fuzz.h 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203
  1. // Copyright 2018 Google Inc.
  2. //
  3. // Licensed under the Apache License, Version 2.0 (the "License");
  4. // you may not use this file except in compliance with the License.
  5. // You may obtain a copy of the License at
  6. //
  7. // http://www.apache.org/licenses/LICENSE-2.0
  8. //
  9. // Unless required by applicable law or agreed to in writing, software
  10. // distributed under the License is distributed on an "AS IS" BASIS,
  11. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. // See the License for the specific language governing permissions and
  13. // limitations under the License.
  14. //
  15. ////////////////////////////////////////////////////////////////////////////////
  16. #include <stdint.h>
  17. #include <stdlib.h>
  18. #include "fuzzing/img_alpha.h"
  19. #include "fuzzing/img_grid.h"
  20. #include "fuzzing/img_peak.h"
  21. #include "src/dsp/dsp.h"
  22. #include "src/webp/encode.h"
  23. //------------------------------------------------------------------------------
  24. // Arbitrary limits to prevent OOM, timeout, or slow execution.
  25. //
  26. // The decoded image size, and for animations additionally the canvas size.
  27. static const size_t kFuzzPxLimit = 1024 * 1024;
  28. // Demuxed or decoded animation frames.
  29. static const int kFuzzFrameLimit = 3;
  30. // Reads and sums (up to) 128 spread-out bytes.
  31. static uint8_t FuzzHash(const uint8_t* const data, size_t size) {
  32. uint8_t value = 0;
  33. size_t incr = size / 128;
  34. if (!incr)
  35. incr = 1;
  36. for (size_t i = 0; i < size; i += incr)
  37. value += data[i];
  38. return value;
  39. }
  40. //------------------------------------------------------------------------------
  41. // Extract an integer in [0, max_value].
  42. static uint32_t Extract(uint32_t max_value,
  43. const uint8_t data[],
  44. size_t size,
  45. uint32_t* const bit_pos) {
  46. uint32_t v = 0;
  47. uint32_t range = 1;
  48. while (*bit_pos < 8 * size && range <= max_value) {
  49. const uint8_t mask = 1u << (*bit_pos & 7);
  50. v = (v << 1) | !!(data[*bit_pos >> 3] & mask);
  51. range <<= 1;
  52. ++*bit_pos;
  53. }
  54. return v % (max_value + 1);
  55. }
  56. //------------------------------------------------------------------------------
  57. // Some functions to override VP8GetCPUInfo and disable some optimizations.
  58. static VP8CPUInfo GetCPUInfo;
  59. static int GetCPUInfoNoSSE41(CPUFeature feature) {
  60. if (feature == kSSE4_1 || feature == kAVX)
  61. return 0;
  62. return GetCPUInfo(feature);
  63. }
  64. static int GetCPUInfoNoAVX(CPUFeature feature) {
  65. if (feature == kAVX)
  66. return 0;
  67. return GetCPUInfo(feature);
  68. }
  69. static int GetCPUInfoForceSlowSSSE3(CPUFeature feature) {
  70. if (feature == kSlowSSSE3 && GetCPUInfo(kSSE3)) {
  71. return 1; // we have SSE3 -> force SlowSSSE3
  72. }
  73. return GetCPUInfo(feature);
  74. }
  75. static int GetCPUInfoOnlyC(CPUFeature feature) {
  76. return 0;
  77. }
  78. static void ExtractAndDisableOptimizations(VP8CPUInfo default_VP8GetCPUInfo,
  79. const uint8_t data[],
  80. size_t size,
  81. uint32_t* const bit_pos) {
  82. GetCPUInfo = default_VP8GetCPUInfo;
  83. const VP8CPUInfo kVP8CPUInfos[5] = {GetCPUInfoOnlyC, GetCPUInfoForceSlowSSSE3,
  84. GetCPUInfoNoSSE41, GetCPUInfoNoAVX,
  85. GetCPUInfo};
  86. int VP8GetCPUInfo_index = Extract(4, data, size, bit_pos);
  87. VP8GetCPUInfo = kVP8CPUInfos[VP8GetCPUInfo_index];
  88. }
  89. //------------------------------------------------------------------------------
  90. static int ExtractWebPConfig(WebPConfig* const config,
  91. const uint8_t data[],
  92. size_t size,
  93. uint32_t* const bit_pos) {
  94. if (config == NULL || !WebPConfigInit(config))
  95. return 0;
  96. config->lossless = Extract(1, data, size, bit_pos);
  97. config->quality = Extract(100, data, size, bit_pos);
  98. config->method = Extract(6, data, size, bit_pos);
  99. config->image_hint =
  100. (WebPImageHint)Extract(WEBP_HINT_LAST - 1, data, size, bit_pos);
