FuzzMain.cpp 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763
  1. /*
  2. * Copyright 2016 Google Inc.
  3. *
  4. * Use of this source code is governed by a BSD-style license that can be
  5. * found in the LICENSE file.
  6. */
  7. #include "fuzz/Fuzz.h"
  8. #include "include/codec/SkCodec.h"
  9. #include "include/core/SkCanvas.h"
  10. #include "include/core/SkData.h"
  11. #include "include/core/SkImage.h"
  12. #include "include/core/SkImageEncoder.h"
  13. #include "include/core/SkMallocPixelRef.h"
  14. #include "include/core/SkPaint.h"
  15. #include "include/core/SkPath.h"
  16. #include "include/core/SkStream.h"
  17. #include "include/core/SkSurface.h"
  18. #include "include/core/SkTextBlob.h"
  19. #include "src/core/SkFontMgrPriv.h"
  20. #include "src/core/SkOSFile.h"
  21. #include "src/core/SkPicturePriv.h"
  22. #include "src/core/SkReadBuffer.h"
  23. #include "src/utils/SkOSPath.h"
  24. #include "tools/ToolUtils.h"
  25. #include "tools/flags/CommandLineFlags.h"
  26. #include "tools/fonts/TestFontMgr.h"
  27. #include <iostream>
  28. #include <map>
  29. #include <regex>
  30. #include <signal.h>
  31. static DEFINE_string2(bytes, b, "", "A path to a file or a directory. If a file, the "
  32. "contents will be used as the fuzz bytes. If a directory, all files "
  33. "in the directory will be used as fuzz bytes for the fuzzer, one at a "
  34. "time.");
  35. static DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name.");
  36. static DEFINE_string2(dump, d, "", "If not empty, dump 'image*' or 'skp' types as a "
  37. "PNG with this name.");
  38. DEFINE_bool2(verbose, v, false, "Print more information while fuzzing.");
  39. // This cannot be inlined in DEFINE_string2 due to interleaved ifdefs
  40. static constexpr char g_type_message[] = "How to interpret --bytes, one of:\n"
  41. "android_codec\n"
  42. "animated_image_decode\n"
  43. "api\n"
  44. "color_deserialize\n"
  45. "filter_fuzz (equivalent to Chrome's filter_fuzz_stub)\n"
  46. "image_decode\n"
  47. "image_decode_incremental\n"
  48. "image_mode\n"
  49. "image_scale\n"
  50. "json\n"
  51. "path_deserialize\n"
  52. "region_deserialize\n"
  53. "region_set_path\n"
  54. "skp\n"
  55. "sksl2glsl\n"
  56. "sksl2metal\n"
  57. "sksl2pipeline\n"
  58. "sksl2spirv\n"
  59. #if defined(SK_ENABLE_SKOTTIE)
  60. "skottie_json\n"
  61. #endif
  62. "textblob";
  63. static DEFINE_string2(type, t, "", g_type_message);
  64. static int fuzz_file(SkString path, SkString type);
  65. static uint8_t calculate_option(SkData*);
  66. static SkString try_auto_detect(SkString path, SkString* name);
  67. static void fuzz_android_codec(sk_sp<SkData>);
  68. static void fuzz_animated_img(sk_sp<SkData>);
  69. static void fuzz_api(sk_sp<SkData> bytes, SkString name);
  70. static void fuzz_color_deserialize(sk_sp<SkData>);
  71. static void fuzz_filter_fuzz(sk_sp<SkData>);
  72. static void fuzz_image_decode(sk_sp<SkData>);
  73. static void fuzz_image_decode_incremental(sk_sp<SkData>);
  74. static void fuzz_img(sk_sp<SkData>, uint8_t, uint8_t);
  75. static void fuzz_json(sk_sp<SkData>);
  76. static void fuzz_path_deserialize(sk_sp<SkData>);
  77. static void fuzz_region_deserialize(sk_sp<SkData>);
  78. static void fuzz_region_set_path(sk_sp<SkData>);
  79. static void fuzz_skp(sk_sp<SkData>);
  80. static void fuzz_sksl2glsl(sk_sp<SkData>);
  81. static void fuzz_sksl2metal(sk_sp<SkData>);
  82. static void fuzz_sksl2spirv(sk_sp<SkData>);
  83. static void fuzz_sksl2pipeline(sk_sp<SkData>);
