Coverage Report

Created: 2026-10-10 06:15

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/harfbuzz/test/fuzzing/hb-fuzzer.hh
Line
Count
Source
1
#include <hb-config.hh>
2
3
#include <hb.h>
4
#include <stddef.h>
5
#include <string.h>
6
7
extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size);
8
9
#if defined(__GNUC__) && (__GNUC__ >= 4) || (__clang__)
10
#define HB_UNUSED __attribute__((unused))
11
#else
12
#define HB_UNUSED
13
#endif
14
15
#ifdef HB_IS_IN_FUZZER
16
17
/* See src/failing-alloc.c */
18
extern "C" int alloc_state;
19
20
#else
21
22
/* Just a dummy global variable */
23
static int HB_UNUSED alloc_state = 0;
24
25
#endif
26
27
static inline int
28
_fuzzing_alloc_state (const uint8_t *data, size_t size)
29
127k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
127k
  if (size && data[size - 1] < 0x80)
34
99.4k
    return 0;
35
36
27.9k
  return size;
37
127k
}
hb-shape-fuzzer.cc:_fuzzing_alloc_state(unsigned char const*, unsigned long)
Line
Count
Source
29
44.4k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
44.4k
  if (size && data[size - 1] < 0x80)
34
36.6k
    return 0;
35
36
7.75k
  return size;
37
44.4k
}
hb-raster-fuzzer.cc:_fuzzing_alloc_state(unsigned char const*, unsigned long)
Line
Count
Source
29
18.2k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
18.2k
  if (size && data[size - 1] < 0x80)
34
14.5k
    return 0;
35
36
3.63k
  return size;
37
18.2k
}
hb-repacker-fuzzer.cc:_fuzzing_alloc_state(unsigned char const*, unsigned long)
Line
Count
Source
29
3.35k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
3.35k
  if (size && data[size - 1] < 0x80)
34
2.07k
    return 0;
35
36
1.28k
  return size;
37
3.35k
}
hb-gpu-fuzzer.cc:_fuzzing_alloc_state(unsigned char const*, unsigned long)
Line
Count
Source
29
20.8k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
20.8k
  if (size && data[size - 1] < 0x80)
34
16.3k
    return 0;
35
36
4.53k
  return size;
37
20.8k
}
hb-subset-fuzzer.cc:_fuzzing_alloc_state(unsigned char const*, unsigned long)
Line
Count
Source
29
26.2k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
26.2k
  if (size && data[size - 1] < 0x80)
34
22.3k
    return 0;
35
36
3.93k
  return size;
37
26.2k
}
hb-vector-fuzzer.cc:_fuzzing_alloc_state(unsigned char const*, unsigned long)
Line
Count
Source
29
14.2k
{
30
  /* https://github.com/harfbuzz/harfbuzz/pull/2764#issuecomment-1172589849 */
31
32
  /* In 50% of the runs, don't fail the allocator. */
33
14.2k
  if (size && data[size - 1] < 0x80)
34
7.50k
    return 0;
35
36
6.78k
  return size;
37
14.2k
}
38
39
static const uint8_t _fuzzing_extended_magic[] = {'H', 'B', 'S', 'U', 'B', 'F', 'Z', '2'};
40
41
enum _fuzzing_extended_op_t
42
{
43
  HB_FUZZING_OP_SET_FLAGS = 1,
44
  HB_FUZZING_OP_KEEP_EVERYTHING = 2,
45
  HB_FUZZING_OP_SET_CLEAR = 3,
46
  HB_FUZZING_OP_SET_INVERT = 4,
47
  HB_FUZZING_OP_SET_ADD_RANGES = 5,
48
  HB_FUZZING_OP_SET_DEL_RANGES = 6,
49
  HB_FUZZING_OP_TEXT_ADD = 7,
50
  HB_FUZZING_OP_TEXT_DEL = 8,
51
  HB_FUZZING_OP_AXIS_PIN_ALL_TO_DEFAULT = 9,
52
  HB_FUZZING_OP_AXIS_SET = 10,
53
};
54
55
