FuzzMain.cpp File Reference

#include "fuzz/Fuzz.h"
#include "include/codec/SkCodec.h"
#include "include/core/SkBitmap.h"
#include "include/core/SkCanvas.h"
#include "include/core/SkData.h"
#include "include/core/SkFontMgr.h"
#include "include/core/SkImage.h"
#include "include/core/SkMallocPixelRef.h"
#include "include/core/SkPaint.h"
#include "include/core/SkPath.h"
#include "include/core/SkStream.h"
#include "include/core/SkSurface.h"
#include "include/core/SkTextBlob.h"
#include "include/encode/SkPngEncoder.h"
#include "src/core/SkOSFile.h"
#include "src/core/SkReadBuffer.h"
#include "src/utils/SkOSPath.h"
#include "tools/ToolUtils.h"
#include "tools/flags/CommandLineFlags.h"
#include "tools/fonts/FontToolUtils.h"
#include <iostream>
#include <map>
#include <regex>
#include <signal.h>

Go to the source code of this file.

Functions
static	DEFINE_string2 (bytes, b, "", "A path to a file or a directory. If a file, the " "contents will be used as the fuzz bytes. If a directory, all files " "in the directory will be used as fuzz bytes for the fuzzer, one at a " "time.")
static	DEFINE_string2 (name, n, "", "If --type is 'api', fuzz the API with this name.")
static	DEFINE_string2 (dump, d, "", "If not empty, dump 'image*' or 'skp' types as a " "PNG with this name.")
static	DEFINE_int (loops, 1, "Run the fuzzer on each input this many times.")
	DEFINE_bool2 (verbose, v, false, "Print more information while fuzzing.")
static	DEFINE_string2 (type, t, "", g_type_message)
static int	fuzz_file (const SkString &path, SkString type)
static uint8_t	calculate_option (SkData *)
static SkString	try_auto_detect (const SkString &path, SkString *name)
static void	fuzz_android_codec (const sk_sp< SkData > &)
static void	fuzz_animated_img (const sk_sp< SkData > &)
static void	fuzz_api (const sk_sp< SkData > &, const SkString &name)
static void	fuzz_color_deserialize (const sk_sp< SkData > &)
static void	fuzz_colrv1 (const sk_sp< SkData > &)
static void	fuzz_filter_fuzz (const sk_sp< SkData > &)
static void	fuzz_image_decode (const sk_sp< SkData > &)
static void	fuzz_image_decode_incremental (const sk_sp< SkData > &)
static void	fuzz_img (const sk_sp< SkData > &, uint8_t, uint8_t)
static void	fuzz_json (const sk_sp< SkData > &)
static void	fuzz_path_deserialize (const sk_sp< SkData > &)
static void	fuzz_region_deserialize (const sk_sp< SkData > &)
static void	fuzz_region_set_path (const sk_sp< SkData > &)
static void	fuzz_skdescriptor_deserialize (const sk_sp< SkData > &)
static void	fuzz_skmeshspecification (const sk_sp< SkData > &)
static void	fuzz_skp (const sk_sp< SkData > &)
static void	fuzz_skruntimeblender (const sk_sp< SkData > &)
static void	fuzz_skruntimecolorfilter (const sk_sp< SkData > &)
static void	fuzz_skruntimeeffect (const sk_sp< SkData > &)
static void	fuzz_sksl2glsl (const sk_sp< SkData > &)
static void	fuzz_sksl2metal (const sk_sp< SkData > &)
static void	fuzz_sksl2pipeline (const sk_sp< SkData > &)
static void	fuzz_sksl2spirv (const sk_sp< SkData > &)
static void	fuzz_sksl2wgsl (const sk_sp< SkData > &)
static void	fuzz_textblob_deserialize (const sk_sp< SkData > &)
static void	print_api_names ()
int	main (int argc, char **argv)
void	FuzzJSON (const uint8_t *data, size_t size)
void	FuzzCOLRv1 (const uint8_t *data, size_t size)
static void	dump_png (const SkBitmap &bitmap)
bool	FuzzAnimatedImage (const uint8_t *data, size_t size)
bool	FuzzImageDecode (const uint8_t *data, size_t size)
bool	FuzzIncrementalImageDecode (const uint8_t *data, size_t size)
bool	FuzzAndroidCodec (const uint8_t *fuzzData, size_t fuzzSize, uint8_t sampleSize)
void	FuzzSKP (const uint8_t *data, size_t size)
void	FuzzColorspace (const uint8_t *data, size_t size)
void	FuzzPathDeserialize (const uint8_t *data, size_t size)
bool	FuzzRegionDeserialize (const uint8_t *data, size_t size)
void	FuzzTextBlobDeserialize (const uint8_t *data, size_t size)
void	FuzzRegionSetPath (Fuzz *fuzz)
void	FuzzImageFilterDeserialize (const uint8_t *data, size_t size)
void	FuzzSkMeshSpecification (const uint8_t *fuzzData, size_t fuzzSize)
bool	FuzzSkRuntimeBlender (const uint8_t *data, size_t size)
bool	FuzzSkRuntimeColorFilter (const uint8_t *data, size_t size)
bool	FuzzSkRuntimeEffect (const uint8_t *data, size_t size)
bool	FuzzSKSL2GLSL (const uint8_t *data, size_t size)
bool	FuzzSKSL2Metal (const uint8_t *data, size_t size)
bool	FuzzSKSL2Pipeline (const uint8_t *data, size_t size)
bool	FuzzSKSL2SPIRV (const uint8_t *data, size_t size)
bool	FuzzSKSL2WGSL (const uint8_t *data, size_t size)
void	FuzzSkDescriptorDeserialize (const uint8_t *data, size_t size)

Variables
static constexpr char	g_type_message []
static std::map< std::string, std::string >	cf_api_map
static std::map< std::string, std::string >	cf_map

Function Documentation

calculate_option()

static uint8_t calculate_option ( SkData *  bytes )

static

Definition at line 423 of file FuzzMain.cpp.

                                               {
    uint8_t total = 0;
    const uint8_t* data = bytes->bytes();
    for (size_t i = 0; i < 1024 && i < bytes->size(); i++) {
        total += data[i];
    }
    return total;
}

DEFINE_bool2()

DEFINE_bool2	(	verbose	,
		v	,
		false	,
		"Print more information while fuzzing."
	)

DEFINE_int()

static DEFINE_int ( loops  , 1  , "Run the fuzzer on each input this many times."    )

static

DEFINE_string2() [1/4]

static DEFINE_string2 ( bytes  , b  , ""  , "A path to a file or a directory. If a  file, the " "contents will be used as the fuzz bytes. If a  directory, all files " "in the directory will be used as fuzz bytes for the  fuzzer, one at a " "time."    )

static

DEFINE_string2() [2/4]

static DEFINE_string2 ( dump  , d  , ""  , "If not  empty, dump 'image *' or 'skp' types as a " "PNG with this name."    )

static

DEFINE_string2() [3/4]

static DEFINE_string2 ( name  , n  , ""  , "If --type is 'api'  , fuzz the API with this name."    )

static

DEFINE_string2() [4/4]

static DEFINE_string2 ( type  , t  , ""  , g_type_message    )

static

dump_png()

static void dump_png ( const SkBitmap &  bitmap )

static

Definition at line 453 of file FuzzMain.cpp.

                                             {
    if (!FLAGS_dump.isEmpty()) {
        SkFILEWStream file(FLAGS_dump[0]);
        SkPngEncoder::Encode(&file, bitmap.pixmap(), {});
        SkDebugf("Dumped to %s\n", FLAGS_dump[0]);
    }
}

fuzz_android_codec()

static void fuzz_android_codec ( const sk_sp< SkData > &  data )

static

Definition at line 493 of file FuzzMain.cpp.

