1 /*
2 * Copyright 2016 Google Inc.
3 *
4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file.
6 */
7
8 #include "Fuzz.h"
9 #include "SkCanvas.h"
10 #include "SkCodec.h"
11 #include "SkCommandLineFlags.h"
12 #include "SkData.h"
13 #include "SkImage.h"
14 #include "SkImageEncoder.h"
15 #include "SkMallocPixelRef.h"
16 #include "SkOSFile.h"
17 #include "SkOSPath.h"
18 #include "SkPaint.h"
19 #include "SkPath.h"
20 #include "SkPicturePriv.h"
21 #include "SkReadBuffer.h"
22 #include "SkStream.h"
23 #include "SkSurface.h"
24 #include "SkTextBlob.h"
25
26 #if SK_SUPPORT_GPU
27 #include "SkSLCompiler.h"
28 #endif
29
30 #include "sk_tool_utils.h"
31
32 #include <iostream>
33 #include <map>
34 #include <regex>
35 #include <signal.h>
36
37 DEFINE_string2(bytes, b, "", "A path to a file or a directory. If a file, the "
38 "contents will be used as the fuzz bytes. If a directory, all files "
39 "in the directory will be used as fuzz bytes for the fuzzer, one at a "
40 "time.");
41 DEFINE_string2(name, n, "", "If --type is 'api', fuzz the API with this name.");
42 DEFINE_string2(dump, d, "", "If not empty, dump 'image*' or 'skp' types as a "
43 "PNG with this name.");
44 DEFINE_bool2(verbose, v, false, "Print more information while fuzzing.");
45
46 // This cannot be inlined in DEFINE_string2 due to interleaved ifdefs
47 static constexpr char g_type_message[] = "How to interpret --bytes, one of:\n"
48 "android_codec\n"
49 "animated_image_decode\n"
50 "api\n"
51 "color_deserialize\n"
52 "filter_fuzz (equivalent to Chrome's filter_fuzz_stub)\n"
53 "image_decode\n"
54 "image_decode_incremental\n"
55 "image_mode\n"
56 "image_scale\n"
57 "json\n"
58 "path_deserialize\n"
59 "region_deserialize\n"
60 "region_set_path\n"
61 "skp\n"
62 "sksl2glsl\n"
63 #if defined(SK_ENABLE_SKOTTIE)
64 "skottie_json\n"
65 #endif
66 "textblob";
67
68 DEFINE_string2(type, t, "", g_type_message);
69
70 static int fuzz_file(SkString path, SkString type);
71 static uint8_t calculate_option(SkData*);
72 static SkString try_auto_detect(SkString path, SkString* name);
73
74 static void fuzz_android_codec(sk_sp<SkData>);
75 static void fuzz_animated_img(sk_sp<SkData>);
76 static void fuzz_api(sk_sp<SkData> bytes, SkString name);
77 static void fuzz_color_deserialize(sk_sp<SkData>);
78 static void fuzz_filter_fuzz(sk_sp<SkData>);
79 static void fuzz_image_decode(sk_sp<SkData>);
80 static void fuzz_image_decode_incremental(sk_sp<SkData>);
81 static void fuzz_img(sk_sp<SkData>, uint8_t, uint8_t);
82 static void fuzz_json(sk_sp<SkData>);
83 static void fuzz_path_deserialize(sk_sp<SkData>);
84 static void fuzz_region_deserialize(sk_sp<SkData>);
85 static void fuzz_region_set_path(sk_sp<SkData>);
86 static void fuzz_skp(sk_sp<SkData>);
87 static void fuzz_textblob_deserialize(sk_sp<SkData>);
88
89 static void print_api_names();
90
91 #if SK_SUPPORT_GPU
92 static void fuzz_sksl2glsl(sk_sp<SkData>);
93 #endif
94
95 #if defined(SK_ENABLE_SKOTTIE)
96 static void fuzz_skottie_json(sk_sp<SkData>);
97 #endif
98
main(int argc,char ** argv)99 int main(int argc, char** argv) {
100 SkCommandLineFlags::SetUsage("Usage: fuzz -t <type> -b <path/to/file> [-n api-to-fuzz]\n"
101 " fuzz -b <path/to/file>\n"
