Coverage Report

Created: 2025-06-13 07:37

/src/libjxl/tools/transforms_fuzzer.cc
Line
Count
Source (jump to first uncovered line)
1
// Copyright (c) the JPEG XL Project Authors. All rights reserved.
2
//
3
// Use of this source code is governed by a BSD-style
4
// license that can be found in the LICENSE file.
5
6
#include <jxl/memory_manager.h>
7
8
#include <algorithm>
9
#include <cstddef>
10
#include <cstdint>
11
#include <vector>
12
13
#include "lib/jxl/base/bits.h"
14
#include "lib/jxl/base/common.h"
15
#include "lib/jxl/base/compiler_specific.h"
16
#include "lib/jxl/base/random.h"
17
#include "lib/jxl/base/span.h"
18
#include "lib/jxl/base/status.h"
19
#include "lib/jxl/dec_bit_reader.h"
20
#include "lib/jxl/fields.h"
21
#include "lib/jxl/fuzztest.h"
22
#include "lib/jxl/modular/encoding/encoding.h"
23
#include "lib/jxl/modular/modular_image.h"
24
#include "lib/jxl/modular/options.h"
25
#include "lib/jxl/modular/transform/transform.h"
26
#include "tools/tracking_memory_manager.h"
27
28
namespace {
29
30
using ::jpegxl::tools::kGiB;
31
using ::jpegxl::tools::TrackingMemoryManager;
32
using ::jxl::BitReader;
33
using ::jxl::BitReaderScopedCloser;
34
using ::jxl::Bytes;
35
using ::jxl::Channel;
36
using ::jxl::GroupHeader;
37
using ::jxl::Image;
38
using ::jxl::ModularOptions;
39
using ::jxl::pixel_type;
40
using ::jxl::Rng;
41
using ::jxl::Status;
42
using ::jxl::Transform;
43
using ::jxl::weighted::Header;
44
45
118k
void FillChannel(Channel& ch, Rng& rng) {
46
118k
  auto* p = &ch.plane;
47
118k
  const size_t w = ch.w;
48
118k
  const size_t h = ch.h;
49
143M
  for (size_t y = 0; y < h; ++y) {
50
143M
    pixel_type* row = p->Row(y);
51
3.24G
    for (size_t x = 0; x < w; ++x) {
52
3.10G
      row[x] = rng.UniformU(0, 0x80000000);
53
3.10G
    }
54
143M
  }
55
118k
}
56
57
28.7k
void Check(bool ok) {
58
28.7k
  if (!ok) {
59
0
    JXL_CRASH();
60
0
  }
61
28.7k
}
62
63
2.31k
void Run(BitReader& reader, JxlMemoryManager* memory_manager) {
64
2.31k
  Rng rng(reader.ReadFixedBits<56>());
65
66
  // One of {0, 1, _2_, 3}; "2" will be filtered out soon.
67
2.31k
  size_t nb_chans = static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x3;
68
2.31k
  size_t nb_extra = static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x7;
69
  // 1..32
70
2.31k
  size_t bit_depth =
71
2.31k
      (static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x1F) + 1;
72
  // {0, 1, 2, 3}
73
2.31k
  size_t log_upsampling =
74
2.31k
      (static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x3);
75
2.31k
  size_t upsampling = 1 << log_upsampling;
76
77
2.31k
  size_t w_orig = static_cast<size_t>(reader.ReadFixedBits<16>());
78
2.31k
  size_t h_orig = static_cast<size_t>(reader.ReadFixedBits<16>());
79
2.31k
  size_t w = jxl::DivCeil(w_orig, upsampling);
80
2.31k
  size_t h = jxl::DivCeil(h_orig, upsampling);
81
82
2.31k
  if ((nb_chans == 2) || ((nb_chans + nb_extra) == 0) || (w * h == 0) ||
83
2.31k
      ((w_orig * h_orig * (nb_chans + nb_extra)) > (1 << 23))) {
84
47
    return;
85
47
  }
86
87
2.26k
  std::vector<int> hshift;
88
2.26k
  std::vector<int> vshift;
89
2.26k
  std::vector<size_t> ec_upsampling;
90
91
2.68k
  for (size_t c = 0; c < nb_chans; c++) {
92
418
    hshift.push_back(static_cast<int>(reader.ReadFixedBits<8>()) & 1);
93
418
    vshift.push_back(static_cast<int>(reader.ReadFixedBits<8>()) & 1);
94
418
  }
95
96
7.49k
  for (size_t ec = 0; ec < nb_extra; ec++) {
97
5.23k
    size_t log_ec_upsampling =
98
5.23k
        (static_cast<size_t>(reader.ReadFixedBits<8>()) & 0x3);
99
5.23k
    log_ec_upsampling = std::max(log_ec_upsampling, log_upsampling);
100
5.23k
    ec_upsampling.push_back(1 << log_ec_upsampling);
101
5.23k
  }
102
103
2.26k
  Image image{memory_manager};
104
2.26k
  bool ok = [&]() -> Status {
105
2.26k
    JXL_ASSIGN_OR_RETURN(image, Image::Create(memory_manager, w, h, bit_depth,
106
2.26k
                                              nb_chans + nb_extra));
107
2.26k
    return true;
108
2.26k
  }();
109
  // OOM is ok here.