  84. static void fuzz_textblob_deserialize(sk_sp<SkData>);
  85. static void print_api_names();
  86. #if defined(SK_ENABLE_SKOTTIE)
  87. static void fuzz_skottie_json(sk_sp<SkData>);
  88. #endif
  89. int main(int argc, char** argv) {
  90. CommandLineFlags::SetUsage(
  91. "Usage: fuzz -t <type> -b <path/to/file> [-n api-to-fuzz]\n"
  92. " fuzz -b <path/to/file>\n"
  93. "--help lists the valid types. If type is not specified,\n"
  94. "fuzz will make a guess based on the name of the file.\n");
  95. CommandLineFlags::Parse(argc, argv);
  96. gSkFontMgr_DefaultFactory = &ToolUtils::MakePortableFontMgr;
  97. SkString path = SkString(FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]);
  98. SkString type = SkString(FLAGS_type.isEmpty() ? "" : FLAGS_type[0]);
  99. if (!sk_isdir(path.c_str())) {
  100. return fuzz_file(path, type);
  101. }
  102. SkOSFile::Iter it(path.c_str());
  103. for (SkString file; it.next(&file); ) {
  104. SkString p = SkOSPath::Join(path.c_str(), file.c_str());
  105. SkDebugf("Fuzzing %s\n", p.c_str());
  106. int rv = fuzz_file(p, type);
  107. if (rv != 0) {
  108. return rv;
  109. }
  110. }
  111. return 0;
  112. }
  113. static int fuzz_file(SkString path, SkString type) {
  114. sk_sp<SkData> bytes(SkData::MakeFromFileName(path.c_str()));
  115. if (!bytes) {
  116. SkDebugf("Could not read %s\n", path.c_str());
  117. return 1;
  118. }
  119. SkString name = SkString(FLAGS_name.isEmpty() ? "" : FLAGS_name[0]);
  120. if (type.isEmpty()) {
  121. type = try_auto_detect(path, &name);
  122. }
  123. if (type.isEmpty()) {
  124. SkDebugf("Could not autodetect type of %s\n", path.c_str());
  125. return 1;
  126. }
  127. if (type.equals("android_codec")) {
  128. fuzz_android_codec(bytes);
  129. return 0;
  130. }
  131. if (type.equals("animated_image_decode")) {
  132. fuzz_animated_img(bytes);
  133. return 0;
  134. }
  135. if (type.equals("api")) {
  136. fuzz_api(bytes, name);
  137. return 0;
  138. }
  139. if (type.equals("color_deserialize")) {
  140. fuzz_color_deserialize(bytes);
  141. return 0;
  142. }
  143. if (type.equals("filter_fuzz")) {
  144. fuzz_filter_fuzz(bytes);
  145. return 0;
  146. }
  147. if (type.equals("image_decode")) {
  148. fuzz_image_decode(bytes);
  149. return 0;
  150. }
  151. if (type.equals("image_decode_incremental")) {
  152. fuzz_image_decode_incremental(bytes);
  153. return 0;
  154. }
  155. if (type.equals("image_scale")) {
  156. uint8_t option = calculate_option(bytes.get());
  157. fuzz_img(bytes, option, 0);
  158. return 0;
  159. }
  160. if (type.equals("image_mode")) {
  161. uint8_t option = calculate_option(bytes.get());
  162. fuzz_img(bytes, 0, option);
  163. return 0;
  164. }
  165. if (type.equals("json")) {
  166. fuzz_json(bytes);
  167. return 0;
  168. }
  169. if (type.equals("path_deserialize")) {
  170. fuzz_path_deserialize(bytes);
  171. return 0;
  172. }
  173. if (type.equals("region_deserialize")) {
  174. fuzz_region_deserialize(bytes);
  175. return 0;
  176. }
  177. if (type.equals("region_set_path")) {
  178. fuzz_region_set_path(bytes);
  179. return 0;
  180. }
  181. if (type.equals("pipe")) {
  182. SkDebugf("I would prefer not to.\n");
  183. return 0;
  184. }
  185. #if defined(SK_ENABLE_SKOTTIE)
  186. if (type.equals("skottie_json")) {
  187. fuzz_skottie_json(bytes);
  188. return 0;
  189. }
  190. #endif
  191. if (type.equals("skp")) {
  192. fuzz_skp(bytes);
  193. return 0;
  194. }
  195. if (type.equals("sksl2glsl")) {