102 "--help lists the valid types. If type is not specified,\n"
103 "fuzz will make a guess based on the name of the file.\n");
104 SkCommandLineFlags::Parse(argc, argv);
105
106 SkString path = SkString(FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]);
107 SkString type = SkString(FLAGS_type.isEmpty() ? "" : FLAGS_type[0]);
108
109 if (!sk_isdir(path.c_str())) {
110 return fuzz_file(path, type);
111 }
112
113 SkOSFile::Iter it(path.c_str());
114 for (SkString file; it.next(&file); ) {
115 SkString p = SkOSPath::Join(path.c_str(), file.c_str());
116 SkDebugf("Fuzzing %s\n", p.c_str());
117 int rv = fuzz_file(p, type);
118 if (rv != 0) {
119 return rv;
120 }
121 }
122 return 0;
123 }
124
fuzz_file(SkString path,SkString type)125 static int fuzz_file(SkString path, SkString type) {
126 sk_sp<SkData> bytes(SkData::MakeFromFileName(path.c_str()));
127 if (!bytes) {
128 SkDebugf("Could not read %s\n", path.c_str());
129 return 1;
130 }
131
132 SkString name = SkString(FLAGS_name.isEmpty() ? "" : FLAGS_name[0]);
133
134 if (type.isEmpty()) {
135 type = try_auto_detect(path, &name);
136 }
137
138 if (type.isEmpty()) {
139 SkDebugf("Could not autodetect type of %s\n", path.c_str());
140 return 1;
141 }
142 if (type.equals("android_codec")) {
143 fuzz_android_codec(bytes);
144 return 0;
145 }
146 if (type.equals("animated_image_decode")) {
147 fuzz_animated_img(bytes);
148 return 0;
149 }
150 if (type.equals("api")) {
151 fuzz_api(bytes, name);
152 return 0;
153 }
154 if (type.equals("color_deserialize")) {
155 fuzz_color_deserialize(bytes);
156 return 0;
157 }
158 if (type.equals("filter_fuzz")) {
159 fuzz_filter_fuzz(bytes);
160 return 0;
161 }
162 if (type.equals("image_decode")) {
163 fuzz_image_decode(bytes);
164 return 0;
165 }
166 if (type.equals("image_decode_incremental")) {
167 fuzz_image_decode_incremental(bytes);
168 return 0;
169 }
170 if (type.equals("image_scale")) {
171 uint8_t option = calculate_option(bytes.get());
172 fuzz_img(bytes, option, 0);
173 return 0;
174 }
175 if (type.equals("image_mode")) {
176 uint8_t option = calculate_option(bytes.get());
177 fuzz_img(bytes, 0, option);
178 return 0;
179 }
180 if (type.equals("json")) {
181 fuzz_json(bytes);
182 return 0;
183 }
184 if (type.equals("path_deserialize")) {
185 fuzz_path_deserialize(bytes);
186 return 0;
187 }
188 if (type.equals("region_deserialize")) {
189 fuzz_region_deserialize(bytes);
190 return 0;
191 }
192 if (type.equals("region_set_path")) {
193 fuzz_region_set_path(bytes);
194 return 0;
195 }
196 if (type.equals("pipe")) {
197 SkDebugf("I would prefer not to.\n");
198 return 0;
199 }
200 #if defined(SK_ENABLE_SKOTTIE)
201 if (type.equals("skottie_json")) {
202 fuzz_skottie_json(bytes);
203 return 0;
204 }
205 #endif
206 if (type.equals("skp")) {
207 fuzz_skp(bytes);
208 return 0;
209 }
210 if (type.equals("textblob")) {
211 fuzz_textblob_deserialize(bytes);
212 return 0;
213 }
214 #if SK_SUPPORT_GPU
215 if (type.equals("sksl2glsl")) {
216 fuzz_sksl2glsl(bytes);
217 return 0;
218 }
219 #endif
220 SkDebugf("Unknown type %s\n", type.c_str());
221 SkCommandLineFlags::PrintUsage();
222 return 1;
223 }
224
225 static std::map<std::string, std::string> cf_api_map = {
