/src/libjxl/tools/transforms_fuzzer.cc
Line | Count | Source (jump to first uncovered line) |
1 | | // Copyright (c) the JPEG XL Project Authors. All rights reserved. |
2 | | // |
3 | | // Use of this source code is governed by a BSD-style |
4 | | // license that can be found in the LICENSE file. |
5 | | |
6 | | #include <jxl/memory_manager.h> |
7 | | |
8 | | #include <algorithm> |
9 | | #include <cstddef> |
10 | | #include <cstdint> |
11 | | #include <vector> |
12 | | |
13 | | #include "lib/jxl/base/bits.h" |
14 | | #include "lib/jxl/base/common.h" |
15 | | #include "lib/jxl/base/compiler_specific.h" |
16 | | #include "lib/jxl/base/random.h" |
17 | | #include "lib/jxl/base/span.h" |
18 | | #include "lib/jxl/base/status.h" |
19 | | #include "lib/jxl/dec_bit_reader.h" |
20 | | #include "lib/jxl/fields.h" |
21 | | #include "lib/jxl/fuzztest.h" |
22 | | #include "lib/jxl/modular/encoding/encoding.h" |
23 | | #include "lib/jxl/modular/modular_image.h" |
24 | | #include "lib/jxl/modular/options.h" |
25 | | #include "lib/jxl/modular/transform/transform.h" |
26 | | #include "tools/tracking_memory_manager.h" |
27 | | |
28 | | namespace { |
29 | | |
30 | | using ::jpegxl::tools::kGiB; |
31 | | using ::jpegxl::tools::TrackingMemoryManager; |
32 | | using ::jxl::BitReader; |
33 | | using ::jxl::BitReaderScopedCloser; |
34 | | using ::jxl::Bytes; |
35 | | using ::jxl::Channel; |
36 | | using ::jxl::GroupHeader; |
37 | | using ::jxl::Image; |
38 | | using ::jxl::ModularOptions; |
39 | | using ::jxl::pixel_type; |
40 | | using ::jxl::Rng; |
41 | | using ::jxl::Status; |
42 | | using ::jxl::Transform; |
43 | | using ::jxl::weighted::Header; |
44 | | |
45 | 118k | void FillChannel(Channel& ch, Rng& rng) { |
46 | 118k | auto* p = &ch.plane; |
47 | 118k | const size_t w = ch.w; |
48 | 118k | const size_t h = ch.h; |
49 | 143M | for (size_t y = 0; y < h; ++y) { |
50 | 143M | pixel_type* row = p->Row(y); |
51 | 3.24G | for (size_t x = 0; x < w; ++x) { |
52 | 3.10G | row[x] = rng.UniformU(0, 0x80000000); |
53 | 3.10G | } |
54 | 143M | } |
55 | 118k | } |
56 | | |
57 | 28.7k | void Check(bool ok) { |
58 | 28.7k | if (!ok) { |
59 | 0 | JXL_CRASH(); |
60 | 0 | } |
61 | 28.7k | } |
62 | | |
63 | 2.31k | void Run(BitReader& reader, JxlMemoryManager* memory_manager) { |
64 | 2.31k | Rng rng(reader.ReadFixedBits<56>()); |
65 | | |
66 | | // One of {0, 1, _2_, 3}; "2" will be filtered out soon. |
67 | 2.31k | size_t nb_chans = static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x3; |
68 | 2.31k | size_t nb_extra = static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x7; |
69 | | // 1..32 |
70 | 2.31k | size_t bit_depth = |
71 | 2.31k | (static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x1F) + 1; |
72 | | // {0, 1, 2, 3} |
73 | 2.31k | size_t log_upsampling = |
74 | 2.31k | (static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x3); |
75 | 2.31k | size_t upsampling = 1 << log_upsampling; |
76 | | |
77 | 2.31k | size_t w_orig = static_cast<size_t>(reader.ReadFixedBits<16>()); |
78 | 2.31k | size_t h_orig = static_cast<size_t>(reader.ReadFixedBits<16>()); |
79 | 2.31k | size_t w = jxl::DivCeil(w_orig, upsampling); |
80 | 2.31k | size_t h = jxl::DivCeil(h_orig, upsampling); |
81 | | |
82 | 2.31k | if ((nb_chans == 2) || ((nb_chans + nb_extra) == 0) || (w * h == 0) || |
83 | 2.31k | ((w_orig * h_orig * (nb_chans + nb_extra)) > (1 << 23))) { |
84 | 47 | return; |
85 | 47 | } |
86 | | |
87 | 2.26k | std::vector<int> hshift; |
88 | 2.26k | std::vector<int> vshift; |
89 | 2.26k | std::vector<size_t> ec_upsampling; |
90 | | |
91 | 2.68k | for (size_t c = 0; c < nb_chans; c++) { |
92 | 418 | hshift.push_back(static_cast<int>(reader.ReadFixedBits<8>()) & 1); |
93 | 418 | vshift.push_back(static_cast<int>(reader.ReadFixedBits<8>()) & 1); |
94 | 418 | } |
95 | | |
96 | 7.49k | for (size_t ec = 0; ec < nb_extra; ec++) { |
97 | 5.23k | size_t log_ec_upsampling = |
98 | 5.23k | (static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x3); |
99 | 5.23k | log_ec_upsampling = std::max(log_ec_upsampling, log_upsampling); |
