blob: bb2b1c803e9ab1f3a7a842ef89cc9ff288e688e1 [file] [log] [blame]
mtklein65e58242016-01-13 12:57:57 -08001/*
2 * Copyright 2016 Google Inc.
3 *
4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file.
6 */
7
8#include "Fuzz.h"
kjlubickdba57342016-01-21 05:03:28 -08009#include "SkCanvas.h"
10#include "SkCodec.h"
mtkleinf5e97822016-01-15 06:19:53 -080011#include "SkCommandLineFlags.h"
kjlubickdba57342016-01-21 05:03:28 -080012#include "SkData.h"
Herb Derbya839fc02017-03-16 12:30:43 -040013#include "SkFlattenableSerialization.h"
kjlubickdba57342016-01-21 05:03:28 -080014#include "SkImage.h"
15#include "SkImageEncoder.h"
Herb Derbya839fc02017-03-16 12:30:43 -040016#include "SkImageFilter.h"
kjlubickdba57342016-01-21 05:03:28 -080017#include "SkMallocPixelRef.h"
Kevin Lubickf80f1152017-01-06 08:26:56 -050018#include "SkOSFile.h"
19#include "SkOSPath.h"
Herb Derbya839fc02017-03-16 12:30:43 -040020#include "SkPaint.h"
Hal Canary62176db2017-02-27 16:42:03 -050021#include "SkPath.h"
kjlubicke5654502016-07-19 16:50:03 -070022#include "SkPicture.h"
Hal Canary62176db2017-02-27 16:42:03 -050023#include "SkRegion.h"
24#include "SkStream.h"
25#include "SkSurface.h"
26
Ethan Nicholas7ef4b742016-11-11 15:16:46 -050027#if SK_SUPPORT_GPU
kjlubicke7195772016-10-18 10:06:24 -070028#include "SkSLCompiler.h"
Ethan Nicholas7ef4b742016-11-11 15:16:46 -050029#endif
kjlubickdba57342016-01-21 05:03:28 -080030
Hal Canary62176db2017-02-27 16:42:03 -050031#include <iostream>
mtkleina1159422016-01-15 05:46:54 -080032#include <signal.h>
Hal Canarydb683012016-11-23 08:55:18 -070033#include "sk_tool_utils.h"
34
Hal Canary24ac42b2017-02-14 13:35:14 -050035
Hal Canary62176db2017-02-27 16:42:03 -050036DEFINE_string2(bytes, b, "", "A path to a file or a directory. If a file, the "
37 "contents will be used as the fuzz bytes. If a directory, all files "
38 "in the directory will be used as fuzz bytes for the fuzzer, one at a "
39 "time.");
mtkleind4387ea2016-01-21 06:13:52 -080040DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name.");
kjlubickdba57342016-01-21 05:03:28 -080041
Hal Canary62176db2017-02-27 16:42:03 -050042DEFINE_string2(type, t, "api", "How to interpret --bytes, either 'image_scale'"
43 ", 'image_mode', 'skp', 'icc', or 'api'.");
44DEFINE_string2(dump, d, "", "If not empty, dump 'image*' or 'skp' types as a "
45 "PNG with this name.");
kjlubickdba57342016-01-21 05:03:28 -080046
Kevin Lubickf80f1152017-01-06 08:26:56 -050047static int printUsage() {
48 SkDebugf("Usage: fuzz -t <type> -b <path/to/file> [-n api-to-fuzz]\n");
kjlubickdba57342016-01-21 05:03:28 -080049 return 1;
50}
Kevin Lubickf80f1152017-01-06 08:26:56 -050051static int fuzz_file(const char* path);
kjlubick2a42f482016-02-16 16:14:23 -080052static uint8_t calculate_option(SkData*);
kjlubickdba57342016-01-21 05:03:28 -080053
Kevin Lubickf80f1152017-01-06 08:26:56 -050054static void fuzz_api(sk_sp<SkData>);
Kevin Lubickf80f1152017-01-06 08:26:56 -050055static void fuzz_color_deserialize(sk_sp<SkData>);
Kevin Lubick0168e042017-02-14 13:12:37 -050056static void fuzz_icc(sk_sp<SkData>);
57static void fuzz_img(sk_sp<SkData>, uint8_t, uint8_t);
Kevin Lubickf04c50a2017-01-06 13:48:19 -050058static void fuzz_path_deserialize(sk_sp<SkData>);
Kevin Lubickedee1ae2017-02-20 17:47:18 -050059static void fuzz_region_deserialize(sk_sp<SkData>);
Kevin Lubick0168e042017-02-14 13:12:37 -050060static void fuzz_skp(sk_sp<SkData>);
Herb Derbya839fc02017-03-16 12:30:43 -040061static void fuzz_filter_fuzz(sk_sp<SkData>);
62
Ethan Nicholas7ef4b742016-11-11 15:16:46 -050063#if SK_SUPPORT_GPU
Kevin Lubickf80f1152017-01-06 08:26:56 -050064static void fuzz_sksl2glsl(sk_sp<SkData>);
Ethan Nicholas7ef4b742016-11-11 15:16:46 -050065#endif
mtklein65e58242016-01-13 12:57:57 -080066