226 {"api_draw_functions", "DrawFunctions"},
227 {"api_gradients", "Gradients"},
228 {"api_image_filter", "ImageFilter"},
229 {"api_mock_gpu_canvas", "MockGPUCanvas"},
230 {"api_null_canvas", "NullCanvas"},
231 {"api_path_measure", "PathMeasure"},
232 {"api_pathop", "Pathop"},
233 {"api_polyutils", "PolyUtils"},
234 {"api_raster_n32_canvas", "RasterN32Canvas"},
235 {"jpeg_encoder", "JPEGEncoder"},
236 {"png_encoder", "PNGEncoder"},
237 {"skia_pathop_fuzzer", "LegacyChromiumPathop"},
238 {"webp_encoder", "WEBPEncoder"}
239 };
240
241 // maps clusterfuzz/oss-fuzz -> Skia's name
242 static std::map<std::string, std::string> cf_map = {
243 {"android_codec", "android_codec"},
244 {"animated_image_decode", "animated_image_decode"},
245 {"image_decode", "image_decode"},
246 {"image_decode_incremental", "image_decode_incremental"},
247 {"image_filter_deserialize", "filter_fuzz"},
248 {"image_filter_deserialize_width", "filter_fuzz"},
249 {"path_deserialize", "path_deserialize"},
250 {"region_deserialize", "region_deserialize"},
251 {"region_set_path", "region_set_path"},
252 {"skjson", "json"},
253 #if defined(SK_ENABLE_SKOTTIE)
254 {"skottie_json", "skottie_json"},
255 #endif
256 {"textblob_deserialize", "textblob"}
257 };
258
try_auto_detect(SkString path,SkString * name)259 static SkString try_auto_detect(SkString path, SkString* name) {
260 std::cmatch m;
261 std::regex clusterfuzz("clusterfuzz-testcase(-minimized)?-([a-z0-9_]+)-[\\d]+");
262 std::regex skiafuzzer("(api-)?(\\w+)-[a-f0-9]+");
263
264 if (std::regex_search(path.c_str(), m, clusterfuzz)) {
265 std::string type = m.str(2);
266
267 if (cf_api_map.find(type) != cf_api_map.end()) {
268 *name = SkString(cf_api_map[type].c_str());
269 return SkString("api");
270 } else {
271 if (cf_map.find(type) != cf_map.end()) {
272 return SkString(cf_map[type].c_str());
273 }
274 }
275 } else if (std::regex_search(path.c_str(), m, skiafuzzer)) {
276 std::string a1 = m.str(1);
277 std::string typeOrName = m.str(2);
278 if (a1.length() > 0) {
279 // it's an api fuzzer
280 *name = SkString(typeOrName.c_str());
281 return SkString("api");
282 } else {
283 return SkString(typeOrName.c_str());
284 }
285 }
286
287 return SkString("");
288 }
289
290 void FuzzJSON(sk_sp<SkData> bytes);
291
fuzz_json(sk_sp<SkData> bytes)292 static void fuzz_json(sk_sp<SkData> bytes){
293 FuzzJSON(bytes);
294 SkDebugf("[terminated] Done parsing!\n");
295 }
296
297 #if defined(SK_ENABLE_SKOTTIE)
298 void FuzzSkottieJSON(sk_sp<SkData> bytes);
299
fuzz_skottie_json(sk_sp<SkData> bytes)300 static void fuzz_skottie_json(sk_sp<SkData> bytes){
301 FuzzSkottieJSON(bytes);
302 SkDebugf("[terminated] Done animating!\n");
303 }
304 #endif
305
306 // This adds up the first 1024 bytes and returns it as an 8 bit integer. This allows afl-fuzz to
307 // deterministically excercise different paths, or *options* (such as different scaling sizes or
308 // different image modes) without needing to introduce a parameter. This way we don't need a
309 // image_scale1, image_scale2, image_scale4, etc fuzzer, we can just have a image_scale fuzzer.
310 // Clients are expected to transform this number into a different range, e.g. with modulo (%).
