/src/libjpeg-turbo.main/fuzz/compress_yuv.cc
Line | Count | Source |
1 | | /* |
2 | | * Copyright (C)2021-2026 D. R. Commander. All Rights Reserved. |
3 | | * Copyright (C)2025 Leslie P. Polzer. All Rights Reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions are met: |
7 | | * |
8 | | * - Redistributions of source code must retain the above copyright notice, |
9 | | * this list of conditions and the following disclaimer. |
10 | | * - Redistributions in binary form must reproduce the above copyright notice, |
11 | | * this list of conditions and the following disclaimer in the documentation |
12 | | * and/or other materials provided with the distribution. |
13 | | * - Neither the name of the libjpeg-turbo Project nor the names of its |
14 | | * contributors may be used to endorse or promote products derived from this |
15 | | * software without specific prior written permission. |
16 | | * |
17 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS", |
18 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
19 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
20 | | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE |
21 | | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
22 | | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
23 | | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
24 | | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
25 | | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
26 | | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
27 | | * POSSIBILITY OF SUCH DAMAGE. |
28 | | */ |
29 | | |
30 | | #include "../src/turbojpeg.h" |
31 | | #include <stdio.h> |
32 | | #include <stdlib.h> |
33 | | #include <stdint.h> |
34 | | #include <string.h> |
35 | | #include <unistd.h> |
36 | | |
37 | | extern "C" unsigned char * |
38 | | _tj3LoadImageFromFileHandle8(tjhandle handle, FILE *file, int *width, |
39 | | int align, int *height, int *pixelFormat); |
40 | | |
41 | | |
42 | 20.3k | #define NUMTESTS 6 |
43 | | |
44 | | |
45 | | struct test { |
46 | | int bottomUp; |
47 | | enum TJPF pf; |
48 | | enum TJSAMP subsamp; |
49 | | int fastDCT, quality, optimize, progressive, arithmetic, restartBlocks; |
50 | | }; |
51 | | |
52 | | |
53 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
54 | 2.91k | { |
55 | 2.91k | tjhandle handle = NULL; |
56 | 2.91k | unsigned char *imgBuf = NULL, *srcBuf, *dstBuf = NULL, *yuvBuf = NULL; |
57 | 2.91k | int width = 0, height = 0, ti; |
58 | 2.91k | FILE *file = NULL; |
59 | 2.91k | struct test tests[NUMTESTS] = { |
60 | | /* |
61 | | BU Pixel Subsampling Fst Qual Opt Prg Ari Rst |
62 | | Format Level DCT Blks */ |
63 | 2.91k | { 0, TJPF_XBGR, TJSAMP_444, 1, 100, 0, 0, 0, 0 }, |
64 | 2.91k | { 0, TJPF_XRGB, TJSAMP_422, 0, 90, 0, 1, 0, 4 }, |
65 | 2.91k | { 0, TJPF_BGR, TJSAMP_420, 0, 75, 0, 0, 0, 0 }, |
66 | 2.91k | { 0, TJPF_RGB, TJSAMP_411, 0, 50, 1, 0, 0, 0 }, |
67 | 2.91k | { 0, TJPF_BGR, TJSAMP_GRAY, 0, 25, 0, 0, 1, 0 }, |
68 | 2.91k | { 1, TJPF_GRAY, TJSAMP_GRAY, 1, 10, 0, 1, 1, 4 } |
69 | 2.91k | }; |
70 | | |
71 | 2.91k | if ((file = fmemopen((void *)data, size, "r")) == NULL) |
72 | 0 | goto bailout; |
73 | | |
74 | 2.91k | if ((handle = tj3Init(TJINIT_COMPRESS)) == NULL) |
75 | 0 | goto bailout; |
76 | | |
77 | 20.3k | for (ti = 0; ti < NUMTESTS; ti++) { |
78 | 17.4k | int pf = tests[ti].pf; |
79 | 17.4k | size_t dstSize = 0, maxBufSize, i, sum = 0; |
80 | | |
81 | | /* Test non-default compression options on specific iterations. */ |
