Coverage Report

Created: 2025-08-26 06:15

/src/cms_transform_fuzzer.c
Line
Count
Source (jump to first uncovered line)
1
// Copyright 2016 The PDFium Authors. All rights reserved.
2
// Use of this source code is governed by a BSD-style license that can be
3
// found in the LICENSE file.
4
#include <stdint.h>
5
6
#include "lcms2.h"
7
8
4.75k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
9
4.75k
  cmsHPROFILE srcProfile = cmsOpenProfileFromMem(data, size);
10
4.75k
  if (!srcProfile) return 0;
11
12
4.13k
  cmsHPROFILE dstProfile = cmsCreate_sRGBProfile();
13
4.13k
  if (!dstProfile) {
14
0
    cmsCloseProfile(srcProfile);
15
0
    return 0;
16
0
  }
17
18
4.13k
  cmsColorSpaceSignature srcCS = cmsGetColorSpace(srcProfile);
19
4.13k
  cmsUInt32Number nSrcComponents = cmsChannelsOf(srcCS);
20
4.13k
  cmsUInt32Number srcFormat;
21
4.13k
  if (srcCS == cmsSigLabData) {
22
257
    srcFormat =
23
257
        COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0);
24
3.87k
  } else {
25
3.87k
    srcFormat =
26
3.87k
        COLORSPACE_SH(PT_ANY) | CHANNELS_SH(nSrcComponents) | BYTES_SH(1);
27
3.87k
  }
28
29
4.13k
  cmsUInt32Number intent = 0;
30
4.13k
  cmsUInt32Number flags = 0;
31
4.13k
  cmsHTRANSFORM hTransform = cmsCreateTransform(
32
4.13k
      srcProfile, srcFormat, dstProfile, TYPE_BGR_8, intent, flags);
33
4.13k
  cmsCloseProfile(srcProfile);
34
4.13k
  cmsCloseProfile(dstProfile);
35
4.13k
  if (!hTransform) return 0;
36
37
474
  uint8_t output[4];
38
474
  if (T_BYTES(srcFormat) == 0) {  // 0 means double
39
0
    double input[nSrcComponents];
40
0
    for (uint32_t i = 0; i < nSrcComponents; i++) input[i] = 0.5f;
41
0
    cmsDoTransform(hTransform, input, output, 1);
42
474
  } else {
43
474
    uint8_t input[nSrcComponents];
44
2.44k
    for (uint32_t i = 0; i < nSrcComponents; i++) input[i] = 128;
45
474
    cmsDoTransform(hTransform, input, output, 1);
46
474
  }
47
474
  cmsDeleteTransform(hTransform);
48
49
474
  return 0;
50
4.13k
}