/src/libjpeg-turbo.3.0.x/fuzz/compress.cc
Line | Count | Source |
1 | | /* |
2 | | * Copyright (C)2021, 2023-2026 D. R. Commander. All Rights Reserved. |
3 | | * |
4 | | * Redistribution and use in source and binary forms, with or without |
5 | | * modification, are permitted provided that the following conditions are met: |
6 | | * |
7 | | * - Redistributions of source code must retain the above copyright notice, |
8 | | * this list of conditions and the following disclaimer. |
9 | | * - Redistributions in binary form must reproduce the above copyright notice, |
10 | | * this list of conditions and the following disclaimer in the documentation |
11 | | * and/or other materials provided with the distribution. |
12 | | * - Neither the name of the libjpeg-turbo Project nor the names of its |
13 | | * contributors may be used to endorse or promote products derived from this |
14 | | * software without specific prior written permission. |
15 | | * |
16 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS", |
17 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
18 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
19 | | * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE |
20 | | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
21 | | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
22 | | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
23 | | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
24 | | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
25 | | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
26 | | * POSSIBILITY OF SUCH DAMAGE. |
27 | | */ |
28 | | |
29 | | #include "../turbojpeg.h" |
30 | | #include <stdio.h> |
31 | | #include <stdlib.h> |
32 | | #include <stdint.h> |
33 | | #include <string.h> |
34 | | #include <unistd.h> |
35 | | |
36 | | extern "C" unsigned char * |
37 | | _tj3LoadImageFromFileHandle8(tjhandle handle, FILE *file, int *width, |
38 | | int align, int *height, int *pixelFormat); |
39 | | |
40 | | |
41 | 30.8k | #define NUMTESTS 7 |
42 | | |
43 | | |
44 | | struct test { |
45 | | enum TJPF pf; |
46 | | enum TJSAMP subsamp; |
47 | | int quality; |
48 | | }; |
49 | | |
50 | | |
51 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
52 | 3.85k | { |
53 | 3.85k | tjhandle handle = NULL; |
54 | 3.85k | unsigned char *srcBuf = NULL, *dstBuf = NULL; |
55 | 3.85k | int width = 0, height = 0, ti; |
56 | 3.85k | FILE *file = NULL; |
57 | 3.85k | struct test tests[NUMTESTS] = { |
58 | 3.85k | { TJPF_RGB, TJSAMP_444, 100 }, |
59 | 3.85k | { TJPF_BGR, TJSAMP_422, 90 }, |
60 | 3.85k | { TJPF_RGBX, TJSAMP_420, 80 }, |
61 | 3.85k | { TJPF_BGRA, TJSAMP_411, 70 }, |
62 | 3.85k | { TJPF_XRGB, TJSAMP_GRAY, 60 }, |
63 | 3.85k | { TJPF_GRAY, TJSAMP_GRAY, 50 }, |
64 | 3.85k | { TJPF_CMYK, TJSAMP_440, 40 } |
65 | 3.85k | }; |
66 | | |
67 | 3.85k | if ((file = fmemopen((void *)data, size, "r")) == NULL) |
68 | 0 | goto bailout; |
69 | | |
70 | 3.85k | if ((handle = tj3Init(TJINIT_COMPRESS)) == NULL) |
71 | 0 | goto bailout; |
72 | | |
73 | 30.8k | for (ti = 0; ti < NUMTESTS; ti++) { |
74 | 27.0k | int pf = tests[ti].pf; |
75 | 27.0k | size_t dstSize = 0, maxBufSize, i, sum = 0; |
76 | | |
77 | | /* Test non-default compression options on specific iterations. */ |
78 | 27.0k | tj3Set(handle, TJPARAM_BOTTOMUP, ti == 0); |
79 | 27.0k | tj3Set(handle, TJPARAM_FASTDCT, ti == 1); |
80 | 27.0k | tj3Set(handle, TJPARAM_OPTIMIZE, ti == 6); |
81 | 27.0k | tj3Set(handle, TJPARAM_PROGRESSIVE, ti == 1 || ti == 3); |
82 | 27.0k | tj3Set(handle, TJPARAM_ARITHMETIC, ti == 2 || ti == 3); |
83 | 27.0k | tj3Set(handle, TJPARAM_NOREALLOC, ti != 2); |
84 | 27.0k | tj3Set(handle, TJPARAM_RESTARTROWS, ti == 1 || ti == 2 ? 2 : 0); |
85 | | |
86 | 27.0k | tj3Set(handle, TJPARAM_MAXPIXELS, 1048576); |
87 | | /* tj3LoadImage8() will refuse to load images larger than 1 Megapixel, so |
88 | | we don't need to check the width and height here. */ |
89 | 27.0k | fseek(file, 0, SEEK_SET); |
90 | 27.0k | if ((srcBuf = _tj3LoadImageFromFileHandle8(handle, file, &width, 1, |
91 | 27.0k | &height, &pf)) == NULL) |
92 | 13.0k | continue; |
93 | | |
94 | 13.9k | maxBufSize = tj3JPEGBufSize(width, height, tests[ti].subsamp); |
95 | 13.9k | if (tj3Get(handle, TJPARAM_NOREALLOC)) { |
96 | 11.8k | if ((dstBuf = (unsigned char *)tj3Alloc(maxBufSize)) == NULL) |
97 | 0 | goto bailout; |
98 | 11.8k | } else |
99 | 2.04k | dstBuf = NULL; |
100 | | |
101 | 13.9k | tj3Set(handle, TJPARAM_SUBSAMP, tests[ti].subsamp); |
102 | 13.9k | tj3Set(handle, TJPARAM_QUALITY, tests[ti].quality); |
103 | 13.9k | if (tj3Compress8(handle, srcBuf, width, 0, height, pf, &dstBuf, |
104 | 13.9k | &dstSize) == 0) { |
105 | | /* Touch all of the output data in order to catch uninitialized reads |
106 | | when using MemorySanitizer. */ |
107 | 130M | for (i = 0; i < dstSize; i++) |
108 | 130M | sum += dstBuf[i]; |
109 | 13.8k | } |
110 | | |
111 | 13.9k | tj3Free(dstBuf); |
112 | 13.9k | dstBuf = NULL; |
113 | 13.9k | tj3Free(srcBuf); |
114 | 13.9k | srcBuf = NULL; |
115 | | |
116 | | /* Prevent the sum above from being optimized out. This test should never |
117 | | be true, but the compiler doesn't know that. */ |
118 | 13.9k | if (sum > 255 * maxBufSize) |
119 | 0 | goto bailout; |
120 | 13.9k | } |
121 | | |
122 | 3.85k | bailout: |
123 | 3.85k | tj3Free(dstBuf); |
124 | 3.85k | tj3Free(srcBuf); |
125 | 3.85k | if (file) fclose(file); |
126 | 3.85k | tj3Destroy(handle); |
127 | 3.85k | return 0; |
128 | 3.85k | } |