2016-01-13 20:57:57 +00:00
|
|
|
/*
|
|
|
|
* Copyright 2016 Google Inc.
|
|
|
|
*
|
|
|
|
* Use of this source code is governed by a BSD-style license that can be
|
|
|
|
* found in the LICENSE file.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef Fuzz_DEFINED
|
|
|
|
#define Fuzz_DEFINED
|
|
|
|
|
|
|
|
#include "SkData.h"
|
2017-01-11 18:58:55 +00:00
|
|
|
#include "../tools/Registry.h"
|
2017-03-27 17:35:15 +00:00
|
|
|
#include "SkMalloc.h"
|
2016-01-13 20:57:57 +00:00
|
|
|
#include "SkTypes.h"
|
|
|
|
|
2016-11-01 19:01:12 +00:00
|
|
|
#include <cmath>
|
2018-01-11 15:27:14 +00:00
|
|
|
#include <signal.h>
|
2016-10-25 13:11:05 +00:00
|
|
|
|
2016-01-13 20:57:57 +00:00
|
|
|
class Fuzz : SkNoncopyable {
|
|
|
|
public:
|
2018-01-11 15:27:14 +00:00
|
|
|
explicit Fuzz(sk_sp<SkData> bytes) : fBytes(bytes), fNextByte(0) {}
|
2016-01-13 20:57:57 +00:00
|
|
|
|
2016-07-19 23:50:03 +00:00
|
|
|
// Returns the total number of "random" bytes available.
|
2018-01-11 15:27:14 +00:00
|
|
|
size_t size() { return fBytes->size(); }
|
2016-11-01 19:01:12 +00:00
|
|
|
// Returns if there are no bytes remaining for fuzzing.
|
2018-01-11 15:27:14 +00:00
|
|
|
bool exhausted(){
|
|
|
|
return fBytes->size() == fNextByte;
|
|
|
|
}
|
2016-07-19 23:50:03 +00:00
|
|
|
|
2016-11-10 21:17:49 +00:00
|
|
|
// next() loads fuzzed bytes into the variable passed in by pointer.
|
|
|
|
// We use this approach instead of T next() because different compilers
|
|
|
|
// evaluate function parameters in different orders. If fuzz->next()
|
|
|
|
// returned 5 and then 7, foo(fuzz->next(), fuzz->next()) would be
|
|
|
|
// foo(5, 7) when compiled on GCC and foo(7, 5) when compiled on Clang.
|
|
|
|
// By requiring params to be passed in, we avoid the temptation to call
|
|
|
|
// next() in a way that does not consume fuzzed bytes in a single
|
2018-02-28 16:46:00 +00:00
|
|
|
// platform-independent order.
|
2016-07-19 23:50:03 +00:00
|
|
|
template <typename T>
|
2016-11-10 21:17:49 +00:00
|
|
|
void next(T* t);
|
|
|
|
|
|
|
|
// This is a convenient way to initialize more than one argument at a time.
|
|
|
|
template <typename Arg, typename... Args>
|
|
|
|
void next(Arg* first, Args... rest);
|
2016-07-19 23:50:03 +00:00
|
|
|
|
2016-11-01 19:01:12 +00:00
|
|
|
// nextRange returns values only in [min, max].
|
2016-11-10 21:17:49 +00:00
|
|
|
template <typename T, typename Min, typename Max>
|
|
|
|
void nextRange(T*, Min, Max);
|
|
|
|
|
|
|
|
// nextN loads n * sizeof(T) bytes into ptr
|
2016-11-01 19:01:12 +00:00
|
|
|
template <typename T>
|
2016-11-10 21:17:49 +00:00
|
|
|
void nextN(T* ptr, int n);
|
2016-10-24 18:53:35 +00:00
|
|
|
|
2018-01-11 15:27:14 +00:00
|
|
|
void signalBug(){
|
|
|
|
// Tell the fuzzer that these inputs found a bug.
|
|
|
|
SkDebugf("Signal bug\n");
|
|
|
|
raise(SIGSEGV);
|
|
|
|
}
|
2016-01-15 13:46:54 +00:00
|
|
|
|
2016-01-13 20:57:57 +00:00
|
|
|
private:
|
2016-01-15 13:46:54 +00:00
|
|
|
template <typename T>
|
|
|
|
T nextT();
|
|
|
|
|
2016-08-03 20:32:32 +00:00
|
|
|
sk_sp<SkData> fBytes;
|
2016-11-01 19:01:12 +00:00
|
|
|
size_t fNextByte;
|
2018-03-30 19:05:13 +00:00
|
|
|
friend void fuzz__MakeEncoderCorpus(Fuzz*);
|
2016-01-13 20:57:57 +00:00
|
|
|
};
|
|
|
|
|
2016-11-01 19:01:12 +00:00
|
|
|
// UBSAN reminds us that bool can only legally hold 0 or 1.