calculate_option(SkData * bytes)311 static uint8_t calculate_option(SkData* bytes) {
312 uint8_t total = 0;
313 const uint8_t* data = bytes->bytes();
314 for (size_t i = 0; i < 1024 && i < bytes->size(); i++) {
315 total += data[i];
316 }
317 return total;
318 }
319
print_api_names()320 static void print_api_names(){
321 SkDebugf("When using --type api, please choose an API to fuzz with --name/-n:\n");
322 for (const Fuzzable& fuzzable : sk_tools::Registry<Fuzzable>::Range()) {
323 SkDebugf("\t%s\n", fuzzable.name);
324 }
325 }
326
fuzz_api(sk_sp<SkData> bytes,SkString name)327 static void fuzz_api(sk_sp<SkData> bytes, SkString name) {
328 for (const Fuzzable& fuzzable : sk_tools::Registry<Fuzzable>::Range()) {
329 if (name.equals(fuzzable.name)) {
330 SkDebugf("Fuzzing %s...\n", fuzzable.name);
331 Fuzz fuzz(std::move(bytes));
332 fuzzable.fn(&fuzz);
333 SkDebugf("[terminated] Success!\n");
334 return;
335 }
336 }
337
338 print_api_names();
339 }
340
dump_png(SkBitmap bitmap)341 static void dump_png(SkBitmap bitmap) {
342 if (!FLAGS_dump.isEmpty()) {
343 sk_tool_utils::EncodeImageToFile(FLAGS_dump[0], bitmap, SkEncodedImageFormat::kPNG, 100);
344 SkDebugf("Dumped to %s\n", FLAGS_dump[0]);
345 }
346 }
347
348 bool FuzzAnimatedImage(sk_sp<SkData> bytes);
349
fuzz_animated_img(sk_sp<SkData> bytes)350 static void fuzz_animated_img(sk_sp<SkData> bytes) {
351 if (FuzzAnimatedImage(bytes)) {
352 SkDebugf("[terminated] Success from decoding/drawing animated image!\n");
353 return;
354 }
355 SkDebugf("[terminated] Could not decode or draw animated image.\n");
356 }
357
358 bool FuzzImageDecode(sk_sp<SkData> bytes);
359
fuzz_image_decode(sk_sp<SkData> bytes)360 static void fuzz_image_decode(sk_sp<SkData> bytes) {
361 if (FuzzImageDecode(bytes)) {
362 SkDebugf("[terminated] Success from decoding/drawing image!\n");
363 return;
364 }
365 SkDebugf("[terminated] Could not decode or draw image.\n");
366 }
367
368 bool FuzzIncrementalImageDecode(sk_sp<SkData> bytes);
369
fuzz_image_decode_incremental(sk_sp<SkData> bytes)370 static void fuzz_image_decode_incremental(sk_sp<SkData> bytes) {
371 if (FuzzIncrementalImageDecode(bytes)) {
372 SkDebugf("[terminated] Success using incremental decode!\n");
373 return;
374 }
375 SkDebugf("[terminated] Could not incrementally decode and image.\n");
376 }
377
378 bool FuzzAndroidCodec(sk_sp<SkData> bytes, uint8_t sampleSize);
379
fuzz_android_codec(sk_sp<SkData> bytes)380 static void fuzz_android_codec(sk_sp<SkData> bytes) {
381 Fuzz fuzz(bytes);
382 uint8_t sampleSize;
383 fuzz.nextRange(&sampleSize, 1, 64);
384 bytes = SkData::MakeSubset(bytes.get(), 1, bytes->size() - 1);
385 if (FuzzAndroidCodec(bytes, sampleSize)) {
386 SkDebugf("[terminated] Success on Android Codec sampleSize=%u!\n", sampleSize);
387 return;
388 }
389 SkDebugf("[terminated] Could not use Android Codec sampleSize=%u!\n", sampleSize);
390 }
391
392 // This is a "legacy" fuzzer that likely does too much. It was based off of how
393 // DM reads in images. image_decode, image_decode_incremental and android_codec
394 // are more targeted fuzzers that do a subset of what this one does.
fuzz_img(sk_sp<SkData> bytes,uint8_t scale,uint8_t mode)395 static void fuzz_img(sk_sp<SkData> bytes, uint8_t scale, uint8_t mode) {
396 // We can scale 1x, 2x, 4x, 8x, 16x
397 scale = scale % 5;
398 float fscale = (float)pow(2.0f, scale);
399 SkDebugf("Scaling factor: %f\n", fscale);
400
401 // We have 5 different modes of decoding.
402 mode = mode % 5;
403 SkDebugf("Mode: %d\n", mode);
404
405 // This is mostly copied from DMSrcSink's CodecSrc::draw method.
