2016-01-13 20:57:57 +00:00
|
|
|
/*
|
|
|
|
* Copyright 2016 Google Inc.
|
|
|
|
*
|
|
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
|
|
* found in the LICENSE file.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "Fuzz.h"
|
2016-01-21 13:03:28 +00:00
|
|
|
#include "SkCanvas.h"
|
|
|
|
#include "SkCodec.h"
|
2016-01-15 14:19:53 +00:00
|
|
|
#include "SkCommandLineFlags.h"
|
2016-01-21 13:03:28 +00:00
|
|
|
#include "SkData.h"
|
|
|
|
#include "SkImage.h"
|
|
|
|
#include "SkImageEncoder.h"
|
|
|
|
#include "SkMallocPixelRef.h"
|
2017-01-06 13:26:56 +00:00
|
|
|
#include "SkOSFile.h"
|
|
|
|
#include "SkOSPath.h"
|
2017-03-16 16:30:43 +00:00
|
|
|
#include "SkPaint.h"
|
2017-02-27 21:42:03 +00:00
|
|
|
#include "SkPath.h"
|
2016-07-19 23:50:03 +00:00
|
|
|
#include "SkPicture.h"
|
2018-01-03 19:38:48 +00:00
|
|
|
#include "SkPipe.h"
|
2017-12-06 21:09:20 +00:00
|
|
|
#include "SkReadBuffer.h"
|
2017-02-27 21:42:03 +00:00
|
|
|
#include "SkStream.h"
|
|
|
|
#include "SkSurface.h"
|
2017-11-21 22:13:35 +00:00
|
|
|
#include "SkTextBlob.h"
|
2017-02-27 21:42:03 +00:00
|
|
|
|
2016-11-11 20:16:46 +00:00
|
|
|
#if SK_SUPPORT_GPU
|
2016-10-18 17:06:24 +00:00
|
|
|
#include "SkSLCompiler.h"
|
2016-11-11 20:16:46 +00:00
|
|
|
#endif
|
2016-01-21 13:03:28 +00:00
|
|
|
|
2018-05-04 19:01:03 +00:00
|
|
|
#if defined(SK_ENABLE_SKOTTIE)
|
|
|
|
#include "Skottie.h"
|
|
|
|
#endif
|
|
|
|
|
2017-02-27 21:42:03 +00:00
|
|
|
#include <iostream>
|
2018-04-24 17:58:16 +00:00
|
|
|
#include <map>
|
2018-04-23 20:44:55 +00:00
|
|
|
#include <regex>
|
2016-01-15 13:46:54 +00:00
|
|
|
#include <signal.h>
|
2016-11-23 15:55:18 +00:00
|
|
|
#include "sk_tool_utils.h"
|
|
|
|
|
2018-01-11 15:27:14 +00:00
|
|
|
|
2017-02-27 21:42:03 +00:00
|
|
|
DEFINE_string2(bytes, b, "", "A path to a file or a directory. If a file, the "
|
|
|
|
"contents will be used as the fuzz bytes. If a directory, all files "
|
|
|
|
"in the directory will be used as fuzz bytes for the fuzzer, one at a "
|
|
|
|
"time.");
|
2016-01-21 14:13:52 +00:00
|
|
|
DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name.");
|
2017-02-27 21:42:03 +00:00
|
|
|
DEFINE_string2(dump, d, "", "If not empty, dump 'image*' or 'skp' types as a "
|
|
|
|
"PNG with this name.");
|
2018-01-09 17:47:33 +00:00
|
|
|
DEFINE_bool2(verbose, v, false, "Print more information while fuzzing.");
|
|
|
|
DEFINE_string2(type, t, "", "How to interpret --bytes, one of:\n"
|
2018-02-12 13:26:39 +00:00
|
|
|
"animated_image_decode\n"
|
2018-01-09 17:47:33 +00:00
|
|
|
"api\n"
|
|
|
|
"color_deserialize\n"
|
|
|
|
"filter_fuzz (equivalent to Chrome's filter_fuzz_stub)\n"
|
2018-02-12 13:26:39 +00:00
|
|
|
"image_decode\n"
|
2018-01-09 17:47:33 +00:00
|
|
|
"image_mode\n"
|
|
|
|
"image_scale\n"
|
|
|
|
"path_deserialize\n"
|
|
|
|
"pipe\n"
|
|
|
|
"region_deserialize\n"
|
2018-01-11 15:27:14 +00:00
|
|
|
"region_set_path\n"
|
2018-01-09 17:47:33 +00:00
|
|
|
"skp\n"
|
|
|
|
"sksl2glsl\n"
|
2018-05-03 20:26:10 +00:00
|
|
|
"skottie_json\n"
|
2018-01-09 17:47:33 +00:00
|
|
|
"textblob");
|
2016-01-21 13:03:28 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static int fuzz_file(SkString path, SkString type);
|
2016-02-17 00:14:23 +00:00
|
|
|
static uint8_t calculate_option(SkData*);
|
2018-04-23 20:44:55 +00:00
|
|
|
static SkString try_auto_detect(SkString path, SkString* name);
|
2016-01-21 13:03:28 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static void fuzz_api(sk_sp<SkData> bytes, SkString name);
|
2017-01-06 13:26:56 +00:00
|
|
|
static void fuzz_color_deserialize(sk_sp<SkData>);
|
2017-11-21 22:13:35 +00:00
|
|
|
static void fuzz_filter_fuzz(sk_sp<SkData>);
|
2018-02-12 13:26:39 +00:00
|
|
|
static void fuzz_img2(sk_sp<SkData>);
|
|
|
|
static void fuzz_animated_img(sk_sp<SkData>);
|
2017-02-14 18:12:37 +00:00
|
|
|
static void fuzz_img(sk_sp<SkData>, uint8_t, uint8_t);
|
2017-01-06 18:48:19 +00:00
|
|
|
static void fuzz_path_deserialize(sk_sp<SkData>);
|
2017-02-20 22:47:18 +00:00
|
|
|
static void fuzz_region_deserialize(sk_sp<SkData>);
|
2018-01-11 15:27:14 +00:00
|
|
|
static void fuzz_region_set_path(sk_sp<SkData>);
|
2017-02-14 18:12:37 +00:00
|
|
