OLD | NEW |
---|---|
1 // Copyright 2016 The PDFium Authors. All rights reserved. | 1 // Copyright 2016 The PDFium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <cstdint> | 5 #include <cstdint> |
6 | 6 |
7 #include "core/fpdfapi/parser/cpdf_array.h" | 7 #include "core/fpdfapi/parser/cpdf_array.h" |
8 #include "core/fpdfapi/parser/cpdf_dictionary.h" | 8 #include "core/fpdfapi/parser/cpdf_dictionary.h" |
9 #include "core/fpdfapi/parser/cpdf_hint_tables.h" | 9 #include "core/fpdfapi/parser/cpdf_hint_tables.h" |
10 #include "core/fpdfapi/parser/cpdf_linearized.h" | 10 #include "core/fpdfapi/parser/cpdf_linearized.h" |
Lei Zhang
2016/11/07 23:31:05
Actually, just this.
| |
11 #include "third_party/base/ptr_util.h" | 11 #include "third_party/base/ptr_util.h" |
12 | 12 |
13 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) { | 13 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) { |
14 const int32_t* ret = *data32; | 14 const int32_t* ret = *data32; |
15 ++(*data32); | 15 ++(*data32); |
16 *data += 4; | 16 *data += 4; |
17 *size -= 4; | 17 *size -= 4; |
18 return *ret; | 18 return *ret; |
19 } | 19 } |
20 | 20 |
21 class HintTableForFuzzing : public CPDF_HintTables { | 21 class HintTableForFuzzing : public CPDF_HintTables { |
22 public: | 22 public: |
23 HintTableForFuzzing(CPDF_Linearized* pLinearized, | 23 HintTableForFuzzing(CPDF_LinearizedHeader* pLinearized, |
24 int shared_hint_table_offset) | 24 int shared_hint_table_offset) |
25 : CPDF_HintTables(nullptr, pLinearized), | 25 : CPDF_HintTables(nullptr, pLinearized), |
26 shared_hint_table_offset_(shared_hint_table_offset) {} | 26 shared_hint_table_offset_(shared_hint_table_offset) {} |
27 ~HintTableForFuzzing() {} | 27 ~HintTableForFuzzing() {} |
28 | 28 |
29 void Fuzz(const uint8_t* data, size_t size) { | 29 void Fuzz(const uint8_t* data, size_t size) { |
30 if (shared_hint_table_offset_ <= 0) | 30 if (shared_hint_table_offset_ <= 0) |
31 return; | 31 return; |
32 | 32 |
33 if (size < static_cast<size_t>(shared_hint_table_offset_)) | 33 if (size < static_cast<size_t>(shared_hint_table_offset_)) |
34 return; | 34 return; |
35 | 35 |
36 CFX_BitStream bs; | 36 CFX_BitStream bs; |
37 bs.Init(data, size); | 37 bs.Init(data, size); |
38 if (!ReadPageHintTable(&bs)) | 38 if (!ReadPageHintTable(&bs)) |
39 return; | 39 return; |
40 ReadSharedObjHintTable(&bs, shared_hint_table_offset_); | 40 ReadSharedObjHintTable(&bs, shared_hint_table_offset_); |
41 } | 41 } |
42 | 42 |
43 private: | 43 private: |
44 int shared_hint_table_offset_; | 44 int shared_hint_table_offset_; |
45 }; | 45 }; |
46 | 46 |
47 class FakeLinearized : public CPDF_Linearized { | 47 class FakeLinearized : public CPDF_LinearizedHeader { |
48 public: | 48 public: |
49 explicit FakeLinearized(CPDF_Dictionary* linearized_dict) | 49 explicit FakeLinearized(CPDF_Dictionary* linearized_dict) |
50 : CPDF_Linearized(linearized_dict) {} | 50 : CPDF_LinearizedHeader(linearized_dict) {} |
51 }; | 51 }; |
52 | 52 |
53 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | 53 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
54 // Need 28 bytes for |linearized_dict|. | 54 // Need 28 bytes for |linearized_dict|. |
55 // The header section of page offset hint table is 36 bytes. | 55 // The header section of page offset hint table is 36 bytes. |
56 // The header section of shared object hint table is 24 bytes. | 56 // The header section of shared object hint table is 24 bytes. |
57 if (size < 28 + 36 + 24) | 57 if (size < 28 + 36 + 24) |
58 return 0; | 58 return 0; |
59 | 59 |
60 const int32_t* data32 = reinterpret_cast<const int32_t*>(data); | 60 const int32_t* data32 = reinterpret_cast<const int32_t*>(data); |
(...skipping 20 matching lines...) Expand all Loading... | |
81 | 81 |
82 const int shared_hint_table_offset = GetData(&data32, &data, &size); | 82 const int shared_hint_table_offset = GetData(&data32, &data, &size); |
83 | 83 |
84 { | 84 { |
85 FakeLinearized linearized(linearized_dict.get()); | 85 FakeLinearized linearized(linearized_dict.get()); |
86 HintTableForFuzzing hint_table(&linearized, shared_hint_table_offset); | 86 HintTableForFuzzing hint_table(&linearized, shared_hint_table_offset); |
87 hint_table.Fuzz(data, size); | 87 hint_table.Fuzz(data, size); |
88 } | 88 } |
89 return 0; | 89 return 0; |
90 } | 90 } |
OLD | NEW |