fuzz::nextRangeU(uint32_t min, uint32_t max) { |
| 403 if (min > max) { |
| 404 SkDebugf("Check mins and maxes (%d, %d)\n", min, max); |
| 405 this->signalBoring(); |
| 406 } |
| 407 uint32_t range = max - min + 1; |
| 408 if (0 == range) { |
| 409 return this->nextU(); |
| 410 } else { |
| 411 return min + this->nextU() % range; |
| 412 } |
| 413 } |
| 414 float Fuzz::nextRangeF(float min, float max) { |
| 415 if (min > max) { |
| 416 SkDebugf("Check mins and maxes (%f, %f)\n", min, max); |
| 417 this->signalBoring(); |
| 418 } |
| 419 float f = std::abs(this->nextF()); |
| 420 if (!std::isnormal(f) && f != 0.0) { |
| 421 this->signalBoring(); |
| 422 } |
| 423 return min + fmod(f, (max - min + 1)); |
| 424 } |
| OLD | NEW |