|
static void fuzz_skp(sk_sp<SkData>);
|
2018-01-03 19:38:48 +00:00
|
|
|
static void fuzz_skpipe(sk_sp<SkData>);
|
2017-11-21 22:13:35 +00:00
|
|
|
static void fuzz_textblob_deserialize(sk_sp<SkData>);
|
2017-03-16 16:30:43 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static void print_api_names();
|
|
|
|
|
2016-11-11 20:16:46 +00:00
|
|
|
#if SK_SUPPORT_GPU
|
2017-01-06 13:26:56 +00:00
|
|
|
static void fuzz_sksl2glsl(sk_sp<SkData>);
|
2016-11-11 20:16:46 +00:00
|
|
|
#endif
|
2016-01-13 20:57:57 +00:00
|
|
|
|
2018-05-04 19:01:03 +00:00
|
|
|
#if defined(SK_ENABLE_SKOTTIE)
|
|
|
|
static void fuzz_skottie_json(sk_sp<SkData>);
|
|
|
|
#endif
|
|
|
|
|
2016-01-13 20:57:57 +00:00
|
|
|
int main(int argc, char** argv) {
|
2018-01-09 17:47:33 +00:00
|
|
|
SkCommandLineFlags::SetUsage("Usage: fuzz -t <type> -b <path/to/file> [-n api-to-fuzz]\n"
|
2018-04-23 20:44:55 +00:00
|
|
|
" fuzz -b <path/to/file>\n"
|
|
|
|
"--help lists the valid types. If type is not specified,\n"
|
|
|
|
"fuzz will make a guess based on the name of the file.\n");
|
2016-01-15 14:19:53 +00:00
|
|
|
SkCommandLineFlags::Parse(argc, argv);
|
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
SkString path = SkString(FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]);
|
|
|
|
SkString type = SkString(FLAGS_type.isEmpty() ? "" : FLAGS_type[0]);
|
2017-01-06 13:26:56 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
if (!sk_isdir(path.c_str())) {
|
|
|
|
return fuzz_file(path, type);
|
2017-01-06 13:26:56 +00:00
|
|
|
}
|
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
SkOSFile::Iter it(path.c_str());
|
2017-01-06 13:26:56 +00:00
|
|
|
for (SkString file; it.next(&file); ) {
|
2018-04-23 20:44:55 +00:00
|
|
|
SkString p = SkOSPath::Join(path.c_str(), file.c_str());
|
2017-01-06 13:26:56 +00:00
|
|
|
SkDebugf("Fuzzing %s\n", p.c_str());
|
2018-04-23 20:44:55 +00:00
|
|
|
int rv = fuzz_file(p, type);
|
2017-01-06 13:26:56 +00:00
|
|
|
if (rv != 0) {
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static int fuzz_file(SkString path, SkString type) {
|
|
|
|
sk_sp<SkData> bytes(SkData::MakeFromFileName(path.c_str()));
|
2016-01-21 13:03:28 +00:00
|
|
|
if (!bytes) {
|
2018-04-23 20:44:55 +00:00
|
|
|
SkDebugf("Could not read %s\n", path.c_str());
|
2017-01-06 13:26:56 +00:00
|
|
|
return 1;
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
2016-01-13 20:57:57 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
SkString name = SkString(FLAGS_name.isEmpty() ? "" : FLAGS_name[0]);
|
|
|
|
|
|
|
|
if (type.isEmpty()) {
|
|
|
|
type = try_auto_detect(path, &name);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (type.isEmpty()) {
|
|
|
|
SkDebugf("Could not autodetect type of %s\n", path.c_str());
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (type.equals("animated_image_decode")) {
|
|
|
|
fuzz_animated_img(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("api")) {
|
|
|
|
fuzz_api(bytes, name);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("color_deserialize")) {
|
|
|
|
fuzz_color_deserialize(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("image_decode")) {
|
|
|
|
fuzz_img2(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("image_scale")) {
|
|
|
|
uint8_t option = calculate_option(bytes.get());
|
|
|
|
fuzz_img(bytes, option, 0);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("image_mode")) {
|
|
|
|
uint8_t option = calculate_option(bytes.get());
|
|
|
|
fuzz_img(bytes, 0, option);
|
|
|
|
return 0;
|
|
|
|
}
|
2018-05-03 20:26:10 +00:00
|
|
|
if (type.equals("filter_fuzz")) {
|
|
|
|
fuzz_filter_fuzz(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
2018-04-23 20:44:55 +00:00
|
|
|
if (type.equals("path_deserialize")) {
|
|
|
|
fuzz_path_deserialize(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("region_deserialize")) {
|
|
|
|
fuzz_region_deserialize(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("region_set_path")) {
|
|
|
|
fuzz_region_set_path(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("pipe")) {
|
|
|
|
fuzz_skpipe(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
2018-05-04 19:01:03 +00:00
|
|
|
#if defined(SK_ENABLE_SKOTTIE)