  101. config->segments = 1 + Extract(3, data, size, bit_pos);
  102. config->sns_strength = Extract(100, data, size, bit_pos);
  103. config->filter_strength = Extract(100, data, size, bit_pos);
  104. config->filter_sharpness = Extract(7, data, size, bit_pos);
  105. config->filter_type = Extract(1, data, size, bit_pos);
  106. config->autofilter = Extract(1, data, size, bit_pos);
  107. config->alpha_compression = Extract(1, data, size, bit_pos);
  108. config->alpha_filtering = Extract(2, data, size, bit_pos);
  109. config->alpha_quality = Extract(100, data, size, bit_pos);
  110. config->pass = 1 + Extract(9, data, size, bit_pos);
  111. config->show_compressed = 1;
  112. config->preprocessing = Extract(2, data, size, bit_pos);
  113. config->partitions = Extract(3, data, size, bit_pos);
  114. config->partition_limit = 10 * Extract(10, data, size, bit_pos);
  115. config->emulate_jpeg_size = Extract(1, data, size, bit_pos);
  116. config->thread_level = Extract(1, data, size, bit_pos);
  117. config->low_memory = Extract(1, data, size, bit_pos);
  118. config->near_lossless = 20 * Extract(5, data, size, bit_pos);
  119. config->exact = Extract(1, data, size, bit_pos);
  120. config->use_delta_palette = Extract(1, data, size, bit_pos);
  121. config->use_sharp_yuv = Extract(1, data, size, bit_pos);
  122. return WebPValidateConfig(config);
  123. }
  124. //------------------------------------------------------------------------------
  125. static int ExtractSourcePicture(WebPPicture* const pic,
  126. const uint8_t data[],
  127. size_t size,
  128. uint32_t* const bit_pos) {
  129. if (pic == NULL)
  130. return 0;
  131. // Pick a source picture.
  132. const uint8_t* kImagesData[] = {kImgAlphaData, kImgGridData, kImgPeakData};
  133. const int kImagesWidth[] = {kImgAlphaWidth, kImgGridWidth, kImgPeakWidth};
  134. const int kImagesHeight[] = {kImgAlphaHeight, kImgGridHeight, kImgPeakHeight};
  135. const size_t kNbImages = sizeof(kImagesData) / sizeof(kImagesData[0]);
  136. const size_t image_index = Extract(kNbImages - 1, data, size, bit_pos);
  137. const uint8_t* const image_data = kImagesData[image_index];
  138. pic->width = kImagesWidth[image_index];
  139. pic->height = kImagesHeight[image_index];
  140. pic->argb_stride = pic->width * 4 * sizeof(uint8_t);
  141. // Read the bytes.
  142. return WebPPictureImportRGBA(pic, image_data, pic->argb_stride);
  143. }
  144. //------------------------------------------------------------------------------
  145. static int max(int a, int b) {
  146. return ((a < b) ? b : a);
  147. }
  148. static int ExtractAndCropOrScale(WebPPicture* const pic,
  149. const uint8_t data[],
  150. size_t size,
  151. uint32_t* const bit_pos) {
  152. if (pic == NULL)
  153. return 0;
  154. #if !defined(WEBP_REDUCE_SIZE)
  155. const int alter_input = Extract(1, data, size, bit_pos);
  156. const int crop_or_scale = Extract(1, data, size, bit_pos);
  157. const int width_ratio = 1 + Extract(7, data, size, bit_pos);
  158. const int height_ratio = 1 + Extract(7, data, size, bit_pos);
  159. if (alter_input) {
  160. if (crop_or_scale) {
  161. const uint32_t left_ratio = 1 + Extract(7, data, size, bit_pos);
  162. const uint32_t top_ratio = 1 + Extract(7, data, size, bit_pos);
  163. const int cropped_width = max(1, pic->width / width_ratio);
  164. const int cropped_height = max(1, pic->height / height_ratio);
  165. const int cropped_left = (pic->width - cropped_width) / left_ratio;
  166. const int cropped_top = (pic->height - cropped_height) / top_ratio;
  167. return WebPPictureCrop(pic, cropped_left, cropped_top, cropped_width,
  168. cropped_height);
  169. } else {
  170. const int scaled_width = 1 + (pic->width * width_ratio) / 8;
  171. const int scaled_height = 1 + (pic->height * height_ratio) / 8;
  172. return WebPPictureRescale(pic, scaled_width, scaled_height);
  173. }
  174. }
  175. #else // defined(WEBP_REDUCE_SIZE)
  176. (void)data;
  177. (void)size;
  178. (void)bit_pos;
  179. #endif // !defined(WEBP_REDUCE_SIZE)
  180. return 1;
  181. }