Merge "import fuzzers from oss-fuzz/chromium"

.gitignore

@@ -42,3 +42,9 @@ cmake_install.cmake
 extras/get_disto
 extras/vwebp_sdl
 extras/webp_quality
+tests/fuzzer/advanced_api_fuzzer
+tests/fuzzer/animation_api_fuzzer
+tests/fuzzer/animencoder_fuzzer
+tests/fuzzer/demux_api_fuzzer
+tests/fuzzer/enc_dec_fuzzer
+tests/fuzzer/simple_api_fuzzer

tests/README

@@ -0,0 +1,19 @@
+Description:
+============
+
+This is a collection of tests for the libwebp libraries, currently covering
+fuzzing through the APIs. Additional test vector coverage can be found at:
+https://chromium.googlesource.com/webm/libwebp-test-data
+
+Building:
+=========
+
+Fuzzers:
+--------
+
+Follow the build instructions in ../README for libwebp, optionally adding build
+flags for various sanitizers (e.g., -fsanitize=address).
+
+fuzzer/makefile.unix can then be used to compile the fuzzer targets:
+
+$ make -C fuzzer -f makefile.unix

tests/fuzzer/advanced_api_fuzzer.c

@@ -0,0 +1,97 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include "./fuzz_utils.h"
+#include "webp/decode.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+  WebPDecoderConfig config;
+  if (!WebPInitDecoderConfig(&config)) return 0;
+  if (WebPGetFeatures(data, size, &config.input) != VP8_STATUS_OK) return 0;
+  if ((size_t)config.input.width * config.input.height > kFuzzPxLimit) return 0;
+
+  // Using two independent criteria ensures that all combinations of options
+  // can reach each path at the decoding stage, with meaningful differences.
+
+  const uint8_t value = FuzzHash(data, size);
+  const float factor = value / 255.f;  // 0-1
+
+  config.options.flip = value & 1;
+  config.options.bypass_filtering = value & 2;
+  config.options.no_fancy_upsampling = value & 4;
+  config.options.use_threads = value & 8;
+  if (size & 1) {
+    config.options.use_cropping = 1;
+    config.options.crop_width = (int)(config.input.width * (1 - factor));
+    config.options.crop_height = (int)(config.input.height * (1 - factor));
+    config.options.crop_left = config.input.width - config.options.crop_width;
+    config.options.crop_top = config.input.height - config.options.crop_height;
+  }
+  if (size & 2) {
+    int strength = (int)(factor * 100);
+    config.options.dithering_strength = strength;
+    config.options.alpha_dithering_strength = 100 - strength;
+  }
+  if (size & 4) {
+    config.options.use_scaling = 1;
+    config.options.scaled_width = (int)(config.input.width * factor * 2);
+    config.options.scaled_height = (int)(config.input.height * factor * 2);
+  }
+
+#if defined(WEBP_REDUCE_CSP)
+  config.output.colorspace = (value & 1)
+                                 ? ((value & 2) ? MODE_RGBA : MODE_BGRA)
+                                 : ((value & 2) ? MODE_rgbA : MODE_bgrA);
+#else
+  config.output.colorspace = (WEBP_CSP_MODE)(value % MODE_LAST);
+#endif  // WEBP_REDUCE_CSP
+
+  if (size % 3) {
+    // Decodes incrementally in chunks of increasing size.
+    WebPIDecoder* idec = WebPIDecode(NULL, 0, &config);
+    if (!idec) return 0;
+    VP8StatusCode status;
+    if (size & 8) {
+      size_t available_size = value + 1;
+      while (1) {
+        if (available_size > size) available_size = size;
+        status = WebPIUpdate(idec, data, available_size);
+        if (status != VP8_STATUS_SUSPENDED || available_size == size) break;
+        available_size *= 2;
+      }
+    } else {
+      // WebPIAppend expects new data and its size with each call.
+      // Implemented here by simply advancing the pointer into data.
+      const uint8_t* new_data = data;
+      size_t new_size = value + 1;
+      while (1) {
+        if (new_data + new_size > data + size) {
+          new_size = data + size - new_data;
+        }
+        status = WebPIAppend(idec, new_data, new_size);
+        if (status != VP8_STATUS_SUSPENDED || new_size == 0) break;
+        new_data += new_size;
+        new_size *= 2;
+      }
+    }
+    WebPIDelete(idec);
+  } else {
+    WebPDecode(data, size, &config);
+  }
+
+  WebPFreeDecBuffer(&config.output);
+  return 0;
+}

tests/fuzzer/animation_api_fuzzer.c

@@ -0,0 +1,78 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include "./fuzz_utils.h"
+#include "webp/decode.h"
+#include "webp/demux.h"
+#include "webp/mux_types.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+  WebPData webp_data;
+  WebPDataInit(&webp_data);
+  webp_data.size = size;
+  webp_data.bytes = data;
+
+  // WebPAnimDecoderNew uses WebPDemux internally to calloc canvas size.
+  WebPDemuxer* const demux = WebPDemux(&webp_data);
+  if (!demux) return 0;
+  const uint32_t cw = WebPDemuxGetI(demux, WEBP_FF_CANVAS_WIDTH);
+  const uint32_t ch = WebPDemuxGetI(demux, WEBP_FF_CANVAS_HEIGHT);
+  if ((size_t)cw * ch > kFuzzPxLimit) {
+    WebPDemuxDelete(demux);
+    return 0;
+  }
+
+  // In addition to canvas size, check each frame separately.
+  WebPIterator iter;
+  for (int i = 0; i < kFuzzFrameLimit; i++) {
+    if (!WebPDemuxGetFrame(demux, i + 1, &iter)) break;
+    int w, h;
+    if (WebPGetInfo(iter.fragment.bytes, iter.fragment.size, &w, &h)) {
+      if ((size_t)w * h > kFuzzPxLimit) {  // image size of the frame payload
+        WebPDemuxReleaseIterator(&iter);
+        WebPDemuxDelete(demux);
+        return 0;
+      }
+    }
+  }
+
+  WebPDemuxReleaseIterator(&iter);
+  WebPDemuxDelete(demux);
+
+  WebPAnimDecoderOptions dec_options;
+  if (!WebPAnimDecoderOptionsInit(&dec_options)) return 0;
+
+  dec_options.use_threads = size & 1;
+  // Animations only support 4 (of 12) modes.
+  dec_options.color_mode = (WEBP_CSP_MODE)(size % MODE_LAST);
+  if (dec_options.color_mode != MODE_BGRA &&
+      dec_options.color_mode != MODE_rgbA &&
+      dec_options.color_mode != MODE_bgrA) {
+    dec_options.color_mode = MODE_RGBA;
+  }
+
+  WebPAnimDecoder* dec = WebPAnimDecoderNew(&webp_data, &dec_options);
+  if (!dec) return 0;
+
+  for (int i = 0; i < kFuzzFrameLimit; i++) {
+    uint8_t* buf;
+    int timestamp;
+    if (!WebPAnimDecoderGetNext(dec, &buf, &timestamp)) break;
+  }
+
+  WebPAnimDecoderDelete(dec);
+  return 0;
+}

tests/fuzzer/animencoder_fuzzer.cc

@@ -0,0 +1,166 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "./fuzz_utils.h"
+#include "webp/encode.h"
+#include "webp/mux.h"
+
+namespace {
+
+const VP8CPUInfo default_VP8GetCPUInfo = VP8GetCPUInfo;
+
+int AddFrame(WebPAnimEncoder** const enc,
+             const WebPAnimEncoderOptions& anim_config, int* const width,
+             int* const height, int timestamp_ms, const uint8_t data[],
+             size_t size, uint32_t* const bit_pos) {
+  if (enc == nullptr || width == nullptr || height == nullptr) {
+    fprintf(stderr, "NULL parameters.\n");
+    if (enc != nullptr) WebPAnimEncoderDelete(*enc);
+    abort();
+  }
+
+  // Init the source picture.
+  WebPPicture pic;
+  if (!WebPPictureInit(&pic)) {
+    fprintf(stderr, "WebPPictureInit failed.\n");
+    WebPAnimEncoderDelete(*enc);
+    abort();
+  }
+  pic.use_argb = Extract(1, data, size, bit_pos);
+
+  // Read the source picture.
+  if (!ExtractSourcePicture(&pic, data, size, bit_pos)) {
+    fprintf(stderr, "Can't read input image.\n");
+    WebPPictureFree(&pic);
+    abort();
+  }
+
+  // Crop and scale.
+  if (*enc == nullptr) {  // First frame will set canvas width and height.
+    if (!ExtractAndCropOrScale(&pic, data, size, bit_pos)) {
+      fprintf(stderr, "ExtractAndCropOrScale failed.");
+      WebPPictureFree(&pic);
+      abort();
+    }
+  } else {  // Other frames will be resized to the first frame's dimensions.
+    if (!WebPPictureRescale(&pic, *width, *height)) {
+      fprintf(stderr, "WebPPictureRescale failed. Size: %d,%d\n", *width,
+              *height);
+      WebPAnimEncoderDelete(*enc);
+      WebPPictureFree(&pic);
+      abort();
+    }
+  }
+
+  // Create encoder if it doesn't exist.
+  if (*enc == nullptr) {
+    *width = pic.width;
+    *height = pic.height;
+    *enc = WebPAnimEncoderNew(*width, *height, &anim_config);
+    if (*enc == nullptr) {
+      fprintf(stderr, "WebPAnimEncoderNew failed.\n");
+      WebPPictureFree(&pic);
+      abort();
+    }
+  }
+
+  // Create frame encoding config.
+  WebPConfig config;
+  if (!ExtractWebPConfig(&config, data, size, bit_pos)) {
+    fprintf(stderr, "ExtractWebPConfig failed.\n");
+    WebPAnimEncoderDelete(*enc);
+    WebPPictureFree(&pic);
+    abort();
+  }
+  // Skip slow settings on big images, it's likely to timeout.
+  if (pic.width * pic.height > 32 * 32) {
+    config.method = (config.method > 4) ? 4 : config.method;
+    config.quality = (config.quality > 99.0f) ? 99.0f : config.quality;
+    config.alpha_quality =
+        (config.alpha_quality > 99) ? 99 : config.alpha_quality;
+  }
+
+  // Encode.
+  if (!WebPAnimEncoderAdd(*enc, &pic, timestamp_ms, &config)) {
+    fprintf(stderr, "WebPEncode failed. Error code: %d\n", pic.error_code);
+    WebPAnimEncoderDelete(*enc);
+    WebPPictureFree(&pic);
+    abort();
+  }
+
+  WebPPictureFree(&pic);
+  return 1;
+}
+
+}  // namespace
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+  WebPAnimEncoder* enc = nullptr;
+  int width = 0, height = 0, timestamp_ms = 0;
+  uint32_t bit_pos = 0;
+
+  ExtractAndDisableOptimizations(default_VP8GetCPUInfo, data, size, &bit_pos);
+
+  // Extract a configuration from the packed bits.
+  WebPAnimEncoderOptions anim_config;
+  if (!WebPAnimEncoderOptionsInit(&anim_config)) {
+    fprintf(stderr, "WebPAnimEncoderOptionsInit failed.\n");
+    abort();
+  }
+  anim_config.minimize_size = Extract(1, data, size, &bit_pos);
+  anim_config.kmax = Extract(15, data, size, &bit_pos);
+  const int min_kmin = (anim_config.kmax > 1) ? (anim_config.kmax / 2) : 0;
+  const int max_kmin = (anim_config.kmax > 1) ? (anim_config.kmax - 1) : 0;
+  anim_config.kmin =
+      min_kmin + Extract((uint32_t)(max_kmin - min_kmin), data, size, &bit_pos);
+  anim_config.allow_mixed = Extract(1, data, size, &bit_pos);
+  anim_config.verbose = 0;
+
+  const int nb_frames = 1 + Extract(15, data, size, &bit_pos);
+
+  // For each frame.
+  for (int i = 0; i < nb_frames; ++i) {
+    if (!AddFrame(&enc, anim_config, &width, &height, timestamp_ms, data, size,
+                  &bit_pos)) {
+      return 0;
+    }
+
+    timestamp_ms += (1 << (2 + Extract(15, data, size, &bit_pos))) +
+                    Extract(1, data, size, &bit_pos);  // [1..131073], arbitrary
+  }
+
+  // Assemble.
+  if (!WebPAnimEncoderAdd(enc, nullptr, timestamp_ms, nullptr)) {
+    fprintf(stderr, "Last WebPAnimEncoderAdd failed.");
+    WebPAnimEncoderDelete(enc);
+    abort();
+  }
+  WebPData webp_data;
+  WebPDataInit(&webp_data);
+  if (!WebPAnimEncoderAssemble(enc, &webp_data)) {
+    fprintf(stderr, "WebPAnimEncoderAssemble failed.");
+    WebPAnimEncoderDelete(enc);
+    WebPDataClear(&webp_data);
+    abort();
+  }
+
+  WebPAnimEncoderDelete(enc);
+  WebPDataClear(&webp_data);
+  return 0;
+}

