AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
3065b5223d
skia2/fuzz/FuzzCommon.cpp
Mike Klein f88f5ef109 simplify nextRange(), fold in nextEnum() 
Doesn't look like we need to distinguish these if we just
write them as the simple

   1) load the right number of bytes
   2) clamp to [min,max]

This makes enum fuzzing independent of its underlying type, and may make
it easier to see the mapping from fuzzed byte stream to
nextRange()/nextEnum() values.

Change-Id: I9f785f94f513a0087ad7151b5e7bc14ddbe9314a
Reviewed-on: https://skia-review.googlesource.com/c/171820
Commit-Queue: Mike Klein <mtklein@google.com>
Commit-Queue: Kevin Lubick <kjlubick@google.com>
Auto-Submit: Mike Klein <mtklein@google.com>
Reviewed-by: Kevin Lubick <kjlubick@google.com>
2018-11-19 18:04:12 +00:00

336 lines
11 KiB
C++
Raw Blame History

/*
* Copyright 2018 Google Inc.
*
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*/
#include "Fuzz.h"
#include "FuzzCommon.h"
// We don't always want to test NaNs and infinities.
static void fuzz_nice_float(Fuzz* fuzz, float* f) {
float v;
fuzz->next(&v);
constexpr float kLimit = 1.0e35f; // FLT_MAX?
*f = (v == v && v <= kLimit && v >= -kLimit) ? v : 0.0f;
}
template <typename... Args>
static void fuzz_nice_float(Fuzz* fuzz, float* f, Args... rest) {
fuzz_nice_float(fuzz, f);
fuzz_nice_float(fuzz, rest...);
}
static void fuzz_nice_rect(Fuzz* fuzz, SkRect* r) {
fuzz_nice_float(fuzz, &r->fLeft, &r->fTop, &r->fRight, &r->fBottom);
r->sort();
}
// allows some float values for path points
void FuzzNicePath(Fuzz* fuzz, SkPath* path, int maxOps) {
if (maxOps <= 0) {
return;
}
uint8_t fillType;
fuzz->nextRange(&fillType, 0, (uint8_t)SkPath::kInverseEvenOdd_FillType);
path->setFillType((SkPath::FillType)fillType);
uint8_t numOps;
fuzz->nextRange(&numOps, 0, maxOps);
for (uint8_t i = 0; i < numOps; ++i) {
uint8_t op;
fuzz->nextRange(&op, 0, 32);
bool test;
SkPath p;
SkMatrix m;
SkRRect rr;
SkRect r;
SkPath::Direction dir;
unsigned int ui;
SkScalar a, b, c, d, e, f;
switch (op) {
case 0:
fuzz_nice_float(fuzz, &a, &b);
path->moveTo(a, b);
break;
case 1:
fuzz_nice_float(fuzz, &a, &b);
path->rMoveTo(a, b);
break;
case 2:
fuzz_nice_float(fuzz, &a, &b);
path->lineTo(a, b);
break;
case 3:
fuzz_nice_float(fuzz, &a, &b);
path->rLineTo(a, b);
break;
case 4:
fuzz_nice_float(fuzz, &a, &b, &c, &d);
path->quadTo(a, b, c, d);
break;
case 5:
fuzz_nice_float(fuzz, &a, &b, &c, &d);
path->rQuadTo(a, b, c, d);
break;
case 6:
fuzz_nice_float(fuzz, &a, &b, &c, &d, &e);
path->conicTo(a, b, c, d, e);
break;
case 7:
fuzz_nice_float(fuzz, &a, &b, &c, &d, &e);
path->rConicTo(a, b, c, d, e);
break;
case 8:
fuzz_nice_float(fuzz, &a, &b, &c, &d, &e, &f);
path->cubicTo(a, b, c, d, e, f);
break;
case 9:
fuzz_nice_float(fuzz, &a, &b, &c, &d, &e, &f);
path->rCubicTo(a, b, c, d, e, f);
break;
case 10:
fuzz_nice_float(fuzz, &a, &b, &c, &d, &e);
path->arcTo(a, b, c, d, e);
break;
case 11:
fuzz_nice_float(fuzz, &a, &b);
fuzz_nice_rect(fuzz, &r);
fuzz->next(&test);
path->arcTo(r, a, b, test);
break;
case 12:
path->close();
break;
case 13:
fuzz_nice_rect(fuzz, &r);
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
path->addRect(r, dir);
break;
case 14:
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
fuzz_nice_rect(fuzz, &r);
fuzz->next(&ui);
path->addRect(r, dir, ui);
break;
case 15:
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
fuzz_nice_rect(fuzz, &r);
path->addOval(r, dir);
break;
case 16:
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
fuzz_nice_rect(fuzz, &r);
fuzz->next(&ui);
path->addOval(r, dir, ui);
break;
case 17:
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
fuzz_nice_float(fuzz, &a, &b, &c);
path->addCircle(a, b, c, dir);
break;
case 18:
fuzz_nice_rect(fuzz, &r);
fuzz_nice_float(fuzz, &a, &b);
path->addArc(r, a, b);
break;
case 19:
fuzz_nice_float(fuzz, &a, &b);
fuzz_nice_rect(fuzz, &r);
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
path->addRoundRect(r, a, b, dir);
break;
case 20:
FuzzNiceRRect(fuzz, &rr);
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
path->addRRect(rr, dir);