                                                          {
    Fuzz fuzz(data->bytes(), data->size());
    uint8_t sampleSize;
    fuzz.nextRange(&sampleSize, 1, 64);
    if (FuzzAndroidCodec(fuzz.remainingData(), fuzz.remainingSize(), sampleSize)) {
        SkDebugf("[terminated] Success on Android Codec sampleSize=%u!\n", sampleSize);
        return;
    }
    SkDebugf("[terminated] Could not use Android Codec sampleSize=%u!\n", sampleSize);
}

fuzz_animated_img()

static void fuzz_animated_img ( const sk_sp< SkData > &  data )

static

Definition at line 463 of file FuzzMain.cpp.

                                                         {
    if (FuzzAnimatedImage(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success from decoding/drawing animated image!\n");
        return;
    }
    SkDebugf("[terminated] Could not decode or draw animated image.\n");
}

fuzz_api()

static void fuzz_api ( const sk_sp< SkData > &  data, const SkString &  name  )

static

Definition at line 439 of file FuzzMain.cpp.

                                                                      {
    for (const Fuzzable& fuzzable : sk_tools::Registry<Fuzzable>::Range()) {
        if (name.equals(fuzzable.name)) {
            SkDebugf("Fuzzing %s...\n", fuzzable.name);
            Fuzz fuzz(data->bytes(), data->size());
            fuzzable.fn(&fuzz);
            SkDebugf("[terminated] Success!\n");
            return;
        }
    }
 
    print_api_names();
}

fuzz_color_deserialize()

static void fuzz_color_deserialize ( const sk_sp< SkData > &  data )

static

Definition at line 752 of file FuzzMain.cpp.

                                                              {
    FuzzColorspace(data->bytes(), data->size());
    SkDebugf("[terminated] Finished SkColorspace\n");
}

fuzz_colrv1()

static void fuzz_colrv1 ( const sk_sp< SkData > &  data )

static

Definition at line 413 of file FuzzMain.cpp.

                                                   {
    FuzzCOLRv1(data->bytes(), data->size());
    SkDebugf("[terminated] Done COLRv1!\n");
}

fuzz_file()

static int fuzz_file ( const SkString &  path, SkString  type  )

static

Definition at line 157 of file FuzzMain.cpp.

                                                          {
    sk_sp<SkData> bytes(SkData::MakeFromFileName(path.c_str()));
    if (!bytes) {
        SkDebugf("Could not read %s\n", path.c_str());
        return 1;
    }
 
    SkString name = SkString(FLAGS_name.isEmpty() ? "" : FLAGS_name[0]);
 
    if (type.isEmpty()) {
        type = try_auto_detect(path, &name);
    }
 
    if (type.isEmpty()) {
        SkDebugf("Could not autodetect type of %s\n", path.c_str());
        return 1;
    }
    if (type.equals("android_codec")) {
        fuzz_android_codec(std::move(bytes));
        return 0;
    }
    if (type.equals("animated_image_decode")) {
        fuzz_animated_img(std::move(bytes));
        return 0;
    }
    if (type.equals("api")) {
        fuzz_api(bytes, name);
        return 0;
    }
    if (type.equals("color_deserialize")) {
        fuzz_color_deserialize(std::move(bytes));
        return 0;
    }
    if (type.equals("colrv1")) {
        fuzz_colrv1(std::move(bytes));
        return 0;
    }
    if (type.equals("filter_fuzz")) {
        fuzz_filter_fuzz(std::move(bytes));
        return 0;
    }
    if (type.equals("image_decode")) {
        fuzz_image_decode(std::move(bytes));
        return 0;
    }
    if (type.equals("image_decode_incremental")) {
        fuzz_image_decode_incremental(std::move(bytes));
        return 0;
    }
    if (type.equals("image_scale")) {
        uint8_t option = calculate_option(bytes.get());
        fuzz_img(std::move(bytes), option, 0);
        return 0;
    }
    if (type.equals("image_mode")) {
        uint8_t option = calculate_option(bytes.get());
        fuzz_img(std::move(bytes), 0, option);
        return 0;
    }
    if (type.equals("json")) {
        fuzz_json(std::move(bytes));
        return 0;
    }
    if (type.equals("path_deserialize")) {
        fuzz_path_deserialize(std::move(bytes));
        return 0;
    }
    if (type.equals("region_deserialize")) {
        fuzz_region_deserialize(std::move(bytes));
        return 0;
    }
    if (type.equals("region_set_path")) {
        fuzz_region_set_path(std::move(bytes));
        return 0;
    }
    if (type.equals("pipe")) {
        SkDebugf("I would prefer not to.\n");
        return 0;
    }
    if (type.equals("skdescriptor_deserialize")) {
        fuzz_skdescriptor_deserialize(std::move(bytes));
        return 0;
    }
#if defined(SK_ENABLE_SKOTTIE)
    if (type.equals("skottie_json")) {
        fuzz_skottie_json(std::move(bytes));
        return 0;
    }
#endif
    if (type.equals("skmeshspecification")) {
        fuzz_skmeshspecification(std::move(bytes));
        return 0;
    }
    if (type.equals("skp")) {
        fuzz_skp(std::move(bytes));
        return 0;
    }
    if (type.equals("skruntimeblender")) {
        fuzz_skruntimeblender(std::move(bytes));
        return 0;
    }
    if (type.equals("skruntimecolorfilter")) {
        fuzz_skruntimecolorfilter(std::move(bytes));
        return 0;
    }
    if (type.equals("skruntimeeffect")) {
        fuzz_skruntimeeffect(std::move(bytes));
        return 0;
    }
    if (type.equals("sksl2glsl")) {
        fuzz_sksl2glsl(std::move(bytes));
        return 0;
    }
    if (type.equals("sksl2metal")) {
        fuzz_sksl2metal(std::move(bytes));
        return 0;
    }
    if (type.equals("sksl2pipeline")) {
        fuzz_sksl2pipeline(std::move(bytes));
        return 0;
    }
    if (type.equals("sksl2spirv")) {
        fuzz_sksl2spirv(std::move(bytes));
        return 0;
    }
    if (type.equals("sksl2wgsl")) {
        fuzz_sksl2wgsl(std::move(bytes));
        return 0;
    }
#if defined(SK_ENABLE_SVG)
    if (type.equals("svg_dom")) {
        fuzz_svg_dom(std::move(bytes));
        return 0;
    }
#endif
    if (type.equals("textblob")) {
        fuzz_textblob_deserialize(std::move(bytes));
        return 0;
    }
    SkDebugf("Unknown type %s\n", type.c_str());
    CommandLineFlags::PrintUsage();
    return 1;
}

fuzz_filter_fuzz()

static void fuzz_filter_fuzz ( const sk_sp< SkData > &  data )

static

Definition at line 791 of file FuzzMain.cpp.

                                                        {
    FuzzImageFilterDeserialize(data->bytes(), data->size());
    SkDebugf("[terminated] filter_fuzz didn't crash!\n");
}

fuzz_image_decode()

static void fuzz_image_decode ( const sk_sp< SkData > &  data )

static

Definition at line 473 of file FuzzMain.cpp.

                                                         {
    if (FuzzImageDecode(data->bytes(), data->size())) {
         SkDebugf("[terminated] Success from decoding/drawing image!\n");
         return;
    }
    SkDebugf("[terminated] Could not decode or draw image.\n");
}

fuzz_image_decode_incremental()

static void fuzz_image_decode_incremental ( const sk_sp< SkData > &  data )

static

Definition at line 483 of file FuzzMain.cpp.

                                                                     {
    if (FuzzIncrementalImageDecode(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success using incremental decode!\n");
        return;
    }
    SkDebugf("[terminated] Could not incrementally decode and image.\n");
}

fuzz_img()

static void fuzz_img ( const sk_sp< SkData > &  bytes, uint8_t  scale, uint8_t  mode  )

static

Definition at line 507 of file FuzzMain.cpp.