enum _fuzzing_extended_axis_mode_t
56
{
57
  HB_FUZZING_AXIS_PIN_TO_DEFAULT = 0,
58
  HB_FUZZING_AXIS_SET_RANGE = 1,
59
};
60
61
static inline uint32_t
62
_fuzzing_read_u32_le (const uint8_t *p)
63
334k
{
64
334k
  return (uint32_t) p[0] |
65
334k
         ((uint32_t) p[1] << 8) |
66
334k
         ((uint32_t) p[2] << 16) |
67
334k
         ((uint32_t) p[3] << 24);
68
334k
}
hb-shape-fuzzer.cc:_fuzzing_read_u32_le(unsigned char const*)
Line
Count
Source
63
15.1k
{
64
15.1k
  return (uint32_t) p[0] |
65
15.1k
         ((uint32_t) p[1] << 8) |
66
15.1k
         ((uint32_t) p[2] << 16) |
67
15.1k
         ((uint32_t) p[3] << 24);
68
15.1k
}
hb-raster-fuzzer.cc:_fuzzing_read_u32_le(unsigned char const*)
Line
Count
Source
63
15.0k
{
64
15.0k
  return (uint32_t) p[0] |
65
15.0k
         ((uint32_t) p[1] << 8) |
66
15.0k
         ((uint32_t) p[2] << 16) |
67
15.0k
         ((uint32_t) p[3] << 24);
68
15.0k
}
Unexecuted instantiation: hb-repacker-fuzzer.cc:_fuzzing_read_u32_le(unsigned char const*)
hb-gpu-fuzzer.cc:_fuzzing_read_u32_le(unsigned char const*)
Line
Count
Source
63
220k
{
64
220k
  return (uint32_t) p[0] |
65
220k
         ((uint32_t) p[1] << 8) |
66
220k
         ((uint32_t) p[2] << 16) |
67
220k
         ((uint32_t) p[3] << 24);
68
220k
}
hb-subset-fuzzer.cc:_fuzzing_read_u32_le(unsigned char const*)
Line
Count
Source
63
72.7k
{
64
72.7k
  return (uint32_t) p[0] |
65
72.7k
         ((uint32_t) p[1] << 8) |
66
72.7k
         ((uint32_t) p[2] << 16) |
67
72.7k
         ((uint32_t) p[3] << 24);
68
72.7k
}
hb-vector-fuzzer.cc:_fuzzing_read_u32_le(unsigned char const*)
Line
Count
Source
63
11.4k
{
64
11.4k
  return (uint32_t) p[0] |
65
11.4k
         ((uint32_t) p[1] << 8) |
66
11.4k
         ((uint32_t) p[2] << 16) |
67
11.4k
         ((uint32_t) p[3] << 24);
68
11.4k
}
69
70
static inline float
71
_fuzzing_read_f32_le (const uint8_t *p)
72
112k
{
73
112k
  uint32_t bits = _fuzzing_read_u32_le (p);
74
112k
  float value;
75
112k
  memcpy (&value, &bits, sizeof (value));
76
112k
  return value;
77
112k
}
hb-shape-fuzzer.cc:_fuzzing_read_f32_le(unsigned char const*)
Line
Count
Source
72
8.04k
{
73
8.04k
  uint32_t bits = _fuzzing_read_u32_le (p);
74
8.04k
  float value;
75
8.04k
  memcpy (&value, &bits, sizeof (value));
76
8.04k
  return value;
77
8.04k
}
hb-raster-fuzzer.cc:_fuzzing_read_f32_le(unsigned char const*)
Line
Count
Source
72
5.98k
{
73
5.98k
  uint32_t bits = _fuzzing_read_u32_le (p);
74
5.98k
  float value;
75
5.98k
  memcpy (&value, &bits, sizeof (value));
76
5.98k
  return value;
77
5.98k
}
Unexecuted instantiation: hb-repacker-fuzzer.cc:_fuzzing_read_f32_le(unsigned char const*)
hb-gpu-fuzzer.cc:_fuzzing_read_f32_le(unsigned char const*)
Line
Count
Source
72
82.9k
{
73
82.9k
  uint32_t bits = _fuzzing_read_u32_le (p);
74
82.9k
  float value;
75
82.9k
  memcpy (&value, &bits, sizeof (value));
76
82.9k
  return value;
77
82.9k
}
hb-subset-fuzzer.cc:_fuzzing_read_f32_le(unsigned char const*)
Line
Count
Source
72
10.8k
{
73
10.8k
  uint32_t bits = _fuzzing_read_u32_le (p);
74
10.8k
  float value;
75
10.8k
  memcpy (&value, &bits, sizeof (value));