  196. fuzz_sksl2glsl(bytes);
  197. return 0;
  198. }
  199. if (type.equals("sksl2metal")) {
  200. fuzz_sksl2metal(bytes);
  201. return 0;
  202. }
  203. if (type.equals("sksl2spirv")) {
  204. fuzz_sksl2spirv(bytes);
  205. return 0;
  206. }
  207. if (type.equals("sksl2pipeline")) {
  208. fuzz_sksl2pipeline(bytes);
  209. return 0;
  210. }
  211. if (type.equals("textblob")) {
  212. fuzz_textblob_deserialize(bytes);
  213. return 0;
  214. }
  215. SkDebugf("Unknown type %s\n", type.c_str());
  216. CommandLineFlags::PrintUsage();
  217. return 1;
  218. }
  219. static std::map<std::string, std::string> cf_api_map = {
  220. {"api_draw_functions", "DrawFunctions"},
  221. {"api_gradients", "Gradients"},
  222. {"api_image_filter", "ImageFilter"},
  223. {"api_mock_gpu_canvas", "MockGPUCanvas"},
  224. {"api_null_canvas", "NullCanvas"},
  225. {"api_path_measure", "PathMeasure"},
  226. {"api_pathop", "Pathop"},
  227. {"api_polyutils", "PolyUtils"},
  228. {"api_raster_n32_canvas", "RasterN32Canvas"},
  229. {"jpeg_encoder", "JPEGEncoder"},
  230. {"png_encoder", "PNGEncoder"},
  231. {"skia_pathop_fuzzer", "LegacyChromiumPathop"},
  232. {"webp_encoder", "WEBPEncoder"}
  233. };
  234. // maps clusterfuzz/oss-fuzz -> Skia's name
  235. static std::map<std::string, std::string> cf_map = {
  236. {"android_codec", "android_codec"},
  237. {"animated_image_decode", "animated_image_decode"},
  238. {"image_decode", "image_decode"},
  239. {"image_decode_incremental", "image_decode_incremental"},
  240. {"image_filter_deserialize", "filter_fuzz"},
  241. {"image_filter_deserialize_width", "filter_fuzz"},
  242. {"path_deserialize", "path_deserialize"},
  243. {"region_deserialize", "region_deserialize"},
  244. {"region_set_path", "region_set_path"},
  245. {"skjson", "json"},
  246. {"sksl2glsl", "sksl2glsl"},
  247. {"sksl2metal", "sksl2metal"},
  248. {"sksl2spirv", "sksl2spirv"},
  249. {"sksl2pipeline", "sksl2pipeline"},
  250. #if defined(SK_ENABLE_SKOTTIE)
  251. {"skottie_json", "skottie_json"},
  252. #endif
  253. {"textblob_deserialize", "textblob"}
  254. };
  255. static SkString try_auto_detect(SkString path, SkString* name) {
  256. std::cmatch m;
  257. std::regex clusterfuzz("clusterfuzz-testcase(-minimized)?-([a-z0-9_]+)-[\\d]+");
  258. std::regex skiafuzzer("(api-)?(\\w+)-[a-f0-9]+");
  259. if (std::regex_search(path.c_str(), m, clusterfuzz)) {
  260. std::string type = m.str(2);
  261. if (cf_api_map.find(type) != cf_api_map.end()) {
  262. *name = SkString(cf_api_map[type].c_str());
  263. return SkString("api");
  264. } else {
  265. if (cf_map.find(type) != cf_map.end()) {
  266. return SkString(cf_map[type].c_str());
  267. }
  268. }
  269. } else if (std::regex_search(path.c_str(), m, skiafuzzer)) {
  270. std::string a1 = m.str(1);
  271. std::string typeOrName = m.str(2);
  272. if (a1.length() > 0) {
  273. // it's an api fuzzer
  274. *name = SkString(typeOrName.c_str());
  275. return SkString("api");
  276. } else {
  277. return SkString(typeOrName.c_str());
  278. }
  279. }
  280. return SkString("");
  281. }
  282. void FuzzJSON(sk_sp<SkData> bytes);
  283. static void fuzz_json(sk_sp<SkData> bytes){
  284. FuzzJSON(bytes);
  285. SkDebugf("[terminated] Done parsing!\n");
  286. }
  287. #if defined(SK_ENABLE_SKOTTIE)
  288. void FuzzSkottieJSON(sk_sp<SkData> bytes);
  289. static void fuzz_skottie_json(sk_sp<SkData> bytes){
  290. FuzzSkottieJSON(bytes);
  291. SkDebugf("[terminated] Done animating!\n");
  292. }