                                                                              {
    // We can scale 1x, 2x, 4x, 8x, 16x
    scale = scale % 5;
    float fscale = (float)pow(2.0f, scale);
    SkDebugf("Scaling factor: %f\n", fscale);
 
    // We have 5 different modes of decoding.
    mode = mode % 5;
    SkDebugf("Mode: %d\n", mode);
 
    // This is mostly copied from DMSrcSink's CodecSrc::draw method.
    SkDebugf("Decoding\n");
    std::unique_ptr<SkCodec> codec(SkCodec::MakeFromData(bytes));
    if (nullptr == codec) {
        SkDebugf("[terminated] Couldn't create codec.\n");
        return;
    }
 
    SkImageInfo decodeInfo = codec->getInfo();
    SkISize size = codec->getScaledDimensions(fscale);
    decodeInfo = decodeInfo.makeDimensions(size);
 
    SkBitmap bitmap;
    SkCodec::Options options;
    options.fZeroInitialized = SkCodec::kYes_ZeroInitialized;
 
    if (!bitmap.tryAllocPixelsFlags(decodeInfo, SkBitmap::kZeroPixels_AllocFlag)) {
        SkDebugf("[terminated] Could not allocate memory.  Image might be too large (%d x %d)",
                 decodeInfo.width(), decodeInfo.height());
        return;
    }
 
    switch (mode) {
        case 0: {//kCodecZeroInit_Mode, kCodec_Mode
            switch (codec->getPixels(decodeInfo, bitmap.getPixels(), bitmap.rowBytes(), &options)) {
                case SkCodec::kSuccess:
                    SkDebugf("[terminated] Success!\n");
                    break;
                case SkCodec::kIncompleteInput:
                    SkDebugf("[terminated] Partial Success\n");
                    break;
                case SkCodec::kErrorInInput:
                    SkDebugf("[terminated] Partial Success with error\n");
                    break;
                case SkCodec::kInvalidConversion:
                    SkDebugf("Incompatible colortype conversion\n");
                    // Crash to allow afl-fuzz to know this was a bug.
                    raise(SIGSEGV);
                    break;
                default:
                    SkDebugf("[terminated] Couldn't getPixels.\n");
                    return;
            }
            break;
        }
        case 1: {//kScanline_Mode
            if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)) {
                SkDebugf("[terminated] Could not start scanline decoder\n");
                return;
            }
 
            void* dst = bitmap.getAddr(0, 0);
            size_t rowBytes = bitmap.rowBytes();
            uint32_t height = decodeInfo.height();
            // We do not need to check the return value.  On an incomplete
            // image, memory will be filled with a default value.
            codec->getScanlines(dst, height, rowBytes);
            SkDebugf("[terminated] Success!\n");
            break;
        }
        case 2: { //kStripe_Mode
            const int height = decodeInfo.height();
            // This value is chosen arbitrarily.  We exercise more cases by choosing a value that
            // does not align with image blocks.
            const int stripeHeight = 37;
            const int numStripes = (height + stripeHeight - 1) / stripeHeight;
 
            // Decode odd stripes
            if (SkCodec::kSuccess != codec->startScanlineDecode(decodeInfo)
                    || SkCodec::kTopDown_SkScanlineOrder != codec->getScanlineOrder()) {
                // This mode was designed to test the new skip scanlines API in libjpeg-turbo.
                // Jpegs have kTopDown_SkScanlineOrder, and at this time, it is not interesting
                // to run this test for image types that do not have this scanline ordering.
                SkDebugf("[terminated] Could not start top-down scanline decoder\n");
                return;
            }
 
            for (int i = 0; i < numStripes; i += 2) {
                // Skip a stripe
                const int linesToSkip = std::min(stripeHeight, height - i * stripeHeight);
                codec->skipScanlines(linesToSkip);
 
                // Read a stripe
                const int startY = (i + 1) * stripeHeight;
                const int linesToRead = std::min(stripeHeight, height - startY);
                if (linesToRead > 0) {
                    codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
                }
            }
 
            // Decode even stripes
            const SkCodec::Result startResult = codec->startScanlineDecode(decodeInfo);
            if (SkCodec::kSuccess != startResult) {
                SkDebugf("[terminated] Failed to restart scanline decoder with same parameters.\n");
                return;
            }
            for (int i = 0; i < numStripes; i += 2) {
                // Read a stripe
                const int startY = i * stripeHeight;
                const int linesToRead = std::min(stripeHeight, height - startY);
                codec->getScanlines(bitmap.getAddr(0, startY), linesToRead, bitmap.rowBytes());
 
                // Skip a stripe
                const int linesToSkip = std::min(stripeHeight, height - (i + 1) * stripeHeight);
                if (linesToSkip > 0) {
                    codec->skipScanlines(linesToSkip);
                }
            }
            SkDebugf("[terminated] Success!\n");
            break;
        }
        case 3: { //kSubset_Mode
            // Arbitrarily choose a divisor.
            int divisor = 2;
            // Total width/height of the image.
            const int W = codec->getInfo().width();
            const int H = codec->getInfo().height();
            if (divisor > W || divisor > H) {
                SkDebugf("[terminated] Cannot codec subset: divisor %d is too big "
                         "with dimensions (%d x %d)\n", divisor, W, H);
                return;
            }
            // subset dimensions
            // SkWebpCodec, the only one that supports subsets, requires even top/left boundaries.
            const int w = SkAlign2(W / divisor);
            const int h = SkAlign2(H / divisor);
            SkIRect subset;
            SkCodec::Options opts;
            opts.fSubset = &subset;
            SkBitmap subsetBm;
            // We will reuse pixel memory from bitmap.
            void* pixels = bitmap.getPixels();
            for (int x = 0; x < W; x += w) {
                for (int y = 0; y < H; y+= h) {
                    // Do not make the subset go off the edge of the image.
                    const int preScaleW = std::min(w, W - x);
                    const int preScaleH = std::min(h, H - y);
                    subset.setXYWH(x, y, preScaleW, preScaleH);
                    // And fscale
                    // FIXME: Should we have a version of getScaledDimensions that takes a subset
                    // into account?
                    decodeInfo = decodeInfo.makeWH(
                            std::max(1, SkScalarRoundToInt(preScaleW * fscale)),
                            std::max(1, SkScalarRoundToInt(preScaleH * fscale)));
                    size_t rowBytes = decodeInfo.minRowBytes();
                    if (!subsetBm.installPixels(decodeInfo, pixels, rowBytes)) {
                        SkDebugf("[terminated] Could not install pixels.\n");
                        return;
                    }
                    const SkCodec::Result result = codec->getPixels(decodeInfo, pixels, rowBytes,
                            &opts);
                    switch (result) {
                        case SkCodec::kSuccess:
                        case SkCodec::kIncompleteInput:
                        case SkCodec::kErrorInInput:
                            SkDebugf("okay\n");
                            break;
                        case SkCodec::kInvalidConversion:
                            if (0 == (x|y)) {
                                // First subset is okay to return unimplemented.
                                SkDebugf("[terminated] Incompatible colortype conversion\n");
                                return;
                            }
                            // If the first subset succeeded, a later one should not fail.
                            [[fallthrough]];
                        case SkCodec::kUnimplemented:
                            if (0 == (x|y)) {
                                // First subset is okay to return unimplemented.
                                SkDebugf("[terminated] subset codec not supported\n");
                                return;
                            }
                            // If the first subset succeeded, why would a later one fail?
                            [[fallthrough]];
                        default:
                            SkDebugf("[terminated] subset codec failed to decode (%d, %d, %d, %d) "
                                                  "with dimensions (%d x %d)\t error %d\n",
                                                  x, y, decodeInfo.width(), decodeInfo.height(),
                                                  W, H, result);
                            return;
                    }
                }
            }
            SkDebugf("[terminated] Success!\n");
            break;
        }
        case 4: { //kAnimated_Mode
            std::vector<SkCodec::FrameInfo> frameInfos = codec->getFrameInfo();
            if (frameInfos.size() == 0) {
                SkDebugf("[terminated] Not an animated image\n");
                break;
            }
 