406 SkDebugf("Decoding\n");
407 std::unique_ptr<SkCodec> codec(SkCodec::MakeFromData(bytes));
408 if (nullptr == codec.get()) {
409 SkDebugf("[terminated] Couldn't create codec.\n");
410 return;
411 }
412
413 SkImageInfo decodeInfo = codec->getInfo();
414 SkISize size = codec->getScaledDimensions(fscale);
415 decodeInfo = decodeInfo.makeWH(size.width(), size.height());
416
417 SkBitmap bitmap;
418 SkCodec::Options options;
419 options.fZeroInitialized = SkCodec::kYes_ZeroInitialized;
420
421 if (!bitmap.tryAllocPixelsFlags(decodeInfo, SkBitmap::kZeroPixels_AllocFlag)) {
422 SkDebugf("[terminated] Could not allocate memory. Image might be too large (%d x %d)",
423 decodeInfo.width(), decodeInfo.height());
424 return;
425 }
426
427 switch (mode) {
428 case 0: {//kCodecZeroInit_Mode, kCodec_Mode
429 switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(), &options)) {
430 case SkCodec::kSuccess:
431 SkDebugf("[terminated] Success!\n");
432 break;
433 case SkCodec::kIncompleteInput:
434 SkDebugf("[terminated] Partial Success\n");
435 break;
436 case SkCodec::kErrorInInput:
437 SkDebugf("[terminated] Partial Success with error\n");
438 break;
439 case SkCodec::kInvalidConversion:
440 SkDebugf("Incompatible colortype conversion\n");
441 // Crash to allow afl-fuzz to know this was a bug.
442 raise(SIGSEGV);
443 default:
444 SkDebugf("[terminated] Couldn't getPixels.\n");
445 return;
446 }
447 break;
448 }
449 case 1: {//kScanline_Mode
450 if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)) {
451 SkDebugf("[terminated] Could not start scanline decoder\n");
452 return;
453 }
454
455 void* dst = bitmap.getAddr(0, 0);
456 size_t rowBytes = bitmap.rowBytes();
457 uint32_t height = decodeInfo.height();
458 // We do not need to check the return value. On an incomplete
459 // image, memory will be filled with a default value.
460 codec->getScanlines(dst, height, rowBytes);
461 SkDebugf("[terminated] Success!\n");
462 break;
463 }
464 case 2: { //kStripe_Mode
465 const int height = decodeInfo.height();
466 // This value is chosen arbitrarily. We exercise more cases by choosing a value that
467 // does not align with image blocks.
468 const int stripeHeight = 37;
469 const int numStripes = (height + stripeHeight - 1) / stripeHeight;
470
471 // Decode odd stripes
472 if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)
473 || SkCodec::kTopDown_SkScanlineOrder != codec->getScanlineOrder()) {
474 // This mode was designed to test the new skip scanlines API in libjpeg-turbo.
475 // Jpegs have kTopDown_SkScanlineOrder, and at this time, it is not interesting
476 // to run this test for image types that do not have this scanline ordering.
477 SkDebugf("[terminated] Could not start top-down scanline decoder\n");
478 return;
479 }
480
481 for (int i = 0; i < numStripes; i += 2) {
482 // Skip a stripe
483 const int linesToSkip = SkTMin(stripeHeight, height - i * stripeHeight);
484 codec->skipScanlines(linesToSkip);
485
486 // Read a stripe
487 const int startY = (i + 1) * stripeHeight;
488 const int linesToRead = SkTMin(stripeHeight, height - startY);
489 if (linesToRead > 0) {
490 codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
491 }
492 }
493
494 // Decode even stripes
495 const SkCodec::Result startResult = codec->startScanlineDecode(decodeInfo);
496 if (SkCodec::kSuccess != startResult) {
497 SkDebugf("[terminated] Failed to restart scanline decoder with same parameters.\n");
498 return;
499 }
500 for (int i = 0; i < numStripes; i += 2) {
501 // Read a stripe
502 const int startY = i * stripeHeight;
503 const int linesToRead = SkTMin(stripeHeight, height - startY);
504 codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
505
506 // Skip a stripe
507 const int linesToSkip = SkTMin(stripeHeight, height - (i + 1) * stripeHeight);
508 if (linesToSkip > 0) {
509 codec->skipScanlines(linesToSkip);
510 }
511 }
512 SkDebugf("[terminated] Success!\n");
513 break;
514 }
515 case 3: { //kSubset_Mode
516 // Arbitrarily choose a divisor.
517 int divisor = 2;
518 // Total width/height of the image.
519 const int W = codec->getInfo().width();
520 const int H = codec->getInfo().height();
521 if (divisor > W || divisor > H) {
522 SkDebugf("[terminated] Cannot codec subset: divisor %d is too big "
523 "with dimensions (%d x %d)\n", divisor, W, H);
524 return;
525 }
526 // subset dimensions
527 // SkWebpCodec, the only one that supports subsets, requires even top/left boundaries.