  293. #endif
  294. // This adds up the first 1024 bytes and returns it as an 8 bit integer. This allows afl-fuzz to
  295. // deterministically excercise different paths, or *options* (such as different scaling sizes or
  296. // different image modes) without needing to introduce a parameter. This way we don't need a
  297. // image_scale1, image_scale2, image_scale4, etc fuzzer, we can just have a image_scale fuzzer.
  298. // Clients are expected to transform this number into a different range, e.g. with modulo (%).
  299. static uint8_t calculate_option(SkData* bytes) {
  300. uint8_t total = 0;
  301. const uint8_t* data = bytes->bytes();
  302. for (size_t i = 0; i < 1024 && i < bytes->size(); i++) {
  303. total += data[i];
  304. }
  305. return total;
  306. }
  307. static void print_api_names(){
  308. SkDebugf("When using --type api, please choose an API to fuzz with --name/-n:\n");
  309. for (const Fuzzable& fuzzable : sk_tools::Registry<Fuzzable>::Range()) {
  310. SkDebugf("\t%s\n", fuzzable.name);
  311. }
  312. }
  313. static void fuzz_api(sk_sp<SkData> bytes, SkString name) {
  314. for (const Fuzzable& fuzzable : sk_tools::Registry<Fuzzable>::Range()) {
  315. if (name.equals(fuzzable.name)) {
  316. SkDebugf("Fuzzing %s...\n", fuzzable.name);
  317. Fuzz fuzz(std::move(bytes));
  318. fuzzable.fn(&fuzz);
  319. SkDebugf("[terminated] Success!\n");
  320. return;
  321. }
  322. }
  323. print_api_names();
  324. }
  325. static void dump_png(SkBitmap bitmap) {
  326. if (!FLAGS_dump.isEmpty()) {
  327. ToolUtils::EncodeImageToFile(FLAGS_dump[0], bitmap, SkEncodedImageFormat::kPNG, 100);
  328. SkDebugf("Dumped to %s\n", FLAGS_dump[0]);
  329. }
  330. }
  331. bool FuzzAnimatedImage(sk_sp<SkData> bytes);
  332. static void fuzz_animated_img(sk_sp<SkData> bytes) {
  333. if (FuzzAnimatedImage(bytes)) {
  334. SkDebugf("[terminated] Success from decoding/drawing animated image!\n");
  335. return;
  336. }
  337. SkDebugf("[terminated] Could not decode or draw animated image.\n");
  338. }
  339. bool FuzzImageDecode(sk_sp<SkData> bytes);
  340. static void fuzz_image_decode(sk_sp<SkData> bytes) {
  341. if (FuzzImageDecode(bytes)) {
  342. SkDebugf("[terminated] Success from decoding/drawing image!\n");
  343. return;
  344. }
  345. SkDebugf("[terminated] Could not decode or draw image.\n");
  346. }
  347. bool FuzzIncrementalImageDecode(sk_sp<SkData> bytes);
  348. static void fuzz_image_decode_incremental(sk_sp<SkData> bytes) {
  349. if (FuzzIncrementalImageDecode(bytes)) {
  350. SkDebugf("[terminated] Success using incremental decode!\n");
  351. return;
  352. }
  353. SkDebugf("[terminated] Could not incrementally decode and image.\n");
  354. }
  355. bool FuzzAndroidCodec(sk_sp<SkData> bytes, uint8_t sampleSize);
  356. static void fuzz_android_codec(sk_sp<SkData> bytes) {
  357. Fuzz fuzz(bytes);
  358. uint8_t sampleSize;
  359. fuzz.nextRange(&sampleSize, 1, 64);
  360. bytes = SkData::MakeSubset(bytes.get(), 1, bytes->size() - 1);
  361. if (FuzzAndroidCodec(bytes, sampleSize)) {
  362. SkDebugf("[terminated] Success on Android Codec sampleSize=%u!\n", sampleSize);
  363. return;
  364. }
  365. SkDebugf("[terminated] Could not use Android Codec sampleSize=%u!\n", sampleSize);
  366. }
  367. // This is a "legacy" fuzzer that likely does too much. It was based off of how
  368. // DM reads in images. image_decode, image_decode_incremental and android_codec
  369. // are more targeted fuzzers that do a subset of what this one does.