|
2018-05-03 20:26:10 +00:00
|
|
|
if (type.equals("skottie_json")) {
|
|
|
|
fuzz_skottie_json(bytes);
|
2018-04-23 20:44:55 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2018-05-04 19:01:03 +00:00
|
|
|
#endif
|
2018-05-03 20:26:10 +00:00
|
|
|
if (type.equals("skp")) {
|
|
|
|
fuzz_skp(bytes);
|
2018-04-23 20:44:55 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (type.equals("textblob")) {
|
|
|
|
fuzz_textblob_deserialize(bytes);
|
|
|
|
return 0;
|
|
|
|
}
|
2016-11-11 20:16:46 +00:00
|
|
|
#if SK_SUPPORT_GPU
|
2018-04-23 20:44:55 +00:00
|
|
|
if (type.equals("sksl2glsl")) {
|
|
|
|
fuzz_sksl2glsl(bytes);
|
|
|
|
return 0;
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
2018-04-23 20:44:55 +00:00
|
|
|
#endif
|
2018-05-29 13:22:06 +00:00
|
|
|
SkDebugf("Unknown type %s\n", type.c_str());
|
2018-01-09 17:47:33 +00:00
|
|
|
SkCommandLineFlags::PrintUsage();
|
|
|
|
return 1;
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static std::map<std::string, std::string> cf_api_map = {
|
|
|
|
{"api_draw_functions", "DrawFunctions"},
|
|
|
|
{"api_gradients", "Gradients"},
|
|
|
|
{"api_image_filter", "ImageFilter"},
|
|
|
|
{"api_mock_gpu_canvas", "MockGPUCanvas"},
|
|
|
|
{"api_null_canvas", "NullCanvas"},
|
|
|
|
{"api_path_measure", "PathMeasure"},
|
|
|
|
{"api_raster_n32_canvas", "RasterN32Canvas"},
|
|
|
|
{"jpeg_encoder", "JPEGEncoder"},
|
|
|
|
{"png_encoder", "PNGEncoder"},
|
|
|
|
{"webp_encoder", "WEBPEncoder"}
|
|
|
|
};
|
|
|
|
|
|
|
|
static std::map<std::string, std::string> cf_map = {
|
|
|
|
{"animated_image_decode", "animated_image_decode"},
|
|
|
|
{"image_decode", "image_decode"},
|
|
|
|
{"image_filter_deserialize", "filter_fuzz"},
|
|
|
|
{"image_filter_deserialize_width", "filter_fuzz"},
|
|
|
|
{"path_deserialize", "path_deserialize"},
|
|
|
|
{"region_deserialize", "region_deserialize"},
|
|
|
|
{"region_set_path", "region_set_path"},
|
|
|
|
{"textblob_deserialize", "textblob"}
|
|
|
|
};
|
|
|
|
|
|
|
|
static SkString try_auto_detect(SkString path, SkString* name) {
|
|
|
|
std::cmatch m;
|
|
|
|
std::regex clusterfuzz("clusterfuzz-testcase(-minimized)?-([a-z0-9_]+)-[\\d]+");
|
|
|
|
std::regex skiafuzzer("(api-)?(\\w+)-[a-f0-9]+");
|
|
|
|
|
|
|
|
if (std::regex_search(path.c_str(), m, clusterfuzz)) {
|
|
|
|
std::string type = m.str(2);
|
|
|
|
if (type.find("api_") != std::string::npos || type.find("_encoder") != std::string::npos) {
|
|
|
|
if (cf_api_map.find(type) != cf_api_map.end()) {
|
|
|
|
*name = SkString(cf_api_map[type].c_str()); //probably wrong
|
|
|
|
return SkString("api");
|
|
|
|
} else {
|
|
|
|
SkDebugf("Unrecognized api name %s\n", type.c_str());
|
|
|
|
print_api_names();
|
|
|
|
return SkString("");
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
if (cf_map.find(type) != cf_map.end()) {
|
|
|
|
return SkString(cf_map[type].c_str());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else if (std::regex_search(path.c_str(), m, skiafuzzer)) {
|
|
|
|
std::string a1 = m.str(1);
|
|
|
|
std::string typeOrName = m.str(2);
|
|
|
|
if (a1.length() > 0) {
|
|
|
|
// it's an api fuzzer
|
|
|
|
*name = SkString(typeOrName.c_str());
|
|
|
|
return SkString("api");
|
|
|
|
} else {
|
|
|
|
return SkString(typeOrName.c_str());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return SkString("");
|
|
|
|
}
|
|
|
|
|
2018-05-04 19:01:03 +00:00
|
|
|
#if defined(SK_ENABLE_SKOTTIE)
|
2018-05-03 20:26:10 +00:00
|
|
|
void FuzzSkottieJSON(sk_sp<SkData> bytes);
|
|
|
|
|
|
|
|
static void fuzz_skottie_json(sk_sp<SkData> bytes){
|
|
|
|
FuzzSkottieJSON(bytes);
|
|
|
|
SkDebugf("[terminated] Done animating!\n");
|
|
|
|
}
|
2018-05-04 19:01:03 +00:00
|
|
|
#endif
|
2018-05-03 20:26:10 +00:00
|
|
|
|
2016-02-17 00:14:23 +00:00
|
|
|
// This adds up the first 1024 bytes and returns it as an 8 bit integer. This allows afl-fuzz to
|
|
|
|
// deterministically excercise different paths, or *options* (such as different scaling sizes or
|
|
|
|
// different image modes) without needing to introduce a parameter. This way we don't need a
|
|
|
|
// image_scale1, image_scale2, image_scale4, etc fuzzer, we can just have a image_scale fuzzer.
