Add ICC fuzzer

fuzz/fuzz.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "Fuzz.h"
 #include "SkCanvas.h"
 #include "SkCodec.h"
 #include "SkCommandLineFlags.h"
 #include "SkData.h"
 #include "SkImage.h"
 #include "SkImageEncoder.h"
 #include "SkMallocPixelRef.h"
 #include "SkPicture.h"
 #include "SkStream.h"
 
 #include <cmath>
 #include <signal.h>
 #include <stdlib.h>
 
 DEFINE_string2(bytes, b, "", "A path to a file.  This can be the fuzz bytes or a binary to parse.");
 DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name.");
 
-DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image_scale', 'image_mode', 'skp', or 'api'.");
+DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image_scale', 'image_mode', 'skp', 'icc', or 'api'.");
 DEFINE_string2(dump, d, "", "If not empty, dump 'image*' or 'skp' types as a PNG with this name.");
 
 static int printUsage(const char* name) {
     SkDebugf("Usage: %s -t <type> -b <path/to/file> [-n api-to-fuzz]\n", name);
     return 1;
 }
 static uint8_t calculate_option(SkData*);
 
 static int fuzz_api(SkData*);
 static int fuzz_img(SkData*, uint8_t, uint8_t);
 static int fuzz_skp(SkData*);
+static int fuzz_icc(SkData*);
 
 int main(int argc, char** argv) {
     SkCommandLineFlags::Parse(argc, argv);
 
     const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0];
     SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path));
     if (!bytes) {
         SkDebugf("Could not read %s\n", path);
         return 2;
     }
 
     uint8_t option = calculate_option(bytes);
 
     if (!FLAGS_type.isEmpty()) {
         switch (FLAGS_type[0][0]) {
             case 'a': return fuzz_api(bytes);
 
             case 'i':
+                if (FLAGS_type[0][1] == 'c') { //icc
+                    return fuzz_icc(bytes);
+                }
                 // We only allow one degree of freedom to avoid a search space explosion for afl-fuzz.
                 if (FLAGS_type[0][6] == 's') { // image_scale
                     return fuzz_img(bytes, option, 0);
                 }
                 // image_mode
                 return fuzz_img(bytes, 0, option);
             case 's': return fuzz_skp(bytes);
         }
     }
     return printUsage(argv[0]);
@@ skipping 299 matching lines @@
         SkIRect size = pic->cullRect().roundOut();
         bitmap.allocN32Pixels(size.width(), size.height());
     }
     SkCanvas canvas(bitmap);
     canvas.drawPicture(pic);
     SkDebugf("[terminated] Success! Decoded and rendered an SkPicture!\n");
     dump_png(bitmap);
     return 0;
 }
 
+int fuzz_icc(SkData* bytes) {
+    sk_sp<SkColorSpace> space(SkColorSpace::NewICC(bytes->data(), bytes->size()));
+    if (!space) {
+        SkDebugf("[terminated] Couldn't decode ICC.\n");
+        return 1;
+    }
+    SkDebugf("[terminated] Success! Decoded ICC.\n");
+    return 0;
+}
+
 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {}
 
 void Fuzz::signalBug   () { SkDebugf("Signal bug\n"); raise(SIGSEGV); }
 void Fuzz::signalBoring() { SkDebugf("Signal boring\n"); exit(0); }
 
 template <typename T>
 T Fuzz::nextT() {
     if (fNextByte + sizeof(T) > fBytes->size()) {
         this->signalBoring();
     }
@@ skipping 32 matching lines @@
     if (min > max) {
         SkDebugf("Check mins and maxes (%f, %f)\n", min, max);
         this->signalBoring();
     }
     float f = std::abs(this->nextF());
     if (!std::isnormal(f) && f != 0.0) {
         this->signalBoring();
     }
     return min + fmod(f, (max - min + 1));
 }