67int main(int argc, char** argv) {
mtkleinf5e97822016-01-15 06:19:53 -080068 SkCommandLineFlags::Parse(argc, argv);
69
mtkleind0b82342016-01-15 07:56:20 -080070 const char* path = FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0];
Kevin Lubickf80f1152017-01-06 08:26:56 -050071
72 if (!sk_isdir(path)) {
73 return fuzz_file(path);
74 }
75
76 SkOSFile::Iter it(path);
77 for (SkString file; it.next(&file); ) {
78 SkString p = SkOSPath::Join(path, file.c_str());
79 SkDebugf("Fuzzing %s\n", p.c_str());
80 int rv = fuzz_file(p.c_str());
81 if (rv != 0) {
82 return rv;
83 }
84 }
85 return 0;
86}
87
88static int fuzz_file(const char* path) {
bungeman38d909e2016-08-02 14:40:46 -070089 sk_sp<SkData> bytes(SkData::MakeFromFileName(path));
kjlubickdba57342016-01-21 05:03:28 -080090 if (!bytes) {
91 SkDebugf("Could not read %s\n", path);
Kevin Lubickf80f1152017-01-06 08:26:56 -050092 return 1;
kjlubickdba57342016-01-21 05:03:28 -080093 }
mtklein65e58242016-01-13 12:57:57 -080094
bungeman38d909e2016-08-02 14:40:46 -070095 uint8_t option = calculate_option(bytes.get());
kjlubick2a42f482016-02-16 16:14:23 -080096
mtkleind4387ea2016-01-21 06:13:52 -080097 if (!FLAGS_type.isEmpty()) {
kjlubicke7195772016-10-18 10:06:24 -070098 if (0 == strcmp("api", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -050099 fuzz_api(bytes);
100 return 0;
kjlubicke7195772016-10-18 10:06:24 -0700101 }
102 if (0 == strcmp("color_deserialize", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -0500103 fuzz_color_deserialize(bytes);
104 return 0;
kjlubicke7195772016-10-18 10:06:24 -0700105 }
106 if (0 == strcmp("icc", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -0500107 fuzz_icc(bytes);
108 return 0;
kjlubicke7195772016-10-18 10:06:24 -0700109 }
110 if (0 == strcmp("image_scale", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -0500111 fuzz_img(bytes, option, 0);
112 return 0;
kjlubicke7195772016-10-18 10:06:24 -0700113 }
114 if (0 == strcmp("image_mode", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -0500115 fuzz_img(bytes, 0, option);
116 return 0;
kjlubicke7195772016-10-18 10:06:24 -0700117 }
Kevin Lubickf04c50a2017-01-06 13:48:19 -0500118 if (0 == strcmp("path_deserialize", FLAGS_type[0])) {
119 fuzz_path_deserialize(bytes);
120 return 0;
121 }
Kevin Lubickedee1ae2017-02-20 17:47:18 -0500122 if (0 == strcmp("region_deserialize", FLAGS_type[0])) {
123 fuzz_region_deserialize(bytes);
124 return 0;
125 }
kjlubicke7195772016-10-18 10:06:24 -0700126 if (0 == strcmp("skp", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -0500127 fuzz_skp(bytes);
128 return 0;
kjlubicke7195772016-10-18 10:06:24 -0700129 }
Herb Derbya839fc02017-03-16 12:30:43 -0400130 if (0 == strcmp("filter_fuzz", FLAGS_type[0])) {
131 fuzz_filter_fuzz(bytes);
132 return 0;
133 }
Ethan Nicholas7ef4b742016-11-11 15:16:46 -0500134#if SK_SUPPORT_GPU
kjlubicke7195772016-10-18 10:06:24 -0700135 if (0 == strcmp("sksl2glsl", FLAGS_type[0])) {
Kevin Lubickf80f1152017-01-06 08:26:56 -0500136 fuzz_sksl2glsl(bytes);
137 return 0;
mtkleind4387ea2016-01-21 06:13:52 -0800138 }
Ethan Nicholas7ef4b742016-11-11 15:16:46 -0500139#endif
kjlubickdba57342016-01-21 05:03:28 -0800140 }
Kevin Lubickf80f1152017-01-06 08:26:56 -0500141 return printUsage();
kjlubickdba57342016-01-21 05:03:28 -0800142}
143
kjlubick2a42f482016-02-16 16:14:23 -0800144// This adds up the first 1024 bytes and returns it as an 8 bit integer. This allows afl-fuzz to
145// deterministically excercise different paths, or *options* (such as different scaling sizes or
146// different image modes) without needing to introduce a parameter. This way we don't need a
147// image_scale1, image_scale2, image_scale4, etc fuzzer, we can just have a image_scale fuzzer.
