Coverage Report

Created: 2026-09-01 06:55

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libwebp/tests/fuzzer/imageio_fuzzer.cc
Line
Count
Source
1
// Copyright 2024 Google Inc.
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14
//
15
////////////////////////////////////////////////////////////////////////////////
16
17
// Fuzzing of libwebp's image readers
18
19
#include <cstddef>
20
#include <cstdint>
21
#include <cstdlib>
22
#include <iostream>
23
#include <string_view>
24
25
#include "./nalloc.h"
26
#include "imageio/image_dec.h"
27
#include "imageio/metadata.h"
28
#include "src/webp/encode.h"
29
#include "tests/fuzzer/fuzz_utils.h"
30
31
namespace {
32
33
void TestReader(const uint8_t* data, size_t size, WebPImageReader reader,
34
8.75k
                bool keep_alpha, bool use_argb) {
35
8.75k
  WebPPicture pic;
36
8.75k
  if (!WebPPictureInit(&pic)) {
37
0
    std::cerr << "WebPPictureInit failed" << std::endl;
38
0
    std::abort();
39
0
  }
40
8.75k
  nalloc_init(nullptr);
41
8.75k
  nalloc_start(data, size);
42
8.75k
  Metadata metadata;
43
8.75k
  MetadataInit(&metadata);
44
8.75k
  pic.use_argb = use_argb ? 1 : 0;
45
46
8.75k
  if (!fuzz_utils::IsImageTooBig(data, size)) {
47
8.67k
    (void)(*reader)(data, size, &pic, keep_alpha ? 1 : 0, &metadata);
48
8.67k
  }
49
8.75k
  WebPPictureFree(&pic);
50
8.75k
  MetadataFree(&metadata);
51
8.75k
  nalloc_end();
52
8.75k
}
53
54
constexpr WebPInputFileFormat kUnknown = WEBP_UNSUPPORTED_FORMAT;
55
56
void Decode(std::string_view arbitrary_bytes, WebPInputFileFormat format,
57
8.75k
            bool keep_alpha, bool use_argb) {
58
8.75k
  const uint8_t* data =
59
8.75k
      reinterpret_cast<const uint8_t*>(arbitrary_bytes.data());
60
8.75k
  const size_t size = arbitrary_bytes.size();
61
8.75k
  if (format == kUnknown) {
62
1.13k
    (void)WebPGuessImageType(data, size);  // shouldn't fail
63
1.13k
    TestReader(data, size, WebPGuessImageReader(data, size), keep_alpha,
64
1.13k
               use_argb);
65
7.62k
  } else {
66
7.62k
    TestReader(data, size, WebPGetImageReader(format), keep_alpha, use_argb);
67
7.62k
  }
68
8.75k
}
69
70
FUZZ_TEST(ImageIOSuite, Decode)
71
    .WithDomains(fuzztest::String().WithMaxSize(fuzz_utils::kMaxWebPFileSize +
72
                                                1),
73
                 fuzztest::ElementOf<WebPInputFileFormat>(
74
                     {WEBP_PNG_FORMAT, WEBP_JPEG_FORMAT, WEBP_TIFF_FORMAT,
75
                      WEBP_WEBP_FORMAT, WEBP_PNM_FORMAT, kUnknown}),
76
                 /*keep_alpha=*/fuzztest::Arbitrary<bool>(),
77
                 /*use_argb=*/fuzztest::Arbitrary<bool>());
78
79
}  // namespace