tests/fuzzer/demux_api_fuzzer.c

@@ -0,0 +1,96 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include "./fuzz_utils.h"
+#include "webp/demux.h"
+#include "webp/mux.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+  WebPData webp_data;
+  WebPDataInit(&webp_data);
+  webp_data.size = size;
+  webp_data.bytes = data;
+
+  // Extracted chunks and frames are not processed or decoded,
+  // which is already covered extensively by the other fuzz targets.
+
+  if (size & 1) {
+    // Mux API
+    WebPMux* mux = WebPMuxCreate(&webp_data, size & 2);
+    if (!mux) return 0;
+
+    WebPData chunk;
+    WebPMuxGetChunk(mux, "EXIF", &chunk);
+    WebPMuxGetChunk(mux, "ICCP", &chunk);
+    WebPMuxGetChunk(mux, "FUZZ", &chunk);  // unknown
+
+    uint32_t flags;
+    WebPMuxGetFeatures(mux, &flags);
+
+    WebPMuxAnimParams params;
+    WebPMuxGetAnimationParams(mux, &params);
+
+    WebPMuxError status;
+    WebPMuxFrameInfo info;
+    for (int i = 0; i < kFuzzFrameLimit; i++) {
+      status = WebPMuxGetFrame(mux, i + 1, &info);
+      if (status == WEBP_MUX_NOT_FOUND) {
+        break;
+      } else if (status == WEBP_MUX_OK) {
+        WebPDataClear(&info.bitstream);
+      }
+    }
+
+    WebPMuxDelete(mux);
+  } else {
+    // Demux API
+    WebPDemuxer* demux;
+    if (size & 2) {
+      WebPDemuxState state;
+      demux = WebPDemuxPartial(&webp_data, &state);
+      if (state < WEBP_DEMUX_PARSED_HEADER) {
+        WebPDemuxDelete(demux);
+        return 0;
+      }
+    } else {
+      demux = WebPDemux(&webp_data);
+      if (!demux) return 0;
+    }
+
+    WebPChunkIterator chunk_iter;
+    if (WebPDemuxGetChunk(demux, "EXIF", 1, &chunk_iter)) {
+      WebPDemuxNextChunk(&chunk_iter);
+    }
+    WebPDemuxReleaseChunkIterator(&chunk_iter);
+    if (WebPDemuxGetChunk(demux, "ICCP", 0, &chunk_iter)) {  // 0 == last
+      WebPDemuxPrevChunk(&chunk_iter);
+    }
+    WebPDemuxReleaseChunkIterator(&chunk_iter);
+    // Skips FUZZ because the Demux API has no concept of (un)known chunks.
+
+    WebPIterator iter;
+    if (WebPDemuxGetFrame(demux, 1, &iter)) {
+      for (int i = 1; i < kFuzzFrameLimit; i++) {
+        if (!WebPDemuxNextFrame(&iter)) break;
+      }
+    }
+
+    WebPDemuxReleaseIterator(&iter);
+    WebPDemuxDelete(demux);
+  }
+
+  return 0;
+}

tests/fuzzer/enc_dec_fuzzer.cc

@@ -0,0 +1,134 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "./fuzz_utils.h"
+#include "webp/decode.h"
+#include "webp/encode.h"
+
+namespace {
+
+const VP8CPUInfo default_VP8GetCPUInfo = VP8GetCPUInfo;
+
+}  // namespace
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+  uint32_t bit_pos = 0;
+
+  ExtractAndDisableOptimizations(default_VP8GetCPUInfo, data, size, &bit_pos);
+
+  // Init the source picture.
+  WebPPicture pic;
+  if (!WebPPictureInit(&pic)) {
+    fprintf(stderr, "WebPPictureInit failed.\n");
+    abort();
+  }
+  pic.use_argb = Extract(1, data, size, &bit_pos);
+
+  // Read the source picture.
+  if (!ExtractSourcePicture(&pic, data, size, &bit_pos)) {
+    fprintf(stderr, "Can't read input image.\n");
+    WebPPictureFree(&pic);
+    abort();
+  }
+
+  // Crop and scale.
+  if (!ExtractAndCropOrScale(&pic, data, size, &bit_pos)) {
+    fprintf(stderr, "ExtractAndCropOrScale failed.");
+    WebPPictureFree(&pic);
+    abort();
+  }
+
+  // Extract a configuration from the packed bits.
+  WebPConfig config;
+  if (!ExtractWebPConfig(&config, data, size, &bit_pos)) {
+    fprintf(stderr, "ExtractWebPConfig failed.\n");
+    abort();
+  }
+  // Skip slow settings on big images, it's likely to timeout.
+  if (pic.width * pic.height > 32 * 32) {
+    if (config.lossless) {
+      if (config.quality > 99.0f && config.method >= 5) {
+        config.quality = 99.0f;
+        config.method = 5;
+      }
+    } else {
+      if (config.quality > 99.0f && config.method == 6) {
+        config.quality = 99.0f;
+      }
+    }
+    if (config.alpha_quality == 100 && config.method == 6) {
+      config.alpha_quality = 99;
+    }
+  }
+
+  // Encode.
+  WebPMemoryWriter memory_writer;
+  WebPMemoryWriterInit(&memory_writer);
+  pic.writer = WebPMemoryWrite;
+  pic.custom_ptr = &memory_writer;
+  if (!WebPEncode(&config, &pic)) {
+    fprintf(stderr, "WebPEncode failed. Error code: %d\n", pic.error_code);
+    WebPMemoryWriterClear(&memory_writer);
+    WebPPictureFree(&pic);
+    abort();
+  }
+
+  // Try decoding the result.
+  int w, h;
+  const uint8_t* const out_data = memory_writer.mem;
+  const size_t out_size = memory_writer.size;
+  uint8_t* const rgba = WebPDecodeBGRA(out_data, out_size, &w, &h);
+  if (rgba == nullptr || w != pic.width || h != pic.height) {
+    fprintf(stderr, "WebPDecodeBGRA failed.\n");
+    WebPFree(rgba);
+    WebPMemoryWriterClear(&memory_writer);
+    WebPPictureFree(&pic);
+    abort();
+  }
+
+  // Compare the results if exact encoding.
+  if (pic.use_argb && config.lossless && config.near_lossless == 100) {
+    const uint32_t* src1 = (const uint32_t*)rgba;
+    const uint32_t* src2 = pic.argb;
+    for (int y = 0; y < h; ++y, src1 += w, src2 += pic.argb_stride) {
+      for (int x = 0; x < w; ++x) {
+        uint32_t v1 = src1[x], v2 = src2[x];
+        if (!config.exact) {
+          if ((v1 & 0xff000000u) == 0 || (v2 & 0xff000000u) == 0) {
+            // Only keep alpha for comparison of fully transparent area.
+            v1 &= 0xff000000u;
+            v2 &= 0xff000000u;
+          }
+        }
+        if (v1 != v2) {
+          fprintf(stderr, "Lossless compression failed pixel-exactness.\n");
+          WebPFree(rgba);
+          WebPMemoryWriterClear(&memory_writer);
+          WebPPictureFree(&pic);
+          abort();
+        }
+      }
+    }
+  }
+
+  WebPFree(rgba);
+  WebPMemoryWriterClear(&memory_writer);
+  WebPPictureFree(&pic);
+  return 0;
+}

tests/fuzzer/fuzz.dict

@@ -0,0 +1,17 @@
+# https://developers.google.com/speed/webp/docs/riff_container
+
+# FourCC
+"ALPH"
+"ANIM"
+"ANMF"
+"EXIF"
+"ICCP"
+"RIFF"
+"VP8 "
+"VP8L"
+"VP8X"
+"WEBP"
+"XMP "
+
+# VP8 signature
+"\x9D\x01\x2A"

