simple_api_fuzzer.cc (3623B)
1 // Copyright 2018 Google Inc. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 // 15 //////////////////////////////////////////////////////////////////////////////// 16 17 #include <cstddef> 18 #include <cstdint> 19 #include <cstdlib> 20 #include <string_view> 21 22 #include "./fuzz_utils.h" 23 #include "src/webp/decode.h" 24 #include "src/webp/types.h" 25 26 namespace { 27 28 void SimpleApiTest(std::string_view data_in) { 29 const uint8_t* const data = reinterpret_cast<const uint8_t*>(data_in.data()); 30 const size_t size = data_in.size(); 31 int w, h; 32 if (!WebPGetInfo(data, size, &w, &h)) return; 33 if ((size_t)w * h > fuzz_utils::kFuzzPxLimit) return; 34 35 const uint8_t value = fuzz_utils::FuzzHash(data, size); 36 uint8_t* buf = NULL; 37 38 // For *Into functions, which decode into an external buffer, an 39 // intentionally too small buffer can be given with low probability. 40 if (value < 0x16) { 41 buf = WebPDecodeRGBA(data, size, &w, &h); 42 } else if (value < 0x2b) { 43 buf = WebPDecodeBGRA(data, size, &w, &h); 44 #if !defined(WEBP_REDUCE_CSP) 45 } else if (value < 0x40) { 46 buf = WebPDecodeARGB(data, size, &w, &h); 47 } else if (value < 0x55) { 48 buf = WebPDecodeRGB(data, size, &w, &h); 49 } else if (value < 0x6a) { 50 buf = WebPDecodeBGR(data, size, &w, &h); 51 #endif // !defined(WEBP_REDUCE_CSP) 52 } else if (value < 0x7f) { 53 uint8_t *u, *v; 54 int stride, uv_stride; 55 buf = WebPDecodeYUV(data, size, &w, &h, &u, &v, &stride, &uv_stride); 56 } else if (value < 0xe8) { 57 const int stride = (value < 0xbe ? 4 : 3) * w; 58 size_t buf_size = stride * h; 59 if (value % 0x10 == 0) buf_size--; 60 uint8_t* const ext_buf = (uint8_t*)malloc(buf_size); 61 if (value < 0x94) { 62 (void)WebPDecodeRGBAInto(data, size, ext_buf, buf_size, stride); 63 #if !defined(WEBP_REDUCE_CSP) 64 } else if (value < 0xa9) { 65 (void)WebPDecodeARGBInto(data, size, ext_buf, buf_size, stride); 66 } else if (value < 0xbe) { 67 (void)WebPDecodeBGRInto(data, size, ext_buf, buf_size, stride); 68 } else if (value < 0xd3) { 69 (void)WebPDecodeRGBInto(data, size, ext_buf, buf_size, stride); 70 #endif // !defined(WEBP_REDUCE_CSP) 71 } else { 72 (void)WebPDecodeBGRAInto(data, size, ext_buf, buf_size, stride); 73 } 74 free(ext_buf); 75 } else { 76 size_t luma_size = w * h; 77 const int uv_stride = (w + 1) / 2; 78 size_t u_size = uv_stride * (h + 1) / 2; 79 size_t v_size = uv_stride * (h + 1) / 2; 80 if (value % 0x10 == 0) { 81 if (size & 1) luma_size--; 82 if (size & 2) u_size--; 83 if (size & 4) v_size--; 84 } 85 uint8_t* const luma_buf = (uint8_t*)malloc(luma_size); 86 uint8_t* const u_buf = (uint8_t*)malloc(u_size); 87 uint8_t* const v_buf = (uint8_t*)malloc(v_size); 88 (void)WebPDecodeYUVInto(data, size, luma_buf, luma_size, 89 w /* luma_stride */, u_buf, u_size, uv_stride, 90 v_buf, v_size, uv_stride); 91 free(luma_buf); 92 free(u_buf); 93 free(v_buf); 94 } 95 96 if (buf) WebPFree(buf); 97 } 98 99 } // namespace 100 101 FUZZ_TEST(SimpleApi, SimpleApiTest) 102 .WithDomains( 103 fuzztest::String() 104 .WithMaxSize(fuzz_utils::kMaxWebPFileSize + 1));