Coverage Report

Created: 2026-03-31 06:58

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/harfbuzz/test/fuzzing/hb-shape-fuzzer.cc
Line
Count
Source
1
#include "hb-shape-input.hh"
2
3
#define TEST_OT_FACE_NO_MAIN 1
4
#include "../api/test-ot-face.c"
5
#undef TEST_OT_FACE_NO_MAIN
6
7
extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
8
34.0k
{
9
34.0k
  alloc_state = _fuzzing_alloc_state (data, size);
10
11
34.0k
  _fuzzing_shape_input_t input;
12
34.0k
  switch (_fuzzing_prepare_shape_input (data, size, 12, 12, &input))
13
34.0k
  {
14
166
    case HB_FUZZING_SHAPE_INPUT_MALFORMED:
15
166
      return 0;
16
33.7k
    case HB_FUZZING_SHAPE_INPUT_RAW:
17
33.8k
    case HB_FUZZING_SHAPE_INPUT_EXTENDED:
18
33.8k
      break;
19
34.0k
  }
20
21
33.8k
  {
22
33.8k
    hb_buffer_t *buffer = hb_buffer_create ();
23
33.8k
    hb_buffer_set_flags (buffer, (hb_buffer_flags_t) (HB_BUFFER_FLAG_VERIFY));
24
33.8k
    hb_buffer_add_utf8 (buffer, "ABCDEXYZ123@_%&)*$!", -1, 0, -1);
25
33.8k
    hb_buffer_guess_segment_properties (buffer);
26
33.8k
    hb_shape (input.font, buffer, nullptr, 0);
27
33.8k
    hb_buffer_destroy (buffer);
28
33.8k
  }
29
30
33.8k
  uint32_t text32[16] = {0};
31
33.8k
  unsigned int len = input.text.size () > 16 ? 16 : (unsigned int) input.text.size ();
32
574k
  for (unsigned int i = 0; i < len; i++)
33
540k
    text32[i] = input.text[i];
34
35
33.8k
  text32[10] = test_font (input.font, text32[15]) % 256;
36
37
33.8k
  hb_buffer_t *buffer = hb_buffer_create ();
38
33.8k
  hb_buffer_add_utf32 (buffer, text32, sizeof (text32) / sizeof (text32[0]), 0, -1);
39
33.8k
  hb_buffer_guess_segment_properties (buffer);
40
33.8k
  hb_shape (input.font, buffer, nullptr, 0);
41
33.8k
  hb_buffer_destroy (buffer);
42
43
33.8k
  return 0;
44
34.0k
}