|
|
|
|
// Clients are expected to transform this number into a different range, e.g. with modulo (%).
|
|
|
|
static uint8_t calculate_option(SkData* bytes) {
|
|
|
|
uint8_t total = 0;
|
|
|
|
const uint8_t* data = bytes->bytes();
|
|
|
|
for (size_t i = 0; i < 1024 && i < bytes->size(); i++) {
|
|
|
|
total += data[i];
|
|
|
|
}
|
|
|
|
return total;
|
|
|
|
}
|
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static void print_api_names(){
|
|
|
|
SkDebugf("When using --type api, please choose an API to fuzz with --name/-n:\n");
|
|
|
|
for (auto r = sk_tools::Registry<Fuzzable>::Head(); r; r = r->next()) {
|
|
|
|
auto fuzzable = r->factory();
|
|
|
|
SkDebugf("\t%s\n", fuzzable.name);
|
|
|
|
}
|
|
|
|
}
|
2016-01-21 14:13:52 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
static void fuzz_api(sk_sp<SkData> bytes, SkString name) {
|
2017-01-11 18:58:55 +00:00
|
|
|
for (auto r = sk_tools::Registry<Fuzzable>::Head(); r; r = r->next()) {
|
2016-01-13 20:57:57 +00:00
|
|
|
auto fuzzable = r->factory();
|
2018-04-23 20:44:55 +00:00
|
|
|
if (name.equals(fuzzable.name)) {
|
2016-01-15 14:19:53 +00:00
|
|
|
SkDebugf("Fuzzing %s...\n", fuzzable.name);
|
2017-03-01 15:42:45 +00:00
|
|
|
Fuzz fuzz(std::move(bytes));
|
2016-01-13 20:57:57 +00:00
|
|
|
fuzzable.fn(&fuzz);
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("[terminated] Success!\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-01-13 20:57:57 +00:00
|
|
|
}
|
|
|
|
}
|
2016-01-21 14:13:52 +00:00
|
|
|
|
2018-04-23 20:44:55 +00:00
|
|
|
print_api_names();
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void dump_png(SkBitmap bitmap) {
|
|
|
|
if (!FLAGS_dump.isEmpty()) {
|
2016-11-23 15:55:18 +00:00
|
|
|
sk_tool_utils::EncodeImageToFile(FLAGS_dump[0], bitmap, SkEncodedImageFormat::kPNG, 100);
|
2016-01-21 13:03:28 +00:00
|
|
|
SkDebugf("Dumped to %s\n", FLAGS_dump[0]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-02-12 13:26:39 +00:00
|
|
|
void FuzzAnimatedImage(sk_sp<SkData> bytes);
|
|
|
|
|
|
|
|
static void fuzz_animated_img(sk_sp<SkData> bytes) {
|
|
|
|
FuzzAnimatedImage(bytes);
|
|
|
|
SkDebugf("[terminated] Didn't crash while decoding/drawing animated image!\n");
|
|
|
|
}
|
|
|
|
|
|
|
|
void FuzzImage(sk_sp<SkData> bytes);
|
|
|
|
|
|
|
|
static void fuzz_img2(sk_sp<SkData> bytes) {
|
|
|
|
FuzzImage(bytes);
|
|
|
|
SkDebugf("[terminated] Didn't crash while decoding/drawing image!\n");
|
|
|
|
}
|
|
|
|
|
2017-01-06 13:26:56 +00:00
|
|
|
static void fuzz_img(sk_sp<SkData> bytes, uint8_t scale, uint8_t mode) {
|
2016-02-17 00:14:23 +00:00
|
|
|
// We can scale 1x, 2x, 4x, 8x, 16x
|
|
|
|
scale = scale % 5;
|
2016-02-18 14:27:38 +00:00
|
|
|
float fscale = (float)pow(2.0f, scale);
|
|
|
|
SkDebugf("Scaling factor: %f\n", fscale);
|
2016-02-17 00:14:23 +00:00
|
|
|
|
2016-12-08 14:07:56 +00:00
|
|
|
// We have 5 different modes of decoding.
|
|
|
|
mode = mode % 5;
|
2016-02-17 00:14:23 +00:00
|
|
|
SkDebugf("Mode: %d\n", mode);
|
|
|
|
|
|
|
|
// This is mostly copied from DMSrcSink's CodecSrc::draw method.