            for (size_t i = 0; i < frameInfos.size(); i++) {
                options.fFrameIndex = i;
                auto result = codec->startIncrementalDecode(decodeInfo, bitmap.getPixels(),
                        bitmap.rowBytes(), &options);
                if (SkCodec::kSuccess != result) {
                    SkDebugf("[terminated] failed to start incremental decode "
                             "in frame %zu with error %d\n", i, result);
                    return;
                }
 
                result = codec->incrementalDecode();
                if (result == SkCodec::kIncompleteInput || result == SkCodec::kErrorInInput) {
                    SkDebugf("okay\n");
                    // Frames beyond this one will not decode.
                    break;
                }
                if (result == SkCodec::kSuccess) {
                    SkDebugf("okay - decoded frame %zu\n", i);
                } else {
                    SkDebugf("[terminated] incremental decode failed with "
                             "error %d\n", result);
                    return;
                }
            }
            SkDebugf("[terminated] Success!\n");
            break;
        }
        default:
            SkDebugf("[terminated] Mode not implemented yet\n");
    }
 
    dump_png(bitmap);
}

fuzz_json()

static void fuzz_json ( const sk_sp< SkData > &  data )

static

Definition at line 388 of file FuzzMain.cpp.

                                                {
    FuzzJSON(data->bytes(), data->size());
    SkDebugf("[terminated] Done parsing!\n");
}

fuzz_path_deserialize()

static void fuzz_path_deserialize ( const sk_sp< SkData > &  data )

static

Definition at line 759 of file FuzzMain.cpp.

                                                             {
    FuzzPathDeserialize(data->bytes(), data->size());
    SkDebugf("[terminated] path_deserialize didn't crash!\n");
}

fuzz_region_deserialize()

static void fuzz_region_deserialize ( const sk_sp< SkData > &  data )

static

Definition at line 766 of file FuzzMain.cpp.

                                                               {
    if (!FuzzRegionDeserialize(data->bytes(), data->size())) {
        SkDebugf("[terminated] Couldn't initialize SkRegion.\n");
        return;
    }
    SkDebugf("[terminated] Success! Initialized SkRegion.\n");
}

fuzz_region_set_path()

static void fuzz_region_set_path ( const sk_sp< SkData > &  data )

static

Definition at line 783 of file FuzzMain.cpp.

                                                            {
    Fuzz fuzz(data->bytes(), data->size());
    FuzzRegionSetPath(&fuzz);
    SkDebugf("[terminated] region_set_path didn't crash!\n");
}

fuzz_skdescriptor_deserialize()

static void fuzz_skdescriptor_deserialize ( const sk_sp< SkData > &  data )

static

Definition at line 885 of file FuzzMain.cpp.

                                                                     {
    FuzzSkDescriptorDeserialize(data->bytes(), data->size());
    SkDebugf("[terminated] Did not crash while deserializing an SkDescriptor.\n");
}

fuzz_skmeshspecification()

static void fuzz_skmeshspecification ( const sk_sp< SkData > &  data )

static

Definition at line 798 of file FuzzMain.cpp.

                                                                {
    FuzzSkMeshSpecification(data->bytes(), data->size());
    SkDebugf("[terminated] SkMeshSpecification::Make didn't crash!\n");
}

fuzz_skp()

static void fuzz_skp ( const sk_sp< SkData > &  data )

static

Definition at line 745 of file FuzzMain.cpp.

                                                {
    FuzzSKP(data->bytes(), data->size());
    SkDebugf("[terminated] Finished SKP\n");
}

fuzz_skruntimeblender()

static void fuzz_skruntimeblender ( const sk_sp< SkData > &  data )

static

Definition at line 805 of file FuzzMain.cpp.

                                                             {
    if (FuzzSkRuntimeBlender(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled and executed SkSL blender.\n");
    } else {
        SkDebugf("[terminated] Could not compile or execute SkSL blender.\n");
    }
}

fuzz_skruntimecolorfilter()

static void fuzz_skruntimecolorfilter ( const sk_sp< SkData > &  data )

static

Definition at line 815 of file FuzzMain.cpp.

                                                                 {
    if (FuzzSkRuntimeColorFilter(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled and executed SkSL color filter.\n");
    } else {
        SkDebugf("[terminated] Could not compile or execute SkSL color filter.\n");
    }
}

fuzz_skruntimeeffect()

static void fuzz_skruntimeeffect ( const sk_sp< SkData > &  data )

static

Definition at line 825 of file FuzzMain.cpp.

                                                            {
    if (FuzzSkRuntimeEffect(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled and executed SkSL shader.\n");
    } else {
        SkDebugf("[terminated] Could not compile or execute SkSL shader.\n");
    }
}

fuzz_sksl2glsl()

static void fuzz_sksl2glsl ( const sk_sp< SkData > &  data )

static

Definition at line 835 of file FuzzMain.cpp.

                                                      {
    if (FuzzSKSL2GLSL(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled input to GLSL.\n");
    } else {
        SkDebugf("[terminated] Could not compile input to GLSL.\n");
    }
}

fuzz_sksl2metal()

static void fuzz_sksl2metal ( const sk_sp< SkData > &  data )

static

Definition at line 845 of file FuzzMain.cpp.

                                                       {
    if (FuzzSKSL2Metal(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled input to Metal.\n");
    } else {
        SkDebugf("[terminated] Could not compile input to Metal.\n");
    }
}

fuzz_sksl2pipeline()

static void fuzz_sksl2pipeline ( const sk_sp< SkData > &  data )

static

Definition at line 855 of file FuzzMain.cpp.

                                                          {
    if (FuzzSKSL2Pipeline(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled input to pipeline stage.\n");
    } else {
        SkDebugf("[terminated] Could not compile input to pipeline stage.\n");
    }
}

fuzz_sksl2spirv()

static void fuzz_sksl2spirv ( const sk_sp< SkData > &  data )

static

Definition at line 865 of file FuzzMain.cpp.

                                                       {
    if (FuzzSKSL2SPIRV(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled input to SPIR-V.\n");
    } else {
        SkDebugf("[terminated] Could not compile input to SPIR-V.\n");
    }
}

fuzz_sksl2wgsl()

static void fuzz_sksl2wgsl ( const sk_sp< SkData > &  data )

static

Definition at line 875 of file FuzzMain.cpp.

                                                      {
    if (FuzzSKSL2WGSL(data->bytes(), data->size())) {
        SkDebugf("[terminated] Success! Compiled input to WGSL.\n");
    } else {
        SkDebugf("[terminated] Could not compile input to WGSL.\n");
    }
}

fuzz_textblob_deserialize()

static void fuzz_textblob_deserialize ( const sk_sp< SkData > &  data )

static

Definition at line 776 of file FuzzMain.cpp.

                                                                 {
    FuzzTextBlobDeserialize(data->bytes(), data->size());
    SkDebugf("[terminated] textblob didn't crash!\n");
}

FuzzAndroidCodec()

bool FuzzAndroidCodec	(	const uint8_t *	fuzzData,
		size_t	fuzzSize,
		uint8_t	sampleSize
	)

Definition at line 17 of file FuzzAndroidCodec.cpp.