tests/fuzzer/fuzz_utils.h

@@ -0,0 +1,201 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#ifndef WEBP_TESTS_FUZZER_FUZZ_UTILS_H_
+#define WEBP_TESTS_FUZZER_FUZZ_UTILS_H_
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#include "./img_alpha.h"
+#include "./img_grid.h"
+#include "./img_peak.h"
+#include "dsp/dsp.h"
+#include "webp/encode.h"
+
+//------------------------------------------------------------------------------
+// Arbitrary limits to prevent OOM, timeout, or slow execution.
+//
+// The decoded image size, and for animations additionally the canvas size.
+static const size_t kFuzzPxLimit = 1024 * 1024;
+// Demuxed or decoded animation frames.
+static const int kFuzzFrameLimit = 3;
+
+// Reads and sums (up to) 128 spread-out bytes.
+static uint8_t FuzzHash(const uint8_t* const data, size_t size) {
+  uint8_t value = 0;
+  size_t incr = size / 128;
+  if (!incr) incr = 1;
+  for (size_t i = 0; i < size; i += incr) value += data[i];
+  return value;
+}
+
+//------------------------------------------------------------------------------
+// Extract an integer in [0, max_value].
+
+static uint32_t Extract(uint32_t max_value, const uint8_t data[], size_t size,
+                        uint32_t* const bit_pos) {
+  uint32_t v = 0;
+  uint32_t range = 1;
+  while (*bit_pos < 8 * size && range <= max_value) {
+    const uint8_t mask = 1u << (*bit_pos & 7);
+    v = (v << 1) | !!(data[*bit_pos >> 3] & mask);
+    range <<= 1;
+    ++*bit_pos;
+  }
+  return v % (max_value + 1);
+}
+
+//------------------------------------------------------------------------------
+// Some functions to override VP8GetCPUInfo and disable some optimizations.
+
+static VP8CPUInfo GetCPUInfo;
+
+static int GetCPUInfoNoSSE41(CPUFeature feature) {
+  if (feature == kSSE4_1 || feature == kAVX) return 0;
+  return GetCPUInfo(feature);
+}
+
+static int GetCPUInfoNoAVX(CPUFeature feature) {
+  if (feature == kAVX) return 0;
+  return GetCPUInfo(feature);
+}
+
+static int GetCPUInfoForceSlowSSSE3(CPUFeature feature) {
+  if (feature == kSlowSSSE3 && GetCPUInfo(kSSE3)) {
+    return 1;  // we have SSE3 -> force SlowSSSE3
+  }
+  return GetCPUInfo(feature);
+}
+
+static int GetCPUInfoOnlyC(CPUFeature feature) { return 0; }
+
+static void ExtractAndDisableOptimizations(VP8CPUInfo default_VP8GetCPUInfo,
+                                           const uint8_t data[], size_t size,
+                                           uint32_t* const bit_pos) {
+  GetCPUInfo = default_VP8GetCPUInfo;
+  const VP8CPUInfo kVP8CPUInfos[5] = {GetCPUInfoOnlyC, GetCPUInfoForceSlowSSSE3,
+                                      GetCPUInfoNoSSE41, GetCPUInfoNoAVX,
+                                      GetCPUInfo};
+  int VP8GetCPUInfo_index = Extract(4, data, size, bit_pos);
+  VP8GetCPUInfo = kVP8CPUInfos[VP8GetCPUInfo_index];
+}
+
+//------------------------------------------------------------------------------
+
+static int ExtractWebPConfig(WebPConfig* const config, const uint8_t data[],
+                             size_t size, uint32_t* const bit_pos) {
+  if (config == NULL || !WebPConfigInit(config)) return 0;
+  config->lossless = Extract(1, data, size, bit_pos);
+  config->quality = Extract(100, data, size, bit_pos);
+  config->method = Extract(6, data, size, bit_pos);
+  config->image_hint =
+      (WebPImageHint)Extract(WEBP_HINT_LAST - 1, data, size, bit_pos);
+  config->segments = 1 + Extract(3, data, size, bit_pos);
+  config->sns_strength = Extract(100, data, size, bit_pos);
+  config->filter_strength = Extract(100, data, size, bit_pos);
+  config->filter_sharpness = Extract(7, data, size, bit_pos);
+  config->filter_type = Extract(1, data, size, bit_pos);
+  config->autofilter = Extract(1, data, size, bit_pos);
+  config->alpha_compression = Extract(1, data, size, bit_pos);
+  config->alpha_filtering = Extract(2, data, size, bit_pos);
+  config->alpha_quality = Extract(100, data, size, bit_pos);
+  config->pass = 1 + Extract(9, data, size, bit_pos);
+  config->show_compressed = 1;
+  config->preprocessing = Extract(2, data, size, bit_pos);
+  config->partitions = Extract(3, data, size, bit_pos);
+  config->partition_limit = 10 * Extract(10, data, size, bit_pos);
+  config->emulate_jpeg_size = Extract(1, data, size, bit_pos);
+  config->thread_level = Extract(1, data, size, bit_pos);
+  config->low_memory = Extract(1, data, size, bit_pos);
+  config->near_lossless = 20 * Extract(5, data, size, bit_pos);
+  config->exact = Extract(1, data, size, bit_pos);
+  config->use_delta_palette = Extract(1, data, size, bit_pos);
+  config->use_sharp_yuv = Extract(1, data, size, bit_pos);
+  return WebPValidateConfig(config);
+}
+
+//------------------------------------------------------------------------------
+
+static int ExtractSourcePicture(WebPPicture* const pic,
+                                const uint8_t data[], size_t size,
+                                uint32_t* const bit_pos) {
+  if (pic == NULL) return 0;
+
+  // Pick a source picture.
+  const uint8_t* kImagesData[] = {
+      kImgAlphaData,
+      kImgGridData,
+      kImgPeakData
+  };
+  const int kImagesWidth[] = {
+      kImgAlphaWidth,
+      kImgGridWidth,
+      kImgPeakWidth
+  };
+  const int kImagesHeight[] = {
+      kImgAlphaHeight,
+      kImgGridHeight,
+      kImgPeakHeight
+  };
+  const size_t kNbImages = sizeof(kImagesData) / sizeof(kImagesData[0]);
+  const size_t image_index = Extract(kNbImages - 1, data, size, bit_pos);
+  const uint8_t* const image_data = kImagesData[image_index];
+  pic->width = kImagesWidth[image_index];
+  pic->height = kImagesHeight[image_index];
+  pic->argb_stride = pic->width * 4 * sizeof(uint8_t);
+
+  // Read the bytes.
+  return WebPPictureImportRGBA(pic, image_data, pic->argb_stride);
+}
+
+//------------------------------------------------------------------------------
+
+static int max(int a, int b) { return ((a < b) ? b : a); }
+
+static int ExtractAndCropOrScale(WebPPicture* const pic, const uint8_t data[],
+                                 size_t size, uint32_t* const bit_pos) {
+  if (pic == NULL) return 0;
+#if !defined(WEBP_REDUCE_SIZE)
+  const int alter_input = Extract(1, data, size, bit_pos);
+  const int crop_or_scale = Extract(1, data, size, bit_pos);
+  const int width_ratio = 1 + Extract(7, data, size, bit_pos);
+  const int height_ratio = 1 + Extract(7, data, size, bit_pos);
+  if (alter_input) {
+    if (crop_or_scale) {
+      const uint32_t left_ratio = 1 + Extract(7, data, size, bit_pos);
+      const uint32_t top_ratio = 1 + Extract(7, data, size, bit_pos);
+      const int cropped_width = max(1, pic->width / width_ratio);
+      const int cropped_height = max(1, pic->height / height_ratio);
+      const int cropped_left = (pic->width - cropped_width) / left_ratio;
+      const int cropped_top = (pic->height - cropped_height) / top_ratio;
+      return WebPPictureCrop(pic, cropped_left, cropped_top, cropped_width,
+                             cropped_height);
+    } else {
+      const int scaled_width = 1 + (pic->width * width_ratio) / 8;
+      const int scaled_height = 1 + (pic->height * height_ratio) / 8;
+      return WebPPictureRescale(pic, scaled_width, scaled_height);
+    }
+  }
+#else   // defined(WEBP_REDUCE_SIZE)
+  (void)data;
+  (void)size;
+  (void)bit_pos;
+#endif  // !defined(WEBP_REDUCE_SIZE)
+  return 1;
+}
+
+#endif  // WEBP_TESTS_FUZZER_FUZZ_UTILS_H_

