Implement a fuzzer for skia paths.

skia/tools/path_fuzzer/path_fuzzer.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "third_party/skia/include/core/SkCanvas.h"
+#include "third_party/skia/include/core/SkPaint.h"
+#include "third_party/skia/include/core/SkPath.h"
+#include "third_party/skia/include/core/SkSurface.h"
+
+const int OPERATION_COUNT = 9;
+
+template <typename T>

[Martin Barbella, 2016/06/01 23:43:36]

I'm assuming this comes up a lot in other fuzzers using libfuzzer. Do we have a
more general way to handle this? I suppose it's easy enough to implement that it
doesn't really matter.

[mmoroz, 2016/06/02 10:05:22]

I've seen a similar thing in some of networking fuzzers, but we don't have a
common solution for this.

+static bool read(uint8_t** data, size_t* size, T* value) {
+  if (*size < sizeof(value))
+    return false;
+
+  *value = *reinterpret_cast<T*>(*data);
+  *data += sizeof(value);
+  *size -= sizeof(value);
+  return true;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
+  SkPath path;

[Martin Barbella, 2016/06/01 23:43:36]

SkPath::readFromMemory actually looks takes data and a size, but it didn't seem
to work well here. Performance was quite a bit worse than this implementation,
though I'm not sure why, and I like being able to mix in other calls while
reading data. I'm also not totally sure that it can handle arbitrary input.

https://code.google.com/p/chromium/codesearch#chromium/src/third_party/skia/s...
for reference.

+  uint8_t operation;
+  SkScalar a, b, c, d, e, f;
+
+  while (read<uint8_t>(&data, &size, &operation)) {
+    bool result = true;
+    switch (operation % OPERATION_COUNT) {
+      // Path building.
+      case 0:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b);
+        if (result)
+          path.lineTo(a, b);
+        break;
+
+      case 1:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b) &&
+                 read<SkScalar>(&data, &size, &c) &&
+                 read<SkScalar>(&data, &size, &d);
+        if (result)
+          path.quadTo(a, b, c, d);
+        break;
+
+      case 2:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b) &&
+                 read<SkScalar>(&data, &size, &c) &&
+                 read<SkScalar>(&data, &size, &d) &&
+                 read<SkScalar>(&data, &size, &e);
+        if (result)
+          path.conicTo(a, b, c, d, e);
+        break;
+
+      case 3:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b) &&
+                 read<SkScalar>(&data, &size, &c) &&
+                 read<SkScalar>(&data, &size, &d) &&
+                 read<SkScalar>(&data, &size, &e) &&
+                 read<SkScalar>(&data, &size, &f);
+        if (result)
+          path.cubicTo(a, b, c, d, e, f);
+        break;
+
+      case 5:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b);
+        if (result)
+          path.moveTo(a, b);
+        break;
+
+      case 6:
+        path.close();
+        break;
+
+      // Potentially interesting calls using the current path.
+      case 7:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b);
+        if (result)
+          path.contains(a, b);
+        break;
+
+      case 8:
+        result = read<SkScalar>(&data, &size, &a) &&
+                 read<SkScalar>(&data, &size, &b) &&
+                 read<SkScalar>(&data, &size, &c) &&
+                 read<SkScalar>(&data, &size, &d);
+        if (result) {
+          SkRect rect = SkRect::MakeLTRB(a, b, c, d);
+          path.conservativelyContainsRect(rect);
+        }
+        break;
+    }
+
+    if (!result)
+      break;
+  }
+
+  SkPaint paint;
+  auto surface(SkSurface::MakeRasterN32Premul(128, 128));
+  SkCanvas* canvas = surface->getCanvas();
+  canvas->drawPath(path, paint);
+
+  return 0;
+}