  370. static void fuzz_img(sk_sp<SkData> bytes, uint8_t scale, uint8_t mode) {
  371. // We can scale 1x, 2x, 4x, 8x, 16x
  372. scale = scale % 5;
  373. float fscale = (float)pow(2.0f, scale);
  374. SkDebugf("Scaling factor: %f\n", fscale);
  375. // We have 5 different modes of decoding.
  376. mode = mode % 5;
  377. SkDebugf("Mode: %d\n", mode);
  378. // This is mostly copied from DMSrcSink's CodecSrc::draw method.
  379. SkDebugf("Decoding\n");
  380. std::unique_ptr<SkCodec> codec(SkCodec::MakeFromData(bytes));
  381. if (nullptr == codec.get()) {
  382. SkDebugf("[terminated] Couldn't create codec.\n");
  383. return;
  384. }
  385. SkImageInfo decodeInfo = codec->getInfo();
  386. SkISize size = codec->getScaledDimensions(fscale);
  387. decodeInfo = decodeInfo.makeWH(size.width(), size.height());
  388. SkBitmap bitmap;
  389. SkCodec::Options options;
  390. options.fZeroInitialized = SkCodec::kYes_ZeroInitialized;
  391. if (!bitmap.tryAllocPixelsFlags(decodeInfo, SkBitmap::kZeroPixels_AllocFlag)) {
  392. SkDebugf("[terminated] Could not allocate memory. Image might be too large (%d x %d)",
  393. decodeInfo.width(), decodeInfo.height());
  394. return;
  395. }
  396. switch (mode) {
  397. case 0: {//kCodecZeroInit_Mode, kCodec_Mode
  398. switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(), &options)) {
  399. case SkCodec::kSuccess:
  400. SkDebugf("[terminated] Success!\n");
  401. break;
  402. case SkCodec::kIncompleteInput:
  403. SkDebugf("[terminated] Partial Success\n");
  404. break;
  405. case SkCodec::kErrorInInput:
  406. SkDebugf("[terminated] Partial Success with error\n");
  407. break;
  408. case SkCodec::kInvalidConversion:
  409. SkDebugf("Incompatible colortype conversion\n");
  410. // Crash to allow afl-fuzz to know this was a bug.
  411. raise(SIGSEGV);
  412. default:
  413. SkDebugf("[terminated] Couldn't getPixels.\n");
  414. return;
  415. }
  416. break;
  417. }
  418. case 1: {//kScanline_Mode
  419. if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)) {
  420. SkDebugf("[terminated] Could not start scanline decoder\n");
  421. return;
  422. }
  423. void* dst = bitmap.getAddr(0, 0);
  424. size_t rowBytes = bitmap.rowBytes();
  425. uint32_t height = decodeInfo.height();
  426. // We do not need to check the return value. On an incomplete
  427. // image, memory will be filled with a default value.