tests/fuzzer/img_alpha.h

@@ -0,0 +1,381 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#ifndef WEBP_TESTS_FUZZER_IMG_ALPHA_H_
+#define WEBP_TESTS_FUZZER_IMG_ALPHA_H_
+
+#include <stdint.h>
+
+static const int kImgAlphaWidth = 32;
+static const int kImgAlphaHeight = 32;
+
+/*Pixel format: Red: 8 bit, Green: 8 bit, Blue: 8 bit, Fix 0xFF: 8 bit*/
+static const uint8_t kImgAlphaData[] = {
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xfe, 0xfe, 0xfe, 0xff, 0xfe, 0xfe, 0xfd, 0xff, 0xfe, 0xfd, 0xfc, 0xff,
+    0xfe, 0xfd, 0xfb, 0xff, 0xfe, 0xfc, 0xfb, 0xff, 0xfe, 0xfc, 0xfa, 0xff,
+    0xfe, 0xfc, 0xf9, 0xff, 0xfe, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf7, 0xff,
+    0xfe, 0xfb, 0xf7, 0xff, 0xfe, 0xfa, 0xf6, 0xff, 0xfe, 0xf9, 0xf5, 0xff,
+    0xfd, 0xf9, 0xf3, 0xff, 0xfd, 0xf8, 0xf2, 0xff, 0xfd, 0xf7, 0xf1, 0xff,
+    0xfc, 0xf7, 0xf0, 0xff, 0xfc, 0xf6, 0xef, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xfe, 0xfe, 0xff,
+    0xfe, 0xfe, 0xfd, 0xff, 0xfe, 0xfd, 0xfc, 0xff, 0xfe, 0xfd, 0xfb, 0xff,
+    0xfe, 0xfc, 0xfa, 0xff, 0xfe, 0xfc, 0xfa, 0xff, 0xfe, 0xfb, 0xf9, 0xff,
+    0xfe, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf7, 0xff, 0xfe, 0xfa, 0xf7, 0xff,
+    0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xfa, 0xf5, 0xff, 0xfd, 0xf9, 0xf4, 0xff,
+    0xfd, 0xf8, 0xf2, 0xff, 0xfc, 0xf7, 0xf1, 0xff, 0xfc, 0xf7, 0xf0, 0xff,
+    0xfc, 0xf7, 0xef, 0xff, 0xfc, 0xf6, 0xee, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xfe, 0xfe, 0xfe, 0xff, 0xfe, 0xfe, 0xfd, 0xff, 0xfe, 0xfd, 0xfd, 0xff,
+    0xfe, 0xfd, 0xfc, 0xff, 0xfe, 0xfd, 0xfb, 0xff, 0xfe, 0xfc, 0xfa, 0xff,
+    0xfe, 0xfc, 0xfa, 0xff, 0xfe, 0xfc, 0xf9, 0xff, 0xfe, 0xfb, 0xf8, 0xff,
+    0xfe, 0xfb, 0xf7, 0xff, 0xfe, 0xfb, 0xf6, 0xff, 0xfe, 0xfa, 0xf5, 0xff,
+    0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xf9, 0xf4, 0xff, 0xfe, 0xf8, 0xf3, 0xff,
+    0xfd, 0xf8, 0xf2, 0xff, 0xfc, 0xf7, 0xf1, 0xff, 0xfc, 0xf5, 0xf0, 0xff,
+    0xfc, 0xf6, 0xee, 0xff, 0xfc, 0xf5, 0xed, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfd, 0xfd, 0xfd, 0xff,
+    0xfc, 0xfb, 0xfb, 0xff, 0xfd, 0xfc, 0xfc, 0xff, 0xfe, 0xfd, 0xfb, 0xff,
+    0xfe, 0xfc, 0xfa, 0xff, 0xfe, 0xfc, 0xfa, 0xff, 0xfe, 0xfc, 0xf9, 0xff,
+    0xfe, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf7, 0xff,
+    0xfe, 0xfb, 0xf6, 0xff, 0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xfa, 0xf5, 0xff,
+    0xfe, 0xf9, 0xf4, 0xff, 0xfe, 0xf9, 0xf3, 0xff, 0xfe, 0xf8, 0xf2, 0xff,
+    0xfd, 0xf7, 0xf1, 0xff, 0xfc, 0xf6, 0xf0, 0xff, 0xfc, 0xf6, 0xee, 0xff,
+    0xfc, 0xf5, 0xec, 0xff, 0xfb, 0xf5, 0xec, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xfc, 0xfc, 0xfc, 0xff, 0xfb, 0xfb, 0xfb, 0xff,
+    0xfa, 0xf9, 0xf9, 0xff, 0xf7, 0xf6, 0xf6, 0xff, 0xfd, 0xfc, 0xfa, 0xff,
+    0xfe, 0xfc, 0xfa, 0xff, 0xfe, 0xfc, 0xf9, 0xff, 0xfe, 0xfb, 0xf9, 0xff,
+    0xfe, 0xfb, 0xf7, 0xff, 0xfe, 0xfb, 0xf7, 0xff, 0xfe, 0xfb, 0xf6, 0xff,
+    0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xfa, 0xf3, 0xff,
+    0xfe, 0xfa, 0xf4, 0xfb, 0xfe, 0xf9, 0xf4, 0xeb, 0xfe, 0xfb, 0xf6, 0xdc,
+    0xfd, 0xfa, 0xf6, 0xcf, 0xfd, 0xfa, 0xf5, 0xcc, 0xfc, 0xf9, 0xf4, 0xcb,
+    0xfd, 0xf8, 0xf3, 0xc7, 0xfc, 0xf8, 0xf2, 0xc7,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfd, 0xfd, 0xfd, 0xff,
+    0xfb, 0xfa, 0xfa, 0xff, 0xf8, 0xf7, 0xf7, 0xff, 0xf6, 0xf4, 0xf4, 0xff,
+    0xf7, 0xf5, 0xf5, 0xff, 0xf5, 0xf5, 0xf4, 0xff, 0xf8, 0xf7, 0xf7, 0xff,
+    0xfd, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf7, 0xff,
+    0xfe, 0xfb, 0xf7, 0xff, 0xfe, 0xfa, 0xf6, 0xff, 0xfe, 0xfa, 0xf5, 0xff,
+    0xfe, 0xfa, 0xf4, 0xff, 0xfd, 0xfa, 0xf4, 0xfc, 0xfe, 0xfc, 0xf9, 0xcf,
+    0xff, 0xff, 0xff, 0xaf, 0xff, 0xff, 0xff, 0xa8, 0xff, 0xff, 0xff, 0xa4,
+    0xff, 0xff, 0xff, 0x9f, 0xff, 0xff, 0xff, 0x9b, 0xff, 0xff, 0xff, 0x94,
+    0xff, 0xff, 0xff, 0x90, 0xff, 0xff, 0xff, 0x8b,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xfd, 0xfc, 0xfc, 0xff, 0xfa, 0xf9, 0xf9, 0xff,
+    0xf6, 0xf5, 0xf4, 0xff, 0xf5, 0xf3, 0xf3, 0xff, 0xf4, 0xf2, 0xf1, 0xff,
+    0xf2, 0xf1, 0xf0, 0xff, 0xf2, 0xf0, 0xf0, 0xff, 0xf0, 0xee, 0xee, 0xff,
+    0xf1, 0xf0, 0xef, 0xff, 0xfe, 0xfb, 0xf8, 0xff, 0xfe, 0xfb, 0xf6, 0xff,
+    0xfe, 0xfa, 0xf6, 0xff, 0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xfb, 0xf4, 0xff,
+    0xfe, 0xfb, 0xf5, 0xf3, 0xff, 0xfe, 0xfe, 0xb4, 0xff, 0xff, 0xff, 0xac,
+    0xff, 0xff, 0xff, 0xa7, 0xff, 0xff, 0xff, 0xa3, 0xff, 0xff, 0xff, 0x9c,
+    0xff, 0xff, 0xff, 0x98, 0xff, 0xff, 0xff, 0x93, 0xff, 0xff, 0xff, 0x8f,
+    0xff, 0xff, 0xff, 0x88, 0xff, 0xff, 0xff, 0x84,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xfe, 0xfe, 0xff,
+    0xfc, 0xfb, 0xfb, 0xff, 0xf9, 0xf8, 0xf8, 0xff, 0xf6, 0xf5, 0xf4, 0xff,
+    0xf3, 0xf1, 0xf1, 0xff, 0xf0, 0xed, 0xed, 0xff, 0xef, 0xec, 0xeb, 0xff,
+    0xee, 0xeb, 0xeb, 0xff, 0xf0, 0xee, 0xee, 0xff, 0xea, 0xe7, 0xe7, 0xff,
+    0xec, 0xe9, 0xe9, 0xff, 0xf5, 0xf2, 0xf0, 0xff, 0xfe, 0xfb, 0xf6, 0xff,
+    0xfe, 0xfb, 0xf5, 0xff, 0xfe, 0xfa, 0xf4, 0xff, 0xfe, 0xfb, 0xf6, 0xeb,
+    0xff, 0xff, 0xff, 0xaf, 0xff, 0xff, 0xff, 0xab, 0xff, 0xff, 0xff, 0xa4,
+    0xff, 0xff, 0xff, 0xa0, 0xff, 0xff, 0xff, 0x9b, 0xff, 0xff, 0xff, 0x97,
+    0xff, 0xff, 0xff, 0x90, 0xff, 0xff, 0xff, 0x8c, 0xff, 0xff, 0xff, 0x87,
+    0xff, 0xff, 0xff, 0x83, 0xff, 0xff, 0xff, 0x7c,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xfd, 0xfc, 0xfc, 0xff, 0xfb, 0xfb, 0xfa, 0xff,
+    0xf8, 0xf6, 0xf6, 0xff, 0xf4, 0xf3, 0xf2, 0xff, 0xf2, 0xf0, 0xf0, 0xff,
+    0xef, 0xec, 0xeb, 0xff, 0xef, 0xec, 0xeb, 0xff, 0xeb, 0xe7, 0xe6, 0xff,
+    0xea, 0xe6, 0xe5, 0xff, 0xeb, 0xe8, 0xe8, 0xff, 0xe9, 0xe6, 0xe7, 0xff,
+    0xe5, 0xe2, 0xe2, 0xff, 0xed, 0xeb, 0xeb, 0xff, 0xf7, 0xf5, 0xf2, 0xff,
+    0xfe, 0xfa, 0xf5, 0xff, 0xfe, 0xfb, 0xf5, 0xf8, 0xff, 0xff, 0xff, 0xac,
+    0xff, 0xff, 0xff, 0xa8, 0xff, 0xff, 0xff, 0xa3, 0xff, 0xff, 0xff, 0x9f,
+    0xff, 0xff, 0xff, 0x98, 0xff, 0xff, 0xff, 0x94, 0xff, 0xff, 0xff, 0x8f,
+    0xff, 0xff, 0xff, 0x8b, 0xff, 0xff, 0xff, 0x84, 0xff, 0xff, 0xff, 0x80,
+    0xff, 0xff, 0xff, 0x7c, 0xff, 0xff, 0xff, 0x77,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xfc, 0xfc, 0xfc, 0xff, 0xf8, 0xf7, 0xf7, 0xff, 0xf6, 0xf5, 0xf4, 0xff,
