Add llvm fuzzer for CPDF_PSEngine

core/fpdfapi/fpdf_page/fpdf_page_func.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <limits.h>
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 #include <vector>
 
+#include "core/fpdfapi/fpdf_page/cpdf_psengine.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_simple_parser.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream_acc.h"
 #include "core/fxcrt/include/fx_safe_types.h"
 #include "third_party/base/numerics/safe_conversions_impl.h"
 
-namespace {
-
-enum PDF_PSOP {
-  PSOP_ADD,
-  PSOP_SUB,
-  PSOP_MUL,
-  PSOP_DIV,
-  PSOP_IDIV,
-  PSOP_MOD,
-  PSOP_NEG,
-  PSOP_ABS,
-  PSOP_CEILING,
-  PSOP_FLOOR,
-  PSOP_ROUND,
-  PSOP_TRUNCATE,
-  PSOP_SQRT,
-  PSOP_SIN,
-  PSOP_COS,
-  PSOP_ATAN,
-  PSOP_EXP,
-  PSOP_LN,
-  PSOP_LOG,
-  PSOP_CVI,
-  PSOP_CVR,
-  PSOP_EQ,
-  PSOP_NE,
-  PSOP_GT,
-  PSOP_GE,
-  PSOP_LT,
-  PSOP_LE,
-  PSOP_AND,
-  PSOP_OR,
-  PSOP_XOR,
-  PSOP_NOT,
-  PSOP_BITSHIFT,
-  PSOP_TRUE,
-  PSOP_FALSE,
-  PSOP_IF,
-  PSOP_IFELSE,
-  PSOP_POP,
-  PSOP_EXCH,
-  PSOP_DUP,
-  PSOP_COPY,
-  PSOP_INDEX,
-  PSOP_ROLL,
-  PSOP_PROC,
-  PSOP_CONST
-};
-
-class CPDF_PSEngine;
-class CPDF_PSProc;
-
 class CPDF_PSOP {

[Lei Zhang, 2016/08/18 06:21:39]

Would be nice to move these out to their own file as well.

[Tom Sepez, 2016/08/18 21:23:07]

Agreed, someday.

  public:
   explicit CPDF_PSOP(PDF_PSOP op) : m_op(op), m_value(0) {
     ASSERT(m_op != PSOP_CONST);
     ASSERT(m_op != PSOP_PROC);
   }
   explicit CPDF_PSOP(FX_FLOAT value) : m_op(PSOP_CONST), m_value(value) {}
   explicit CPDF_PSOP(std::unique_ptr<CPDF_PSProc> proc)
       : m_op(PSOP_PROC), m_value(0), m_proc(std::move(proc)) {}
 
   FX_FLOAT GetFloatValue() const {
@@ skipping 11 matching lines @@
   }
 
   PDF_PSOP GetOp() const { return m_op; }
 
  private:
   const PDF_PSOP m_op;
   const FX_FLOAT m_value;
   std::unique_ptr<CPDF_PSProc> m_proc;
 };
 
-class CPDF_PSProc {
- public:
-  CPDF_PSProc() {}
-  ~CPDF_PSProc() {}
+FX_BOOL CPDF_PSEngine::Execute() {
+  return m_MainProc.Execute(this);
+}
 
-  FX_BOOL Parse(CPDF_SimpleParser* parser);
-  FX_BOOL Execute(CPDF_PSEngine* pEngine);
-
- private:
-  std::vector<std::unique_ptr<CPDF_PSOP>> m_Operators;
-};
-
-const uint32_t PSENGINE_STACKSIZE = 100;
-
-class CPDF_PSEngine {
- public:
-  CPDF_PSEngine();
-  ~CPDF_PSEngine();
-
-  FX_BOOL Parse(const FX_CHAR* str, int size);
-  FX_BOOL Execute() { return m_MainProc.Execute(this); }
-  FX_BOOL DoOperator(PDF_PSOP op);
-  void Reset() { m_StackCount = 0; }
-  void Push(FX_FLOAT value);
-  void Push(int value) { Push((FX_FLOAT)value); }
-  FX_FLOAT Pop();
-  uint32_t GetStackSize() const { return m_StackCount; }
-
- private:
-  FX_FLOAT m_Stack[PSENGINE_STACKSIZE];
-  uint32_t m_StackCount;
-  CPDF_PSProc m_MainProc;
-};
+CPDF_PSProc::CPDF_PSProc() {}
+CPDF_PSProc::~CPDF_PSProc() {}
 
 FX_BOOL CPDF_PSProc::Execute(CPDF_PSEngine* pEngine) {
   for (size_t i = 0; i < m_Operators.size(); ++i) {
     const PDF_PSOP op = m_Operators[i]->GetOp();
     if (op == PSOP_PROC)
       continue;
 
     if (op == PSOP_CONST) {
       pEngine->Push(m_Operators[i]->GetFloatValue());
       continue;
@@ skipping 122 matching lines @@
       Push(d1 * d2);
       break;
     case PSOP_DIV:
       d2 = Pop();
       d1 = Pop();
       Push(d1 / d2);
       break;
     case PSOP_IDIV:
       i2 = (int)Pop();
       i1 = (int)Pop();
-      Push(i1 / i2);
+      if (i2)

[Lei Zhang, 2016/08/18 06:21:39]

1 Push() with a ternary operator inside? Ditto for MOD.

[Tom Sepez, 2016/08/18 21:23:07]

Done.

+        Push(i1 / i2);
+      else
+        Push(0);
       break;
     case PSOP_MOD:
       i2 = (int)Pop();
       i1 = (int)Pop();
-      Push(i1 % i2);
+      if (i2)
+        Push(i1 % i2);
+      else
+        Push(0);
       break;
     case PSOP_NEG:
       d1 = Pop();
       Push(-d1);
       break;
     case PSOP_ABS:
       d1 = Pop();
       Push((FX_FLOAT)FXSYS_fabs(d1));
       break;
     case PSOP_CEILING:
@@ skipping 232 matching lines @@
   for (uint32_t i = 0; i < m_nInputs; i++)
     PS.Push(inputs[i]);
   PS.Execute();
   if (PS.GetStackSize() < m_nOutputs)
     return FALSE;
   for (uint32_t i = 0; i < m_nOutputs; i++)
     results[m_nOutputs - i - 1] = PS.Pop();
   return TRUE;
 }
 
-}  // namespace
 
 CPDF_SampledFunc::CPDF_SampledFunc() : CPDF_Function(Type::kType0Sampled) {}
 
 CPDF_SampledFunc::~CPDF_SampledFunc() {}
 
 FX_BOOL CPDF_SampledFunc::v_Init(CPDF_Object* pObj) {
   CPDF_Stream* pStream = pObj->AsStream();
   if (!pStream)
     return false;
 
@@ skipping 360 matching lines @@
   return m_Type == Type::kType2ExpotentialInterpolation
              ? static_cast<const CPDF_ExpIntFunc*>(this)
              : nullptr;
 }
 
 const CPDF_StitchFunc* CPDF_Function::ToStitchFunc() const {
   return m_Type == Type::kType3Stitching
              ? static_cast<const CPDF_StitchFunc*>(this)
              : nullptr;
 }