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("Decoding\n");
|
2017-07-23 19:30:02 +00:00
|
|
|
std::unique_ptr<SkCodec> codec(SkCodec::MakeFromData(bytes));
|
2016-01-21 13:03:28 +00:00
|
|
|
if (nullptr == codec.get()) {
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("[terminated] Couldn't create codec.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
SkImageInfo decodeInfo = codec->getInfo();
|
2016-02-17 00:14:23 +00:00
|
|
|
SkISize size = codec->getScaledDimensions(fscale);
|
|
|
|
decodeInfo = decodeInfo.makeWH(size.width(), size.height());
|
|
|
|
|
2016-01-21 13:03:28 +00:00
|
|
|
SkBitmap bitmap;
|
|
|
|
SkCodec::Options options;
|
|
|
|
options.fZeroInitialized = SkCodec::kYes_ZeroInitialized;
|
|
|
|
|
2017-07-18 14:53:11 +00:00
|
|
|
if (!bitmap.tryAllocPixelsFlags(decodeInfo, SkBitmap::kZeroPixels_AllocFlag)) {
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("[terminated] Could not allocate memory. Image might be too large (%d x %d)",
|
2016-02-17 00:14:23 +00:00
|
|
|
decodeInfo.width(), decodeInfo.height());
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
|
|
|
|
2016-02-17 00:14:23 +00:00
|
|
|
switch (mode) {
|
|
|
|
case 0: {//kCodecZeroInit_Mode, kCodec_Mode
|
2017-07-11 17:35:31 +00:00
|
|
|
switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(), &options)) {
|
2016-02-17 00:14:23 +00:00
|
|
|
case SkCodec::kSuccess:
|
|
|
|
SkDebugf("[terminated] Success!\n");
|
|
|
|
break;
|
|
|
|
case SkCodec::kIncompleteInput:
|
|
|
|
SkDebugf("[terminated] Partial Success\n");
|
|
|
|
break;
|
2017-07-06 16:26:09 +00:00
|
|
|
case SkCodec::kErrorInInput:
|
|
|
|
SkDebugf("[terminated] Partial Success with error\n");
|
|
|
|
break;
|
2016-02-17 00:14:23 +00:00
|
|
|
case SkCodec::kInvalidConversion:
|
|
|
|
SkDebugf("Incompatible colortype conversion\n");
|
|
|
|
// Crash to allow afl-fuzz to know this was a bug.
|
|
|
|
raise(SIGSEGV);
|
|
|
|
default:
|
|
|
|
SkDebugf("[terminated] Couldn't getPixels.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 1: {//kScanline_Mode
|
2017-07-11 17:35:31 +00:00
|
|
|
if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)) {
|
|
|
|
SkDebugf("[terminated] Could not start scanline decoder\n");
|
|
|
|
return;
|
|
|
|
}
|
2016-02-17 00:14:23 +00:00
|
|
|
|
|
|
|
void* dst = bitmap.getAddr(0, 0);
|
|
|
|
size_t rowBytes = bitmap.rowBytes();
|
|
|
|
uint32_t height = decodeInfo.height();
|
2018-04-06 19:28:23 +00:00
|
|
|
// We do not need to check the return value. On an incomplete
|
|
|
|
// image, memory will be filled with a default value.
|
|
|
|
codec->getScanlines(dst, height, rowBytes);
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("[terminated] Success!\n");
|
2016-01-21 13:03:28 +00:00
|
|
|
break;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
case 2: { //kStripe_Mode
|
|
|
|
const int height = decodeInfo.height();
|
|
|
|
// This value is chosen arbitrarily. We exercise more cases by choosing a value that
|
|
|
|
// does not align with image blocks.
|
|
|
|
const int stripeHeight = 37;
|
|
|
|
const int numStripes = (height + stripeHeight - 1) / stripeHeight;
|
|
|
|
|
|
|
|
// Decode odd stripes
|
2017-07-11 17:35:31 +00:00
|
|
|
if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)
|
2016-02-17 00:14:23 +00:00
|
|
|
|| SkCodec::kTopDown_SkScanlineOrder != codec->getScanlineOrder()) {
|
|
|
|
// This mode was designed to test the new skip scanlines API in libjpeg-turbo.
|
|
|
|
// Jpegs have kTopDown_SkScanlineOrder, and at this time, it is not interesting
|
|
|
|
// to run this test for image types that do not have this scanline ordering.