+    0xf3, 0xf1, 0xf0, 0xff, 0xf1, 0xef, 0xef, 0xff, 0xef, 0xed, 0xec, 0xff,
+    0xec, 0xe8, 0xe7, 0xff, 0xe9, 0xe6, 0xe6, 0xff, 0xec, 0xe9, 0xe9, 0xff,
+    0xe4, 0xe0, 0xdf, 0xff, 0xec, 0xe9, 0xe9, 0xff, 0xea, 0xe6, 0xe6, 0xff,
+    0xe6, 0xe2, 0xe2, 0xff, 0xea, 0xe8, 0xe8, 0xff, 0xec, 0xe8, 0xe7, 0xff,
+    0xfc, 0xf9, 0xf4, 0xff, 0xfe, 0xfd, 0xfa, 0xc3, 0xff, 0xff, 0xff, 0xa7,
+    0xff, 0xff, 0xff, 0xa0, 0xff, 0xff, 0xff, 0x9c, 0xff, 0xff, 0xff, 0x97,
+    0xff, 0xff, 0xff, 0x93, 0xff, 0xff, 0xff, 0x8c, 0xfe, 0xfc, 0xf9, 0xa3,
+    0xfc, 0xfb, 0xf5, 0xb0, 0xfc, 0xf9, 0xf1, 0xbb, 0xfb, 0xf8, 0xf1, 0xb8,
+    0xfb, 0xf8, 0xef, 0xb4, 0xfb, 0xf9, 0xf2, 0xa4,
+    0xff, 0xff, 0xff, 0xff, 0xfe, 0xfe, 0xfe, 0xff, 0xfc, 0xfc, 0xfc, 0xff,
+    0xf8, 0xf7, 0xf7, 0xff, 0xf5, 0xf3, 0xf3, 0xff, 0xf1, 0xef, 0xef, 0xff,
+    0xef, 0xec, 0xeb, 0xff, 0xeb, 0xe7, 0xe7, 0xff, 0xea, 0xe7, 0xe6, 0xff,
+    0xe7, 0xe3, 0xe2, 0xff, 0xe4, 0xdf, 0xde, 0xff, 0xe6, 0xe2, 0xe2, 0xff,
+    0xe4, 0xe1, 0xe0, 0xff, 0xe6, 0xe3, 0xe2, 0xff, 0xe0, 0xdc, 0xdc, 0xff,
+    0xe3, 0xdf, 0xdf, 0xff, 0xe8, 0xe5, 0xe5, 0xff, 0xe4, 0xe1, 0xe2, 0xff,
+    0xec, 0xe8, 0xe5, 0xf8, 0xff, 0xff, 0xff, 0xa4, 0xff, 0xff, 0xff, 0xa0,
+    0xff, 0xff, 0xff, 0x9b, 0xff, 0xff, 0xff, 0x97, 0xff, 0xff, 0xff, 0x90,
+    0xfe, 0xfe, 0xfb, 0x9c, 0xfc, 0xf9, 0xef, 0xf7, 0xfc, 0xf8, 0xed, 0xff,
+    0xfc, 0xf7, 0xeb, 0xff, 0xfb, 0xf7, 0xeb, 0xff, 0xfa, 0xf6, 0xe9, 0xff,
+    0xfa, 0xf5, 0xe7, 0xff, 0xf8, 0xf4, 0xe5, 0xff,
+    0xfd, 0xfd, 0xfd, 0xff, 0xfa, 0xfa, 0xfa, 0xff, 0xfc, 0xfc, 0xfc, 0xff,
+    0xf8, 0xf7, 0xf7, 0xff, 0xf1, 0xef, 0xee, 0xff, 0xed, 0xea, 0xe9, 0xff,
+    0xea, 0xe6, 0xe5, 0xff, 0xe7, 0xe3, 0xe2, 0xff, 0xe4, 0xe0, 0xdf, 0xff,
+    0xe3, 0xde, 0xdd, 0xff, 0xe2, 0xde, 0xdd, 0xff, 0xe5, 0xe1, 0xe1, 0xff,
+    0xde, 0xda, 0xda, 0xff, 0xe0, 0xdd, 0xdc, 0xff, 0xe1, 0xdd, 0xdd, 0xff,
+    0xe3, 0xe0, 0xdf, 0xff, 0xe4, 0xe1, 0xe1, 0xff, 0xe3, 0xe0, 0xe0, 0xff,
+    0xec, 0xea, 0xea, 0xe8, 0xff, 0xff, 0xff, 0x9f, 0xff, 0xff, 0xff, 0x98,
+    0xff, 0xff, 0xff, 0x93, 0xff, 0xff, 0xff, 0x8f, 0xfe, 0xfe, 0xfe, 0x8c,
+    0xfd, 0xfb, 0xef, 0xff, 0xfd, 0xfb, 0xed, 0xff, 0xfd, 0xf8, 0xec, 0xff,
+    0xfc, 0xf8, 0xeb, 0xff, 0xfc, 0xf7, 0xea, 0xff, 0xfb, 0xf6, 0xe9, 0xff,
+    0xfa, 0xf6, 0xe7, 0xff, 0xfa, 0xf5, 0xe5, 0xff,
+    0xfa, 0xfa, 0xfa, 0xff, 0xf8, 0xf7, 0xf8, 0xff, 0xf6, 0xf6, 0xf6, 0xff,
+    0xf1, 0xf0, 0xf0, 0xff, 0xed, 0xec, 0xec, 0xff, 0xe9, 0xe6, 0xe5, 0xff,
+    0xe6, 0xe1, 0xe0, 0xff, 0xe2, 0xde, 0xdc, 0xff, 0xe0, 0xda, 0xd8, 0xff,
+    0xdd, 0xd7, 0xd5, 0xff, 0xde, 0xda, 0xd9, 0xff, 0xde, 0xda, 0xda, 0xff,
+    0xdc, 0xd7, 0xd8, 0xff, 0xdf, 0xdc, 0xdc, 0xff, 0xe5, 0xe3, 0xe4, 0xff,
+    0xe1, 0xde, 0xde, 0xff, 0xde, 0xdc, 0xdc, 0xff, 0xe9, 0xe7, 0xe8, 0xff,
+    0xe8, 0xe7, 0xe6, 0xe7, 0xff, 0xff, 0xff, 0x97, 0xff, 0xff, 0xff, 0x93,
+    0xff, 0xff, 0xff, 0x8c, 0xff, 0xff, 0xff, 0x88, 0xfe, 0xfe, 0xfa, 0x9b,
+    0xfc, 0xfb, 0xee, 0xff, 0xfc, 0xfa, 0xed, 0xff, 0xfb, 0xfa, 0xeb, 0xff,
+    0xfb, 0xf8, 0xeb, 0xff, 0xfb, 0xf7, 0xea, 0xff, 0xfa, 0xf6, 0xe8, 0xff,
+    0xf8, 0xf6, 0xe6, 0xff, 0xf7, 0xf5, 0xe3, 0xff,
+    0xf9, 0xf9, 0xf9, 0xff, 0xf7, 0xf6, 0xf7, 0xff, 0xf5, 0xf4, 0xf4, 0xff,
+    0xf0, 0xee, 0xef, 0xff, 0xe8, 0xe7, 0xe7, 0xff, 0xe7, 0xe4, 0xe3, 0xff,
+    0xe2, 0xdd, 0xdb, 0xff, 0xdf, 0xd9, 0xd7, 0xff, 0xdc, 0xd6, 0xd4, 0xff,
+    0xd8, 0xd2, 0xcf, 0xff, 0xd8, 0xd2, 0xd1, 0xff, 0xe0, 0xdc, 0xdc, 0xff,
+    0xdb, 0xd7, 0xd7, 0xff, 0xdb, 0xd7, 0xd7, 0xff, 0xe7, 0xe5, 0xe5, 0xff,
+    0xde, 0xda, 0xdb, 0xff, 0xdb, 0xd8, 0xd9, 0xff, 0xe0, 0xde, 0xde, 0xff,
+    0xed, 0xeb, 0xec, 0xe4, 0xff, 0xff, 0xff, 0x8f, 0xff, 0xff, 0xff, 0x8b,
+    0xff, 0xff, 0xff, 0x87, 0xff, 0xff, 0xff, 0x80, 0xfe, 0xfe, 0xfa, 0x94,
+    0xfd, 0xfb, 0xee, 0xff, 0xfd, 0xfb, 0xed, 0xff, 0xfc, 0xfb, 0xec, 0xff,
+    0xfc, 0xfa, 0xea, 0xff, 0xf8, 0xf7, 0xe9, 0xff, 0xf8, 0xf6, 0xe7, 0xff,
+    0xf7, 0xf7, 0xe5, 0xff, 0xf7, 0xf5, 0xe3, 0xff,
+    0xf9, 0xf9, 0xf9, 0xff, 0xf5, 0xf4, 0xf4, 0xff, 0xf2, 0xf2, 0xf2, 0xff,
+    0xe9, 0xe6, 0xe6, 0xff, 0xe9, 0xe7, 0xe6, 0xff, 0xe9, 0xe7, 0xe7, 0xff,
+    0xe0, 0xdb, 0xda, 0xff, 0xda, 0xd3, 0xd2, 0xff, 0xd6, 0xd0, 0xce, 0xff,
+    0xd4, 0xcd, 0xcb, 0xff, 0xd0, 0xc8, 0xc7, 0xff, 0xd7, 0xd2, 0xd1, 0xff,
+    0xd8, 0xd3, 0xd3, 0xff, 0xd4, 0xd1, 0xd1, 0xff, 0xe6, 0xe3, 0xe2, 0xff,
+    0xdd, 0xda, 0xda, 0xff, 0xe3, 0xe1, 0xe1, 0xff, 0xe0, 0xde, 0xde, 0xff,
+    0xe7, 0xe5, 0xe5, 0xe3, 0xff, 0xff, 0xff, 0x88, 0xff, 0xff, 0xff, 0x84,
+    0xff, 0xff, 0xff, 0x7f, 0xff, 0xff, 0xff, 0x7b, 0xfe, 0xfe, 0xfb, 0x88,
+    0xfc, 0xfc, 0xef, 0xff, 0xfb, 0xfc, 0xee, 0xff, 0xfb, 0xfa, 0xeb, 0xff,
+    0xfa, 0xfa, 0xea, 0xff, 0xf9, 0xf9, 0xe7, 0xff, 0xf7, 0xf7, 0xe6, 0xff,
+    0xf6, 0xf5, 0xe5, 0xff, 0xf7, 0xf5, 0xe3, 0xff,
+    0xf8, 0xf7, 0xf7, 0xff, 0xf4, 0xf4, 0xf4, 0xff, 0xf2, 0xf2, 0xf1, 0xff,
+    0xe8, 0xe6, 0xe6, 0xff, 0xe4, 0xe1, 0xe1, 0xff, 0xdd, 0xda, 0xda, 0xff,
+    0xe7, 0xe3, 0xe3, 0xff, 0xd6, 0xcf, 0xcd, 0xff, 0xd4, 0xcc, 0xca, 0xff,
+    0xcf, 0xc7, 0xc5, 0xff, 0xcc, 0xc3, 0xc1, 0xff, 0xd3, 0xce, 0xcc, 0xff,
+    0xd9, 0xd4, 0xd4, 0xff, 0xda, 0xd6, 0xd6, 0xff, 0xe3, 0xe1, 0xe0, 0xff,
+    0xdb, 0xd8, 0xd7, 0xff, 0xe4, 0xe2, 0xe2, 0xff, 0xe1, 0xde, 0xdf, 0xff,
+    0xe3, 0xe1, 0xe1, 0xf0, 0xff, 0xff, 0xff, 0x83, 0xff, 0xff, 0xff, 0x7c,
+    0xff, 0xff, 0xff, 0x78, 0xff, 0xff, 0xff, 0x73, 0xff, 0xff, 0xff, 0x6f,
+    0xfb, 0xfc, 0xed, 0xff, 0xfa, 0xfb, 0xed, 0xff, 0xfb, 0xfa, 0xeb, 0xff,
+    0xfa, 0xf9, 0xe9, 0xff, 0xfa, 0xf9, 0xe7, 0xff, 0xf8, 0xf9, 0xe7, 0xff,
+    0xf7, 0xf5, 0xe3, 0xff, 0xf7, 0xf4, 0xe1, 0xff,
+    0xf2, 0xf2, 0xf2, 0xff, 0xf0, 0xf0, 0xf0, 0xff, 0xf0, 0xf0, 0xef, 0xff,
+    0xe5, 0xe3, 0xe3, 0xff, 0xdd, 0xd9, 0xd9, 0xff, 0xdf, 0xdc, 0xdc, 0xff,
+    0xe6, 0xe3, 0xe3, 0xff, 0xe1, 0xda, 0xdb, 0xff, 0xd2, 0xca, 0xc7, 0xff,
+    0xca, 0xc2, 0xc0, 0xff, 0xc7, 0xbe, 0xbc, 0xff, 0xc8, 0xc2, 0xc0, 0xff,
+    0xd2, 0xcf, 0xce, 0xff, 0xd5, 0xcf, 0xd0, 0xff, 0xd5, 0xd1, 0xd1, 0xff,
+    0xda, 0xd6, 0xd7, 0xff, 0xde, 0xdc, 0xdd, 0xff, 0xde, 0xdd, 0xdc, 0xff,
+    0xe2, 0xe0, 0xe0, 0xff, 0xff, 0xff, 0xff, 0x7c, 0xff, 0xff, 0xff, 0x77,
+    0xff, 0xff, 0xff, 0x70, 0xff, 0xff, 0xff, 0x6c, 0xff, 0xff, 0xff, 0x67,
+    0xfa, 0xfd, 0xed, 0xf8, 0xf9, 0xfc, 0xeb, 0xff, 0xf9, 0xfb, 0xea, 0xff,