528 const int w = SkAlign2(W / divisor);
529 const int h = SkAlign2(H / divisor);
530 SkIRect subset;
531 SkCodec::Options opts;
532 opts.fSubset = ⊂
533 SkBitmap subsetBm;
534 // We will reuse pixel memory from bitmap.
535 void* pixels = bitmap.getPixels();
536 // Keep track of left and top (for drawing subsetBm into canvas). We could use
537 // fscale * x and fscale * y, but we want integers such that the next subset will start
538 // where the last one ended. So we'll add decodeInfo.width() and height().
539 int left = 0;
540 for (int x = 0; x < W; x += w) {
541 int top = 0;
542 for (int y = 0; y < H; y+= h) {
543 // Do not make the subset go off the edge of the image.
544 const int preScaleW = SkTMin(w, W - x);
545 const int preScaleH = SkTMin(h, H - y);
546 subset.setXYWH(x, y, preScaleW, preScaleH);
547 // And fscale
548 // FIXME: Should we have a version of getScaledDimensions that takes a subset
549 // into account?
550 decodeInfo = decodeInfo.makeWH(
551 SkTMax(1, SkScalarRoundToInt(preScaleW * fscale)),
552 SkTMax(1, SkScalarRoundToInt(preScaleH * fscale)));
553 size_t rowBytes = decodeInfo.minRowBytes();
554 if (!subsetBm.installPixels(decodeInfo, pixels, rowBytes)) {
555 SkDebugf("[terminated] Could not install pixels.\n");
556 return;
557 }
558 const SkCodec::Result result = codec->getPixels(decodeInfo, pixels, rowBytes,
559 &opts);
560 switch (result) {
561 case SkCodec::kSuccess:
562 case SkCodec::kIncompleteInput:
563 case SkCodec::kErrorInInput:
564 SkDebugf("okay\n");
565 break;
566 case SkCodec::kInvalidConversion:
567 if (0 == (x|y)) {
568 // First subset is okay to return unimplemented.
569 SkDebugf("[terminated] Incompatible colortype conversion\n");
570 return;
571 }
572 // If the first subset succeeded, a later one should not fail.
573 // fall through to failure
574 case SkCodec::kUnimplemented:
575 if (0 == (x|y)) {
576 // First subset is okay to return unimplemented.
577 SkDebugf("[terminated] subset codec not supported\n");
578 return;
579 }
580 // If the first subset succeeded, why would a later one fail?
581 // fall through to failure
582 default:
583 SkDebugf("[terminated] subset codec failed to decode (%d, %d, %d, %d) "
584 "with dimensions (%d x %d)\t error %d\n",
585 x, y, decodeInfo.width(), decodeInfo.height(),
586 W, H, result);
587 return;
588 }
589 // translate by the scaled height.
590 top += decodeInfo.height();
591 }
592 // translate by the scaled width.
593 left += decodeInfo.width();
594 }
595 SkDebugf("[terminated] Success!\n");
596 break;
597 }
598 case 4: { //kAnimated_Mode
599 std::vector<SkCodec::FrameInfo> frameInfos = codec->getFrameInfo();
600 if (frameInfos.size() == 0) {
601 SkDebugf("[terminated] Not an animated image\n");
602 break;
603 }
604
605 for (size_t i = 0; i < frameInfos.size(); i++) {
606 options.fFrameIndex = i;
607 auto result = codec->startIncrementalDecode(decodeInfo, bitmap.getPixels(),
608 bitmap.rowBytes(), &options);
609 if (SkCodec::kSuccess != result) {
610 SkDebugf("[terminated] failed to start incremental decode "
611 "in frame %d with error %d\n", i, result);
612 return;
613 }
614
615 result = codec->incrementalDecode();
616 if (result == SkCodec::kIncompleteInput || result == SkCodec::kErrorInInput) {
617 SkDebugf("okay\n");
618 // Frames beyond this one will not decode.
