Coverage Report

Created: 2026-01-09 06:57

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/cgif/fuzz/cgif_file_fuzzer.c
Line
Count
Source
1
#include <cgif.h>
2
3
#include <stddef.h>
4
#include <stdint.h>
5
#include <stdlib.h>
6
#include <string.h>
7
8
#include <unistd.h>
9
10
typedef struct {
11
  const uint8_t* pData;
12
  size_t         numBytes;
13
  size_t         curPos;
14
} ByteStream;
15
16
56.4k
static int readdata(ByteStream* pStream, void* pDest, size_t size) {
17
56.4k
  if((pStream->curPos + size) <= pStream->numBytes) {
18
45.3k
    memcpy(pDest, &pStream->pData[pStream->curPos], size);
19
45.3k
    pStream->curPos += size;
20
45.3k
    return 0;
21
45.3k
  }
22
  // error: out of bounds
23
11.0k
  pStream->curPos = pStream->numBytes; // mark stream as out of sync
24
11.0k
  return -1;
25
56.4k
}
26
27
2.06k
static int read_gifconfig(ByteStream* pStream, CGIF_Config* pDest) {
28
2.06k
  int r;
29
30
2.06k
  memset(pDest, 0, sizeof(CGIF_Config));
31
  // width     : U16
32
  // height    : U16
33
  // attrFlags : U32
34
  // genFlags  : U32
35
  // sizeGCT   : U16
36
  // numLoops  : U16
37
  // pGCT      : U8[sizeGCT * 3]
38
2.06k
  r  = readdata(pStream, &pDest->width,                   2);
39
2.06k
  r |= readdata(pStream, &pDest->height,                  2);
40
2.06k
  r |= readdata(pStream, &pDest->attrFlags,               4);
41
2.06k
  r |= readdata(pStream, &pDest->genFlags,                4);
42
2.06k
  r |= readdata(pStream, &pDest->numGlobalPaletteEntries, 2);
43
2.06k
  if(!(pDest->attrFlags & CGIF_ATTR_NO_GLOBAL_TABLE)) {
44
1.95k
    pDest->pGlobalPalette = (uint8_t*)malloc(pDest->numGlobalPaletteEntries * 3);
45
1.95k
    if(pDest->pGlobalPalette == NULL) return 0; // malloc failed
46
1.95k
    r |= readdata(pStream, pDest->pGlobalPalette, pDest->numGlobalPaletteEntries * 3);
47
1.95k
  }
48
2.06k
  if(r) {
49
41
    free(pDest->pGlobalPalette);
50
41
  }
51
2.06k
  return (r ? 0 : 1);
52
2.06k
}
53
54
7.15k
static int read_frameconfig(ByteStream* pStream, CGIF_FrameConfig* pDest, size_t sizeImageData) {
55
7.15k
  int r;
56
57
7.15k
  memset(pDest, 0, sizeof(CGIF_FrameConfig));
58
  // attrFlags  : U16
59
  // genFlags   : U16
60
  // delay      : U16
61
  // transIndex : U8
62
  // sizeLCT    : U16
63
  // pLCT       : U8[sizeLCT * 3]
64
  // pImageData : U8[sizeImageData]
65
7.15k
  r  = readdata(pStream, &pDest->attrFlags,              2);
66
7.15k
  r |= readdata(pStream, &pDest->genFlags,               2);
67
7.15k
  r |= readdata(pStream, &pDest->delay,                  2);
68
7.15k
  r |= readdata(pStream, &pDest->transIndex,             1);
69
7.15k
  r |= readdata(pStream, &pDest->numLocalPaletteEntries, 2);
70
7.15k
  if(pDest->attrFlags & CGIF_FRAME_ATTR_USE_LOCAL_TABLE) {
71
1.24k
    pDest->pLocalPalette = (uint8_t*)malloc(pDest->numLocalPaletteEntries * 3);
72
1.24k
    if(pDest->pLocalPalette == NULL) return 0; // malloc failed
73
1.24k
    r |= readdata(pStream, pDest->pLocalPalette, pDest->numLocalPaletteEntries * 3);
74
1.24k
  }
75
7.15k
  pDest->pImageData = (uint8_t*)malloc(sizeImageData);
76
7.15k
  if(pDest->pImageData == NULL) return 0; // malloc failed
77
7.15k
  r |= readdata(pStream, pDest->pImageData, sizeImageData);
78
7.15k
  if(r) {
79
1.96k
    free(pDest->pImageData);
80
1.96k
    free(pDest->pLocalPalette);
81
1.96k
  }
82
7.15k
  return (r ? 0 : 1);
83
7.15k
}
84
85
2.06k
static int processInput(ByteStream* pStream) {
86
2.06k
  CGIF_Config      gconfig;
87
2.06k
  CGIF_FrameConfig fconfig;
88
2.06k
  CGIF*            pGIF;
89
2.06k
  size_t           sizeImageData;
90
2.06k
  int              r;
91
2.06k
  int              numFrames;
92
93
2.06k
  r = read_gifconfig(pStream, &gconfig);
94
2.06k
  if(!r) {
95
41
    return -1;
96
41
  }
97
2.02k
  sizeImageData    = (uint32_t)gconfig.width * (uint32_t)gconfig.height;
98
  // limit dimensions of GIF to be created
99
2.02k
  if(sizeImageData > (10000 * 10000)) {
100
10
    free(gconfig.pGlobalPalette);
101
10
    return -1;
102
10
  }
103
2.01k
  gconfig.path = "/tmp/out.gif"; // write to temporary file
104
2.01k
  pGIF         = cgif_newgif(&gconfig);
105
2.01k
  free(gconfig.pGlobalPalette);
106
2.01k
  if(pGIF == NULL) {
107
18
    unlink("/tmp/out.gif");
108
18
    return -1;
109
18
  }
110
1.99k
  r = read_frameconfig(pStream, &fconfig, sizeImageData);
111
1.99k
  numFrames = 1;
112
7.15k
  while(r) {
113
5.19k
    cgif_addframe(pGIF, &fconfig);
114
5.19k
    free(fconfig.pImageData);
115
5.19k
    free(fconfig.pLocalPalette);
116
5.19k
    if(numFrames >= 16) {
117
      // limit number of frames to avoid timeouts: 16 should be more than enough
118
34
      break;
119
34
    }
120
5.15k
    numFrames++;
121
5.15k
    r = read_frameconfig(pStream, &fconfig, sizeImageData);
122
5.15k
  }
123
1.99k
  r = cgif_close(pGIF);
124
1.99k
  unlink("/tmp/out.gif");
125
1.99k
  return r;
126
2.01k
}
127
128
#ifdef __cplusplus
129
extern "C"
130
#endif
131
5.30k
int LLVMFuzzerTestOneInput(const uint8_t* pData, size_t numBytes) {
132
5.30k
  ByteStream input = { pData, numBytes, 0 };
133
5.30k
  processInput(&input);
134
5.30k
  return 0;
135
5.30k
}