148// Clients are expected to transform this number into a different range, e.g. with modulo (%).
149static uint8_t calculate_option(SkData* bytes) {
150 uint8_t total = 0;
151 const uint8_t* data = bytes->bytes();
152 for (size_t i = 0; i < 1024 && i < bytes->size(); i++) {
153 total += data[i];
154 }
155 return total;
156}
157
Kevin Lubickf80f1152017-01-06 08:26:56 -0500158static void fuzz_api(sk_sp<SkData> bytes) {
mtkleind4387ea2016-01-21 06:13:52 -0800159 const char* name = FLAGS_name.isEmpty() ? "" : FLAGS_name[0];
160
Mike Reedab273fa2017-01-11 13:58:55 -0500161 for (auto r = sk_tools::Registry<Fuzzable>::Head(); r; r = r->next()) {
mtklein65e58242016-01-13 12:57:57 -0800162 auto fuzzable = r->factory();
mtkleind4387ea2016-01-21 06:13:52 -0800163 if (0 == strcmp(name, fuzzable.name)) {
mtkleinf5e97822016-01-15 06:19:53 -0800164 SkDebugf("Fuzzing %s...\n", fuzzable.name);
Kevin Lubick1ac8fd22017-03-01 10:42:45 -0500165 Fuzz fuzz(std::move(bytes));
mtklein65e58242016-01-13 12:57:57 -0800166 fuzzable.fn(&fuzz);
kjlubick47d158e2016-02-01 08:23:50 -0800167 SkDebugf("[terminated] Success!\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500168 return;
mtklein65e58242016-01-13 12:57:57 -0800169 }
170 }
mtkleind4387ea2016-01-21 06:13:52 -0800171
172 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n:\n");
Mike Reedab273fa2017-01-11 13:58:55 -0500173 for (auto r = sk_tools::Registry<Fuzzable>::Head(); r; r = r->next()) {
mtkleind4387ea2016-01-21 06:13:52 -0800174 auto fuzzable = r->factory();
175 SkDebugf("\t%s\n", fuzzable.name);
176 }
kjlubickdba57342016-01-21 05:03:28 -0800177}
178
179static void dump_png(SkBitmap bitmap) {
180 if (!FLAGS_dump.isEmpty()) {
Hal Canarydb683012016-11-23 08:55:18 -0700181 sk_tool_utils::EncodeImageToFile(FLAGS_dump[0], bitmap, SkEncodedImageFormat::kPNG, 100);
kjlubickdba57342016-01-21 05:03:28 -0800182 SkDebugf("Dumped to %s\n", FLAGS_dump[0]);
183 }
184}
185
Kevin Lubickf80f1152017-01-06 08:26:56 -0500186static void fuzz_img(sk_sp<SkData> bytes, uint8_t scale, uint8_t mode) {
kjlubick2a42f482016-02-16 16:14:23 -0800187 // We can scale 1x, 2x, 4x, 8x, 16x
188 scale = scale % 5;
kjlubick5bd98a22016-02-18 06:27:38 -0800189 float fscale = (float)pow(2.0f, scale);
190 SkDebugf("Scaling factor: %f\n", fscale);
kjlubick2a42f482016-02-16 16:14:23 -0800191
Leon Scroggins IIIc5a83662016-12-08 09:07:56 -0500192 // We have 5 different modes of decoding.
