| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCanvas.h" | 9 #include "SkCanvas.h" |
| 10 #include "SkCodec.h" | 10 #include "SkCodec.h" |
| (...skipping 18 matching lines...) Expand all Loading... |
| 29 static int printUsage(const char* name) { | 29 static int printUsage(const char* name) { |
| 30 SkDebugf("Usage: %s -t <type> -b <path/to/file> [-n api-to-fuzz]\n", name); | 30 SkDebugf("Usage: %s -t <type> -b <path/to/file> [-n api-to-fuzz]\n", name); |
| 31 return 1; | 31 return 1; |
| 32 } | 32 } |
| 33 static uint8_t calculate_option(SkData*); | 33 static uint8_t calculate_option(SkData*); |
| 34 | 34 |
| 35 static int fuzz_api(SkData*); | 35 static int fuzz_api(SkData*); |
| 36 static int fuzz_img(SkData*, uint8_t, uint8_t); | 36 static int fuzz_img(SkData*, uint8_t, uint8_t); |
| 37 static int fuzz_skp(SkData*); | 37 static int fuzz_skp(SkData*); |
| 38 static int fuzz_icc(SkData*); | 38 static int fuzz_icc(SkData*); |
| 39 static int fuzz_color_deserialize(SkData*); |
| 39 | 40 |
| 40 int main(int argc, char** argv) { | 41 int main(int argc, char** argv) { |
| 41 SkCommandLineFlags::Parse(argc, argv); | 42 SkCommandLineFlags::Parse(argc, argv); |
| 42 | 43 |
| 43 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]; | 44 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]; |
| 44 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); | 45 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); |
| 45 if (!bytes) { | 46 if (!bytes) { |
| 46 SkDebugf("Could not read %s\n", path); | 47 SkDebugf("Could not read %s\n", path); |
| 47 return 2; | 48 return 2; |
| 48 } | 49 } |
| 49 | 50 |
| 50 uint8_t option = calculate_option(bytes); | 51 uint8_t option = calculate_option(bytes); |
| 51 | 52 |
| 52 if (!FLAGS_type.isEmpty()) { | 53 if (!FLAGS_type.isEmpty()) { |
| 53 switch (FLAGS_type[0][0]) { | 54 switch (FLAGS_type[0][0]) { |
| 54 case 'a': return fuzz_api(bytes); | 55 case 'a': return fuzz_api(bytes); |
| 55 | 56 |
| 57 case 'c': return fuzz_color_deserialize(bytes); |
| 58 |
| 56 case 'i': | 59 case 'i': |
| 57 if (FLAGS_type[0][1] == 'c') { //icc | 60 if (FLAGS_type[0][1] == 'c') { //icc |
| 58 return fuzz_icc(bytes); | 61 return fuzz_icc(bytes); |
| 59 } | 62 } |
| 60 // We only allow one degree of freedom to avoid a search space e
xplosion for afl-fuzz. | 63 // We only allow one degree of freedom to avoid a search space e
xplosion for afl-fuzz. |
| 61 if (FLAGS_type[0][6] == 's') { // image_scale | 64 if (FLAGS_type[0][6] == 's') { // image_scale |
| 62 return fuzz_img(bytes, option, 0); | 65 return fuzz_img(bytes, option, 0); |
| 63 } | 66 } |
| 64 // image_mode | 67 // image_mode |
| 65 return fuzz_img(bytes, 0, option); | 68 return fuzz_img(bytes, 0, option); |
| (...skipping 313 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 379 int fuzz_icc(SkData* bytes) { | 382 int fuzz_icc(SkData* bytes) { |
| 380 sk_sp<SkColorSpace> space(SkColorSpace::NewICC(bytes->data(), bytes->size())
); | 383 sk_sp<SkColorSpace> space(SkColorSpace::NewICC(bytes->data(), bytes->size())
); |
| 381 if (!space) { | 384 if (!space) { |
| 382 SkDebugf("[terminated] Couldn't decode ICC.\n"); | 385 SkDebugf("[terminated] Couldn't decode ICC.\n"); |
| 383 return 1; | 386 return 1; |
| 384 } | 387 } |
| 385 SkDebugf("[terminated] Success! Decoded ICC.\n"); | 388 SkDebugf("[terminated] Success! Decoded ICC.\n"); |
| 386 return 0; | 389 return 0; |
| 387 } | 390 } |
| 388 | 391 |
| 392 int fuzz_color_deserialize(SkData* bytes) { |
| 393 sk_sp<SkColorSpace> space(SkColorSpace::Deserialize(bytes->data(), bytes->si
ze())); |
| 394 if (!space) { |
| 395 SkDebugf("[terminated] Couldn't deserialize Colorspace.\n"); |
| 396 return 1; |
| 397 } |
| 398 SkDebugf("[terminated] Success! deserialized Colorspace.\n"); |
| 399 return 0; |
| 400 } |
| 401 |
| 389 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} | 402 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} |
| 390 | 403 |
| 391 void Fuzz::signalBug () { SkDebugf("Signal bug\n"); raise(SIGSEGV); } | 404 void Fuzz::signalBug () { SkDebugf("Signal bug\n"); raise(SIGSEGV); } |
| 392 void Fuzz::signalBoring() { SkDebugf("Signal boring\n"); exit(0); } | 405 void Fuzz::signalBoring() { SkDebugf("Signal boring\n"); exit(0); } |
| 393 | 406 |
| 394 template <typename T> | 407 template <typename T> |
| 395 T Fuzz::nextT() { | 408 T Fuzz::nextT() { |
| 396 if (fNextByte + sizeof(T) > fBytes->size()) { | 409 if (fNextByte + sizeof(T) > fBytes->size()) { |
| 397 this->signalBoring(); | 410 this->signalBoring(); |
| 398 } | 411 } |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 431 if (min > max) { | 444 if (min > max) { |
| 432 SkDebugf("Check mins and maxes (%f, %f)\n", min, max); | 445 SkDebugf("Check mins and maxes (%f, %f)\n", min, max); |
| 433 this->signalBoring(); | 446 this->signalBoring(); |
| 434 } | 447 } |
| 435 float f = std::abs(this->nextF()); | 448 float f = std::abs(this->nextF()); |
| 436 if (!std::isnormal(f) && f != 0.0) { | 449 if (!std::isnormal(f) && f != 0.0) { |
| 437 this->signalBoring(); | 450 this->signalBoring(); |
| 438 } | 451 } |
| 439 return min + fmod(f, (max - min + 1)); | 452 return min + fmod(f, (max - min + 1)); |
| 440 } | 453 } |
| OLD | NEW |