|
|
|
|
SkDebugf("[terminated] Could not start top-down scanline decoder\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for (int i = 0; i < numStripes; i += 2) {
|
|
|
|
// Skip a stripe
|
|
|
|
const int linesToSkip = SkTMin(stripeHeight, height - i * stripeHeight);
|
|
|
|
codec->skipScanlines(linesToSkip);
|
|
|
|
|
|
|
|
// Read a stripe
|
|
|
|
const int startY = (i + 1) * stripeHeight;
|
|
|
|
const int linesToRead = SkTMin(stripeHeight, height - startY);
|
|
|
|
if (linesToRead > 0) {
|
|
|
|
codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Decode even stripes
|
2017-07-11 17:35:31 +00:00
|
|
|
const SkCodec::Result startResult = codec->startScanlineDecode(decodeInfo);
|
2016-02-17 00:14:23 +00:00
|
|
|
if (SkCodec::kSuccess != startResult) {
|
|
|
|
SkDebugf("[terminated] Failed to restart scanline decoder with same parameters.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
for (int i = 0; i < numStripes; i += 2) {
|
|
|
|
// Read a stripe
|
|
|
|
const int startY = i * stripeHeight;
|
|
|
|
const int linesToRead = SkTMin(stripeHeight, height - startY);
|
|
|
|
codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
|
|
|
|
|
|
|
|
// Skip a stripe
|
|
|
|
const int linesToSkip = SkTMin(stripeHeight, height - (i + 1) * stripeHeight);
|
|
|
|
if (linesToSkip > 0) {
|
|
|
|
codec->skipScanlines(linesToSkip);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
SkDebugf("[terminated] Success!\n");
|
2016-01-21 13:03:28 +00:00
|
|
|
break;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
case 3: { //kSubset_Mode
|
|
|
|
// Arbitrarily choose a divisor.
|
|
|
|
int divisor = 2;
|
|
|
|
// Total width/height of the image.
|
|
|
|
const int W = codec->getInfo().width();
|
|
|
|
const int H = codec->getInfo().height();
|
|
|
|
if (divisor > W || divisor > H) {
|
|
|
|
SkDebugf("[terminated] Cannot codec subset: divisor %d is too big "
|
|
|
|
"with dimensions (%d x %d)\n", divisor, W, H);
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
// subset dimensions
|
|
|
|
// SkWebpCodec, the only one that supports subsets, requires even top/left boundaries.
|
|
|
|
const int w = SkAlign2(W / divisor);
|
|
|
|
const int h = SkAlign2(H / divisor);
|
|
|
|
SkIRect subset;
|
|
|
|
SkCodec::Options opts;
|
|
|
|
opts.fSubset = ⊂
|
|
|
|
SkBitmap subsetBm;
|
|
|
|
// We will reuse pixel memory from bitmap.
|
|
|
|
void* pixels = bitmap.getPixels();
|
|
|
|
// Keep track of left and top (for drawing subsetBm into canvas). We could use
|
|
|
|
// fscale * x and fscale * y, but we want integers such that the next subset will start
|
|
|
|
// where the last one ended. So we'll add decodeInfo.width() and height().
|
|
|
|
int left = 0;
|
|
|
|
for (int x = 0; x < W; x += w) {
|
|
|
|
int top = 0;
|
|
|
|
for (int y = 0; y < H; y+= h) {
|
|
|
|
// Do not make the subset go off the edge of the image.
|
|
|
|
const int preScaleW = SkTMin(w, W - x);
|
|
|
|
const int preScaleH = SkTMin(h, H - y);
|
|
|
|
subset.setXYWH(x, y, preScaleW, preScaleH);
|
|
|
|
// And fscale
|
|
|
|
// FIXME: Should we have a version of getScaledDimensions that takes a subset
|
|
|
|
// into account?
|
|
|
|
decodeInfo = decodeInfo.makeWH(
|
|
|
|
SkTMax(1, SkScalarRoundToInt(preScaleW * fscale)),
|
|
|
|
SkTMax(1, SkScalarRoundToInt(preScaleH * fscale)));
|
|
|
|
size_t rowBytes = decodeInfo.minRowBytes();
|
2017-07-11 17:35:31 +00:00
|
|
|
if (!subsetBm.installPixels(decodeInfo, pixels, rowBytes)) {
|
2016-02-17 00:14:23 +00:00
|
|
|
SkDebugf("[terminated] Could not install pixels.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
const SkCodec::Result result = codec->getPixels(decodeInfo, pixels, rowBytes,
|
2017-07-11 17:35:31 +00:00
|
|
|
&opts);
|
2016-02-17 00:14:23 +00:00
|
|
|
switch (result) {
|
|
|
|
case SkCodec::kSuccess:
|
|
|
|
case SkCodec::kIncompleteInput:
|
2017-07-06 16:26:09 +00:00
|
|
|
case SkCodec::kErrorInInput:
|
2016-02-17 00:14:23 +00:00
|
|
|
SkDebugf("okay\n");
|
|
|
|
break;
|
|
|
|
case SkCodec::kInvalidConversion:
|
|
|
|
if (0 == (x|y)) {
|
|
|
|
// First subset is okay to return unimplemented.
|
|
|
|
SkDebugf("[terminated] Incompatible colortype conversion\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
// If the first subset succeeded, a later one should not fail.
|
|
|
|
// fall through to failure
|
|
|
|
case SkCodec::kUnimplemented:
|
|
|
|
if (0 == (x|y)) {
|
|
|
|
// First subset is okay to return unimplemented.
|
|
|
|
SkDebugf("[terminated] subset codec not supported\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
// If the first subset succeeded, why would a later one fail?