+    0xf8, 0xf9, 0xe8, 0xff, 0xf7, 0xf9, 0xe6, 0xff, 0xf7, 0xf8, 0xe6, 0xff,
+    0xf6, 0xf5, 0xe4, 0xff, 0xf6, 0xf4, 0xe1, 0xff,
+    0xe7, 0xe7, 0xe7, 0xff, 0xe3, 0xe4, 0xe3, 0xff, 0xe1, 0xe2, 0xe2, 0xff,
+    0xe4, 0xe4, 0xe4, 0xff, 0xd7, 0xd6, 0xd5, 0xff, 0xd5, 0xd4, 0xd4, 0xff,
+    0xdd, 0xdc, 0xdc, 0xff, 0xdc, 0xda, 0xda, 0xff, 0xd0, 0xc9, 0xc9, 0xff,
+    0xc9, 0xbf, 0xbe, 0xff, 0xc2, 0xba, 0xb8, 0xff, 0xc0, 0xb8, 0xb6, 0xff,
+    0xcc, 0xc7, 0xc7, 0xff, 0xd2, 0xcd, 0xcd, 0xff, 0xd2, 0xce, 0xcf, 0xff,
+    0xd1, 0xcc, 0xcd, 0xff, 0xdf, 0xde, 0xde, 0xff, 0xe7, 0xe6, 0xe6, 0xff,
+    0xe4, 0xe3, 0xe3, 0xff, 0xfd, 0xfd, 0xfd, 0x78, 0xff, 0xff, 0xff, 0x70,
+    0xff, 0xff, 0xff, 0x6b, 0xff, 0xff, 0xff, 0x67, 0xff, 0xff, 0xff, 0x60,
+    0xfc, 0xfe, 0xef, 0xcf, 0xf9, 0xfc, 0xec, 0xff, 0xfa, 0xfa, 0xe9, 0xff,
+    0xf8, 0xfa, 0xe8, 0xff, 0xf7, 0xf7, 0xe5, 0xff, 0xf6, 0xf7, 0xe5, 0xff,
+    0xf5, 0xf5, 0xe3, 0xff, 0xf6, 0xf4, 0xe0, 0xff,
+    0xdc, 0xdd, 0xdd, 0xff, 0xdb, 0xdc, 0xdc, 0xff, 0xd3, 0xd4, 0xd4, 0xff,
+    0xd8, 0xd8, 0xd8, 0xff, 0xd1, 0xd1, 0xd1, 0xff, 0xd0, 0xd0, 0xd0, 0xff,
+    0xca, 0xcb, 0xcb, 0xff, 0xcc, 0xcc, 0xcd, 0xff, 0xcb, 0xcb, 0xcb, 0xff,
+    0xc6, 0xc1, 0xc1, 0xff, 0xc0, 0xbc, 0xba, 0xff, 0xba, 0xb1, 0xaf, 0xff,
+    0xc5, 0xbf, 0xc0, 0xff, 0xd6, 0xd2, 0xd2, 0xff, 0xc4, 0xbf, 0xbf, 0xff,
+    0xd3, 0xce, 0xcd, 0xff, 0xd3, 0xd1, 0xd2, 0xff, 0xe3, 0xe2, 0xe2, 0xff,
+    0xe6, 0xe4, 0xe4, 0xff, 0xee, 0xee, 0xed, 0x9b, 0xff, 0xff, 0xff, 0x68,
+    0xff, 0xff, 0xff, 0x63, 0xff, 0xff, 0xff, 0x5f, 0xff, 0xff, 0xff, 0x5b,
+    0xfd, 0xfe, 0xf6, 0x80, 0xf9, 0xfc, 0xeb, 0xff, 0xf7, 0xfa, 0xeb, 0xff,
+    0xf7, 0xf9, 0xe9, 0xff, 0xf6, 0xf8, 0xe8, 0xff, 0xf6, 0xf7, 0xe5, 0xff,
+    0xf5, 0xf4, 0xe4, 0xff, 0xf5, 0xf4, 0xe3, 0xff,
+    0xd7, 0xd8, 0xd8, 0xff, 0xd4, 0xd5, 0xd4, 0xff, 0xd2, 0xd3, 0xd3, 0xff,
+    0xcf, 0xd0, 0xd0, 0xff, 0xcc, 0xce, 0xcd, 0xff, 0xc9, 0xca, 0xca, 0xff,
+    0xc5, 0xc6, 0xc6, 0xff, 0xc3, 0xc4, 0xc4, 0xff, 0xbf, 0xbf, 0xbd, 0xff,
+    0xbe, 0xbf, 0xbf, 0xff, 0xba, 0xba, 0xba, 0xff, 0xb4, 0xb1, 0xb1, 0xff,
+    0xbb, 0xba, 0xb9, 0xff, 0xc9, 0xc8, 0xc7, 0xff, 0xe2, 0xde, 0xde, 0xff,
+    0xc1, 0xbd, 0xbd, 0xff, 0xd6, 0xd5, 0xd5, 0xff, 0xde, 0xdd, 0xdc, 0xff,
+    0xdc, 0xda, 0xda, 0xff, 0xe6, 0xe5, 0xe5, 0xcf, 0xff, 0xff, 0xff, 0x63,
+    0xff, 0xff, 0xff, 0x5c, 0xff, 0xff, 0xff, 0x58, 0xff, 0xff, 0xff, 0x53,
+    0xff, 0xff, 0xff, 0x4f, 0xf9, 0xfc, 0xeb, 0xfb, 0xf6, 0xf9, 0xeb, 0xff,
+    0xf6, 0xf9, 0xea, 0xff, 0xf6, 0xf9, 0xe8, 0xff, 0xf5, 0xf5, 0xe4, 0xff,
+    0xf6, 0xf6, 0xe4, 0xff, 0xf5, 0xf4, 0xe2, 0xff,
+    0xd3, 0xd4, 0xd4, 0xff, 0xcc, 0xcd, 0xcd, 0xff, 0xce, 0xcf, 0xcf, 0xff,
+    0xc9, 0xcb, 0xcb, 0xff, 0xc6, 0xc7, 0xc7, 0xff, 0xc3, 0xc5, 0xc4, 0xff,
+    0xc0, 0xc1, 0xc1, 0xff, 0xbb, 0xbd, 0xbc, 0xff, 0xb7, 0xb9, 0xb8, 0xff,
+    0xb6, 0xb7, 0xb7, 0xff, 0xb4, 0xb7, 0xb6, 0xff, 0xaf, 0xaf, 0xaf, 0xff,
+    0xb0, 0xb2, 0xb2, 0xff, 0xb5, 0xb5, 0xb5, 0xff, 0xc1, 0xc0, 0xc0, 0xff,
+    0xc9, 0xc6, 0xc7, 0xff, 0xb3, 0xad, 0xae, 0xff, 0xcf, 0xcd, 0xce, 0xff,
+    0xe3, 0xe2, 0xe2, 0xff, 0xe4, 0xe2, 0xe2, 0xff, 0xfd, 0xfd, 0xfd, 0x60,
+    0xff, 0xff, 0xff, 0x57, 0xff, 0xff, 0xff, 0x50, 0xff, 0xff, 0xff, 0x4c,
+    0xff, 0xff, 0xff, 0x47, 0xfa, 0xfb, 0xef, 0xa8, 0xf8, 0xfc, 0xed, 0xff,
+    0xf7, 0xf9, 0xea, 0xff, 0xf6, 0xf7, 0xe7, 0xff, 0xf6, 0xf4, 0xe7, 0xff,
+    0xf5, 0xf4, 0xe5, 0xff, 0xf4, 0xf3, 0xe3, 0xff,
+    0xce, 0xcf, 0xcf, 0xff, 0xc8, 0xc9, 0xc9, 0xff, 0xc6, 0xc8, 0xc8, 0xff,
+    0xc4, 0xc6, 0xc6, 0xff, 0xc2, 0xc3, 0xc3, 0xff, 0xba, 0xbd, 0xbc, 0xff,
+    0xbc, 0xbe, 0xbe, 0xff, 0xb5, 0xb8, 0xb7, 0xff, 0xb4, 0xb6, 0xb5, 0xff,
+    0xb0, 0xb2, 0xb2, 0xff, 0xaf, 0xb1, 0xb0, 0xff, 0xaa, 0xad, 0xac, 0xff,
+    0xaa, 0xad, 0xac, 0xff, 0xa7, 0xa9, 0xa8, 0xff, 0xa4, 0xa5, 0xa5, 0xff,
+    0xa7, 0xa8, 0xa8, 0xff, 0xc4, 0xc3, 0xc3, 0xff, 0xb8, 0xb7, 0xb7, 0xff,
+    0xc0, 0xbf, 0xbe, 0xff, 0xd0, 0xce, 0xce, 0xff, 0xe3, 0xe2, 0xe2, 0x94,
+    0xff, 0xff, 0xff, 0x4f, 0xff, 0xff, 0xff, 0x4b, 0xff, 0xff, 0xff, 0x44,
+    0xff, 0xff, 0xff, 0x40, 0xed, 0xe7, 0xe6, 0x48, 0xba, 0xad, 0xa1, 0xff,
+    0xd6, 0xcf, 0xc1, 0xff, 0xf4, 0xf3, 0xe4, 0xff, 0xf5, 0xf4, 0xe5, 0xff,
+    0xf5, 0xf3, 0xe5, 0xff, 0xf5, 0xf5, 0xe5, 0xff,
+    0xc7, 0xc9, 0xc8, 0xff, 0xc5, 0xc6, 0xc6, 0xff, 0xc1, 0xc2, 0xc2, 0xff,
+    0xbd, 0xbe, 0xbe, 0xff, 0xba, 0xbc, 0xbb, 0xff, 0xb3, 0xb4, 0xb4, 0xff,
+    0xb2, 0xb5, 0xb4, 0xff, 0xb1, 0xb4, 0xb3, 0xff, 0xac, 0xaf, 0xae, 0xff,
+    0xa8, 0xaa, 0xa9, 0xff, 0xa8, 0xab, 0xaa, 0xff, 0xa1, 0xa4, 0xa3, 0xff,
+    0xa1, 0xa4, 0xa3, 0xff, 0xa3, 0xa5, 0xa4, 0xff, 0x9f, 0xa1, 0xa0, 0xff,
+    0x99, 0x9b, 0x9a, 0xff, 0x98, 0x9a, 0x9a, 0xff, 0x97, 0x9a, 0x99, 0xff,
+    0xa0, 0xa0, 0xa0, 0xff, 0x9b, 0x9b, 0x9b, 0xff, 0x9f, 0xa0, 0x9f, 0xe8,
+    0xff, 0xff, 0xff, 0x48, 0xff, 0xff, 0xff, 0x44, 0xff, 0xff, 0xff, 0x3f,
+    0xff, 0xff, 0xff, 0x3b, 0xff, 0xff, 0xff, 0x34, 0xbb, 0xa7, 0xa5, 0xd8,
+    0xb9, 0xa9, 0xa6, 0xff, 0xb9, 0xac, 0xa0, 0xff, 0xf8, 0xfa, 0xe7, 0xff,
+    0xf5, 0xf4, 0xe6, 0xff, 0xf4, 0xf3, 0xe4, 0xff,
+    0xc0, 0xc0, 0xbf, 0xff, 0xbb, 0xbb, 0xbb, 0xff, 0xbb, 0xbc, 0xbb, 0xff,
+    0xb6, 0xb6, 0xb6, 0xff, 0xb0, 0xb1, 0xb1, 0xff, 0xad, 0xad, 0xad, 0xff,
+    0xa8, 0xa7, 0xa7, 0xff, 0xa8, 0xa9, 0xa9, 0xff, 0xa5, 0xa6, 0xa6, 0xff,
+    0xa4, 0xa6, 0xa5, 0xff, 0xa3, 0xa6, 0xa6, 0xff, 0x9b, 0x9d, 0x9c, 0xff,
+    0x96, 0x99, 0x99, 0xff, 0x9b, 0x9d, 0x9d, 0xff, 0x97, 0x99, 0x98, 0xff,
+    0x8e, 0x91, 0x91, 0xff, 0x98, 0x9b, 0x9b, 0xff, 0x89, 0x8c, 0x8b, 0xff,
+    0x87, 0x8b, 0x89, 0xff, 0x84, 0x7f, 0x81, 0xff, 0x82, 0x82, 0x83, 0xff,
+    0xc0, 0xbe, 0xbf, 0x67, 0xff, 0xff, 0xff, 0x3c, 0xff, 0xff, 0xff, 0x37,
+    0xff, 0xff, 0xff, 0x33, 0xff, 0xff, 0xff, 0x2f, 0xc6, 0xbb, 0xb9, 0x50,
+    0xac, 0x9c, 0x99, 0xff, 0xa8, 0x98, 0x91, 0xff, 0xbd, 0xb0, 0xa5, 0xff,
+    0xf6, 0xf5, 0xe6, 0xff, 0xf4, 0xf3, 0xe4, 0xff,
+    0xbb, 0xbb, 0xba, 0xff, 0xb3, 0xb3, 0xb3, 0xff, 0xb3, 0xb4, 0xb4, 0xff,
+    0xae, 0xaf, 0xae, 0xff, 0xad, 0xae, 0xae, 0xff, 0xb2, 0xb4, 0xb4, 0xfc,
+    0xa8, 0xa8, 0xa9, 0xf3, 0xa7, 0xa7, 0xa7, 0xf3, 0x9e, 0x9f, 0x9d, 0xfc,
+    0x9b, 0x9c, 0x9a, 0xff, 0x9c, 0x9e, 0x9e, 0xff, 0x94, 0x96, 0x94, 0xff,
+    0x90, 0x90, 0x90, 0xff, 0x96, 0x98, 0x99, 0xff, 0x8d, 0x8f, 0x8e, 0xff,