619 break;
620 }
621 if (result == SkCodec::kSuccess) {
622 SkDebugf("okay - decoded frame %d\n", i);
623 } else {
624 SkDebugf("[terminated] incremental decode failed with "
625 "error %d\n", result);
626 return;
627 }
628 }
629 SkDebugf("[terminated] Success!\n");
630 break;
631 }
632 default:
633 SkDebugf("[terminated] Mode not implemented yet\n");
634 }
635
636 dump_png(bitmap);
637 }
638
fuzz_skp(sk_sp<SkData> bytes)639 static void fuzz_skp(sk_sp<SkData> bytes) {
640 SkReadBuffer buf(bytes->data(), bytes->size());
641 SkDebugf("Decoding\n");
642 sk_sp<SkPicture> pic(SkPicturePriv::MakeFromBuffer(buf));
643 if (!pic) {
644 SkDebugf("[terminated] Couldn't decode as a picture.\n");
645 return;
646 }
647 SkDebugf("Rendering\n");
648 SkBitmap bitmap;
649 if (!FLAGS_dump.isEmpty()) {
650 SkIRect size = pic->cullRect().roundOut();
651 bitmap.allocN32Pixels(size.width(), size.height());
652 }
653 SkCanvas canvas(bitmap);
654 canvas.drawPicture(pic);
655 SkDebugf("[terminated] Success! Decoded and rendered an SkPicture!\n");
656 dump_png(bitmap);
657 }
658
fuzz_color_deserialize(sk_sp<SkData> bytes)659 static void fuzz_color_deserialize(sk_sp<SkData> bytes) {
660 sk_sp<SkColorSpace> space(SkColorSpace::Deserialize(bytes->data(), bytes->size()));
661 if (!space) {
662 SkDebugf("[terminated] Couldn't deserialize Colorspace.\n");
663 return;
664 }
665 SkDebugf("[terminated] Success! deserialized Colorspace.\n");
666 }
667
668 void FuzzPathDeserialize(SkReadBuffer& buf);
669
fuzz_path_deserialize(sk_sp<SkData> bytes)670 static void fuzz_path_deserialize(sk_sp<SkData> bytes) {
671 SkReadBuffer buf(bytes->data(), bytes->size());
672 FuzzPathDeserialize(buf);
673 SkDebugf("[terminated] path_deserialize didn't crash!\n");
674 }
675
676 bool FuzzRegionDeserialize(sk_sp<SkData> bytes);
677
fuzz_region_deserialize(sk_sp<SkData> bytes)678 static void fuzz_region_deserialize(sk_sp<SkData> bytes) {
679 if (!FuzzRegionDeserialize(bytes)) {
680 SkDebugf("[terminated] Couldn't initialize SkRegion.\n");
681 return;
682 }
683 SkDebugf("[terminated] Success! Initialized SkRegion.\n");
684 }
685
686 void FuzzTextBlobDeserialize(SkReadBuffer& buf);
687
fuzz_textblob_deserialize(sk_sp<SkData> bytes)688 static void fuzz_textblob_deserialize(sk_sp<SkData> bytes) {
689 SkReadBuffer buf(bytes->data(), bytes->size());
690 FuzzTextBlobDeserialize(buf);
691 SkDebugf("[terminated] textblob didn't crash!\n");
692 }
693
694 void FuzzRegionSetPath(Fuzz* fuzz);
695
fuzz_region_set_path(sk_sp<SkData> bytes)696 static void fuzz_region_set_path(sk_sp<SkData> bytes) {
697 Fuzz fuzz(bytes);
698 FuzzRegionSetPath(&fuzz);
699 SkDebugf("[terminated] region_set_path didn't crash!\n");
700 }
701
702 void FuzzImageFilterDeserialize(sk_sp<SkData> bytes);
703
fuzz_filter_fuzz(sk_sp<SkData> bytes)704 static void fuzz_filter_fuzz(sk_sp<SkData> bytes) {
705 FuzzImageFilterDeserialize(bytes);
706 SkDebugf("[terminated] filter_fuzz didn't crash!\n");
707 }
708
709 #if SK_SUPPORT_GPU
fuzz_sksl2glsl(sk_sp<SkData> bytes)710 static void fuzz_sksl2glsl(sk_sp<SkData> bytes) {
711 SkSL::Compiler compiler;
712 SkSL::String output;
713 SkSL::Program::Settings settings;
714 sk_sp<GrShaderCaps> caps = SkSL::ShaderCapsFactory::Default();
715 settings.fCaps = caps.get();
716 std::unique_ptr<SkSL::Program> program = compiler.convertProgram(SkSL::Program::kFragment_Kind,
717 SkSL::String((const char*) bytes->data()),
718 settings);
719 if (!program || !compiler.toGLSL(*program, &output)) {
720 SkDebugf("[terminated] Couldn't compile input.\n");
721 return;
722 }
723 SkDebugf("[terminated] Success! Compiled input.\n");
724 }
725 #endif
726