76
10.8k
  return value;
77
10.8k
}
hb-vector-fuzzer.cc:_fuzzing_read_f32_le(unsigned char const*)
Line
Count
Source
72
4.67k
{
73
4.67k
  uint32_t bits = _fuzzing_read_u32_le (p);
74
4.67k
  float value;
75
4.67k
  memcpy (&value, &bits, sizeof (value));
76
4.67k
  return value;
77
4.67k
}
78
79
template <typename T>
80
static inline bool
81
_fuzzing_read_value (const uint8_t *&p,
82
                     const uint8_t *end,
83
                     T *out)
84
69.2k
{
85
69.2k
  if ((size_t) (end - p) < sizeof (T))
86
62
    return false;
87
88
69.1k
  memcpy (out, p, sizeof (T));
89
69.1k
  p += sizeof (T);
90
69.1k
  return true;
91
69.2k
}
hb-shape-fuzzer.cc:bool _fuzzing_read_value<unsigned char>(unsigned char const*&, unsigned char const*, unsigned char*)
Line
Count
Source
84
14.4k
{
85
14.4k
  if ((size_t) (end - p) < sizeof (T))
86
16
    return false;
87
88
14.4k
  memcpy (out, p, sizeof (T));
89
14.4k
  p += sizeof (T);
90
14.4k
  return true;
91
14.4k
}
hb-raster-fuzzer.cc:bool _fuzzing_read_value<unsigned char>(unsigned char const*&, unsigned char const*, unsigned char*)
Line
Count
Source
84
5.42k
{
85
5.42k
  if ((size_t) (end - p) < sizeof (T))
86
10
    return false;
87
88
5.41k
  memcpy (out, p, sizeof (T));
89
5.41k
  p += sizeof (T);
90
5.41k
  return true;
91
5.42k
}
hb-gpu-fuzzer.cc:bool _fuzzing_read_value<unsigned char>(unsigned char const*&, unsigned char const*, unsigned char*)
Line
Count
Source
84
30.9k
{
85
30.9k
  if ((size_t) (end - p) < sizeof (T))
86
19
    return false;
87
88
30.9k
  memcpy (out, p, sizeof (T));
89
30.9k
  p += sizeof (T);
90
30.9k
  return true;
91
30.9k
}
hb-subset-fuzzer.cc:bool _fuzzing_read_value<unsigned char>(unsigned char const*&, unsigned char const*, unsigned char*)
Line
Count
Source
84
13.0k
{
85
13.0k
  if ((size_t) (end - p) < sizeof (T))
86
4
    return false;
87
88
13.0k
  memcpy (out, p, sizeof (T));
89
13.0k
  p += sizeof (T);
90
13.0k
  return true;
91
13.0k
}
hb-vector-fuzzer.cc:bool _fuzzing_read_value<unsigned char>(unsigned char const*&, unsigned char const*, unsigned char*)
Line
Count
Source
84
5.32k
{
85
5.32k
  if ((size_t) (end - p) < sizeof (T))
86
13
    return false;
87
88
5.31k
  memcpy (out, p, sizeof (T));
89
5.31k
  p += sizeof (T);
90
5.31k
  return true;
91
5.32k
}
92
93
static inline bool
94
_fuzzing_read_u32_value (const uint8_t *&p,
95
                         const uint8_t *end,
96
                         uint32_t *out)
97
216k
{
98
216k
  if ((size_t) (end - p) < 4)
99
822
    return false;
100
216k
  *out = _fuzzing_read_u32_le (p);
101
216k
  p += 4;
102
216k
  return true;
103
216k
}
hb-shape-fuzzer.cc:_fuzzing_read_u32_value(unsigned char const*&, unsigned char const*, unsigned int*)
Line
Count
Source
97
6.70k
{
98
6.70k
  if ((size_t) (end - p) < 4)
99
117
    return false;
100
6.58k
  *out = _fuzzing_read_u32_le (p);
101
6.58k
  p += 4;
102
6.58k
  return true;
103
6.70k
}
hb-raster-fuzzer.cc:_fuzzing_read_u32_value(unsigned char const*&, unsigned char const*, unsigned int*)
Line
Count
Source
97
8.21k
{
98
8.21k