                                                                                    {
    auto codec = SkAndroidCodec::MakeFromStream(SkMemoryStream::MakeDirect(fuzzData, fuzzSize));
    if (!codec) {
        return false;
    }
 
    auto size = codec->getSampledDimensions(sampleSize);
    auto info = SkImageInfo::MakeN32Premul(size);
    SkBitmap bm;
    if (!bm.tryAllocPixels(info)) {
        // May fail in memory-constrained fuzzing environments
        return false;
    }
 
    SkAndroidCodec::AndroidOptions options;
    options.fSampleSize = sampleSize;
 
    auto result = codec->getAndroidPixels(bm.info(), bm.getPixels(), bm.rowBytes(), &options);
    switch (result) {
        case SkCodec::kSuccess:
        case SkCodec::kIncompleteInput:
        case SkCodec::kErrorInInput:
            break;
        default:
            return false;
    }
 
    SkGainmapInfo gainmapInfo;
    auto gainmapImageStream = std::unique_ptr<SkStream>();
 
    if (codec->getAndroidGainmap(&gainmapInfo, &gainmapImageStream)) {
        // Do something with the outputs so the compiler does not optimize the call away.
        if (!std::isfinite(gainmapInfo.fDisplayRatioSdr)) {
            return false;
        }
        if (gainmapImageStream->getLength() > 100000000) {
            return false;
        }
    }
 
    auto surface = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(size.width(), size.height()));
    if (!surface) {
        // May return nullptr in memory-constrained fuzzing environments
        return false;
    }
 
    surface->getCanvas()->drawImage(bm.asImage(), 0, 0);
    return true;
}

FuzzAnimatedImage()

bool FuzzAnimatedImage	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 14 of file FuzzAnimatedImage.cpp.

                                                         {
    auto codec = SkAndroidCodec::MakeFromStream(SkMemoryStream::MakeDirect(data, size));
    if (nullptr == codec) {
        return false;
    }
    auto aImg = SkAnimatedImage::Make(std::move(codec));
    if (nullptr == aImg) {
        return false;
    }
 
    auto s = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(128, 128));
    if (!s) {
        // May return nullptr in memory-constrained fuzzing environments
        return false;
    }
 
    int escape = 0;
    while (!aImg->isFinished() && escape < 100) {
        aImg->draw(s->getCanvas());
        escape++;
        aImg->decodeNextFrame();
    }
    return true;
}

FuzzColorspace()

void FuzzColorspace	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 13 of file FuzzColorspace.cpp.

                                                      {
    sk_sp<SkColorSpace> space(SkColorSpace::Deserialize(data, size));
    if (!space) {
        return;
    }
    // Call some arbitrary methods on the colorspace, using a throw-away
    // variable to prevent the compiler from optimizing things away.
    int i = 0;
    if (space->gammaCloseToSRGB()) {
        i += 1;
    }
    if (space->gammaIsLinear()) {
        i += 1;
    }
    if (space->isSRGB()) {
        i += 1;
    }
    skcms_ICCProfile profile;
    space->toProfile(&profile);
    sk_sp<SkColorSpace> space2 = space->makeLinearGamma()->makeSRGBGamma()->makeColorSpin();
    sk_sp<SkData> data1 = space->serialize();
    if (SkColorSpace::Equals(space.get(), space2.get()) && i > 5) {
        SkDebugf("Should never happen %d", (int)data1->size());
        space2->writeToMemory(nullptr);
    }
}

FuzzCOLRv1()

void FuzzCOLRv1	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 19 of file FuzzCOLRv1.cpp.

                                                  {
    // We do not want the portable fontmgr here, as it does not allow creation of fonts from bytes.
    sk_sp<SkFontMgr> mgr = ToolUtils::TestFontMgr();
    std::unique_ptr<SkStreamAsset> stream = SkMemoryStream::MakeDirect(data, size);
    sk_sp<SkTypeface> typeface = mgr->makeFromStream(std::move(stream), 0);
 
    if (!typeface) {
        return;
    }
 
    auto s = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(128, 128));
    if (!s) {
        return;
    }
 
    // Place at a baseline in the lower part of the canvas square, but canvas size and baseline
    // placement are chosen arbitrarily and we just need to cover colrv1 rendering in this
    // fuzz test.
    SkFont colrv1Font = SkFont(typeface, 120);
    SkCanvas* canvas = s->getCanvas();
    SkPaint paint;
    int numGlyphs = typeface->countGlyphs();
 
    for (int i = 0; i < std::min(numGlyphs, 10); ++i) {
        SkPoint origin = SkPoint::Make(10, 108);
        SkPoint position = SkPoint::Make(0, 0);
        SkGlyphID glyphId = i;
        canvas->drawGlyphs(1, &glyphId, &position, origin, colrv1Font, paint);
    }
}

FuzzImageDecode()

bool FuzzImageDecode	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 14 of file FuzzImage.cpp.

                                                       {
    auto img = SkImages::DeferredFromEncodedData(SkData::MakeWithoutCopy(data, size));
    if (nullptr == img.get()) {
        return false;
    }
 
    auto s = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(128, 128));
    if (!s) {
        // May return nullptr in memory-constrained fuzzing environments
        return false;
    }
 
    s->getCanvas()->drawImage(img, 0, 0);
    return true;
}

FuzzImageFilterDeserialize()

void FuzzImageFilterDeserialize	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 16 of file FuzzImageFilterDeserialize.cpp.

                                                                  {
    const int BitmapSize = 24;
    SkBitmap bitmap;
    bitmap.allocN32Pixels(BitmapSize, BitmapSize);
    SkCanvas canvas(bitmap);
    canvas.clear(0x00000000);
 
    auto flattenable = SkImageFilter::Deserialize(data, size);
 
    if (flattenable != nullptr) {
        // Let's see if using the filters can cause any trouble...
        SkPaint paint;
        paint.setImageFilter(flattenable);
        canvas.save();
        canvas.clipIRect(bitmap.bounds());
 
        // This call shouldn't crash or cause ASAN to flag any memory issues
        // If nothing bad happens within this call, everything is fine
        canvas.drawImage(bitmap.asImage(), 0, 0, SkSamplingOptions(), &paint);
 
        canvas.restore();
    }
}

FuzzIncrementalImageDecode()

bool FuzzIncrementalImageDecode	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 13 of file FuzzIncrementalImage.cpp.

                                                                  {
    auto codec = SkCodec::MakeFromStream(SkMemoryStream::MakeDirect(data, size));
    if (!codec) {
        return false;
    }
 
    SkBitmap bm;
    if (!bm.tryAllocPixels(codec->getInfo())) {
        // May fail in memory-constrained fuzzing environments
        return false;
    }
 
    auto result = codec->startIncrementalDecode(bm.info(), bm.getPixels(), bm.rowBytes());
    if (result != SkCodec::kSuccess) {
        return false;
    }
 
    // Deliberately uninitialized to verify that incrementalDecode initializes it when it
    // returns kIncompleteInput or kErrorInInput.
    int rowsDecoded;
    result = codec->incrementalDecode(&rowsDecoded);
    switch (result) {
        case SkCodec::kIncompleteInput:
        case SkCodec::kErrorInInput:
            if (rowsDecoded < bm.height()) {
                void* dst = SkTAddOffset<void>(bm.getPixels(), rowsDecoded * bm.rowBytes());
                sk_bzero(dst, (bm.height() - rowsDecoded) * bm.rowBytes());
            }
            return true; // decoded a partial image
         case SkCodec::kSuccess:
            return true;
         default:
            return false;
    }
}

FuzzJSON()

void FuzzJSON	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 11 of file FuzzJSON.cpp.

                                                {
    skjson::DOM dom(reinterpret_cast<const char*>(data), size);
    SkDynamicMemoryWStream wstream;
    dom.write(&wstream);
}

FuzzPathDeserialize()

void FuzzPathDeserialize	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 14 of file FuzzPathDeserialize.cpp.

