/src/harfbuzz/test/fuzzing/hb-raster-fuzzer.cc
Line | Count | Source |
1 | | #include "hb-shape-input.hh" |
2 | | |
3 | | #include <hb-raster.h> |
4 | | |
5 | | extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size) |
6 | 17.1k | { |
7 | 17.1k | alloc_state = _fuzzing_alloc_state (data, size); |
8 | | |
9 | 17.1k | _fuzzing_shape_input_t input; |
10 | 17.1k | if (_fuzzing_prepare_shape_input (data, size, 30, 30, &input) == HB_FUZZING_SHAPE_INPUT_MALFORMED) |
11 | 278 | return 0; |
12 | | |
13 | 16.8k | hb_raster_draw_t *draw = hb_raster_draw_create_or_fail (); |
14 | 16.8k | hb_raster_paint_t *paint = hb_raster_paint_create_or_fail (); |
15 | 16.8k | if (!draw || !paint) |
16 | 166 | { |
17 | 166 | hb_raster_draw_destroy (draw); |
18 | 166 | hb_raster_paint_destroy (paint); |
19 | 166 | return 0; |
20 | 166 | } |
21 | 16.7k | hb_raster_paint_set_foreground (paint, HB_COLOR (0, 0, 0, 255)); |
22 | | |
23 | | /* Cap font scale so malicious fonts don't produce huge surfaces. */ |
24 | 16.7k | int x_scale, y_scale; |
25 | 16.7k | hb_font_get_scale (input.font, &x_scale, &y_scale); |
26 | 16.7k | if (x_scale > 1000 || x_scale < -1000) x_scale = 1000; |
27 | 16.7k | if (y_scale > 1000 || y_scale < -1000) y_scale = 1000; |
28 | 16.7k | hb_font_set_scale (input.font, x_scale, y_scale); |
29 | | |
30 | 16.7k | unsigned glyph_count = hb_face_get_glyph_count (input.face); |
31 | 16.7k | unsigned limit = glyph_count > 16 ? 16 : glyph_count; |
32 | | |
33 | 16.7k | volatile unsigned counter = !glyph_count; |
34 | | |
35 | 16.7k | if (limit) |
36 | 14.8k | { |
37 | 14.8k | unsigned gid = input.text.empty () ? 0 : input.text[0] % limit; |
38 | 14.8k | float x = (float) ((gid % 4) * 40); |
39 | 14.8k | float y = (float) ((gid / 4) * 40); |
40 | 14.8k | hb_raster_draw_set_transform (draw, 1.f, 0.f, 0.f, 1.f, x, y); |
41 | 14.8k | hb_raster_draw_glyph (draw, input.font, gid); |
42 | 14.8k | hb_raster_paint_set_transform (paint, 1.f, 0.f, 0.f, 1.f, x, y); |
43 | 14.8k | hb_raster_paint_glyph (paint, input.font, gid); |
44 | | |
45 | 14.8k | hb_raster_image_t *draw_image = hb_raster_draw_render (draw); |
46 | 14.8k | if (draw_image) |
47 | 14.6k | { |
48 | 14.6k | hb_raster_extents_t ext; |
49 | 14.6k | hb_raster_image_get_extents (draw_image, &ext); |
50 | 14.6k | counter += ext.width + ext.height + (unsigned) (ext.x_origin != 0) + (unsigned) (ext.y_origin != 0); |
51 | 14.6k | const uint8_t *buf = hb_raster_image_get_buffer (draw_image); |
52 | 14.6k | if (buf && ext.height && ext.stride) |
53 | 0 | counter += buf[0]; |
54 | 14.6k | hb_raster_draw_recycle_image (draw, draw_image); |
55 | 14.6k | } |
56 | | |
57 | 14.8k | hb_raster_image_t *paint_image = hb_raster_paint_render (paint); |
58 | 14.8k | if (paint_image) |
59 | 5.83k | { |
60 | 5.83k | hb_raster_extents_t ext; |
61 | 5.83k | hb_raster_image_get_extents (paint_image, &ext); |
62 | 5.83k | counter += ext.width + ext.height + (unsigned) (ext.x_origin != 0) + (unsigned) (ext.y_origin != 0); |
63 | 5.83k | const uint8_t *buf = hb_raster_image_get_buffer (paint_image); |
64 | 5.83k | if (buf && ext.height && ext.stride) |
65 | 5.83k | counter += buf[0]; |
66 | 5.83k | hb_raster_paint_recycle_image (paint, paint_image); |
67 | 5.83k | } |
68 | 14.8k | } |
69 | | |
70 | 16.7k | hb_raster_draw_destroy (draw); |
71 | 16.7k | hb_raster_paint_destroy (paint); |
72 | 16.7k | return counter ? 0 : 0; |
73 | 16.8k | } |