193 mode = mode % 5;
kjlubick2a42f482016-02-16 16:14:23 -0800194 SkDebugf("Mode: %d\n", mode);
195
196 // This is mostly copied from DMSrcSink's CodecSrc::draw method.
kjlubick47d158e2016-02-01 08:23:50 -0800197 SkDebugf("Decoding\n");
Mike Reedede7bac2017-07-23 15:30:02 -0400198 std::unique_ptr<SkCodec> codec(SkCodec::MakeFromData(bytes));
kjlubickdba57342016-01-21 05:03:28 -0800199 if (nullptr == codec.get()) {
kjlubick47d158e2016-02-01 08:23:50 -0800200 SkDebugf("[terminated] Couldn't create codec.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500201 return;
kjlubickdba57342016-01-21 05:03:28 -0800202 }
203
204 SkImageInfo decodeInfo = codec->getInfo();
kjlubick2a42f482016-02-16 16:14:23 -0800205 SkISize size = codec->getScaledDimensions(fscale);
206 decodeInfo = decodeInfo.makeWH(size.width(), size.height());
207
kjlubickdba57342016-01-21 05:03:28 -0800208 SkBitmap bitmap;
kjlubickdba57342016-01-21 05:03:28 -0800209 SkCodec::Options options;
210 options.fZeroInitialized = SkCodec::kYes_ZeroInitialized;
211
Mike Reed086a4272017-07-18 10:53:11 -0400212 if (!bitmap.tryAllocPixelsFlags(decodeInfo, SkBitmap::kZeroPixels_AllocFlag)) {
kjlubick47d158e2016-02-01 08:23:50 -0800213 SkDebugf("[terminated] Could not allocate memory. Image might be too large (%d x %d)",
kjlubick2a42f482016-02-16 16:14:23 -0800214 decodeInfo.width(), decodeInfo.height());
Kevin Lubickf80f1152017-01-06 08:26:56 -0500215 return;
kjlubickdba57342016-01-21 05:03:28 -0800216 }
217
kjlubick2a42f482016-02-16 16:14:23 -0800218 switch (mode) {
219 case 0: {//kCodecZeroInit_Mode, kCodec_Mode
Leon Scroggins571b30f2017-07-11 17:35:31 +0000220 switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(), &options)) {
kjlubick2a42f482016-02-16 16:14:23 -0800221 case SkCodec::kSuccess:
222 SkDebugf("[terminated] Success!\n");
223 break;
224 case SkCodec::kIncompleteInput:
225 SkDebugf("[terminated] Partial Success\n");
226 break;
Leon Scroggins III674a1842017-07-06 12:26:09 -0400227 case SkCodec::kErrorInInput:
228 SkDebugf("[terminated] Partial Success with error\n");
229 break;
kjlubick2a42f482016-02-16 16:14:23 -0800230 case SkCodec::kInvalidConversion:
231 SkDebugf("Incompatible colortype conversion\n");
232 // Crash to allow afl-fuzz to know this was a bug.
233 raise(SIGSEGV);
234 default:
235 SkDebugf("[terminated] Couldn't getPixels.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500236 return;
kjlubick2a42f482016-02-16 16:14:23 -0800237 }
238 break;
239 }
240 case 1: {//kScanline_Mode
Leon Scroggins571b30f2017-07-11 17:35:31 +0000241 if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)) {
242 SkDebugf("[terminated] Could not start scanline decoder\n");
243 return;
244 }
kjlubick2a42f482016-02-16 16:14:23 -0800245
246 void* dst = bitmap.getAddr(0, 0);
247 size_t rowBytes = bitmap.rowBytes();
248 uint32_t height = decodeInfo.height();
249 switch (codec->getScanlineOrder()) {
250 case SkCodec::kTopDown_SkScanlineOrder:
251 case SkCodec::kBottomUp_SkScanlineOrder:
kjlubick2a42f482016-02-16 16:14:23 -0800252 // We do not need to check the return value. On an incomplete
253 // image, memory will be filled with a default value.
254 codec->getScanlines(dst, height, rowBytes);
255 break;
kjlubick2a42f482016-02-16 16:14:23 -0800256 }
kjlubick47d158e2016-02-01 08:23:50 -0800257 SkDebugf("[terminated] Success!\n");
kjlubickdba57342016-01-21 05:03:28 -0800258 break;
kjlubick2a42f482016-02-16 16:14:23 -0800259 }
260 case 2: { //kStripe_Mode
261 const int height = decodeInfo.height();
262 // This value is chosen arbitrarily. We exercise more cases by choosing a value that
263 // does not align with image blocks.
