Add fuzzer for (A)PNG decoder

Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
created by joostouwerling@google.com and three existing static PNG images
in WebKits LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662
Review-Url: https://codereview.chromium.org/2603303003
Cr-Commit-Position: refs/heads/master@{#441661}
Committed: https://chromium.googlesource.com/chromium/src/+/1cc893851ef9ad007f4fb1eaabf58870fc634e81

[scroggo_chromium, 2017-01-03 18:20:36]

Description was changed from

==========
Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
which I created myself, and three existing static PNG images in WebKits
LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662

patch from issue 2578263002 at patchset 20001
(http://crrev.com/2578263002#ps20001)
==========

to

==========
Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
created by joostouwerling@google.com, and three existing static PNG images
in WebKits LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662
==========

[scroggo_chromium, 2017-01-03 18:20:57]

Description was changed from

==========
Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
created by joostouwerling@google.com, and three existing static PNG images
in WebKits LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662
==========

to

==========
Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
created by joostouwerling@google.com and three existing static PNG images
in WebKits LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662
==========

[scroggo_chromium, 2017-01-03 18:25:54]

scroggo@chromium.org changed reviewers:
+ mmoroz@chromium.org, noel@chromium.org

[scroggo_chromium, 2017-01-03 18:25:54]

This addresses the comments in patch set 1 of crrev.com/2578263002. Patch set 1
of this issue is unchanged from the original, so looking at the diffs from 1
shows the relevant changes.

[Noel Gordon, 2017-01-04 00:01:46]

LGTM - thanks Leon & Joost(?)

[mmoroz, 2017-01-04 08:37:54]

Thanks! LGTM

https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/platform/BUILD.gn (right):

https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/platform/BUILD.gn:2033: seed_corpus =
"//third_party/WebKit/LayoutTests/images/resources/pngfuzz"
I like your idea to have multiple seed corpus directories, but we do not support
it at the moment. Though it would be easy to implement. I'll do it and update
this config file then (filed: crbug.com/678181)

https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/platform/PngFuzzer.cpp (right):

https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/platform/PngFuzzer.cpp:23: //
`~/another_dir_to_store_corpus
Looks like a typo: "`"

[mmoroz, 2017-01-05 10:10:13]

On 2017/01/04 08:37:54, mmoroz wrote:
> Thanks! LGTM
> 
>
https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
> File third_party/WebKit/Source/platform/BUILD.gn (right):
> 
>
https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
> third_party/WebKit/Source/platform/BUILD.gn:2033: seed_corpus =
> "//third_party/WebKit/LayoutTests/images/resources/pngfuzz"
> I like your idea to have multiple seed corpus directories, but we do not
support
> it at the moment. Though it would be easy to implement. I'll do it and update
> this config file then (filed: crbug.com/678181)
> 
>
https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
> File third_party/WebKit/Source/platform/PngFuzzer.cpp (right):
> 
>
https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
> third_party/WebKit/Source/platform/PngFuzzer.cpp:23: //
> `~/another_dir_to_store_corpus
> Looks like a typo: "`"

FYI, I've uploaded a CL for multiple seed_corpus directories support:
https://codereview.chromium.org/2610323002/. Depending on which CL lands first,
then we'll need to update seed_corpus argument for your fuzzer.

[scroggo_chromium, 2017-01-05 14:26:09]

https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/platform/PngFuzzer.cpp (right):

https://codereview.chromium.org/2603303003/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/platform/PngFuzzer.cpp:23: //
`~/another_dir_to_store_corpus
On 2017/01/04 08:37:54, mmoroz wrote:
> Looks like a typo: "`" 

Done.

[scroggo_chromium, 2017-01-05 14:26:14]

The CQ bit was checked by scroggo@chromium.org

[scroggo_chromium, 2017-01-05 14:26:15]

The patchset sent to the CQ was uploaded after l-g-t-m from mmoroz@chromium.org,
noel@chromium.org
Link to the patchset: https://codereview.chromium.org/2603303003/#ps40001
(title: "Fix typo")

[commit-bot: I haz the power, 2017-01-05 14:26:27]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-05 15:52:16]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1483626374586300,
"parent_rev": "d37312ad011596dc26c3814464a1eb912b6c5704", "commit_rev":
"1cc893851ef9ad007f4fb1eaabf58870fc634e81"}

[commit-bot: I haz the power, 2017-01-05 15:52:45]

Description was changed from

==========
Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
created by joostouwerling@google.com and three existing static PNG images
in WebKits LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662
==========

to

==========
Add fuzzer for (A)PNG decoder

Implement a fuzzer for the PNG decoder. It uses three animated png images
created by joostouwerling@google.com and three existing static PNG images
in WebKits LayoutTest resources as a seed corpus.

It works for both the current PNGImageDecoder, which only supports
decoding static PNGs, and the new PNGImageDecoder which also supports
decoding animated PNGs. This is achieved by having both static and
animated PNG images in the seed corpus.

BUG=437662

Review-Url: https://codereview.chromium.org/2603303003
Cr-Commit-Position: refs/heads/master@{#441661}
Committed:
https://chromium.googlesource.com/chromium/src/+/1cc893851ef9ad007f4fb1eaabf5...
==========

[commit-bot: I haz the power, 2017-01-05 15:52:47]

Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/chromium/src/+/1cc893851ef9ad007f4fb1eaabf5...