Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2016 The PDFium Authors. All rights reserved. | 1 // Copyright 2016 The PDFium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <cstdint> | 5 #include <cstdint> |
| 6 | 6 |
| 7 #include "core/fpdfapi/parser/cpdf_array.h" | 7 #include "core/fpdfapi/parser/cpdf_array.h" |
| 8 #include "core/fpdfapi/parser/cpdf_dictionary.h" | 8 #include "core/fpdfapi/parser/cpdf_dictionary.h" |
| 9 #include "core/fpdfapi/parser/cpdf_hint_tables.h" | 9 #include "core/fpdfapi/parser/cpdf_hint_tables.h" |
| 10 #include "core/fpdfapi/parser/cpdf_linearized.h" | 10 #include "core/fpdfapi/parser/cpdf_linearized.h" |
|
Lei Zhang
2016/11/07 23:31:05
Actually, just this.
| |
| 11 #include "third_party/base/ptr_util.h" | 11 #include "third_party/base/ptr_util.h" |
| 12 | 12 |
| 13 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) { | 13 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) { |
| 14 const int32_t* ret = *data32; | 14 const int32_t* ret = *data32; |
| 15 ++(*data32); | 15 ++(*data32); |
| 16 *data += 4; | 16 *data += 4; |
| 17 *size -= 4; | 17 *size -= 4; |
| 18 return *ret; | 18 return *ret; |
| 19 } | 19 } |
| 20 | 20 |
| 21 class HintTableForFuzzing : public CPDF_HintTables { | 21 class HintTableForFuzzing : public CPDF_HintTables { |
| 22 public: | 22 public: |
| 23 HintTableForFuzzing(CPDF_Linearized* pLinearized, | 23 HintTableForFuzzing(CPDF_LinearizedHeader* pLinearized, |
| 24 int shared_hint_table_offset) | 24 int shared_hint_table_offset) |
| 25 : CPDF_HintTables(nullptr, pLinearized), | 25 : CPDF_HintTables(nullptr, pLinearized), |
| 26 shared_hint_table_offset_(shared_hint_table_offset) {} | 26 shared_hint_table_offset_(shared_hint_table_offset) {} |
| 27 ~HintTableForFuzzing() {} | 27 ~HintTableForFuzzing() {} |
| 28 | 28 |
| 29 void Fuzz(const uint8_t* data, size_t size) { | 29 void Fuzz(const uint8_t* data, size_t size) { |
| 30 if (shared_hint_table_offset_ <= 0) | 30 if (shared_hint_table_offset_ <= 0) |
| 31 return; | 31 return; |
| 32 | 32 |
| 33 if (size < static_cast<size_t>(shared_hint_table_offset_)) | 33 if (size < static_cast<size_t>(shared_hint_table_offset_)) |
| 34 return; | 34 return; |
| 35 | 35 |
| 36 CFX_BitStream bs; | 36 CFX_BitStream bs; |
| 37 bs.Init(data, size); | 37 bs.Init(data, size); |
| 38 if (!ReadPageHintTable(&bs)) | 38 if (!ReadPageHintTable(&bs)) |
| 39 return; | 39 return; |
| 40 ReadSharedObjHintTable(&bs, shared_hint_table_offset_); | 40 ReadSharedObjHintTable(&bs, shared_hint_table_offset_); |
| 41 } | 41 } |
| 42 | 42 |
| 43 private: | 43 private: |
| 44 int shared_hint_table_offset_; | 44 int shared_hint_table_offset_; |
| 45 }; | 45 }; |
| 46 | 46 |
| 47 class FakeLinearized : public CPDF_Linearized { | 47 class FakeLinearized : public CPDF_LinearizedHeader { |
| 48 public: | 48 public: |
| 49 explicit FakeLinearized(CPDF_Dictionary* linearized_dict) | 49 explicit FakeLinearized(CPDF_Dictionary* linearized_dict) |
| 50 : CPDF_Linearized(linearized_dict) {} | 50 : CPDF_LinearizedHeader(linearized_dict) {} |
| 51 }; | 51 }; |
| 52 | 52 |
| 53 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | 53 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 54 // Need 28 bytes for |linearized_dict|. | 54 // Need 28 bytes for |linearized_dict|. |
| 55 // The header section of page offset hint table is 36 bytes. | 55 // The header section of page offset hint table is 36 bytes. |
| 56 // The header section of shared object hint table is 24 bytes. | 56 // The header section of shared object hint table is 24 bytes. |
| 57 if (size < 28 + 36 + 24) | 57 if (size < 28 + 36 + 24) |
| 58 return 0; | 58 return 0; |
| 59 | 59 |
| 60 const int32_t* data32 = reinterpret_cast<const int32_t*>(data); | 60 const int32_t* data32 = reinterpret_cast<const int32_t*>(data); |
| (...skipping 20 matching lines...) Expand all Loading... | |
| 81 | 81 |
| 82 const int shared_hint_table_offset = GetData(&data32, &data, &size); | 82 const int shared_hint_table_offset = GetData(&data32, &data, &size); |
| 83 | 83 |
| 84 { | 84 { |
| 85 FakeLinearized linearized(linearized_dict.get()); | 85 FakeLinearized linearized(linearized_dict.get()); |
| 86 HintTableForFuzzing hint_table(&linearized, shared_hint_table_offset); | 86 HintTableForFuzzing hint_table(&linearized, shared_hint_table_offset); |
| 87 hint_table.Fuzz(data, size); | 87 hint_table.Fuzz(data, size); |
| 88 } | 88 } |
| 89 return 0; | 89 return 0; |
| 90 } | 90 } |
| OLD | NEW |