FuzzPathop.cpp 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202
  1. /*
  2. * Copyright 2016 Google Inc.
  3. *
  4. * Use of this source code is governed by a BSD-style license that can be
  5. * found in the LICENSE file.
  6. */
  7. #include "fuzz/Fuzz.h"
  8. #include "fuzz/FuzzCommon.h"
  9. #include "include/core/SkPath.h"
  10. #include "include/core/SkRect.h"
  11. #include "include/pathops/SkPathOps.h"
  12. const uint8_t MAX_OPS = 20;
  13. DEF_FUZZ(Pathop, fuzz) {
  14. uint8_t choice;
  15. fuzz->nextRange(&choice, 0, 4);
  16. switch (choice) {
  17. case 0: {
  18. uint8_t ops;
  19. fuzz->nextRange(&ops, 0, MAX_OPS);
  20. SkOpBuilder builder;
  21. for (uint8_t i = 0; i < ops && !fuzz->exhausted(); i++) {
  22. SkPath path;
  23. FuzzEvilPath(fuzz, &path, SkPath::Verb::kDone_Verb);
  24. SkPath::FillType ft;
  25. fuzz->nextRange(&ft, 0, SkPath::kInverseEvenOdd_FillType);
  26. path.setFillType(ft);
  27. SkPathOp op;
  28. fuzz->nextRange(&op, 0, SkPathOp::kReverseDifference_SkPathOp);
  29. builder.add(path, op);
  30. }
  31. SkPath result;
  32. builder.resolve(&result);
  33. break;
  34. }
  35. case 1: {
  36. SkPath path;
  37. FuzzEvilPath(fuzz, &path, SkPath::Verb::kDone_Verb);
  38. SkPath::FillType ft;
  39. fuzz->nextRange(&ft, 0, SkPath::kInverseEvenOdd_FillType);
  40. path.setFillType(ft);
  41. SkPath result;
  42. bool isSame;
  43. fuzz->next(&isSame);
  44. if (isSame) {
  45. result = path;
  46. }
  47. Simplify(path, &result);
  48. break;
  49. }
  50. case 2: {
  51. SkPath path;
  52. FuzzEvilPath(fuzz, &path, SkPath::Verb::kDone_Verb);
  53. SkPath::FillType ft;
  54. fuzz->nextRange(&ft, 0, SkPath::kInverseEvenOdd_FillType);
  55. path.setFillType(ft);
  56. SkPath path2;
  57. FuzzEvilPath(fuzz, &path2, SkPath::Verb::kDone_Verb);
  58. fuzz->nextRange(&ft, 0, SkPath::kInverseEvenOdd_FillType);
  59. path.setFillType(ft);
  60. SkPathOp op;
  61. fuzz->nextRange(&op, 0, SkPathOp::kReverseDifference_SkPathOp);
  62. SkPath result;
  63. uint8_t pickOutput;
  64. fuzz->nextRange(&pickOutput, 0, 2);
  65. if (pickOutput == 1) {
  66. result = path;
  67. } else if (pickOutput == 2) {
  68. result = path2;
  69. }
  70. Op(path, path2, op, &result);
  71. break;
  72. }
  73. case 3: {
  74. SkPath path;
  75. FuzzEvilPath(fuzz, &path, SkPath::Verb::kDone_Verb);
  76. SkPath::FillType ft;
  77. fuzz->nextRange(&ft, 0, SkPath::kInverseEvenOdd_FillType);
  78. path.setFillType(ft);
  79. SkPath result;
  80. bool isSame;
  81. fuzz->next(&isSame);
  82. if (isSame) {
  83. result = path;
  84. }
  85. AsWinding(path, &result);
  86. break;
  87. }
  88. case 4: {
  89. SkPath path;
  90. FuzzEvilPath(fuzz, &path, SkPath::Verb::kDone_Verb);
  91. SkPath::FillType ft;
  92. fuzz->nextRange(&ft, 0, SkPath::kInverseEvenOdd_FillType);
  93. path.setFillType(ft);
  94. SkRect result;
  95. TightBounds(path, &result);
  96. break;
  97. }
  98. default: {
  99. SkASSERT(false);
  100. break;
  101. }
  102. }
  103. }
  104. const int kLastOp = SkPathOp::kReverseDifference_SkPathOp;
  105. void BuildPath(Fuzz* fuzz, SkPath* path) {
  106. while (!fuzz->exhausted()) {
  107. // Use a uint8_t to conserve bytes. This makes our "fuzzed bytes footprint"
  108. // smaller, which leads to more efficient fuzzing.
  109. uint8_t operation;
  110. fuzz->next(&operation);
  111. SkScalar a,b,c,d,e,f;
  112. switch (operation % (SkPath::Verb::kDone_Verb + 1)) {
  113. case SkPath::Verb::kMove_Verb:
  114. if (fuzz->remaining() < (2*sizeof(SkScalar))) {
  115. fuzz->deplete();
  116. return;
  117. }
  118. fuzz->next(&a, &b);
  119. path->moveTo(a, b);
  120. break;
  121. case SkPath::Verb::kLine_Verb:
  122. if (fuzz->remaining() < (2*sizeof(SkScalar))) {
  123. fuzz->deplete();
  124. return;
  125. }
  126. fuzz->next(&a, &b);
  127. path->lineTo(a, b);
  128. break;
  129. case SkPath::Verb::kQuad_Verb:
  130. if (fuzz->remaining() < (4*sizeof(SkScalar))) {
  131. fuzz->deplete();
  132. return;
  133. }
  134. fuzz->next(&a, &b, &c, &d);
  135. path->quadTo(a, b, c, d);
  136. break;
  137. case SkPath::Verb::kConic_Verb:
  138. if (fuzz->remaining() < (5*sizeof(SkScalar))) {
  139. fuzz->deplete();
  140. return;
  141. }
  142. fuzz->next(&a, &b, &c, &d, &e);
  143. path->conicTo(a, b, c, d, e);
  144. break;
  145. case SkPath::Verb::kCubic_Verb:
  146. if (fuzz->remaining() < (6*sizeof(SkScalar))) {
  147. fuzz->deplete();
  148. return;
  149. }
  150. fuzz->next(&a, &b, &c, &d, &e, &f);
  151. path->cubicTo(a, b, c, d, e, f);
  152. break;
  153. case SkPath::Verb::kClose_Verb:
  154. path->close();
  155. break;
  156. case SkPath::Verb::kDone_Verb:
  157. // In this case, simply exit.
  158. return;
  159. }
  160. }
  161. }
  162. DEF_FUZZ(LegacyChromiumPathop, fuzz) {
  163. // See https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/skia_pathop_fuzzer.cc
  164. SkOpBuilder builder;
  165. while (!fuzz->exhausted()) {
  166. SkPath path;
  167. uint8_t op;
  168. fuzz->next(&op);
  169. if (fuzz->exhausted()) {
  170. break;
  171. }
  172. BuildPath(fuzz, &path);
  173. builder.add(path, static_cast<SkPathOp>(op % (kLastOp + 1)));
  174. }
  175. SkPath result;
  176. builder.resolve(&result);
  177. }