[libfuzzer] libpng_read_fuzzer: call png_set_user_limits() for MSan.

testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc

Index: testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc
diff --git a/testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc b/testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc
index 1ea45d36c565ad305b889ec67482bbf30bfc216f..06bae03207358e885ca1490d6bee87f6e4cbea89 100644
--- a/testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc
+++ b/testing/libfuzzer/fuzzers/libpng_read_fuzzer.cc
@@ -46,6 +46,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     (PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
   assert(png_ptr);
 
+#ifdef MEMORY_SANITIZER

[aizatsky, 2016/09/29 17:14:40]

why not to make it unconditional? Seems like a good idea anyway. It is a matter
of time it will OOM under any sanitizer, isn't it?

[mmoroz, 2016/09/30 08:28:59]

I would like to agree, but:
1) we lose some coverage by enabling this:
https://codereview.chromium.org/2383023002/diff2/1:20001/testing/libfuzzer/fu...

2) other builds are far enough from hitting OOM ("Peak RSS" column):
https://cluster-fuzz.appspot.com/fuzzerstats?fuzzer_name=libfuzzer_libpng_rea...

3) we ship Chrome with default values from
https://cs.chromium.org/chromium/src/third_party/libpng/pnglibconf.h?l=210, so
it makes sense to fuzz that version until we get blocked


Also I have a feeling that we may not hit OOM with, let's say, 999999 x 999999
image, since there are other limits like
https://cs.chromium.org/chromium/src/third_party/libpng/pnglibconf.h?l=225
preventing us from allocating too large buffers
https://cs.chromium.org/chromium/src/third_party/libpng/pngrutil.c?rcl=147520...,
so for me it seems to be MSan only :(

[aizatsky, 2016/09/30 17:51:52]

Understood. Please try to make it an if() statement rather than preprocessor
then.

[mmoroz, 2016/10/04 12:38:26]

I've searched for something to do that, but haven't found a convenient way.
Everything I tried depends on preprocessor and is undefined for non-MSan build.

Also I've asked Dmitry and Alex from your team and they hadn't suggested any way
to do that.

Can I land this version?

+  // To avoid OOM with MSan (crbug.com/648073). These values are recommended as
+  // safe settings by https://github.com/glennrp/libpng/blob/libpng16/pngusr.dfa
+  png_set_user_limits(png_ptr, 65535, 65535);
+#endif
+
   png_set_crc_action(png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
 
   png_infop info_ptr = png_create_info_struct(png_ptr);