  if ((size_t) (end - p) < 4)
99
164
    return false;
100
8.05k
  *out = _fuzzing_read_u32_le (p);
101
8.05k
  p += 4;
102
8.05k
  return true;
103
8.21k
}
Unexecuted instantiation: hb-repacker-fuzzer.cc:_fuzzing_read_u32_value(unsigned char const*&, unsigned char const*, unsigned int*)
hb-gpu-fuzzer.cc:_fuzzing_read_u32_value(unsigned char const*&, unsigned char const*, unsigned int*)
Line
Count
Source
97
136k
{
98
136k
  if ((size_t) (end - p) < 4)
99
241
    return false;
100
136k
  *out = _fuzzing_read_u32_le (p);
101
136k
  p += 4;
102
136k
  return true;
103
136k
}
hb-subset-fuzzer.cc:_fuzzing_read_u32_value(unsigned char const*&, unsigned char const*, unsigned int*)
Line
Count
Source
97
58.8k
{
98
58.8k
  if ((size_t) (end - p) < 4)
99
125
    return false;
100
58.7k
  *out = _fuzzing_read_u32_le (p);
101
58.7k
  p += 4;
102
58.7k
  return true;
103
58.8k
}
hb-vector-fuzzer.cc:_fuzzing_read_u32_value(unsigned char const*&, unsigned char const*, unsigned int*)
Line
Count
Source
97
6.37k
{
98
6.37k
  if ((size_t) (end - p) < 4)
99
175
    return false;
100
6.20k
  *out = _fuzzing_read_u32_le (p);
101
6.20k
  p += 4;
102
6.20k
  return true;
103
6.37k
}
104
105
static inline bool
106
_fuzzing_read_f32_value (const uint8_t *&p,
107
                         const uint8_t *end,
108
                         float *out)
109
112k
{
110
112k
  if ((size_t) (end - p) < 4)
111
213
    return false;
112
112k
  *out = _fuzzing_read_f32_le (p);
113
112k
  p += 4;
114
112k
  return true;
115
112k
}
hb-shape-fuzzer.cc:_fuzzing_read_f32_value(unsigned char const*&, unsigned char const*, float*)
Line
Count
Source
109
8.08k
{
110
8.08k
  if ((size_t) (end - p) < 4)
111
44
    return false;
112
8.04k
  *out = _fuzzing_read_f32_le (p);
113
8.04k
  p += 4;
114
8.04k
  return true;
115
8.08k
}
hb-raster-fuzzer.cc:_fuzzing_read_f32_value(unsigned char const*&, unsigned char const*, float*)
Line
Count
Source
109
6.03k
{
110
6.03k
  if ((size_t) (end - p) < 4)
111
50
    return false;
112
5.98k
  *out = _fuzzing_read_f32_le (p);
113
5.98k
  p += 4;
114
5.98k
  return true;
115
6.03k
}
Unexecuted instantiation: hb-repacker-fuzzer.cc:_fuzzing_read_f32_value(unsigned char const*&, unsigned char const*, float*)
hb-gpu-fuzzer.cc:_fuzzing_read_f32_value(unsigned char const*&, unsigned char const*, float*)
Line
Count
Source
109
83.0k
{
110
83.0k
  if ((size_t) (end - p) < 4)
111
61
    return false;
112
82.9k
  *out = _fuzzing_read_f32_le (p);
113
82.9k
  p += 4;
114
82.9k
  return true;
115
83.0k
}
hb-subset-fuzzer.cc:_fuzzing_read_f32_value(unsigned char const*&, unsigned char const*, float*)
Line
Count
Source
109
10.8k
{
110
10.8k
  if ((size_t) (end - p) < 4)
111
10
    return false;
112
10.8k
  *out = _fuzzing_read_f32_le (p);
113
10.8k
  p += 4;
114
10.8k
  return true;
115
10.8k
}
hb-vector-fuzzer.cc:_fuzzing_read_f32_value(unsigned char const*&, unsigned char const*, float*)
Line
Count
Source
109
4.72k
{
110
4.72k
  if ((size_t) (end - p) < 4)
111
48
    return false;
112
4.67k
  *out = _fuzzing_read_f32_le (p);
113
4.67k
  p += 4;
114
4.67k
  return true;
115
4.72k
}