264 const int stripeHeight = 37;
265 const int numStripes = (height + stripeHeight - 1) / stripeHeight;
266
267 // Decode odd stripes
Leon Scroggins571b30f2017-07-11 17:35:31 +0000268 if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)
kjlubick2a42f482016-02-16 16:14:23 -0800269 || SkCodec::kTopDown_SkScanlineOrder != codec->getScanlineOrder()) {
270 // This mode was designed to test the new skip scanlines API in libjpeg-turbo.
271 // Jpegs have kTopDown_SkScanlineOrder, and at this time, it is not interesting
272 // to run this test for image types that do not have this scanline ordering.
273 SkDebugf("[terminated] Could not start top-down scanline decoder\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500274 return;
kjlubick2a42f482016-02-16 16:14:23 -0800275 }
276
277 for (int i = 0; i < numStripes; i += 2) {
278 // Skip a stripe
279 const int linesToSkip = SkTMin(stripeHeight, height - i * stripeHeight);
280 codec->skipScanlines(linesToSkip);
281
282 // Read a stripe
283 const int startY = (i + 1) * stripeHeight;
284 const int linesToRead = SkTMin(stripeHeight, height - startY);
285 if (linesToRead > 0) {
286 codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
287 }
288 }
289
290 // Decode even stripes
Leon Scroggins571b30f2017-07-11 17:35:31 +0000291 const SkCodec::Result startResult = codec->startScanlineDecode(decodeInfo);
kjlubick2a42f482016-02-16 16:14:23 -0800292 if (SkCodec::kSuccess != startResult) {
293 SkDebugf("[terminated] Failed to restart scanline decoder with same parameters.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500294 return;
kjlubick2a42f482016-02-16 16:14:23 -0800295 }
296 for (int i = 0; i < numStripes; i += 2) {
297 // Read a stripe
298 const int startY = i * stripeHeight;
299 const int linesToRead = SkTMin(stripeHeight, height - startY);
300 codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
301
302 // Skip a stripe
303 const int linesToSkip = SkTMin(stripeHeight, height - (i + 1) * stripeHeight);
304 if (linesToSkip > 0) {
305 codec->skipScanlines(linesToSkip);
306 }
307 }
308 SkDebugf("[terminated] Success!\n");
kjlubickdba57342016-01-21 05:03:28 -0800309 break;
kjlubick2a42f482016-02-16 16:14:23 -0800310 }
311 case 3: { //kSubset_Mode
312 // Arbitrarily choose a divisor.
313 int divisor = 2;
314 // Total width/height of the image.
315 const int W = codec->getInfo().width();
316 const int H = codec->getInfo().height();
317 if (divisor > W || divisor > H) {
318 SkDebugf("[terminated] Cannot codec subset: divisor %d is too big "
319 "with dimensions (%d x %d)\n", divisor, W, H);
Kevin Lubickf80f1152017-01-06 08:26:56 -0500320 return;
kjlubick2a42f482016-02-16 16:14:23 -0800321 }
322 // subset dimensions
323 // SkWebpCodec, the only one that supports subsets, requires even top/left boundaries.
324 const int w = SkAlign2(W / divisor);
325 const int h = SkAlign2(H / divisor);
326 SkIRect subset;
327 SkCodec::Options opts;
328 opts.fSubset = &subset;
329 SkBitmap subsetBm;
330 // We will reuse pixel memory from bitmap.
331 void* pixels = bitmap.getPixels();
332 // Keep track of left and top (for drawing subsetBm into canvas). We could use
333 // fscale * x and fscale * y, but we want integers such that the next subset will start
334 // where the last one ended. So we'll add decodeInfo.width() and height().
335 int left = 0;
336 for (int x = 0; x < W; x += w) {
337 int top = 0;
338 for (int y = 0; y < H; y+= h) {
339 // Do not make the subset go off the edge of the image.
340 const int preScaleW = SkTMin(w, W - x);
341 const int preScaleH = SkTMin(h, H - y);
342 subset.setXYWH(x, y, preScaleW, preScaleH);
343 // And fscale
344 // FIXME: Should we have a version of getScaledDimensions that takes a subset
345 // into account?