break;
case 21:
fuzz->nextRange(&ui, 0, 1);
dir = static_cast<SkPath::Direction>(ui);
FuzzNiceRRect(fuzz, &rr);
path->addRRect(rr, dir, ui);
break;
case 22: {
fuzz->nextRange(&ui, 0, 1);
SkPath::AddPathMode mode = static_cast<SkPath::AddPathMode>(ui);
FuzzNiceMatrix(fuzz, &m);
FuzzNicePath(fuzz, &p, maxOps-1);
path->addPath(p, m, mode);
break;
}
case 23: {
fuzz->nextRange(&ui, 0, 1);
SkPath::AddPathMode mode = static_cast<SkPath::AddPathMode>(ui);
FuzzNiceMatrix(fuzz, &m);
path->addPath(*path, m, mode);
break;
}
case 24:
FuzzNicePath(fuzz, &p, maxOps-1);
path->reverseAddPath(p);
break;
case 25:
path->addPath(*path);
break;
case 26:
path->reverseAddPath(*path);
break;
case 27:
fuzz_nice_float(fuzz, &a, &b);
path->offset(a, b, path);
break;
case 28:
FuzzNicePath(fuzz, &p, maxOps-1);
fuzz_nice_float(fuzz, &a, &b);
p.offset(a, b, path);
break;
case 29:
FuzzNiceMatrix(fuzz, &m);
path->transform(m, path);
break;
case 30:
FuzzNicePath(fuzz, &p, maxOps-1);
FuzzNiceMatrix(fuzz, &m);
p.transform(m, path);
break;
case 31:
fuzz_nice_float(fuzz, &a, &b);
path->setLastPt(a, b);
break;
case 32:
path->shrinkToFit();
break;
default:
SkASSERT(false);
break;
}
SkASSERTF( path->isValid(), "path->isValid() failed at op %d, case %d", i, op);
SkASSERTF(path->pathRefIsValid(), "path->pathRefIsValid() failed at op %d, case %d", i, op);
}
}
// allows all float values for path points
void FuzzEvilPath(Fuzz* fuzz, SkPath* path, int last_verb) {
while (!fuzz->exhausted()) {
// Use a uint8_t to conserve bytes. This makes our "fuzzed bytes footprint"
// smaller, which leads to more efficient fuzzing.
uint8_t operation;
fuzz->next(&operation);
SkScalar a,b,c,d,e,f;
switch (operation % (last_verb + 1)) {
case SkPath::Verb::kMove_Verb:
fuzz->next(&a, &b);
path->moveTo(a, b);
break;
case SkPath::Verb::kLine_Verb:
fuzz->next(&a, &b);
path->lineTo(a, b);
break;
case SkPath::Verb::kQuad_Verb:
fuzz->next(&a, &b, &c, &d);
path->quadTo(a, b, c, d);
break;
case SkPath::Verb::kConic_Verb:
fuzz->next(&a, &b, &c, &d, &e);
path->conicTo(a, b, c, d, e);
break;
case SkPath::Verb::kCubic_Verb:
fuzz->next(&a, &b, &c, &d, &e, &f);
path->cubicTo(a, b, c, d, e, f);
break;
case SkPath::Verb::kClose_Verb:
path->close();
break;
case SkPath::Verb::kDone_Verb:
// In this case, simply exit.
return;
}
}
}
void FuzzNiceRRect(Fuzz* fuzz, SkRRect* rr) {
SkRect r;
fuzz_nice_rect(fuzz, &r);
SkVector radii[4];
for (SkVector& vec : radii) {
fuzz->nextRange(&vec.fX, 0.0f, 1.0f);
vec.fX *= 0.5f * r.width();
fuzz->nextRange(&vec.fY, 0.0f, 1.0f);
vec.fY *= 0.5f * r.height();
}
rr->setRectRadii(r, radii);
SkASSERT(rr->isValid());
}
void FuzzNiceMatrix(Fuzz* fuzz, SkMatrix* m) {
constexpr int kArrayLength = 9;
SkScalar buffer[kArrayLength];
int matrixType;
fuzz->nextRange(&matrixType, 0, 4);
switch (matrixType) {
case 0: // identity
*m = SkMatrix::I();
return;
case 1: // translate
fuzz->nextRange(&buffer[0], -4000.0f, 4000.0f);
fuzz->nextRange(&buffer[1], -4000.0f, 4000.0f);
*m = SkMatrix::MakeTrans(buffer[0], buffer[1]);
return;
case 2: // translate + scale
fuzz->nextRange(&buffer[0], -400.0f, 400.0f);
fuzz->nextRange(&buffer[1], -400.0f, 400.0f);
fuzz->nextRange(&buffer[2], -4000.0f, 4000.0f);
fuzz->nextRange(&buffer[3], -4000.0f, 4000.0f);
*m = SkMatrix::MakeScale(buffer[0], buffer[1]);
m->postTranslate(buffer[2], buffer[3]);
return;
case 3: // affine
fuzz->nextN(buffer, 6);
m->setAffine(buffer);
return;
case 4: // perspective
fuzz->nextN(buffer, kArrayLength);
m->set9(buffer);
return;
default:
SkASSERT(false);
return;
}
}
void FuzzNiceRegion(Fuzz* fuzz, SkRegion* region, int maxN) {
uint8_t N;
fuzz->nextRange(&N, 0, maxN);
for (uint8_t i = 0; i < N; ++i) {
SkIRect r;
SkRegion::Op op;
// Avoid the sentinal value used by Region.
fuzz->nextRange(&r.fLeft, -2147483646, 2147483646);
fuzz->nextRange(&r.fTop, -2147483646, 2147483646);
fuzz->nextRange(&r.fRight, -2147483646, 2147483646);
fuzz->nextRange(&r.fBottom, -2147483646, 2147483646);
r.sort();
fuzz->nextRange(&op, 0, SkRegion::kLastOp);
if (!region->op(r, op)) {
return;
}
}
}
Reference in New Issue View Git Blame Copy Permalink