                                                           {
    SkReadBuffer buf(data, size);
 
    SkPath path;
    buf.readPath(&path);
    if (!buf.isValid()) {
        return;
    }
 
    auto s = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(128, 128));
    if (!s) {
        // May return nullptr in memory-constrained fuzzing environments
        return;
    }
    s->getCanvas()->drawPath(path, SkPaint());
}

FuzzRegionDeserialize()

bool FuzzRegionDeserialize	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 14 of file FuzzRegionDeserialize.cpp.

                                                             {
    SkRegion region;
    if (!region.readFromMemory(data, size)) {
        return false;
    }
    region.computeRegionComplexity();
    region.isComplex();
    SkRegion r2;
    if (region == r2) {
        region.contains(0,0);
    } else {
        region.contains(1,1);
    }
    auto s = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(128, 128));
    if (!s) {
        // May return nullptr in memory-constrained fuzzing environments
        return false;
    }
    s->getCanvas()->drawRegion(region, SkPaint());
    SkDEBUGCODE(SkRegionPriv::Validate(region));
    return true;
}

FuzzRegionSetPath()

void FuzzRegionSetPath

(

Fuzz *

fuzz

)

Definition at line 14 of file FuzzRegionSetPath.cpp.

                                   {
    SkPath p;
    FuzzNicePath(fuzz, &p, 1000);
    SkRegion r1;
    bool initR1;
    fuzz->next(&initR1);
    if (initR1) {
        fuzz->next(&r1);
    }
    SkRegion r2;
    fuzz->next(&r2);
 
    r1.setPath(p, r2);
 
    // Do some follow on computations to make sure region is well-formed.
    r1.computeRegionComplexity();
    r1.isComplex();
    if (r1 == r2) {
        r1.contains(0,0);
    } else {
        r1.contains(1,1);
    }
}

FuzzSkDescriptorDeserialize()

void FuzzSkDescriptorDeserialize	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 11 of file FuzzSkDescriptorDeserialize.cpp.

                                                                   {
    SkReadBuffer buffer{data, size};
    auto sut = SkAutoDescriptor::MakeFromBuffer(buffer);
    if (!sut.has_value()) {
        return;
    }
 
    auto desc = sut->getDesc();
 
    desc->computeChecksum();
    desc->isValid();
 
    // An arbitrary number
    uint32_t tagToFind = 117;
 
    uint32_t ignore;
    desc->findEntry(tagToFind, &ignore);
}

FuzzSkMeshSpecification()

void FuzzSkMeshSpecification	(	const uint8_t *	fuzzData,
		size_t	fuzzSize
	)

Definition at line 26 of file FuzzSkMeshSpecification.cpp.

                                                                       {
    using Attribute = SkMeshSpecification::Attribute;
    using Varying = SkMeshSpecification::Varying;
 
    SkSpan<const uint8_t> data(fuzzData, fuzzSize);
    STArray<SkMeshSpecification::kMaxAttributes, Attribute> attributes;
    STArray<SkMeshSpecification::kMaxVaryings,   Varying>   varyings;
    size_t vertexStride;
    SkString vs, fs;
 
    auto fuzzByteToASCII = [&](uint8_t c, SkString* str) -> bool {
        // Most control characters (including \0) and all high ASCII are treated as stop bytes.
        if ((c >= 32 && c <= 127) || c == '\r' || c == '\n' || c == '\t') {
            char ascii = c;
            str->append(&ascii, 1);
            return true;
        }
        return false;
    };
 
    auto fuzzByteToSkSL = [&](uint8_t c, SkString* str) -> bool {
        // In the 0x00 - 0x80 range, treat characters as ASCII.
        if (c < 128) {
            return fuzzByteToASCII(c, str);
        }
        c -= 128;
 
        // Dedicate a few bytes to injecting our attribute and varying names.
        if (c < SkMeshSpecification::kMaxAttributes) {
            if (!attributes.empty()) {
                str->append(attributes[c % attributes.size()].name);
            }
            return true;
        }
        c -= SkMeshSpecification::kMaxAttributes;
 
        if (c < SkMeshSpecification::kMaxVaryings) {
            if (!varyings.empty()) {
                str->append(varyings[c % varyings.size()].name);
            }
            return true;
        }
        c -= SkMeshSpecification::kMaxVaryings;
 
        // Replace the remaining high-ASCII bytes with valid SkSL operators and keywords in order to
        // improve our chances of generating a program. (We omit single-character operators since
        // single-byte versions of those already exist in the low-ASCII space.)
        static constexpr std::string_view kSkSLData[] = {
                " true ",
                " false ",
                " if ",
                " else ",
                " for ",
                " while ",
                " do ",
                " switch ",
                " case ",
                " default ",
                " break ",
                " continue ",
                " discard ",
                " return ",
                " in ",
                " out ",
                " inout ",
                " uniform ",
                " const ",
                " flat ",
                " noperspective ",
                " inline ",
                " noinline ",
                " $pure ",
                " readonly ",
                " writeonly ",
                " buffer ",
                " struct ",
                " layout ",
                " highp ",
                " mediump ",
                " lowp ",
                " $es3 ",
                " $export ",
                " workgroup ",
                " << ",
                " >> ",
                " && ",
                " || ",
                " ^^ ",
                " == ",
                " != ",
                " <= ",
                " >= ",
                " += ",
                " -= ",
                " *= ",
                " /= ",
                " %= ",
                " <<= ",
                " >>= ",
                " &= ",
                " |= ",
                " ^= ",
                " ++ ",
                " -- ",
                " //",
                " /*",
                "*/ ",
                " float",
                " half",
                " int",
                " uint",
                " short",
                " ushort",
                " bool",
                " void",
                " vec",
                " ivec",
                " bvec",
                " mat",
                " Attributes ",
                " Varyings ",
        };
 
        c %= std::size(kSkSLData);
        str->append(kSkSLData[c]);
        return true;
    };
 
    // Pick a vertex stride; intentionally allow some bad values through.
    vertexStride = extract<uint16_t>(data) % (SkMeshSpecification::kMaxStride + 2);
 
    while (!data.empty()) {
        uint8_t control = extract<uint8_t>(data) % 4;
        // A control code with no payload can be ignored.
        if (data.empty()) {
            break;
        }
        switch (control) {
            case 0: {
                // Add an attribute.
                Attribute& a = attributes.push_back();
                a.type = (Attribute::Type)(extract<uint8_t>(data) %
                                           ((int)Attribute::Type::kLast + 1));
                a.offset = extract<uint16_t>(data) % (SkMeshSpecification::kMaxStride + 2);
                while (uint8_t c = extract<char>(data)) {
                    if (!fuzzByteToASCII(c, &a.name)) {
                        break;
                    }
                }
                break;
            }
            case 1: {
                // Add a varying.
                Varying& v = varyings.push_back();
                v.type = (Varying::Type)(extract<uint8_t>(data) % ((int)Varying::Type::kLast + 1));
                while (uint8_t c = extract<char>(data)) {
                    if (!fuzzByteToASCII(c, &v.name)) {
                        break;
                    }
                }
                break;
            }
            case 2: {
                // Convert the following data into SkSL and add it into the vertex program.
                while (uint8_t c = extract<char>(data)) {
                    if (!fuzzByteToSkSL(c, &vs)) {
                        break;
                    }
                }
                break;
            }
            case 3: {
                // Convert the following data into SkSL and add it into the fragment program.
                while (uint8_t c = extract<char>(data)) {
                    if (!fuzzByteToSkSL(c, &fs)) {
                        break;
                    }
                }
                break;
            }
        }
    }
 
    auto result = SkMeshSpecification::Make(attributes, vertexStride, varyings, vs, fs);
    if (result.error.isEmpty()) {
        // TODO: synthesize a mesh with this specification and paint it.
        printf("----\n%s\n----\n\n----\n%s\n----\n\n\n", vs.c_str(), fs.c_str());
    }
}

FuzzSKP()

void FuzzSKP	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 15 of file FuzzSKP.cpp.