  428. codec->getScanlines(dst, height, rowBytes);
  429. SkDebugf("[terminated] Success!\n");
  430. break;
  431. }
  432. case 2: { //kStripe_Mode
  433. const int height = decodeInfo.height();
  434. // This value is chosen arbitrarily. We exercise more cases by choosing a value that
  435. // does not align with image blocks.
  436. const int stripeHeight = 37;
  437. const int numStripes = (height + stripeHeight - 1) / stripeHeight;
  438. // Decode odd stripes
  439. if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)
  440. || SkCodec::kTopDown_SkScanlineOrder != codec->getScanlineOrder()) {
  441. // This mode was designed to test the new skip scanlines API in libjpeg-turbo.
  442. // Jpegs have kTopDown_SkScanlineOrder, and at this time, it is not interesting
  443. // to run this test for image types that do not have this scanline ordering.
  444. SkDebugf("[terminated] Could not start top-down scanline decoder\n");
  445. return;
  446. }
  447. for (int i = 0; i < numStripes; i += 2) {
  448. // Skip a stripe
  449. const int linesToSkip = SkTMin(stripeHeight, height - i * stripeHeight);
  450. codec->skipScanlines(linesToSkip);
  451. // Read a stripe
  452. const int startY = (i + 1) * stripeHeight;
  453. const int linesToRead = SkTMin(stripeHeight, height - startY);
  454. if (linesToRead > 0) {
  455. codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
  456. }
  457. }
  458. // Decode even stripes
  459. const SkCodec::Result startResult = codec->startScanlineDecode(decodeInfo);
  460. if (SkCodec::kSuccess != startResult) {
  461. SkDebugf("[terminated] Failed to restart scanline decoder with same parameters.\n");
  462. return;
  463. }
  464. for (int i = 0; i < numStripes; i += 2) {
  465. // Read a stripe
  466. const int startY = i * stripeHeight;
  467. const int linesToRead = SkTMin(stripeHeight, height - startY);
  468. codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
  469. // Skip a stripe
  470. const int linesToSkip = SkTMin(stripeHeight, height - (i + 1) * stripeHeight);
  471. if (linesToSkip > 0) {
  472. codec->skipScanlines(linesToSkip);
  473. }
  474. }
  475. SkDebugf("[terminated] Success!\n");
  476. break;
  477. }
  478. case 3: { //kSubset_Mode
  479. // Arbitrarily choose a divisor.
  480. int divisor = 2;
  481. // Total width/height of the image.
  482. const int W = codec->getInfo().width();
  483. const int H = codec->getInfo().height();
  484. if (divisor > W || divisor > H) {
  485. SkDebugf("[terminated] Cannot codec subset: divisor %d is too big "
  486. "with dimensions (%d x %d)\n", divisor, W, H);
  487. return;
  488. }
  489. // subset dimensions
  490. // SkWebpCodec, the only one that supports subsets, requires even top/left boundaries.
  491. const int w = SkAlign2(W / divisor);
  492. const int h = SkAlign2(H / divisor);
  493. SkIRect subset;
  494. SkCodec::Options opts;
  495. opts.fSubset = &subset;
  496. SkBitmap subsetBm;
  497. // We will reuse pixel memory from bitmap.
  498. void* pixels = bitmap.getPixels();
  499. // Keep track of left and top (for drawing subsetBm into canvas). We could use
  500. // fscale * x and fscale * y, but we want integers such that the next subset will start
  501. // where the last one ended. So we'll add decodeInfo.width() and height().
  502. int left = 0;
  503. for (int x = 0; x < W; x += w) {
  504. int top = 0;
  505. for (int y = 0; y < H; y+= h) {
  506. // Do not make the subset go off the edge of the image.
  507. const int preScaleW = SkTMin(w, W - x);
  508. const int preScaleH = SkTMin(h, H - y);
  509. subset.setXYWH(x, y, preScaleW, preScaleH);
  510. // And fscale
  511. // FIXME: Should we have a version of getScaledDimensions that takes a subset
  512. // into account?
