dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-04-03 23:46:49 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

advanced_api_fuzzer: add extreme config value coverage

Browse Source 
this enables cases that might trigger overflows, but increases the risk
of OOM and timeouts

Bug: chromium:1196850
Change-Id: I317b5109525646731e762faa3c34ed28a27595dc
This commit is contained in:
James Zern 2021-06-07 18:59:44 -07:00
parent 72fe52f623
commit b60d460318
1 changed files with 48 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
tests/fuzzer/advanced_api_fuzzer.c
View File

@ -14,10 +14,13 @@
//
////////////////////////////////////////////////////////////////////////////////
#include <string.h>
#include "./fuzz_utils.h"
#include "webp/decode.h"
int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
int i;
WebPDecoderConfig config;
if (!WebPInitDecoderConfig(&config)) return 0;
if (WebPGetFeatures(data, size, &config.input) != VP8_STATUS_OK) return 0;
@ -59,6 +62,19 @@ int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
config.output.colorspace = (WEBP_CSP_MODE)(value % MODE_LAST);
#endif // WEBP_REDUCE_CSP
for (i = 0; i < 2; ++i) {
if (i == 1) {
// Use the bitstream data to generate extreme ranges for the options. An
// alternative approach would be to use a custom corpus containing webp
// files prepended with sizeof(config.options) zeroes to allow the fuzzer
// to modify these independently.
const int data_offset = 50;
if (size > data_offset + sizeof(config.options)) {
memcpy(&config.options, data + data_offset, sizeof(config.options));
} else {
break;
}
}
if (size % 3) {
// Decodes incrementally in chunks of increasing size.
WebPIDecoder* idec = WebPIDecode(NULL, 0, &config);
@ -93,5 +109,6 @@ int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
}
WebPFreeDecBuffer(&config.output);
}
return 0;
}