                                               {
    sk_sp<SkPicture> pic = SkPicture::MakeFromData(data, size);
    if (!pic) {
        return;
    }
    sk_sp<SkSurface> surface = SkSurfaces::Raster(
            SkImageInfo::MakeN32Premul(kCanvasSize.width(), kCanvasSize.height()));
    surface->getCanvas()->drawPicture(pic);
    pic->approximateBytesUsed();
    pic->approximateOpCount();
    return;
}

FuzzSkRuntimeBlender()

bool FuzzSkRuntimeBlender	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 59 of file FuzzSkRuntimeBlender.cpp.

                                                            {
    // Test once with optimization disabled...
    SkString shaderText{reinterpret_cast<const char*>(data), size};
    SkRuntimeEffect::Options options;
    options.forceUnoptimized = true;
    bool result = FuzzSkRuntimeBlender_Once(shaderText, options);
 
    // ... and then with optimization enabled.
    options.forceUnoptimized = false;
    result = FuzzSkRuntimeBlender_Once(shaderText, options) || result;
 
    return result;
}

FuzzSkRuntimeColorFilter()

bool FuzzSkRuntimeColorFilter	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 59 of file FuzzSkRuntimeColorFilter.cpp.

                                                                {
    // Test once with optimization disabled...
    SkString shaderText{reinterpret_cast<const char*>(data), size};
    SkRuntimeEffect::Options options;
    options.forceUnoptimized = true;
    bool result = FuzzSkRuntimeColorFilter_Once(shaderText, options);
 
    // ... and then with optimization enabled.
    options.forceUnoptimized = false;
    result = FuzzSkRuntimeColorFilter_Once(shaderText, options) || result;
 
    return result;
}

FuzzSkRuntimeEffect()

bool FuzzSkRuntimeEffect	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 58 of file FuzzSkRuntimeEffect.cpp.

                                                           {
    // Test once with optimization disabled...
    SkString shaderText{reinterpret_cast<const char*>(data), size};
    SkRuntimeEffect::Options options;
    options.forceUnoptimized = true;
    bool result = FuzzSkRuntimeEffect_Once(shaderText, options);
 
    // ... and then with optimization enabled.
    options.forceUnoptimized = false;
    result = FuzzSkRuntimeEffect_Once(shaderText, options) || result;
 
    return result;
}

FuzzSKSL2GLSL()

bool FuzzSKSL2GLSL	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 17 of file FuzzSKSL2GLSL.cpp.

                                                     {
    SkSL::Compiler compiler;
    SkSL::ProgramSettings settings;
    std::unique_ptr<SkSL::Program> program =
            compiler.convertProgram(SkSL::ProgramKind::kFragment,
                                    std::string(reinterpret_cast<const char*>(data), size),
                                    settings);
    std::string output;
    if (!program || !SkSL::ToGLSL(*program, SkSL::ShaderCapsFactory::Default(), &output)) {
        return false;
    }
    return true;
}

FuzzSKSL2Metal()

bool FuzzSKSL2Metal	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 17 of file FuzzSKSL2Metal.cpp.

                                                      {
    SkSL::Compiler compiler;
    SkSL::ProgramSettings settings;
    std::unique_ptr<SkSL::Program> program =
            compiler.convertProgram(SkSL::ProgramKind::kFragment,
                                    std::string(reinterpret_cast<const char*>(data), size),
                                    settings);
    std::string output;
    if (!program || !SkSL::ToMetal(*program, SkSL::ShaderCapsFactory::Default(), &output)) {
        return false;
    }
    return true;
}

FuzzSKSL2Pipeline()

bool FuzzSKSL2Pipeline	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 18 of file FuzzSKSL2Pipeline.cpp.

                                                         {
    SkSL::Compiler compiler;
    SkSL::ProgramSettings settings;
    std::unique_ptr<SkSL::Program> program =
            compiler.convertProgram(SkSL::ProgramKind::kRuntimeShader,
                                    std::string(reinterpret_cast<const char*>(data), size),
                                    settings);
    if (!program) {
        return false;
    }
 
    class Callbacks : public SkSL::PipelineStage::Callbacks {
        std::string declareUniform(const SkSL::VarDeclaration* decl) override {
            return std::string(decl->var()->name());
        }
 
        void defineFunction(const char* /*decl*/, const char* /*body*/, bool /*isMain*/) override {}
        void declareFunction(const char* /*decl*/) override {}
        void defineStruct(const char* /*definition*/) override {}
        void declareGlobal(const char* /*declaration*/) override {}
 
        std::string sampleShader(int index, std::string coords) override {
            return "child_" + std::to_string(index) + ".eval(" + coords + ")";
        }
 
        std::string sampleColorFilter(int index, std::string color) override {
            return "child_" + std::to_string(index) + ".eval(" + color + ")";
        }
 
        std::string sampleBlender(int index, std::string src, std::string dst) override {
            return "child_" + std::to_string(index) + ".eval(" + src + ", " + dst + ")";
        }
 
        std::string toLinearSrgb(std::string color) override { return color; }
        std::string fromLinearSrgb(std::string color) override { return color; }
    };
 
    Callbacks callbacks;
    SkSL::PipelineStage::ConvertProgram(*program, "coords", "inColor", "half4(1)", &callbacks);
    return true;
}

FuzzSKSL2SPIRV()

bool FuzzSKSL2SPIRV	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 17 of file FuzzSKSL2SPIRV.cpp.

                                                      {
    SkSL::Compiler compiler;
    SkSL::ProgramSettings settings;
 
    // This tells the compiler where the rt-flip uniform will live should it be required. For
    // fuzzing purposes we don't care where that is, but the compiler will report an error if we
    // leave them at their default invalid values, or if the offset overlaps another uniform.
    settings.fRTFlipOffset  = 16384;
    settings.fRTFlipSet     = 0;
    settings.fRTFlipBinding = 0;
 
    std::unique_ptr<SkSL::Program> program =
            compiler.convertProgram(SkSL::ProgramKind::kFragment,
                                    std::string(reinterpret_cast<const char*>(data), size),
                                    settings);
    std::string output;
    if (!program || !SkSL::ToSPIRV(*program, SkSL::ShaderCapsFactory::Default(), &output)) {
        return false;
    }
    return true;
}

FuzzSKSL2WGSL()

bool FuzzSKSL2WGSL	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 17 of file FuzzSKSL2WGSL.cpp.

                                                     {
    SkSL::Compiler compiler;
    SkSL::ProgramSettings settings;
    std::unique_ptr<SkSL::Program> program =
            compiler.convertProgram(SkSL::ProgramKind::kFragment,
                                    std::string(reinterpret_cast<const char*>(data), size),
                                    settings);
    std::string output;
    if (!program || !SkSL::ToWGSL(*program, SkSL::ShaderCapsFactory::Default(), &output)) {
        return false;
    }
    return true;
}

FuzzTextBlobDeserialize()

void FuzzTextBlobDeserialize	(	const uint8_t *	data,
		size_t	size
	)

Definition at line 15 of file FuzzTextBlobDeserialize.cpp.

                                                               {
    SkReadBuffer buf(data, size);
    auto tb = SkTextBlobPriv::MakeFromBuffer(buf);
    if (!buf.isValid()) {
        return;
    }
 
    auto s = SkSurfaces::Raster(SkImageInfo::MakeN32Premul(128, 128));
    if (!s) {
        // May return nullptr in memory-constrained fuzzing environments
        return;
    }
    s->getCanvas()->drawTextBlob(tb, 200, 200, SkPaint());
}

main()

int main	(	int	argc,
		char **	argv
	)

Definition at line 119 of file FuzzMain.cpp.

