1 /*
2 * Copyright 2018 Google, LLC
3 *
4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file.
6 */
7
8 #include "include/codec/SkAndroidCodec.h"
9 #include "include/core/SkBitmap.h"
10 #include "include/core/SkCanvas.h"
11 #include "include/core/SkStream.h"
12 #include "include/core/SkSurface.h"
13 #include "include/private/SkGainmapInfo.h"
14
15 #include "fuzz/Fuzz.h"
16
FuzzAndroidCodec(const uint8_t * fuzzData,size_t fuzzSize,uint8_t sampleSize)17 bool FuzzAndroidCodec(const uint8_t *fuzzData, size_t fuzzSize, uint8_t sampleSize) {
18 auto codec = SkAndroidCodec::MakeFromStream(SkMemoryStream::MakeDirect(fuzzData, fuzzSize));
19 if (!codec) {
20 return false;
21 }
22
23 auto size = codec->getSampledDimensions(sampleSize);
24 auto info = SkImageInfo::MakeN32Premul(size);
25 SkBitmap bm;
26 if (!bm.tryAllocPixels(info)) {
27 // May fail in memory-constrained fuzzing environments
28 return false;
29 }
30
31 SkAndroidCodec::AndroidOptions options;
32 options.fSampleSize = sampleSize;
33
34 auto result = codec->getAndroidPixels(bm.info(), bm.getPixels(), bm.rowBytes(), &options);
35 switch (result) {
36 case SkCodec::kSuccess:
37 case SkCodec::kIncompleteInput:
38 case SkCodec::kErrorInInput:
39 break;
40 default:
41 return false;
42 }
43
44 SkGainmapInfo gainmapInfo;
45 auto gainmapImageStream = std::unique_ptr<SkStream>();
46
47 if (codec->getAndroidGainmap(&gainmapInfo, &gainmapImageStream)) {
48 // Do something with the outputs so the compiler does not optimize the call away.
49 if (!std::isfinite(gainmapInfo.fDisplayRatioSdr)) {
50 return false;
51 }
52 if (gainmapImageStream->getLength() > 100000000) {
53 return false;
54 }
55 }
56
57 auto surface = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(size.width(), size.height()));
58 if (!surface) {
59 // May return nullptr in memory-constrained fuzzing environments
60 return false;
61 }
62
63 surface->getCanvas()->drawImage(bm.asImage(), 0, 0);
64 return true;
65 }
66
67 #if defined(SK_BUILD_FOR_LIBFUZZER)
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)68 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
69 if (size > 10240) {
70 return 0;
71 }
72 Fuzz fuzz(data, size);
73 uint8_t sampleSize;
74 fuzz.nextRange(&sampleSize, 1, 64);
75 FuzzAndroidCodec(fuzz.remainingData(), fuzz.remainingSize(), sampleSize);
76 return 0;
77 }
78 #endif
79