82 | 17.4k | tj3Set(handle, TJPARAM_BOTTOMUP, tests[ti].bottomUp); |
83 | 17.4k | tj3Set(handle, TJPARAM_FASTDCT, tests[ti].fastDCT); |
84 | 17.4k | tj3Set(handle, TJPARAM_OPTIMIZE, tests[ti].optimize); |
85 | 17.4k | tj3Set(handle, TJPARAM_PROGRESSIVE, tests[ti].progressive); |
86 | 17.4k | tj3Set(handle, TJPARAM_ARITHMETIC, tests[ti].arithmetic); |
87 | 17.4k | tj3Set(handle, TJPARAM_NOREALLOC, 1); |
88 | 17.4k | tj3Set(handle, TJPARAM_RESTARTBLOCKS, tests[ti].restartBlocks); |
89 | | |
90 | 17.4k | tj3Set(handle, TJPARAM_MAXPIXELS, 1048576); |
91 | | /* tj3LoadImage8() will refuse to load images larger than 1 Megapixel, so |
92 | | we don't need to check the width and height here. */ |
93 | 17.4k | fseek(file, 0, SEEK_SET); |
94 | 17.4k | if ((imgBuf = _tj3LoadImageFromFileHandle8(handle, file, &width, 1, |
95 | 17.4k | &height, &pf)) == NULL) { |
96 | 9.68k | if (size < 2) |
97 | 96 | continue; |
98 | | |
99 | | /* Derive image dimensions from input data. Use first 2 bytes to |
100 | | influence width/height. These must be multiples of the maximum iMCU |
101 | | size for the subsampling levels we plan to test. */ |
102 | 9.59k | width = ((data[0] % 4) + 1) * 32; /* 32-128, multiple of 32 */ |
103 | 9.59k | height = ((data[1] % 8) + 1) * 16; /* 16-128, multiple of 16 */ |
104 | | |
105 | 9.59k | size_t required_size = 2 + (size_t)width * height * |
106 | 9.59k | tjPixelSize[tests[ti].pf]; |
107 | 9.59k | if (size < required_size) { |
108 | | /* Not enough data - try smaller dimensions */ |
109 | 9.30k | width = 32; |
110 | 9.30k | height = 16; |
111 | 9.30k | required_size = 2 + (size_t)width * height * |
112 | 9.30k | tjPixelSize[tests[ti].pf]; |
113 | 9.30k | if (size < required_size) |
114 | 9.05k | continue; |
115 | 9.30k | } |
116 | | |
117 | | /* Skip header bytes. */ |
118 | 538 | srcBuf = (unsigned char *)data + 2; |
119 | 538 | } else |
120 | 7.79k | srcBuf = imgBuf; |
121 | | |
122 | 8.33k | dstSize = maxBufSize = tj3JPEGBufSize(width, height, tests[ti].subsamp); |
123 | 8.33k | if ((dstBuf = (unsigned char *)tj3Alloc(dstSize)) == NULL) |
124 | 0 | goto bailout; |
125 | 8.33k | if ((yuvBuf = |
126 | 8.33k | (unsigned char *)malloc(tj3YUVBufSize(width, 1, height, |
127 | 8.33k | tests[ti].subsamp))) == NULL) |
128 | 0 | goto bailout; |
129 | | |
130 | 8.33k | tj3Set(handle, TJPARAM_SUBSAMP, tests[ti].subsamp); |
131 | 8.33k | tj3Set(handle, TJPARAM_QUALITY, tests[ti].quality); |
132 | 8.33k | if (tj3EncodeYUV8(handle, srcBuf, width, 0, height, pf, yuvBuf, 1) == 0 && |
133 | 8.27k | tj3CompressFromYUV8(handle, yuvBuf, width, 1, height, &dstBuf, |
134 | 8.27k | &dstSize) == 0) { |
135 | | /* Touch all of the output data in order to catch uninitialized reads |
136 | | when using MemorySanitizer. */ |
137 | 144M | for (i = 0; i < dstSize; i++) |
138 | 144M | sum += dstBuf[i]; |
139 | 8.27k | } |
140 | | |
141 | 8.33k | tj3Free(dstBuf); |
142 | 8.33k | dstBuf = NULL; |
143 | 8.33k | free(yuvBuf); |
144 | 8.33k | yuvBuf = NULL; |
145 | 8.33k | tj3Free(imgBuf); |
146 | 8.33k | imgBuf = NULL; |
147 | | |
148 | | /* Prevent the sum above from being optimized out. This test should never |
149 | | be true, but the compiler doesn't know that. */ |
150 | 8.33k | if (sum > 255 * maxBufSize) |
151 | 0 | goto bailout; |
152 | 8.33k | } |
153 | | |
154 | 2.91k | bailout: |
155 | 2.91k | tj3Free(dstBuf); |
156 | 2.91k | free(yuvBuf); |
157 | 2.91k | tj3Free(imgBuf); |
158 | 2.91k | if (file) fclose(file); |
159 | 2.91k | tj3Destroy(handle); |
160 | 2.91k | return 0; |
161 | 2.91k | } |