346 decodeInfo = decodeInfo.makeWH(
347 SkTMax(1, SkScalarRoundToInt(preScaleW * fscale)),
348 SkTMax(1, SkScalarRoundToInt(preScaleH * fscale)));
349 size_t rowBytes = decodeInfo.minRowBytes();
Leon Scroggins571b30f2017-07-11 17:35:31 +0000350 if (!subsetBm.installPixels(decodeInfo, pixels, rowBytes)) {
kjlubick2a42f482016-02-16 16:14:23 -0800351 SkDebugf("[terminated] Could not install pixels.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500352 return;
kjlubick2a42f482016-02-16 16:14:23 -0800353 }
354 const SkCodec::Result result = codec->getPixels(decodeInfo, pixels, rowBytes,
Leon Scroggins571b30f2017-07-11 17:35:31 +0000355 &opts);
kjlubick2a42f482016-02-16 16:14:23 -0800356 switch (result) {
357 case SkCodec::kSuccess:
358 case SkCodec::kIncompleteInput:
Leon Scroggins III674a1842017-07-06 12:26:09 -0400359 case SkCodec::kErrorInInput:
kjlubick2a42f482016-02-16 16:14:23 -0800360 SkDebugf("okay\n");
361 break;
362 case SkCodec::kInvalidConversion:
363 if (0 == (x|y)) {
364 // First subset is okay to return unimplemented.
365 SkDebugf("[terminated] Incompatible colortype conversion\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500366 return;
kjlubick2a42f482016-02-16 16:14:23 -0800367 }
368 // If the first subset succeeded, a later one should not fail.
369 // fall through to failure
370 case SkCodec::kUnimplemented:
371 if (0 == (x|y)) {
372 // First subset is okay to return unimplemented.
373 SkDebugf("[terminated] subset codec not supported\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500374 return;
kjlubick2a42f482016-02-16 16:14:23 -0800375 }
376 // If the first subset succeeded, why would a later one fail?
377 // fall through to failure
378 default:
379 SkDebugf("[terminated] subset codec failed to decode (%d, %d, %d, %d) "
380 "with dimensions (%d x %d)\t error %d\n",
381 x, y, decodeInfo.width(), decodeInfo.height(),
382 W, H, result);
Kevin Lubickf80f1152017-01-06 08:26:56 -0500383 return;
kjlubick2a42f482016-02-16 16:14:23 -0800384 }
385 // translate by the scaled height.
386 top += decodeInfo.height();
387 }
388 // translate by the scaled width.
389 left += decodeInfo.width();
390 }
391 SkDebugf("[terminated] Success!\n");
392 break;
393 }
Leon Scroggins IIIc5a83662016-12-08 09:07:56 -0500394 case 4: { //kAnimated_Mode
395 std::vector<SkCodec::FrameInfo> frameInfos = codec->getFrameInfo();
396 if (frameInfos.size() == 0) {
397 SkDebugf("[terminated] Not an animated image\n");
398 break;
399 }
400
401 for (size_t i = 0; i < frameInfos.size(); i++) {
402 options.fFrameIndex = i;
403 auto result = codec->startIncrementalDecode(decodeInfo, bitmap.getPixels(),
404 bitmap.rowBytes(), &options);
405 if (SkCodec::kSuccess != result) {
406 SkDebugf("[terminated] failed to start incremental decode "
407 "in frame %d with error %d\n", i, result);
Kevin Lubickf80f1152017-01-06 08:26:56 -0500408 return;
Leon Scroggins IIIc5a83662016-12-08 09:07:56 -0500409 }
410
411 result = codec->incrementalDecode();
Leon Scroggins III674a1842017-07-06 12:26:09 -0400412 if (result == SkCodec::kIncompleteInput || result == SkCodec::kErrorInInput) {
Leon Scroggins IIIc5a83662016-12-08 09:07:56 -0500413 SkDebugf("okay\n");
414 // Frames beyond this one will not decode.
