/src/image-png/fuzz/fuzz_targets/decode.rs
Line | Count | Source |
1 | | #![no_main] |
2 | | |
3 | | use libfuzzer_sys::fuzz_target; |
4 | | use std::io::Cursor; |
5 | | |
6 | | #[inline(always)] |
7 | 8.27k | fn png_decode(data: &[u8]) -> Result<(Option<png::OutputInfo>, Vec<u8>), ()> { |
8 | 8.27k | let limits = png::Limits { bytes: 1 << 16 }; |
9 | 8.27k | let decoder = png::Decoder::new_with_limits(Cursor::new(data), limits); |
10 | 8.27k | let mut reader = decoder.read_info().map_err(|_| ())?; |
11 | | |
12 | 4.49k | if reader.info().raw_bytes() > 5_000_000 { |
13 | 51 | return Err(()); |
14 | 4.44k | } |
15 | | |
16 | 4.44k | let mut img_data = vec![0u8; reader.info().raw_bytes()]; |
17 | | |
18 | 4.44k | let mut last_info = None; |
19 | 6.31k | while let Ok(info) = reader.next_frame(&mut img_data) { |
20 | 1.87k | last_info = Some(info); |
21 | 1.87k | } |
22 | | |
23 | 4.44k | Ok((last_info, img_data)) |
24 | 8.27k | } |
25 | | |
26 | | fuzz_target!(|data: &[u8]| { |
27 | | let _ = png_decode(&data); |
28 | | }); |