  513. decodeInfo = decodeInfo.makeWH(
  514. SkTMax(1, SkScalarRoundToInt(preScaleW * fscale)),
  515. SkTMax(1, SkScalarRoundToInt(preScaleH * fscale)));
  516. size_t rowBytes = decodeInfo.minRowBytes();
  517. if (!subsetBm.installPixels(decodeInfo, pixels, rowBytes)) {
  518. SkDebugf("[terminated] Could not install pixels.\n");
  519. return;
  520. }
  521. const SkCodec::Result result = codec->getPixels(decodeInfo, pixels, rowBytes,
  522. &opts);
  523. switch (result) {
  524. case SkCodec::kSuccess:
  525. case SkCodec::kIncompleteInput:
  526. case SkCodec::kErrorInInput:
  527. SkDebugf("okay\n");
  528. break;
  529. case SkCodec::kInvalidConversion:
  530. if (0 == (x|y)) {
  531. // First subset is okay to return unimplemented.
  532. SkDebugf("[terminated] Incompatible colortype conversion\n");
  533. return;
  534. }
  535. // If the first subset succeeded, a later one should not fail.
  536. // fall through to failure
  537. case SkCodec::kUnimplemented:
  538. if (0 == (x|y)) {
  539. // First subset is okay to return unimplemented.
  540. SkDebugf("[terminated] subset codec not supported\n");
  541. return;
  542. }
  543. // If the first subset succeeded, why would a later one fail?
  544. // fall through to failure
  545. default:
  546. SkDebugf("[terminated] subset codec failed to decode (%d, %d, %d, %d) "
  547. "with dimensions (%d x %d)\t error %d\n",
  548. x, y, decodeInfo.width(), decodeInfo.height(),
  549. W, H, result);
  550. return;
  551. }
  552. // translate by the scaled height.
  553. top += decodeInfo.height();
  554. }
  555. // translate by the scaled width.
  556. left += decodeInfo.width();
  557. }
  558. SkDebugf("[terminated] Success!\n");
  559. break;
  560. }
  561. case 4: { //kAnimated_Mode
  562. std::vector<SkCodec::FrameInfo> frameInfos = codec->getFrameInfo();
  563. if (frameInfos.size() == 0) {
  564. SkDebugf("[terminated] Not an animated image\n");
  565. break;
  566. }
  567. for (size_t i = 0; i < frameInfos.size(); i++) {
  568. options.fFrameIndex = i;
  569. auto result = codec->startIncrementalDecode(decodeInfo, bitmap.getPixels(),
  570. bitmap.rowBytes(), &options);
  571. if (SkCodec::kSuccess != result) {
  572. SkDebugf("[terminated] failed to start incremental decode "
  573. "in frame %d with error %d\n", i, result);
  574. return;
  575. }
  576. result = codec->incrementalDecode();
  577. if (result == SkCodec::kIncompleteInput || result == SkCodec::kErrorInInput) {
  578. SkDebugf("okay\n");
  579. // Frames beyond this one will not decode.
  580. break;
  581. }
  582. if (result == SkCodec::kSuccess) {
  583. SkDebugf("okay - decoded frame %d\n", i);
  584. } else {
  585. SkDebugf("[terminated] incremental decode failed with "
  586. "error %d\n", result);
  587. return;
  588. }
  589. }
  590. SkDebugf("[terminated] Success!\n");
  591. break;
  592. }
  593. default:
  594. SkDebugf("[terminated] Mode not implemented yet\n");
  595. }
  596. dump_png(bitmap);
  597. }
  598. static void fuzz_skp(sk_sp<SkData> bytes) {
  599. SkReadBuffer buf(bytes->data(), bytes->size());
  600. SkDebugf("Decoding\n");
  601. sk_sp<SkPicture> pic(SkPicturePriv::MakeFromBuffer(buf));
  602. if (!pic) {
  603. SkDebugf("[terminated] Couldn't decode as a picture.\n");
  604. return;
  605. }
  606. SkDebugf("Rendering\n");