415 break;
416 }
417 if (result == SkCodec::kSuccess) {
418 SkDebugf("okay - decoded frame %d\n", i);
419 } else {
420 SkDebugf("[terminated] incremental decode failed with "
421 "error %d\n", result);
Kevin Lubickf80f1152017-01-06 08:26:56 -0500422 return;
Leon Scroggins IIIc5a83662016-12-08 09:07:56 -0500423 }
424 }
425 SkDebugf("[terminated] Success!\n");
426 break;
427 }
kjlubickdba57342016-01-21 05:03:28 -0800428 default:
kjlubick2a42f482016-02-16 16:14:23 -0800429 SkDebugf("[terminated] Mode not implemented yet\n");
kjlubickdba57342016-01-21 05:03:28 -0800430 }
431
432 dump_png(bitmap);
mtklein65e58242016-01-13 12:57:57 -0800433}
434
Kevin Lubickf80f1152017-01-06 08:26:56 -0500435static void fuzz_skp(sk_sp<SkData> bytes) {
kjlubickdba57342016-01-21 05:03:28 -0800436 SkMemoryStream stream(bytes);
437 SkDebugf("Decoding\n");
reedca2622b2016-03-18 07:25:55 -0700438 sk_sp<SkPicture> pic(SkPicture::MakeFromStream(&stream));
kjlubickdba57342016-01-21 05:03:28 -0800439 if (!pic) {
kjlubick47d158e2016-02-01 08:23:50 -0800440 SkDebugf("[terminated] Couldn't decode as a picture.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500441 return;
kjlubickdba57342016-01-21 05:03:28 -0800442 }
443 SkDebugf("Rendering\n");
444 SkBitmap bitmap;
445 if (!FLAGS_dump.isEmpty()) {
446 SkIRect size = pic->cullRect().roundOut();
447 bitmap.allocN32Pixels(size.width(), size.height());
448 }
449 SkCanvas canvas(bitmap);
450 canvas.drawPicture(pic);
kjlubick47d158e2016-02-01 08:23:50 -0800451 SkDebugf("[terminated] Success! Decoded and rendered an SkPicture!\n");
kjlubickdba57342016-01-21 05:03:28 -0800452 dump_png(bitmap);
kjlubickdba57342016-01-21 05:03:28 -0800453}
mtklein65e58242016-01-13 12:57:57 -0800454
Kevin Lubickf80f1152017-01-06 08:26:56 -0500455static void fuzz_icc(sk_sp<SkData> bytes) {
Brian Osman526972e2016-10-24 09:24:02 -0400456 sk_sp<SkColorSpace> space(SkColorSpace::MakeICC(bytes->data(), bytes->size()));
kjlubick897a8e32016-06-09 07:15:12 -0700457 if (!space) {
458 SkDebugf("[terminated] Couldn't decode ICC.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500459 return;
kjlubick897a8e32016-06-09 07:15:12 -0700460 }
461 SkDebugf("[terminated] Success! Decoded ICC.\n");
kjlubick897a8e32016-06-09 07:15:12 -0700462}
463
Kevin Lubickf80f1152017-01-06 08:26:56 -0500464static void fuzz_color_deserialize(sk_sp<SkData> bytes) {
kjlubick3e3c1a52016-06-23 10:49:27 -0700465 sk_sp<SkColorSpace> space(SkColorSpace::Deserialize(bytes->data(), bytes->size()));
466 if (!space) {
467 SkDebugf("[terminated] Couldn't deserialize Colorspace.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500468 return;
kjlubick3e3c1a52016-06-23 10:49:27 -0700469 }
470 SkDebugf("[terminated] Success! deserialized Colorspace.\n");
kjlubick3e3c1a52016-06-23 10:49:27 -0700471}
472
Kevin Lubickf04c50a2017-01-06 13:48:19 -0500473static void fuzz_path_deserialize(sk_sp<SkData> bytes) {
474 SkPath path;
475 if (!path.readFromMemory(bytes->data(), bytes->size())) {
476 SkDebugf("[terminated] Couldn't initialize SkPath.\n");
477 return;
478 }
Kevin Lubick0d4bc0d2017-02-21 09:37:48 -0500479 auto s = SkSurface::MakeRasterN32Premul(1024, 1024);
480 s->getCanvas()->drawPath(path, SkPaint());
Kevin Lubickf04c50a2017-01-06 13:48:19 -0500481 SkDebugf("[terminated] Success! Initialized SkPath.\n");
482}
483
Kevin Lubickedee1ae2017-02-20 17:47:18 -0500484static void fuzz_region_deserialize(sk_sp<SkData> bytes) {
485 SkRegion region;
486 if (!region.readFromMemory(bytes->data(), bytes->size())) {
487 SkDebugf("[terminated] Couldn't initialize SkRegion.\n");
488 return;
489 }
490 region.computeRegionComplexity();
491 region.isComplex();
492 SkRegion r2;
493 if (region == r2) {
494 region.contains(0,0);
495 } else {
496 region.contains(1,1);
497 }
498 auto s = SkSurface::MakeRasterN32Premul(1024, 1024);
499 s->getCanvas()->drawRegion(region, SkPaint());
500 SkDEBUGCODE(region.validate());
501 SkDebugf("[terminated] Success! Initialized SkRegion.\n");
502}
503
Herb Derbya839fc02017-03-16 12:30:43 -0400504static void fuzz_filter_fuzz(sk_sp<SkData> bytes) {
505
506 const int BitmapSize = 24;
507 SkBitmap bitmap;
508 bitmap.allocN32Pixels(BitmapSize, BitmapSize);
509 SkCanvas canvas(bitmap);
510 canvas.clear(0x00000000);
511
512 sk_sp<SkImageFilter> flattenable = SkValidatingDeserializeImageFilter(
513 bytes->data(), bytes->size());
514
515 // Adding some info, but the test passed if we got here without any trouble
516 if (flattenable != NULL) {
517 SkDebugf("Valid stream detected.\n");
518 // Let's see if using the filters can cause any trouble...