|
|
|
|
// fall through to failure
|
|
|
|
default:
|
|
|
|
SkDebugf("[terminated] subset codec failed to decode (%d, %d, %d, %d) "
|
|
|
|
"with dimensions (%d x %d)\t error %d\n",
|
|
|
|
x, y, decodeInfo.width(), decodeInfo.height(),
|
|
|
|
W, H, result);
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-02-17 00:14:23 +00:00
|
|
|
}
|
|
|
|
// translate by the scaled height.
|
|
|
|
top += decodeInfo.height();
|
|
|
|
}
|
|
|
|
// translate by the scaled width.
|
|
|
|
left += decodeInfo.width();
|
|
|
|
}
|
|
|
|
SkDebugf("[terminated] Success!\n");
|
|
|
|
break;
|
|
|
|
}
|
2016-12-08 14:07:56 +00:00
|
|
|
case 4: { //kAnimated_Mode
|
|
|
|
std::vector<SkCodec::FrameInfo> frameInfos = codec->getFrameInfo();
|
|
|
|
if (frameInfos.size() == 0) {
|
|
|
|
SkDebugf("[terminated] Not an animated image\n");
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (size_t i = 0; i < frameInfos.size(); i++) {
|
|
|
|
options.fFrameIndex = i;
|
|
|
|
auto result = codec->startIncrementalDecode(decodeInfo, bitmap.getPixels(),
|
|
|
|
bitmap.rowBytes(), &options);
|
|
|
|
if (SkCodec::kSuccess != result) {
|
|
|
|
SkDebugf("[terminated] failed to start incremental decode "
|
|
|
|
"in frame %d with error %d\n", i, result);
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-12-08 14:07:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
result = codec->incrementalDecode();
|
2017-07-06 16:26:09 +00:00
|
|
|
if (result == SkCodec::kIncompleteInput || result == SkCodec::kErrorInInput) {
|
2016-12-08 14:07:56 +00:00
|
|
|
SkDebugf("okay\n");
|
|
|
|
// Frames beyond this one will not decode.
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (result == SkCodec::kSuccess) {
|
|
|
|
SkDebugf("okay - decoded frame %d\n", i);
|
|
|
|
} else {
|
|
|
|
SkDebugf("[terminated] incremental decode failed with "
|
|
|
|
"error %d\n", result);
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-12-08 14:07:56 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
SkDebugf("[terminated] Success!\n");
|
|
|
|
break;
|
|
|
|
}
|
2016-01-21 13:03:28 +00:00
|
|
|
default:
|
2016-02-17 00:14:23 +00:00
|
|
|
SkDebugf("[terminated] Mode not implemented yet\n");
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
dump_png(bitmap);
|
2016-01-13 20:57:57 +00:00
|
|
|
}
|
|
|
|
|
2017-01-06 13:26:56 +00:00
|
|
|
static void fuzz_skp(sk_sp<SkData> bytes) {
|
2017-12-12 17:52:39 +00:00
|
|
|
SkReadBuffer buf(bytes->data(), bytes->size());
|
2016-01-21 13:03:28 +00:00
|
|
|
SkDebugf("Decoding\n");
|
2017-12-12 17:52:39 +00:00
|
|
|
sk_sp<SkPicture> pic(SkPicture::MakeFromBuffer(buf));
|
2016-01-21 13:03:28 +00:00
|
|
|
if (!pic) {
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("[terminated] Couldn't decode as a picture.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-01-21 13:03:28 +00:00
|
|
|
}
|
|
|
|
SkDebugf("Rendering\n");
|
|
|
|
SkBitmap bitmap;
|
|
|
|
if (!FLAGS_dump.isEmpty()) {
|
|
|
|
SkIRect size = pic->cullRect().roundOut();
|
|
|
|
bitmap.allocN32Pixels(size.width(), size.height());
|
|
|
|
}
|
|
|
|
SkCanvas canvas(bitmap);
|
|
|
|
canvas.drawPicture(pic);
|
2016-02-01 16:23:50 +00:00
|
|
|
SkDebugf("[terminated] Success! Decoded and rendered an SkPicture!\n");
|
2016-01-21 13:03:28 +00:00
|
|
|
dump_png(bitmap);
|
|
|
|
}
|
2016-01-13 20:57:57 +00:00
|
|
|
|
2018-01-03 19:38:48 +00:00
|
|
|
static void fuzz_skpipe(sk_sp<SkData> bytes) {
|
|
|
|
SkPipeDeserializer d;
|
|
|
|
SkDebugf("Decoding\n");
|
|
|
|
sk_sp<SkPicture> pic(d.readPicture(bytes.get()));
|
|
|
|
if (!pic) {
|
|
|
|
SkDebugf("[terminated] Couldn't decode picture via SkPipe.\n");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
SkDebugf("Rendering\n");
