| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCanvas.h" | 9 #include "SkCanvas.h" |
| 10 #include "SkCodec.h" | 10 #include "SkCodec.h" |
| (...skipping 26 matching lines...) Expand all Loading... |
| 37 static int fuzz_api(SkData*); | 37 static int fuzz_api(SkData*); |
| 38 static int fuzz_img(SkData*, uint8_t, uint8_t); | 38 static int fuzz_img(SkData*, uint8_t, uint8_t); |
| 39 static int fuzz_skp(SkData*); | 39 static int fuzz_skp(SkData*); |
| 40 static int fuzz_icc(SkData*); | 40 static int fuzz_icc(SkData*); |
| 41 static int fuzz_color_deserialize(SkData*); | 41 static int fuzz_color_deserialize(SkData*); |
| 42 | 42 |
| 43 int main(int argc, char** argv) { | 43 int main(int argc, char** argv) { |
| 44 SkCommandLineFlags::Parse(argc, argv); | 44 SkCommandLineFlags::Parse(argc, argv); |
| 45 | 45 |
| 46 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]; | 46 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]; |
| 47 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); | 47 sk_sp<SkData> bytes(SkData::MakeFromFileName(path)); |
| 48 if (!bytes) { | 48 if (!bytes) { |
| 49 SkDebugf("Could not read %s\n", path); | 49 SkDebugf("Could not read %s\n", path); |
| 50 return 2; | 50 return 2; |
| 51 } | 51 } |
| 52 | 52 |
| 53 uint8_t option = calculate_option(bytes); | 53 uint8_t option = calculate_option(bytes.get()); |
| 54 | 54 |
| 55 if (!FLAGS_type.isEmpty()) { | 55 if (!FLAGS_type.isEmpty()) { |
| 56 switch (FLAGS_type[0][0]) { | 56 switch (FLAGS_type[0][0]) { |
| 57 case 'a': return fuzz_api(bytes); | 57 case 'a': return fuzz_api(bytes.get()); |
| 58 | 58 |
| 59 case 'c': return fuzz_color_deserialize(bytes); | 59 case 'c': return fuzz_color_deserialize(bytes.get()); |
| 60 | 60 |
| 61 case 'i': | 61 case 'i': |
| 62 if (FLAGS_type[0][1] == 'c') { //icc | 62 if (FLAGS_type[0][1] == 'c') { //icc |
| 63 return fuzz_icc(bytes); | 63 return fuzz_icc(bytes.get()); |
| 64 } | 64 } |
| 65 // We only allow one degree of freedom to avoid a search space e
xplosion for afl-fuzz. | 65 // We only allow one degree of freedom to avoid a search space e
xplosion for afl-fuzz. |
| 66 if (FLAGS_type[0][6] == 's') { // image_scale | 66 if (FLAGS_type[0][6] == 's') { // image_scale |
| 67 return fuzz_img(bytes, option, 0); | 67 return fuzz_img(bytes.get(), option, 0); |
| 68 } | 68 } |
| 69 // image_mode | 69 // image_mode |
| 70 return fuzz_img(bytes, 0, option); | 70 return fuzz_img(bytes.get(), 0, option); |
| 71 case 's': return fuzz_skp(bytes); | 71 case 's': return fuzz_skp(bytes.get()); |
| 72 } | 72 } |
| 73 } | 73 } |
| 74 return printUsage(argv[0]); | 74 return printUsage(argv[0]); |
| 75 } | 75 } |
| 76 | 76 |
| 77 // This adds up the first 1024 bytes and returns it as an 8 bit integer. This a
llows afl-fuzz to | 77 // This adds up the first 1024 bytes and returns it as an 8 bit integer. This a
llows afl-fuzz to |
| 78 // deterministically excercise different paths, or *options* (such as different
scaling sizes or | 78 // deterministically excercise different paths, or *options* (such as different
scaling sizes or |
| 79 // different image modes) without needing to introduce a parameter. This way we
don't need a | 79 // different image modes) without needing to introduce a parameter. This way we
don't need a |
| 80 // image_scale1, image_scale2, image_scale4, etc fuzzer, we can just have a imag
e_scale fuzzer. | 80 // image_scale1, image_scale2, image_scale4, etc fuzzer, we can just have a imag
e_scale fuzzer. |
| 81 // Clients are expected to transform this number into a different range, e.g. wi
th modulo (%). | 81 // Clients are expected to transform this number into a different range, e.g. wi
th modulo (%). |
| (...skipping 370 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 452 if (min > max) { | 452 if (min > max) { |
| 453 SkDebugf("Check mins and maxes (%f, %f)\n", min, max); | 453 SkDebugf("Check mins and maxes (%f, %f)\n", min, max); |
| 454 this->signalBoring(); | 454 this->signalBoring(); |
| 455 } | 455 } |
| 456 float f = std::abs(this->nextF()); | 456 float f = std::abs(this->nextF()); |
| 457 if (!std::isnormal(f) && f != 0.0) { | 457 if (!std::isnormal(f) && f != 0.0) { |
| 458 this->signalBoring(); | 458 this->signalBoring(); |
| 459 } | 459 } |
| 460 return min + fmod(f, (max - min + 1)); | 460 return min + fmod(f, (max - min + 1)); |
| 461 } | 461 } |
| OLD | NEW |