110
2.26k
  if (!ok) return;
111
112
2.68k
  for (size_t c = 0; c < nb_chans; c++) {
113
418
    Channel& ch = image.channel[c];
114
418
    ch.hshift = hshift[c];
115
418
    ch.vshift = vshift[c];
116
418
    Check(ch.shrink(jxl::DivCeil(w, 1 << hshift[c]),
117
418
                    jxl::DivCeil(h, 1 << vshift[c])));
118
418
  }
119
120
7.49k
  for (size_t ec = 0; ec < nb_extra; ec++) {
121
5.23k
    Channel& ch = image.channel[ec + nb_chans];
122
5.23k
    size_t ch_up = ec_upsampling[ec];
123
5.23k
    int up_level =
124
5.23k
        jxl::CeilLog2Nonzero(ch_up) - jxl::CeilLog2Nonzero(upsampling);
125
5.23k
    Check(ch.shrink(jxl::DivCeil(w_orig, ch_up), jxl::DivCeil(h_orig, ch_up)));
126
5.23k
    ch.hshift = ch.vshift = up_level;
127
5.23k
  }
128
129
2.26k
  GroupHeader header;
130
2.26k
  if (!jxl::Bundle::Read(&reader, &header)) return;
131
1.98k
  Header w_header;
132
1.98k
  if (!jxl::Bundle::Read(&reader, &w_header)) return;
133
134
  // TODO(eustas): give it a try?
135
1.96k
  if (!reader.AllReadsWithinBounds()) return;
136
137
1.96k
  image.transform = header.transforms;
138
6.65k
  for (Transform& transform : image.transform) {
139
6.65k
    if (!transform.MetaApply(image)) return;
140
6.65k
  }
141
1.72k
  if (image.error) return;
142
143
1.72k
  ModularOptions options;
144
1.72k
  if (!ValidateChannelDimensions(image, options)) return;
145
146
118k
  for (Channel& ch : image.channel) {
147
118k
    FillChannel(ch, rng);
148
118k
  }
149
150
1.72k
  image.undo_transforms(w_header);
151
152
1.72k
  Check(!image.error);
153
1.72k
  Check(image.nb_meta_channels == 0);
154
1.72k
  Check(image.channel.size() == nb_chans + nb_extra);
155
156
1.83k
  for (size_t c = 0; c < nb_chans; c++) {
157
113
    const Channel& ch = image.channel[c];
158
113
    Check(ch.hshift == hshift[c]);
159
113
    Check(ch.vshift == vshift[c]);
160
113
    Check(ch.w == jxl::DivCeil(w, 1 << hshift[c]));
161
113
    Check(ch.h == jxl::DivCeil(h, 1 << vshift[c]));
162
113
  }
163
164
5.52k
  for (size_t ec = 0; ec < nb_extra; ec++) {
165
3.79k
    const Channel& ch = image.channel[ec + nb_chans];
166
3.79k
    size_t ch_up = ec_upsampling[ec];
167
3.79k
    int up_level =
168
3.79k
        jxl::CeilLog2Nonzero(ch_up) - jxl::CeilLog2Nonzero(upsampling);
169
3.79k
    Check(ch.w == jxl::DivCeil(w_orig, ch_up));
170
3.79k
    Check(ch.h == jxl::DivCeil(h_orig, ch_up));
171
3.79k
    Check(ch.hshift == up_level);
172
3.79k
    Check(ch.vshift == up_level);
173
3.79k
  }
174
1.72k
}
175
176
2.31k
int DoTestOneInput(const uint8_t* data, size_t size) {
177
2.31k
  if (size < 15) return 0;
178
179
2.31k
  TrackingMemoryManager memory_manager{/* cap */ 1 * kGiB,
180
2.31k
                                       /* total_cap */ 5 * kGiB};
181
2.31k
  {
182
2.31k
    static Status nevermind = true;
183
2.31k
    BitReader reader(Bytes(data, size));
184
2.31k
    BitReaderScopedCloser reader_closer(reader, nevermind);
185
2.31k
    Run(reader, memory_manager.get());
186
2.31k
  }
187
2.31k
  Check(memory_manager.Reset());
188
189
2.31k
  return 0;
190
2.31k
}
191
192
}  // namespace
193
194
71.7k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
195
71.7k
  return DoTestOneInput(data, size);
196
71.7k
}
197
198
0
void TestOneInput(const std::vector<uint8_t>& data) {
199
0
  DoTestOneInput(data.data(), data.size());
200
0
}
201
202
FUZZ_TEST(TransformsFuzzTest, TestOneInput);