|
|
|
|
SkBitmap bitmap;
|
|
|
|
SkCanvas canvas(bitmap);
|
|
|
|
canvas.drawPicture(pic);
|
|
|
|
SkDebugf("[terminated] Success! Decoded and rendered an SkPicture from SkPipe!\n");
|
|
|
|
}
|
|
|
|
|
2017-01-06 13:26:56 +00:00
|
|
|
static void fuzz_color_deserialize(sk_sp<SkData> bytes) {
|
2016-06-23 17:49:27 +00:00
|
|
|
sk_sp<SkColorSpace> space(SkColorSpace::Deserialize(bytes->data(), bytes->size()));
|
|
|
|
if (!space) {
|
|
|
|
SkDebugf("[terminated] Couldn't deserialize Colorspace.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-06-23 17:49:27 +00:00
|
|
|
}
|
|
|
|
SkDebugf("[terminated] Success! deserialized Colorspace.\n");
|
|
|
|
}
|
|
|
|
|
2018-02-08 19:31:24 +00:00
|
|
|
void FuzzPathDeserialize(SkReadBuffer& buf);
|
|
|
|
|
2017-01-06 18:48:19 +00:00
|
|
|
static void fuzz_path_deserialize(sk_sp<SkData> bytes) {
|
2017-12-06 21:09:20 +00:00
|
|
|
SkReadBuffer buf(bytes->data(), bytes->size());
|
2018-02-08 19:31:24 +00:00
|
|
|
FuzzPathDeserialize(buf);
|
|
|
|
SkDebugf("[terminated] path_deserialize didn't crash!\n");
|
2017-01-06 18:48:19 +00:00
|
|
|
}
|
|
|
|
|
2018-01-11 15:27:14 +00:00
|
|
|
bool FuzzRegionDeserialize(sk_sp<SkData> bytes);
|
|
|
|
|
2017-02-20 22:47:18 +00:00
|
|
|
static void fuzz_region_deserialize(sk_sp<SkData> bytes) {
|
2018-01-11 15:27:14 +00:00
|
|
|
if (!FuzzRegionDeserialize(bytes)) {
|
2017-02-20 22:47:18 +00:00
|
|
|
SkDebugf("[terminated] Couldn't initialize SkRegion.\n");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
SkDebugf("[terminated] Success! Initialized SkRegion.\n");
|
|
|
|
}
|
|
|
|
|
2018-02-08 19:31:24 +00:00
|
|
|
void FuzzTextBlobDeserialize(SkReadBuffer& buf);
|
|
|
|
|
2017-11-21 22:13:35 +00:00
|
|
|
static void fuzz_textblob_deserialize(sk_sp<SkData> bytes) {
|
2017-12-06 21:09:20 +00:00
|
|
|
SkReadBuffer buf(bytes->data(), bytes->size());
|
2018-02-08 19:31:24 +00:00
|
|
|
FuzzTextBlobDeserialize(buf);
|
|
|
|
SkDebugf("[terminated] textblob didn't crash!\n");
|
2017-11-21 22:13:35 +00:00
|
|
|
}
|
|
|
|
|
2018-01-11 15:27:14 +00:00
|
|
|
void FuzzRegionSetPath(Fuzz* fuzz);
|
|
|
|
|
|
|
|
static void fuzz_region_set_path(sk_sp<SkData> bytes) {
|
|
|
|
Fuzz fuzz(bytes);
|
|
|
|
FuzzRegionSetPath(&fuzz);
|
|
|
|
SkDebugf("[terminated] region_set_path didn't crash!\n");
|
|
|
|
}
|
|
|
|
|
2018-02-08 19:31:24 +00:00
|
|
|
void FuzzImageFilterDeserialize(sk_sp<SkData> bytes);
|
2017-03-16 16:30:43 +00:00
|
|
|
|
2018-02-08 19:31:24 +00:00
|
|
|
static void fuzz_filter_fuzz(sk_sp<SkData> bytes) {
|
|
|
|
FuzzImageFilterDeserialize(bytes);
|
|
|
|
SkDebugf("[terminated] filter_fuzz didn't crash!\n");
|
2017-03-16 16:30:43 +00:00
|
|
|
}
|
|
|
|
|
2016-11-11 20:16:46 +00:00
|
|
|
#if SK_SUPPORT_GPU
|
2017-01-06 13:26:56 +00:00
|
|
|
static void fuzz_sksl2glsl(sk_sp<SkData> bytes) {
|
2016-10-18 17:06:24 +00:00
|
|
|
SkSL::Compiler compiler;
|
2017-03-31 17:56:23 +00:00
|
|
|
SkSL::String output;
|
2016-12-12 20:33:30 +00:00
|
|
|
SkSL::Program::Settings settings;
|
|
|
|
sk_sp<GrShaderCaps> caps = SkSL::ShaderCapsFactory::Default();
|
|
|
|
settings.fCaps = caps.get();
|
|
|
|
std::unique_ptr<SkSL::Program> program = compiler.convertProgram(SkSL::Program::kFragment_Kind,
|
2017-08-14 18:48:10 +00:00
|
|
|
SkSL::String((const char*) bytes->data()),
|
|
|
|
settings);
|
2016-12-12 20:33:30 +00:00
|
|
|
if (!program || !compiler.toGLSL(*program, &output)) {
|
2016-10-18 17:06:24 +00:00
|
|
|
SkDebugf("[terminated] Couldn't compile input.\n");
|
2017-01-06 13:26:56 +00:00
|
|
|
return;
|
2016-10-18 17:06:24 +00:00
|
|
|
}
|
|
|
|
SkDebugf("[terminated] Success! Compiled input.\n");
|
|
|
|
}
|
2016-11-11 20:16:46 +00:00
|
|
|
#endif
|