|
|
|
|
template <>
|
2016-11-10 21:17:49 +00:00
|
|
|
inline void Fuzz::next(bool* b) {
|
|
|
|
uint8_t n;
|
|
|
|
this->next(&n);
|
|
|
|
*b = (n & 1) == 1;
|
2016-11-01 19:01:12 +00:00
|
|
|
}
|
|
|
|
|
2016-07-19 23:50:03 +00:00
|
|
|
template <typename T>
|
2016-11-10 21:17:49 +00:00
|
|
|
inline void Fuzz::next(T* n) {
|
2016-11-01 19:01:12 +00:00
|
|
|
if ((fNextByte + sizeof(T)) > fBytes->size()) {
|
2017-02-14 18:35:14 +00:00
|
|
|
sk_bzero(n, sizeof(T));
|
2016-11-10 21:17:49 +00:00
|
|
|
memcpy(n, fBytes->bytes() + fNextByte, fBytes->size() - fNextByte);
|
2016-11-01 19:01:12 +00:00
|
|
|
fNextByte = fBytes->size();
|
2016-11-10 21:17:49 +00:00
|
|
|
return;
|
2016-07-19 23:50:03 +00:00
|
|
|
}
|
2016-11-10 21:17:49 +00:00
|
|
|
memcpy(n, fBytes->bytes() + fNextByte, sizeof(T));
|
2016-07-19 23:50:03 +00:00
|
|
|
fNextByte += sizeof(T);
|
2016-11-10 21:17:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
template <typename Arg, typename... Args>
|
|
|
|
inline void Fuzz::next(Arg* first, Args... rest) {
|
|
|
|
this->next(first);
|
|
|
|
this->next(rest...);
|
2016-11-01 19:01:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
template <>
|
2016-11-10 21:17:49 +00:00
|
|
|
inline void Fuzz::nextRange(float* f, float min, float max) {
|
|
|
|
this->next(f);
|
|
|
|
if (!std::isnormal(*f) && *f != 0.0f) {
|
2016-11-01 19:01:12 +00:00
|
|
|
// Don't deal with infinity or other strange floats.
|
2016-11-10 21:17:49 +00:00
|
|
|
*f = max;
|
2016-11-01 19:01:12 +00:00
|
|
|
}
|
2016-11-10 21:17:49 +00:00
|
|
|
*f = min + std::fmod(std::abs(*f), (max - min + 1));
|
2016-11-01 19:01:12 +00:00
|
|
|
}
|
|
|
|
|
2016-11-10 21:17:49 +00:00
|
|
|
template <typename T, typename Min, typename Max>
|
|
|
|
inline void Fuzz::nextRange(T* n, Min min, Max max) {
|
|
|
|
this->next<T>(n);
|
2016-11-29 16:25:52 +00:00
|
|
|
if (min == max) {
|
|
|
|
*n = min;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (min > max) {
|
2016-11-15 21:07:02 +00:00
|
|
|
// Avoid misuse of nextRange
|
2018-02-27 15:59:10 +00:00
|
|
|
SkDebugf("min > max (%d > %d) \n", min, max);
|
2016-11-15 21:07:02 +00:00
|
|
|
this->signalBug();
|
|
|
|
}
|
|
|
|
if (*n < 0) { // Handle negatives
|
|
|
|
if (*n != std::numeric_limits<T>::lowest()) {
|
|
|
|
*n *= -1;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
*n = std::numeric_limits<T>::max();
|
|
|
|
}
|
2016-11-01 19:01:12 +00:00
|
|
|
}
|
2016-11-15 21:07:02 +00:00
|
|
|
*n = min + (*n % ((size_t)max - min + 1));
|
2016-07-19 23:50:03 +00:00
|
|
|
}
|
|
|
|
|
2016-11-10 21:17:49 +00:00
|
|
|
template <typename T>
|
|
|
|
inline void Fuzz::nextN(T* ptr, int n) {
|
|
|
|
for (int i = 0; i < n; i++) {
|
|
|
|
this->next(ptr+i);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-01-13 20:57:57 +00:00
|
|
|
struct Fuzzable {
|
|
|
|
const char* name;
|
|
|
|
void (*fn)(Fuzz*);
|
|
|
|
};
|
|
|
|
|
2018-02-27 13:30:43 +00:00
|
|
|
// Not static so that we can link these into oss-fuzz harnesses if we like.
|
2017-01-11 18:58:55 +00:00
|
|
|
#define DEF_FUZZ(name, f) \
|
2018-02-27 13:30:43 +00:00
|
|
|
void fuzz_##name(Fuzz*); \
|
2017-01-11 18:58:55 +00:00
|
|
|
sk_tools::Registry<Fuzzable> register_##name({#name, fuzz_##name}); \
|
2018-02-27 13:30:43 +00:00
|
|
|
void fuzz_##name(Fuzz* f)
|
2016-01-13 20:57:57 +00:00
|
|
|
|
|
|
|
#endif//Fuzz_DEFINED
|