100 | 5.23k | ec_upsampling.push_back(1 << log_ec_upsampling); |
101 | 5.23k | } |
102 | | |
103 | 2.26k | Image image{memory_manager}; |
104 | 2.26k | bool ok = [&]() -> Status { |
105 | 2.26k | JXL_ASSIGN_OR_RETURN(image, Image::Create(memory_manager, w, h, bit_depth, |
106 | 2.26k | nb_chans + nb_extra)); |
107 | 2.26k | return true; |
108 | 2.26k | }(); |
109 | | // OOM is ok here. |
110 | 2.26k | if (!ok) return; |
111 | | |
112 | 2.68k | for (size_t c = 0; c < nb_chans; c++) { |
113 | 418 | Channel& ch = image.channel[c]; |
114 | 418 | ch.hshift = hshift[c]; |
115 | 418 | ch.vshift = vshift[c]; |
116 | 418 | Check(ch.shrink(jxl::DivCeil(w, 1 << hshift[c]), |
117 | 418 | jxl::DivCeil(h, 1 << vshift[c]))); |
118 | 418 | } |
119 | | |
120 | 7.49k | for (size_t ec = 0; ec < nb_extra; ec++) { |
121 | 5.23k | Channel& ch = image.channel[ec + nb_chans]; |
122 | 5.23k | size_t ch_up = ec_upsampling[ec]; |
123 | 5.23k | int up_level = |
124 | 5.23k | jxl::CeilLog2Nonzero(ch_up) - jxl::CeilLog2Nonzero(upsampling); |
125 | 5.23k | Check(ch.shrink(jxl::DivCeil(w_orig, ch_up), jxl::DivCeil(h_orig, ch_up))); |
126 | 5.23k | ch.hshift = ch.vshift = up_level; |
127 | 5.23k | } |
128 | | |
129 | 2.26k | GroupHeader header; |
130 | 2.26k | if (!jxl::Bundle::Read(&reader, &header)) return; |
131 | 1.98k | Header w_header; |
132 | 1.98k | if (!jxl::Bundle::Read(&reader, &w_header)) return; |
133 | | |
134 | | // TODO(eustas): give it a try? |
135 | 1.96k | if (!reader.AllReadsWithinBounds()) return; |
136 | | |
137 | 1.96k | image.transform = header.transforms; |
138 | 6.65k | for (Transform& transform : image.transform) { |
139 | 6.65k | if (!transform.MetaApply(image)) return; |
140 | 6.65k | } |
141 | 1.72k | if (image.error) return; |
142 | | |
143 | 1.72k | ModularOptions options; |
144 | 1.72k | if (!ValidateChannelDimensions(image, options)) return; |
145 | | |
146 | 118k | for (Channel& ch : image.channel) { |
147 | 118k | FillChannel(ch, rng); |
148 | 118k | } |
149 | | |
150 | 1.72k | image.undo_transforms(w_header); |
151 | | |
152 | 1.72k | Check(!image.error); |
153 | 1.72k | Check(image.nb_meta_channels == 0); |
154 | 1.72k | Check(image.channel.size() == nb_chans + nb_extra); |
155 | | |
156 | 1.83k | for (size_t c = 0; c < nb_chans; c++) { |
157 | 113 | const Channel& ch = image.channel[c]; |
158 | 113 | Check(ch.hshift == hshift[c]); |
159 | 113 | Check(ch.vshift == vshift[c]); |
160 | 113 | Check(ch.w == jxl::DivCeil(w, 1 << hshift[c])); |
161 | 113 | Check(ch.h == jxl::DivCeil(h, 1 << vshift[c])); |
162 | 113 | } |
163 | | |
164 | 5.52k | for (size_t ec = 0; ec < nb_extra; ec++) { |
165 | 3.79k | const Channel& ch = image.channel[ec + nb_chans]; |
166 | 3.79k | size_t ch_up = ec_upsampling[ec]; |
167 | 3.79k | int up_level = |
168 | 3.79k | jxl::CeilLog2Nonzero(ch_up) - jxl::CeilLog2Nonzero(upsampling); |
169 | 3.79k | Check(ch.w == jxl::DivCeil(w_orig, ch_up)); |
170 | 3.79k | Check(ch.h == jxl::DivCeil(h_orig, ch_up)); |
171 | 3.79k | Check(ch.hshift == up_level); |
172 | 3.79k | Check(ch.vshift == up_level); |
173 | 3.79k | } |
174 | 1.72k | } |
175 | | |
176 | 2.31k | int DoTestOneInput(const uint8_t* data, size_t size) { |
177 | 2.31k | if (size < 15) return 0; |
178 | | |
179 | 2.31k | TrackingMemoryManager memory_manager{/* cap */ 1 * kGiB, |
180 | 2.31k | /* total_cap */ 5 * kGiB}; |
181 | 2.31k | { |
182 | 2.31k | static Status nevermind = true; |
183 | 2.31k | BitReader reader(Bytes(data, size)); |
184 | 2.31k | BitReaderScopedCloser reader_closer(reader, nevermind); |
185 | 2.31k | Run(reader, memory_manager.get()); |
186 | 2.31k | } |
187 | 2.31k | Check(memory_manager.Reset()); |
188 | | |
189 | 2.31k | return 0; |
190 | 2.31k | } |
191 | | |
192 | | } // namespace |
193 | | |
194 | 71.7k | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
195 | 71.7k | return DoTestOneInput(data, size); |
196 | 71.7k | } |
197 | | |
198 | 0 | void TestOneInput(const std::vector<uint8_t>& data) { |
199 | 0 | DoTestOneInput(data.data(), data.size()); |
200 | 0 | } |
201 | | |
202 | | FUZZ_TEST(TransformsFuzzTest, TestOneInput); |