519 SkPaint paint;
520 paint.setImageFilter(flattenable);
521 canvas.save();
522 canvas.clipRect(SkRect::MakeXYWH(
523 0, 0, SkIntToScalar(BitmapSize), SkIntToScalar(BitmapSize)));
524
525 // This call shouldn't crash or cause ASAN to flag any memory issues
526 // If nothing bad happens within this call, everything is fine
527 canvas.drawBitmap(bitmap, 0, 0, &paint);
528
529 SkDebugf("Filter DAG rendered successfully\n");
530 canvas.restore();
531 } else {
532 SkDebugf("Invalid stream detected.\n");
533 }
534
535 SkDebugf("[terminated] Done\n");
536}
537
Ethan Nicholas7ef4b742016-11-11 15:16:46 -0500538#if SK_SUPPORT_GPU
Kevin Lubickf80f1152017-01-06 08:26:56 -0500539static void fuzz_sksl2glsl(sk_sp<SkData> bytes) {
kjlubicke7195772016-10-18 10:06:24 -0700540 SkSL::Compiler compiler;
Ethan Nicholas0df1b042017-03-31 13:56:23 -0400541 SkSL::String output;
Ethan Nicholas941e7e22016-12-12 15:33:30 -0500542 SkSL::Program::Settings settings;
543 sk_sp<GrShaderCaps> caps = SkSL::ShaderCapsFactory::Default();
544 settings.fCaps = caps.get();
545 std::unique_ptr<SkSL::Program> program = compiler.convertProgram(SkSL::Program::kFragment_Kind,
Brian Osman93ba0a42017-08-14 14:48:10 -0400546 SkSL::String((const char*) bytes->data()),
547 settings);
Ethan Nicholas941e7e22016-12-12 15:33:30 -0500548 if (!program || !compiler.toGLSL(*program, &output)) {
kjlubicke7195772016-10-18 10:06:24 -0700549 SkDebugf("[terminated] Couldn't compile input.\n");
Kevin Lubickf80f1152017-01-06 08:26:56 -0500550 return;
kjlubicke7195772016-10-18 10:06:24 -0700551 }
552 SkDebugf("[terminated] Success! Compiled input.\n");
kjlubicke7195772016-10-18 10:06:24 -0700553}
Ethan Nicholas7ef4b742016-11-11 15:16:46 -0500554#endif
kjlubicke7195772016-10-18 10:06:24 -0700555
reed42943c82016-09-12 12:01:44 -0700556Fuzz::Fuzz(sk_sp<SkData> bytes) : fBytes(bytes), fNextByte(0) {}
mtklein65e58242016-01-13 12:57:57 -0800557
Kevin Lubick2f535ce2016-11-01 15:01:12 -0400558void Fuzz::signalBug() { SkDebugf("Signal bug\n"); raise(SIGSEGV); }
mtkleina1159422016-01-15 05:46:54 -0800559
kjlubicke5654502016-07-19 16:50:03 -0700560size_t Fuzz::size() { return fBytes->size(); }
561
Kevin Lubick2f535ce2016-11-01 15:01:12 -0400562bool Fuzz::exhausted() {
563 return fBytes->size() == fNextByte;
kjlubick5bd98a22016-02-18 06:27:38 -0800564}