                                {
    CommandLineFlags::SetUsage(
            "Usage: fuzz -t <type> -b <path/to/file> [-n api-to-fuzz]\n"
            "       fuzz -b <path/to/file>\n"
            "--help lists the valid types. If type is not specified,\n"
            "fuzz will make a guess based on the name of the file.\n");
    CommandLineFlags::Parse(argc, argv);
    ToolUtils::UsePortableFontMgr();
 
    SkString path = SkString(FLAGS_bytes.isEmpty() ? argv[0] : FLAGS_bytes[0]);
    SkString type = SkString(FLAGS_type.isEmpty() ? "" : FLAGS_type[0]);
 
    int loopCount = std::max(FLAGS_loops, 1);
 
    if (!sk_isdir(path.c_str())) {
        for (int i = 0; i < loopCount; ++i) {
            int rv = fuzz_file(path, type);
            if (rv != 0) {
                return rv;
            }
        }
        return 0;
    }
 
    SkOSFile::Iter it(path.c_str());
    for (SkString file; it.next(&file); ) {
        SkString p = SkOSPath::Join(path.c_str(), file.c_str());
        SkDebugf("Fuzzing %s\n", p.c_str());
        for (int i = 0; i < loopCount; ++i) {
            int rv = fuzz_file(p, type);
            if (rv != 0) {
                return rv;
            }
        }
    }
    return 0;
}

print_api_names()

static void print_api_names ( )

static

Definition at line 432 of file FuzzMain.cpp.

                             {
    SkDebugf("When using --type api, please choose an API to fuzz with --name/-n:\n");
    for (const Fuzzable& fuzzable : sk_tools::Registry<Fuzzable>::Range()) {
        SkDebugf("\t%s\n", fuzzable.name);
    }
}

try_auto_detect()

static SkString try_auto_detect ( const SkString &  path, SkString *  name  )

static

Definition at line 355 of file FuzzMain.cpp.

                                                                      {
    std::cmatch m;
    std::regex clusterfuzz("clusterfuzz-testcase(-minimized)?-([a-z0-9_]+)-[\\d]+");
    std::regex skiafuzzer("(api-)?(\\w+)-[a-f0-9]+");
 
    if (std::regex_search(path.c_str(), m, clusterfuzz)) {
        std::string type = m.str(2);
 
        if (cf_api_map.find(type) != cf_api_map.end()) {
            *name = SkString(cf_api_map[type].c_str());
            return SkString("api");
        } else {
            if (cf_map.find(type) != cf_map.end()) {
                return SkString(cf_map[type].c_str());
            }
        }
    } else if (std::regex_search(path.c_str(), m, skiafuzzer)) {
        std::string a1 = m.str(1);
        std::string typeOrName = m.str(2);
        if (a1.length() > 0) {
            // it's an api fuzzer
            *name = SkString(typeOrName.c_str());
            return SkString("api");
        } else {
            return SkString(typeOrName.c_str());
        }
    }
 
    return SkString();
}

Variable Documentation

cf_api_map

std::map<std::string, std::string> cf_api_map

static

Initial value:

= {
    {"api_create_ddl", "CreateDDL"},
    {"api_draw_functions", "DrawFunctions"},
    {"api_ddl_threading", "DDLThreadingGL"},
    {"api_gradients", "Gradients"},
    {"api_image_filter", "ImageFilter"},
    {"api_mock_gpu_canvas", "MockGPUCanvas"},
    {"api_null_canvas", "NullCanvas"},
    {"api_path_measure", "PathMeasure"},
    {"api_pathop", "Pathop"},
    {"api_polyutils", "PolyUtils"},
 
 
 
    {"api_raster_n32_canvas", "RasterN32Canvas"},
    {"api_skparagraph", "SkParagraph"},
    {"api_svg_canvas", "SVGCanvas"},
    {"cubic_quad_roots", "CubicQuadRoots"},
    {"jpeg_encoder", "JPEGEncoder"},
    {"png_encoder", "PNGEncoder"},
    {"skia_pathop_fuzzer", "LegacyChromiumPathop"},
    {"webp_encoder", "WEBPEncoder"}
}

Definition at line 301 of file FuzzMain.cpp.

                                                 {
    {"api_create_ddl", "CreateDDL"},
    {"api_draw_functions", "DrawFunctions"},
    {"api_ddl_threading", "DDLThreadingGL"},
    {"api_gradients", "Gradients"},
    {"api_image_filter", "ImageFilter"},
    {"api_mock_gpu_canvas", "MockGPUCanvas"},
    {"api_null_canvas", "NullCanvas"},
    {"api_path_measure", "PathMeasure"},
    {"api_pathop", "Pathop"},
    {"api_polyutils", "PolyUtils"},
#if defined(SK_GRAPHITE) && defined(SK_ENABLE_PRECOMPILE)
    {"api_precompile", "Precompile"},
#endif
    {"api_raster_n32_canvas", "RasterN32Canvas"},
    {"api_skparagraph", "SkParagraph"},
    {"api_svg_canvas", "SVGCanvas"},
    {"cubic_quad_roots", "CubicQuadRoots"},
    {"jpeg_encoder", "JPEGEncoder"},
    {"png_encoder", "PNGEncoder"},
    {"skia_pathop_fuzzer", "LegacyChromiumPathop"},
    {"webp_encoder", "WEBPEncoder"}
};

cf_map

std::map<std::string, std::string> cf_map

static

Initial value:

= {
    {"android_codec", "android_codec"},
    {"animated_image_decode", "animated_image_decode"},
    {"colrv1", "colrv1"},
    {"image_decode", "image_decode"},
    {"image_decode_incremental", "image_decode_incremental"},
    {"image_filter_deserialize", "filter_fuzz"},
    {"image_filter_deserialize_width", "filter_fuzz"},
    {"path_deserialize", "path_deserialize"},
    {"region_deserialize", "region_deserialize"},
    {"region_set_path", "region_set_path"},
    {"skdescriptor_deserialize", "skdescriptor_deserialize"},
    {"skjson", "json"},
    {"skmeshspecification", "skmeshspecification"},
    {"skp", "skp"},
    {"skruntimeeffect", "skruntimeeffect"},
    {"sksl2glsl", "sksl2glsl"},
    {"sksl2metal", "sksl2metal"},
    {"sksl2spirv", "sksl2spirv"},
    {"sksl2pipeline", "sksl2pipeline"},
 
 
 
 
 
 
    {"textblob_deserialize", "textblob"}
}

Definition at line 326 of file FuzzMain.cpp.

                                             {
    {"android_codec", "android_codec"},
    {"animated_image_decode", "animated_image_decode"},
    {"colrv1", "colrv1"},
    {"image_decode", "image_decode"},
    {"image_decode_incremental", "image_decode_incremental"},
    {"image_filter_deserialize", "filter_fuzz"},
    {"image_filter_deserialize_width", "filter_fuzz"},
    {"path_deserialize", "path_deserialize"},
    {"region_deserialize", "region_deserialize"},
    {"region_set_path", "region_set_path"},
    {"skdescriptor_deserialize", "skdescriptor_deserialize"},
    {"skjson", "json"},
    {"skmeshspecification", "skmeshspecification"},
    {"skp", "skp"},
    {"skruntimeeffect", "skruntimeeffect"},
    {"sksl2glsl", "sksl2glsl"},
    {"sksl2metal", "sksl2metal"},
    {"sksl2spirv", "sksl2spirv"},
    {"sksl2pipeline", "sksl2pipeline"},
#if defined(SK_ENABLE_SKOTTIE)
    {"skottie_json", "skottie_json"},
#endif
#if defined(SK_ENABLE_SVG)
    {"svg_dom", "svg_dom"},
#endif
    {"textblob_deserialize", "textblob"}
};

g_type_message

constexpr char g_type_message[]

staticconstexpr

Definition at line 45 of file FuzzMain.cpp.