Fuzz.h 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137
  1. /*
  2. * Copyright 2016 Google Inc.
  3. *
  4. * Use of this source code is governed by a BSD-style license that can be
  5. * found in the LICENSE file.
  6. */
  7. #ifndef Fuzz_DEFINED
  8. #define Fuzz_DEFINED
  9. #include "include/core/SkData.h"
  10. #include "include/core/SkImageFilter.h"
  11. #include "include/core/SkRegion.h"
  12. #include "include/core/SkTypes.h"
  13. #include "include/private/SkMalloc.h"
  14. #include "tools/Registry.h"
  15. #include <limits>
  16. #include <cmath>
  17. #include <signal.h>
  18. #include <limits>
  19. class Fuzz : SkNoncopyable {
  20. public:
  21. explicit Fuzz(sk_sp<SkData> bytes) : fBytes(bytes), fNextByte(0) {}
  22. // Returns the total number of "random" bytes available.
  23. size_t size() { return fBytes->size(); }
  24. // Returns if there are no bytes remaining for fuzzing.
  25. bool exhausted() {
  26. return fBytes->size() == fNextByte;
  27. }
  28. size_t remaining() {
  29. return fBytes->size() - fNextByte;
  30. }
  31. void deplete() {
  32. fNextByte = fBytes->size();
  33. }
  34. // next() loads fuzzed bytes into the variable passed in by pointer.
  35. // We use this approach instead of T next() because different compilers
  36. // evaluate function parameters in different orders. If fuzz->next()
  37. // returned 5 and then 7, foo(fuzz->next(), fuzz->next()) would be
  38. // foo(5, 7) when compiled on GCC and foo(7, 5) when compiled on Clang.
  39. // By requiring params to be passed in, we avoid the temptation to call
  40. // next() in a way that does not consume fuzzed bytes in a single
  41. // platform-independent order.
  42. template <typename T>
  43. void next(T* t) { this->nextBytes(t, sizeof(T)); }
  44. // This is a convenient way to initialize more than one argument at a time.
  45. template <typename Arg, typename... Args>
  46. void next(Arg* first, Args... rest);
  47. // nextRange returns values only in [min, max].
  48. template <typename T, typename Min, typename Max>
  49. void nextRange(T*, Min, Max);
  50. // nextEnum is a wrapper around nextRange for enums.
  51. template <typename T>
  52. void nextEnum(T* ptr, T max);
  53. // nextN loads n * sizeof(T) bytes into ptr
  54. template <typename T>
  55. void nextN(T* ptr, int n);
  56. void signalBug(){
  57. // Tell the fuzzer that these inputs found a bug.
  58. SkDebugf("Signal bug\n");
  59. raise(SIGSEGV);
  60. }
  61. // Specialized versions for when true random doesn't quite make sense
  62. void next(bool* b);
  63. void next(SkImageFilter::CropRect* cropRect);
  64. void next(SkRegion* region);
  65. void nextRange(float* f, float min, float max);
  66. private:
  67. template <typename T>
  68. T nextT();
  69. sk_sp<SkData> fBytes;
  70. size_t fNextByte;
  71. friend void fuzz__MakeEncoderCorpus(Fuzz*);
  72. void nextBytes(void* ptr, size_t size);
  73. };
  74. template <typename Arg, typename... Args>
  75. inline void Fuzz::next(Arg* first, Args... rest) {
  76. this->next(first);
  77. this->next(rest...);
  78. }
  79. template <typename T, typename Min, typename Max>
  80. inline void Fuzz::nextRange(T* value, Min min, Max max) {
  81. this->next(value);
  82. if (*value < (T)min) { *value = (T)min; }
  83. if (*value > (T)max) { *value = (T)max; }
  84. }
  85. template <typename T>
  86. inline void Fuzz::nextEnum(T* value, T max) {
  87. // This works around the fact that UBSAN will assert if we put an invalid
  88. // value into an enum. We might see issues with enums being represented
  89. // on Windows differently than Linux, but that's not a thing we can fix here.
  90. using U = typename std::underlying_type<T>::type;
  91. U v;
  92. this->next(&v);
  93. if (v < (U)0) { *value = (T)0; return;}
  94. if (v > (U)max) { *value = (T)max; return;}
  95. *value = (T)v;
  96. }
  97. template <typename T>
  98. inline void Fuzz::nextN(T* ptr, int n) {
  99. for (int i = 0; i < n; i++) {
  100. this->next(ptr+i);
  101. }
  102. }
  103. struct Fuzzable {
  104. const char* name;
  105. void (*fn)(Fuzz*);
  106. };
  107. // Not static so that we can link these into oss-fuzz harnesses if we like.
  108. #define DEF_FUZZ(name, f) \
  109. void fuzz_##name(Fuzz*); \
  110. sk_tools::Registry<Fuzzable> register_##name({#name, fuzz_##name}); \
  111. void fuzz_##name(Fuzz* f)
  112. #endif//Fuzz_DEFINED