huffman_fuzzer.cc (2696B)
1 // Copyright 2023 Google Inc. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 // 15 //////////////////////////////////////////////////////////////////////////////// 16 17 #include <cstddef> 18 #include <cstdint> 19 #include <cstring> 20 #include <string_view> 21 22 #include "./fuzz_utils.h" 23 #include "src/dec/vp8li_dec.h" 24 #include "src/utils/bit_reader_utils.h" 25 #include "src/utils/huffman_utils.h" 26 #include "src/utils/utils.h" 27 #include "src/webp/format_constants.h" 28 29 namespace { 30 31 void HuffmanTest(std::string_view blob) { 32 const uint8_t* const data = reinterpret_cast<const uint8_t*>(blob.data()); 33 const size_t size = blob.size(); 34 35 // Number of bits to initialize data. 36 static const int kColorCacheBitsBits = 4; 37 // 'num_htree_groups' is contained in the RG channel, hence 16 bits. 38 static const int kNumHtreeGroupsBits = 16; 39 if (size * sizeof(*data) < kColorCacheBitsBits + kNumHtreeGroupsBits) { 40 return; 41 } 42 43 // A non-NULL mapping brings minor changes that are tested by the normal 44 // fuzzer. 45 int* const mapping = NULL; 46 HuffmanTables huffman_tables; 47 memset(&huffman_tables, 0, sizeof(huffman_tables)); 48 HTreeGroup* htree_groups = NULL; 49 50 int num_htree_groups, num_htree_groups_max, color_cache_bits; 51 VP8LBitReader* br; 52 VP8LDecoder* dec = VP8LNew(); 53 if (dec == NULL) goto Error; 54 br = &dec->br; 55 VP8LInitBitReader(br, data, size); 56 57 color_cache_bits = VP8LReadBits(br, kColorCacheBitsBits); 58 if (color_cache_bits < 1 || color_cache_bits > MAX_CACHE_BITS) goto Error; 59 60 num_htree_groups = VP8LReadBits(br, kNumHtreeGroupsBits); 61 // 'num_htree_groups' cannot be 0 as it is built from a non-empty image. 62 if (num_htree_groups == 0) goto Error; 63 // This variable is only useful when mapping is not NULL. 64 num_htree_groups_max = num_htree_groups; 65 (void)ReadHuffmanCodesHelper(color_cache_bits, num_htree_groups, 66 num_htree_groups_max, mapping, dec, 67 &huffman_tables, &htree_groups); 68 69 Error: 70 WebPSafeFree(mapping); 71 VP8LHtreeGroupsFree(htree_groups); 72 VP8LHuffmanTablesDeallocate(&huffman_tables); 73 VP8LDelete(dec); 74 } 75 76 } // namespace 77 78 FUZZ_TEST(Huffman, HuffmanTest).WithDomains(fuzztest::String());