+    0x83, 0x83, 0x84, 0xff, 0x8f, 0x92, 0x91, 0xff, 0x83, 0x85, 0x85, 0xff,
+    0x87, 0x87, 0x87, 0xff, 0x7c, 0x7d, 0x7d, 0xff, 0x78, 0x74, 0x72, 0xff,
+    0x95, 0x93, 0x92, 0x97, 0xff, 0xff, 0xff, 0x34, 0xff, 0xff, 0xff, 0x30,
+    0xff, 0xff, 0xff, 0x2c, 0xff, 0xff, 0xff, 0x27, 0xff, 0xff, 0xff, 0x23,
+    0xa2, 0x93, 0x94, 0xe7, 0x96, 0x83, 0x81, 0xff, 0xa8, 0x91, 0x8b, 0xff,
+    0xc4, 0xbc, 0xb2, 0xff, 0xf5, 0xf5, 0xe4, 0xff,
+    0xb7, 0xb9, 0xb8, 0xff, 0xaf, 0xaf, 0xae, 0xff, 0xaf, 0xaf, 0xaf, 0xff,
+    0xac, 0xad, 0xae, 0xff, 0xa8, 0xaa, 0xa9, 0xff, 0xae, 0xaf, 0xaf, 0xec,
+    0xc6, 0xc7, 0xc7, 0xb4, 0xc5, 0xc6, 0xc6, 0xb3, 0x9a, 0x99, 0x99, 0xeb,
+    0x91, 0x91, 0x90, 0xff, 0x94, 0x95, 0x95, 0xff, 0x95, 0x96, 0x96, 0xff,
+    0x8c, 0x8e, 0x8e, 0xff, 0x86, 0x88, 0x87, 0xff, 0x83, 0x82, 0x82, 0xff,
+    0x80, 0x81, 0x81, 0xff, 0x82, 0x84, 0x84, 0xff, 0x7b, 0x79, 0x7a, 0xff,
+    0x73, 0x74, 0x73, 0xff, 0x79, 0x7a, 0x7b, 0xff, 0x75, 0x73, 0x72, 0xff,
+    0x6f, 0x70, 0x6e, 0xfc, 0xe8, 0xe7, 0xe7, 0x37, 0xff, 0xff, 0xff, 0x2b,
+    0xff, 0xff, 0xff, 0x24, 0xff, 0xff, 0xff, 0x20, 0xff, 0xff, 0xff, 0x1c,
+    0x70, 0x6e, 0x6d, 0xeb, 0x6c, 0x69, 0x66, 0xff, 0x83, 0x78, 0x7b, 0xff,
+    0x83, 0x7f, 0x78, 0xff, 0xdc, 0xd5, 0xcd, 0xff,
+    0xb3, 0xb5, 0xb4, 0xff, 0xa9, 0xa9, 0xaa, 0xff, 0xa7, 0xa8, 0xa7, 0xff,
+    0xa7, 0xa8, 0xa7, 0xff, 0xa6, 0xa8, 0xa8, 0xff, 0xab, 0xac, 0xab, 0xe3,
+    0xdb, 0xdc, 0xdc, 0x97, 0xd9, 0xda, 0xda, 0x93, 0x99, 0x99, 0x98, 0xe0,
+    0x94, 0x95, 0x95, 0xff, 0x8e, 0x8f, 0x8e, 0xff, 0x8f, 0x93, 0x92, 0xff,
+    0x88, 0x8a, 0x89, 0xff, 0x79, 0x78, 0x78, 0xff, 0x80, 0x82, 0x82, 0xff,
+    0x7f, 0x81, 0x81, 0xff, 0x7f, 0x7d, 0x7e, 0xff, 0x76, 0x72, 0x72, 0xff,
+    0x70, 0x70, 0x70, 0xff, 0x73, 0x73, 0x73, 0xff, 0x67, 0x66, 0x64, 0xff,
+    0x6b, 0x6b, 0x6a, 0xff, 0x70, 0x73, 0x72, 0xd4, 0xff, 0xff, 0xff, 0x23,
+    0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xff, 0x1b, 0x79, 0x74, 0x72, 0x67,
+    0x63, 0x61, 0x61, 0xff, 0x63, 0x62, 0x60, 0xff, 0x5e, 0x5c, 0x5a, 0xff,
+    0x61, 0x5f, 0x5c, 0xff, 0x6b, 0x63, 0x5e, 0xff,
+    0xae, 0xaf, 0xaf, 0xff, 0xa9, 0xa9, 0xa9, 0xff, 0x9c, 0x9b, 0x99, 0xff,
+    0x9d, 0x9c, 0x9b, 0xff, 0x9c, 0x9c, 0x9c, 0xff, 0x9c, 0x9c, 0x9d, 0xf7,
+    0xaa, 0xac, 0xac, 0xd4, 0xa5, 0xa7, 0xa6, 0xd3, 0x98, 0x9a, 0x9a, 0xf4,
+    0x8d, 0x8e, 0x8e, 0xff, 0x85, 0x85, 0x85, 0xff, 0x85, 0x86, 0x86, 0xff,
+    0x82, 0x84, 0x84, 0xff, 0x7b, 0x7b, 0x7b, 0xff, 0x7e, 0x82, 0x81, 0xff,
+    0x79, 0x7b, 0x7b, 0xff, 0x79, 0x7b, 0x7b, 0xff, 0x72, 0x73, 0x73, 0xff,
+    0x70, 0x6e, 0x6e, 0xff, 0x6d, 0x6d, 0x6d, 0xff, 0x61, 0x5f, 0x5d, 0xff,
+    0x5d, 0x5d, 0x5b, 0xff, 0x64, 0x60, 0x61, 0xff, 0x5e, 0x5d, 0x5d, 0xec,
+    0x6a, 0x69, 0x67, 0xa0, 0x67, 0x66, 0x64, 0xbc, 0x59, 0x56, 0x55, 0xff,
+    0x54, 0x51, 0x4e, 0xff, 0x56, 0x52, 0x51, 0xff, 0x55, 0x52, 0x4f, 0xff,
+    0x52, 0x4e, 0x49, 0xff, 0x54, 0x54, 0x52, 0xff,
+    0xa9, 0xac, 0xab, 0xff, 0xa1, 0xa0, 0xa0, 0xff, 0x9a, 0x99, 0x98, 0xff,
+    0x97, 0x97, 0x96, 0xff, 0x95, 0x94, 0x94, 0xff, 0x8e, 0x8c, 0x8c, 0xff,
+    0x95, 0x98, 0x97, 0xfc, 0x90, 0x91, 0x91, 0xfc, 0x95, 0x96, 0x96, 0xff,
+    0x86, 0x86, 0x86, 0xff, 0x81, 0x82, 0x80, 0xff, 0x7d, 0x7e, 0x7b, 0xff,
+    0x78, 0x79, 0x78, 0xff, 0x71, 0x70, 0x6e, 0xff, 0x72, 0x71, 0x70, 0xff,
+    0x72, 0x73, 0x72, 0xff, 0x70, 0x70, 0x6e, 0xff, 0x6d, 0x6a, 0x6a, 0xff,
+    0x64, 0x64, 0x63, 0xff, 0x69, 0x68, 0x67, 0xff, 0x61, 0x5f, 0x5e, 0xff,
+    0x59, 0x57, 0x57, 0xff, 0x5f, 0x5f, 0x5e, 0xff, 0x55, 0x55, 0x53, 0xff,
+    0x57, 0x58, 0x57, 0xff, 0x51, 0x53, 0x50, 0xff, 0x54, 0x51, 0x51, 0xff,
+    0x4c, 0x4b, 0x4a, 0xff, 0x49, 0x4a, 0x47, 0xff, 0x4f, 0x51, 0x4e, 0xff,
+    0x4f, 0x4d, 0x49, 0xff, 0x4c, 0x4b, 0x46, 0xff,
+    0xa7, 0xaa, 0xaa, 0xff, 0x99, 0x98, 0x98, 0xff, 0x95, 0x92, 0x92, 0xff,
+    0x94, 0x93, 0x92, 0xff, 0x8a, 0x87, 0x84, 0xff, 0x85, 0x80, 0x7f, 0xff,
+    0x8d, 0x90, 0x8f, 0xff, 0x85, 0x85, 0x85, 0xff, 0x8e, 0x8e, 0x8e, 0xff,
+    0x80, 0x80, 0x81, 0xff, 0x7c, 0x7d, 0x7b, 0xff, 0x79, 0x79, 0x78, 0xff,
+    0x78, 0x79, 0x78, 0xff, 0x6e, 0x6c, 0x6b, 0xff, 0x68, 0x66, 0x66, 0xff,
+    0x69, 0x6a, 0x67, 0xff, 0x60, 0x5e, 0x5d, 0xff, 0x5b, 0x58, 0x57, 0xff,
+    0x58, 0x56, 0x55, 0xff, 0x61, 0x5e, 0x5d, 0xff, 0x54, 0x53, 0x52, 0xff,
+    0x60, 0x5d, 0x5c, 0xff, 0x5b, 0x5b, 0x5a, 0xff, 0x59, 0x5a, 0x58, 0xff,
+    0x48, 0x43, 0x42, 0xff, 0x44, 0x40, 0x40, 0xff, 0x48, 0x46, 0x44, 0xff,
+    0x4a, 0x46, 0x46, 0xff, 0x4c, 0x4f, 0x4c, 0xff, 0x49, 0x4a, 0x48, 0xff,
+    0x47, 0x46, 0x41, 0xff, 0x44, 0x43, 0x3f, 0xff,
+    0xa2, 0xa4, 0xa4, 0xff, 0x96, 0x95, 0x96, 0xff, 0x8e, 0x8c, 0x8a, 0xff,
+    0x89, 0x86, 0x86, 0xff, 0x82, 0x7c, 0x7c, 0xff, 0x83, 0x80, 0x7f, 0xff,
+    0x82, 0x82, 0x80, 0xff, 0x82, 0x83, 0x81, 0xff, 0x82, 0x85, 0x85, 0xff,
+    0x7c, 0x7c, 0x7c, 0xff, 0x77, 0x78, 0x75, 0xff, 0x75, 0x77, 0x76, 0xff,
+    0x71, 0x72, 0x70, 0xff, 0x68, 0x66, 0x65, 0xff, 0x62, 0x60, 0x5f, 0xff,
+    0x5f, 0x5e, 0x5c, 0xff, 0x5a, 0x52, 0x4f, 0xff, 0x5b, 0x53, 0x4f, 0xff,
+    0x50, 0x49, 0x49, 0xff, 0x5c, 0x58, 0x57, 0xff, 0x50, 0x4b, 0x49, 0xff,
+    0x57, 0x54, 0x53, 0xff, 0x4f, 0x4f, 0x4e, 0xff, 0x53, 0x57, 0x55, 0xff,
+    0x48, 0x45, 0x44, 0xff, 0x3c, 0x33, 0x33, 0xff, 0x49, 0x45, 0x43, 0xff,
+    0x41, 0x3f, 0x3d, 0xff, 0x49, 0x46, 0x44, 0xff, 0x4a, 0x48, 0x47, 0xff,
+    0x3f, 0x3c, 0x3a, 0xff, 0x43, 0x41, 0x3e, 0xff,
+    0x99, 0x9c, 0x9a, 0xff, 0x90, 0x8e, 0x8f, 0xff, 0x8c, 0x8b, 0x89, 0xff,
+    0x81, 0x7c, 0x7c, 0xff, 0x7d, 0x78, 0x78, 0xff, 0x82, 0x82, 0x80, 0xff,
+    0x77, 0x74, 0x73, 0xff, 0x75, 0x73, 0x73, 0xff, 0x78, 0x76, 0x76, 0xff,
+    0x70, 0x6f, 0x6f, 0xff, 0x6d, 0x6c, 0x6b, 0xff, 0x6e, 0x6f, 0x6d, 0xff,
+    0x68, 0x68, 0x66, 0xff, 0x5f, 0x5b, 0x5b, 0xff, 0x5b, 0x56, 0x56, 0xff,
+    0x5a, 0x58, 0x57, 0xff, 0x53, 0x49, 0x47, 0xff, 0x4e, 0x45, 0x43, 0xff,
+    0x49, 0x43, 0x41, 0xff, 0x5f, 0x5b, 0x5a, 0xff, 0x46, 0x3f, 0x3e, 0xff,
+    0x4b, 0x48, 0x47, 0xff, 0x42, 0x3f, 0x3f, 0xff, 0x4d, 0x50, 0x50, 0xff,
+    0x52, 0x52, 0x51, 0xff, 0x37, 0x31, 0x30, 0xff, 0x3d, 0x38, 0x37, 0xff,
+    0x3f, 0x39, 0x38, 0xff, 0x40, 0x3c, 0x3b, 0xff, 0x4a, 0x48, 0x47, 0xff,
+    0x3f, 0x3d, 0x3b, 0xff, 0x46, 0x45, 0x43, 0xff,
+};
+
+#endif  // WEBP_TESTS_FUZZER_IMG_ALPHA_H_

