Coverage Report

Created: 2026-06-10 06:43

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libwebp/tests/fuzzer/animation_api_fuzzer.cc
Line
Count
Source
1
// Copyright 2018 Google Inc.
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14
//
15
////////////////////////////////////////////////////////////////////////////////
16
17
#include <cstddef>
18
#include <cstdint>
19
#include <string>
20
#include <string_view>
21
22
#include "./fuzz_utils.h"
23
#include "gtest/gtest.h"
24
#include "webp/decode.h"
25
#include "webp/demux.h"
26
#include "webp/mux_types.h"
27
28
namespace {
29
30
void AnimationApiTest(std::string_view blob, bool use_threads,
31
4.02k
                      WEBP_CSP_MODE color_mode) {
32
4.02k
  const size_t size = blob.size();
33
4.02k
  WebPData webp_data;
34
4.02k
  WebPDataInit(&webp_data);
35
4.02k
  webp_data.size = size;
36
4.02k
  webp_data.bytes = reinterpret_cast<const uint8_t*>(blob.data());
37
38
  // WebPAnimDecoderNew uses WebPDemux internally to calloc canvas size.
39
4.02k
  WebPDemuxer* const demux = WebPDemux(&webp_data);
40
4.02k
  if (!demux) return;
41
3.82k
  const uint32_t cw = WebPDemuxGetI(demux, WEBP_FF_CANVAS_WIDTH);
42
3.82k
  const uint32_t ch = WebPDemuxGetI(demux, WEBP_FF_CANVAS_HEIGHT);
43
3.82k
  if ((size_t)cw * ch > fuzz_utils::kFuzzPxLimit) {
44
12
    WebPDemuxDelete(demux);
45
12
    return;
46
12
  }
47
48
  // In addition to canvas size, check each frame separately.
49
3.81k
  WebPIterator iter;
50
7.62k
  for (int i = 0; i < fuzz_utils::kFuzzFrameLimit; i++) {
51
7.62k
    if (!WebPDemuxGetFrame(demux, i + 1, &iter)) break;
52
3.81k
    int w, h;
53
3.81k
    if (WebPGetInfo(iter.fragment.bytes, iter.fragment.size, &w, &h)) {
54
3.81k
      if ((size_t)w * h >
55
3.81k
          fuzz_utils::kFuzzPxLimit) {  // image size of the frame payload
56
0
        WebPDemuxReleaseIterator(&iter);
57
0
        WebPDemuxDelete(demux);
58
0
        return;
59
0
      }
60
3.81k
    }
61
3.81k
  }
62
63
3.81k
  WebPDemuxReleaseIterator(&iter);
64
3.81k
  WebPDemuxDelete(demux);
65
66
3.81k
  WebPAnimDecoderOptions dec_options;
67
3.81k
  if (!WebPAnimDecoderOptionsInit(&dec_options)) return;
68
69
3.81k
  dec_options.use_threads = use_threads;
70
3.81k
  dec_options.color_mode = color_mode;
71
72
3.81k
  WebPAnimDecoder* dec = WebPAnimDecoderNew(&webp_data, &dec_options);
73
3.81k
  if (!dec) return;
74
75
4.58k
  for (int i = 0; i < fuzz_utils::kFuzzFrameLimit; i++) {
76
4.58k
    uint8_t* buf;
77
4.58k
    int timestamp;
78
4.58k
    if (!WebPAnimDecoderGetNext(dec, &buf, &timestamp)) break;
79
4.58k
  }
80
81
3.81k
  WebPAnimDecoderDelete(dec);
82
3.81k
}
83
84
}  // namespace
85
86
FUZZ_TEST(AnimationApi, AnimationApiTest)
87
    .WithDomains(fuzztest::String().WithMaxSize(fuzz_utils::kMaxWebPFileSize +
88
                                                1),
89
                 /*use_threads=*/fuzztest::Arbitrary<bool>(),
90
                 // Animations only support 4 (out of 12) modes.
91
                 fuzztest::ElementOf<WEBP_CSP_MODE>({MODE_RGBA, MODE_BGRA,
92
                                                     MODE_rgbA, MODE_bgrA}));
93
94
0
TEST(AnimationApi, Buganizer498965803) {
95
0
  AnimationApiTest(
96
0
      std::string("ALPH\000\000\000\000\000\000\000\000\021\000\000\000\t\305"
97
0
                  "\006d\301\013\177\000\000webp\034\205\000#@VP8 "
98
0
                  "!\000\000\000v\003\000\235\001*\007\200\"\000\0020("
99
0
                  "\000\377\377\377\003\000\000\000\311\311\311\311\311\311\311"
100
0
                  "\311\311\311\311\311\311\311\311\311\311\311\311\311\311\211"
101
0
                  "\311\311\311\311\311\030\030\030\030\030\030\311\311",
102
0
                  98),
103
0
      false, static_cast<WEBP_CSP_MODE>(1));
104
0
}