Home | History | Annotate | Download | only in libfuzzer
      1 // Copyright 2016 The PDFium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include <cstdint>
      6 #include <memory>
      7 #include <vector>
      8 
      9 #include "core/fxcodec/codec/ccodec_jpxmodule.h"
     10 #include "core/fxcodec/codec/cjpx_decoder.h"
     11 #include "core/fxcrt/fx_safe_types.h"
     12 #include "core/fxge/dib/cfx_dibitmap.h"
     13 #include "core/fxge/fx_dib.h"
     14 
     15 CCodec_JpxModule g_module;
     16 
     17 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     18   std::unique_ptr<CJPX_Decoder> decoder =
     19       g_module.CreateDecoder(data, size, nullptr);
     20   if (!decoder)
     21     return 0;
     22 
     23   uint32_t width;
     24   uint32_t height;
     25   uint32_t components;
     26   g_module.GetImageInfo(decoder.get(), &width, &height, &components);
     27 
     28   static constexpr uint32_t kMemLimit = 1024 * 1024 * 1024;  // 1 GB.
     29   FX_SAFE_UINT32 mem = width;
     30   mem *= height;
     31   mem *= components;
     32   if (!mem.IsValid() || mem.ValueOrDie() > kMemLimit)
     33     return 0;
     34 
     35   FXDIB_Format format;
     36   if (components == 1) {
     37     format = FXDIB_8bppRgb;
     38   } else if (components <= 3) {
     39     format = FXDIB_Rgb;
     40   } else if (components == 4) {
     41     format = FXDIB_Rgb32;
     42   } else {
     43     width = (width * components + 2) / 3;
     44     format = FXDIB_Rgb;
     45   }
     46   auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
     47   if (!bitmap->Create(width, height, format))
     48     return 0;
     49 
     50   std::vector<uint8_t> output_offsets(components);
     51   for (uint32_t i = 0; i < components; ++i)
     52     output_offsets[i] = i;
     53 
     54   g_module.Decode(decoder.get(), bitmap->GetBuffer(), bitmap->GetPitch(),
     55                   output_offsets);
     56   return 0;
     57 }
     58