tests/fuzzer/img_grid.h

@@ -0,0 +1,125 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#ifndef WEBP_TESTS_FUZZER_IMG_GRID_H_
+#define WEBP_TESTS_FUZZER_IMG_GRID_H_
+
+#include <stdint.h>
+
+static const int kImgGridWidth = 16;
+static const int kImgGridHeight = 16;
+
+/*Pixel format: Red: 8 bit, Green: 8 bit, Blue: 8 bit, Fix 0xFF: 8 bit*/
+static const uint8_t kImgGridData[] = {
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff,
+    0x00, 0x00, 0xff, 0xff, 0xff, 0x00, 0x00, 0xff, 0x00, 0x00, 0xff, 0xff,
+    0xff, 0x00, 0x00, 0xff,
+};
+
+#endif  // WEBP_TESTS_FUZZER_IMG_GRID_H_

tests/fuzzer/makefile.unix

@@ -0,0 +1,29 @@
+# This Makefile will compile all fuzzing targets. It doesn't check tool
+# requirements and paths may need to be updated depending on your environment.
+# Note a clang 6+ toolchain is assumed for use of -fsanitize=fuzzer.
+
+CC = clang
+CXX = clang++
+CFLAGS = -fsanitize=fuzzer -I../../src -I../..
+CXXFLAGS = $(CFLAGS)
+LDFLAGS = -fsanitize=fuzzer
+LDLIBS = ../../src/mux/libwebpmux.a ../../src/demux/libwebpdemux.a
+LDLIBS += ../../src/libwebp.a
+
+FUZZERS = advanced_api_fuzzer animation_api_fuzzer animencoder_fuzzer
+FUZZERS += demux_api_fuzzer enc_dec_fuzzer simple_api_fuzzer
+
+%.o: %.c %.cc fuzz_utils.h img_alpha.h img_grid.h img_peak.h
+all: $(FUZZERS)
+
+define FUZZER_template
+$(1): $$(addsuffix .o, $(1)) $(LDLIBS)
+OBJS += $$(addsuffix .o, $(1))
+endef
+
+$(foreach fuzzer, $(FUZZERS), $(eval $(call FUZZER_template, $(fuzzer))))
+
+clean:
+	$(RM) $(FUZZERS) $(OBJS)
+
+.PHONY: all clean

tests/fuzzer/simple_api_fuzzer.c

@@ -0,0 +1,88 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include "./fuzz_utils.h"
+#include "webp/decode.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+  int w, h;
+  if (!WebPGetInfo(data, size, &w, &h)) return 0;
+  if ((size_t)w * h > kFuzzPxLimit) return 0;
+
+  const uint8_t value = FuzzHash(data, size);
+  uint8_t* buf = NULL;
+
+  // For *Into functions, which decode into an external buffer, an
+  // intentionally too small buffer can be given with low probability.
+  if (value < 0x16) {
+    buf = WebPDecodeRGBA(data, size, &w, &h);
+  } else if (value < 0x2b) {
+    buf = WebPDecodeBGRA(data, size, &w, &h);
+#if !defined(WEBP_REDUCE_CSP)
+  } else if (value < 0x40) {
+    buf = WebPDecodeARGB(data, size, &w, &h);
+  } else if (value < 0x55) {
+    buf = WebPDecodeRGB(data, size, &w, &h);
+  } else if (value < 0x6a) {
+    buf = WebPDecodeBGR(data, size, &w, &h);
+#endif  // !defined(WEBP_REDUCE_CSP)
+  } else if (value < 0x7f) {
+    uint8_t *u, *v;
+    int stride, uv_stride;
+    buf = WebPDecodeYUV(data, size, &w, &h, &u, &v, &stride, &uv_stride);
+  } else if (value < 0xe8) {
+    const int stride = (value < 0xbe ? 4 : 3) * w;
+    size_t buf_size = stride * h;
+    if (value % 0x10 == 0) buf_size--;
+    uint8_t* const ext_buf = (uint8_t*)malloc(buf_size);
+    if (value < 0x94) {
+      WebPDecodeRGBAInto(data, size, ext_buf, buf_size, stride);
+#if !defined(WEBP_REDUCE_CSP)
+    } else if (value < 0xa9) {
+      WebPDecodeARGBInto(data, size, ext_buf, buf_size, stride);
+    } else if (value < 0xbe) {
+      WebPDecodeBGRInto(data, size, ext_buf, buf_size, stride);
+    } else if (value < 0xd3) {
+      WebPDecodeRGBInto(data, size, ext_buf, buf_size, stride);
+#endif  // !defined(WEBP_REDUCE_CSP)
+    } else {
+      WebPDecodeBGRAInto(data, size, ext_buf, buf_size, stride);
+    }
+    free(ext_buf);
+  } else {
+    size_t luma_size = w * h;
+    const int uv_stride = (w + 1) / 2;
+    size_t u_size = uv_stride * (h + 1) / 2;
+    size_t v_size = uv_stride * (h + 1) / 2;
+    if (value % 0x10 == 0) {
+      if (size & 1) luma_size--;
+      if (size & 2) u_size--;
+      if (size & 4) v_size--;
+    }
+    uint8_t* const luma_buf = (uint8_t*)malloc(luma_size);
+    uint8_t* const u_buf = (uint8_t*)malloc(u_size);
+    uint8_t* const v_buf = (uint8_t*)malloc(v_size);
+    WebPDecodeYUVInto(data, size, luma_buf, luma_size, w /* luma_stride */,
+                      u_buf, u_size, uv_stride, v_buf, v_size, uv_stride);
+    free(luma_buf);
+    free(u_buf);
+    free(v_buf);
+  }
+
+  if (buf) WebPFree(buf);
+
+  return 0;
+}