  607. SkBitmap bitmap;
  608. if (!FLAGS_dump.isEmpty()) {
  609. SkIRect size = pic->cullRect().roundOut();
  610. bitmap.allocN32Pixels(size.width(), size.height());
  611. }
  612. SkCanvas canvas(bitmap);
  613. canvas.drawPicture(pic);
  614. SkDebugf("[terminated] Success! Decoded and rendered an SkPicture!\n");
  615. dump_png(bitmap);
  616. }
  617. static void fuzz_color_deserialize(sk_sp<SkData> bytes) {
  618. sk_sp<SkColorSpace> space(SkColorSpace::Deserialize(bytes->data(), bytes->size()));
  619. if (!space) {
  620. SkDebugf("[terminated] Couldn't deserialize Colorspace.\n");
  621. return;
  622. }
  623. SkDebugf("[terminated] Success! deserialized Colorspace.\n");
  624. }
  625. void FuzzPathDeserialize(SkReadBuffer& buf);
  626. static void fuzz_path_deserialize(sk_sp<SkData> bytes) {
  627. SkReadBuffer buf(bytes->data(), bytes->size());
  628. FuzzPathDeserialize(buf);
  629. SkDebugf("[terminated] path_deserialize didn't crash!\n");
  630. }
  631. bool FuzzRegionDeserialize(sk_sp<SkData> bytes);
  632. static void fuzz_region_deserialize(sk_sp<SkData> bytes) {
  633. if (!FuzzRegionDeserialize(bytes)) {
  634. SkDebugf("[terminated] Couldn't initialize SkRegion.\n");
  635. return;
  636. }
  637. SkDebugf("[terminated] Success! Initialized SkRegion.\n");
  638. }
  639. void FuzzTextBlobDeserialize(SkReadBuffer& buf);
  640. static void fuzz_textblob_deserialize(sk_sp<SkData> bytes) {
  641. SkReadBuffer buf(bytes->data(), bytes->size());
  642. FuzzTextBlobDeserialize(buf);
  643. SkDebugf("[terminated] textblob didn't crash!\n");
  644. }
  645. void FuzzRegionSetPath(Fuzz* fuzz);
  646. static void fuzz_region_set_path(sk_sp<SkData> bytes) {
  647. Fuzz fuzz(bytes);
  648. FuzzRegionSetPath(&fuzz);
  649. SkDebugf("[terminated] region_set_path didn't crash!\n");
  650. }
  651. void FuzzImageFilterDeserialize(sk_sp<SkData> bytes);
  652. static void fuzz_filter_fuzz(sk_sp<SkData> bytes) {
  653. FuzzImageFilterDeserialize(bytes);
  654. SkDebugf("[terminated] filter_fuzz didn't crash!\n");
  655. }
  656. bool FuzzSKSL2GLSL(sk_sp<SkData> bytes);
  657. static void fuzz_sksl2glsl(sk_sp<SkData> bytes) {
  658. if (FuzzSKSL2GLSL(bytes)) {
  659. SkDebugf("[terminated] Success! Compiled input to GLSL.\n");
  660. } else {
  661. SkDebugf("[terminated] Could not compile input to GLSL.\n");
  662. }
  663. }
  664. bool FuzzSKSL2SPIRV(sk_sp<SkData> bytes);
  665. static void fuzz_sksl2spirv(sk_sp<SkData> bytes) {
  666. if (FuzzSKSL2SPIRV(bytes)) {
  667. SkDebugf("[terminated] Success! Compiled input to SPIRV.\n");
  668. } else {
  669. SkDebugf("[terminated] Could not compile input to SPIRV.\n");
  670. }
  671. }
  672. bool FuzzSKSL2Metal(sk_sp<SkData> bytes);
  673. static void fuzz_sksl2metal(sk_sp<SkData> bytes) {
  674. if (FuzzSKSL2Metal(bytes)) {
  675. SkDebugf("[terminated] Success! Compiled input to Metal.\n");
  676. } else {
  677. SkDebugf("[terminated] Could not compile input to Metal.\n");
  678. }
  679. }
  680. bool FuzzSKSL2Pipeline(sk_sp<SkData> bytes);
  681. static void fuzz_sksl2pipeline(sk_sp<SkData> bytes) {
  682. if (FuzzSKSL2Pipeline(bytes)) {
  683. SkDebugf("[terminated] Success! Compiled input to pipeline stage.\n");
  684. } else {
  685. SkDebugf("[terminated] Could not compile input to pipeline stage.\n");
  686. }
  687. }