Coverage Report

Created: 2025-07-11 06:48

/src/cms_transform_fuzzer.c
Line
Count
Source (jump to first uncovered line)
1
// Copyright 2016 The PDFium Authors. All rights reserved.
2
// Use of this source code is governed by a BSD-style license that can be
3
// found in the LICENSE file.
4
#include <stdint.h>
5
6
#include "lcms2.h"
7
8
4.87k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
9
4.87k
  cmsHPROFILE srcProfile = cmsOpenProfileFromMem(data, size);
10
4.87k
  if (!srcProfile) return 0;
11
12
4.25k
  cmsHPROFILE dstProfile = cmsCreate_sRGBProfile();
13
4.25k
  if (!dstProfile) {
14
0
    cmsCloseProfile(srcProfile);
15
0
    return 0;
16
0
  }
17
18
4.25k
  cmsColorSpaceSignature srcCS = cmsGetColorSpace(srcProfile);
19
4.25k
  cmsUInt32Number nSrcComponents = cmsChannelsOf(srcCS);
20
4.25k
  cmsUInt32Number srcFormat;
21
4.25k
  if (srcCS == cmsSigLabData) {
22
231
    srcFormat =
23
231
        COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0);
24
4.02k
  } else {
25
4.02k
    srcFormat =
26
4.02k
        COLORSPACE_SH(PT_ANY) | CHANNELS_SH(nSrcComponents) | BYTES_SH(1);
27
4.02k
  }
28
29
4.25k
  cmsUInt32Number intent = 0;
30
4.25k
  cmsUInt32Number flags = 0;
31
4.25k
  cmsHTRANSFORM hTransform = cmsCreateTransform(
32
4.25k
      srcProfile, srcFormat, dstProfile, TYPE_BGR_8, intent, flags);
33
4.25k
  cmsCloseProfile(srcProfile);
34
4.25k
  cmsCloseProfile(dstProfile);
35
4.25k
  if (!hTransform) return 0;
36
37
478
  uint8_t output[4];
38
478
  if (T_BYTES(srcFormat) == 0) {  // 0 means double
39
0
    double input[nSrcComponents];
40
0
    for (uint32_t i = 0; i < nSrcComponents; i++) input[i] = 0.5f;
41
0
    cmsDoTransform(hTransform, input, output, 1);
42
478
  } else {
43
478
    uint8_t input[nSrcComponents];
44
2.58k
    for (uint32_t i = 0; i < nSrcComponents; i++) input[i] = 128;
45
478
    cmsDoTransform(hTransform, input, output, 1);
46
478
  }
47
478
  cmsDeleteTransform(hTransform);
48
49
478
  return 0;
50
4.25k
}