/src/ots/util/ots-fuzzer.cc
Line | Count | Source |
1 | | // Copyright (c) 2016-2017 The OTS Authors. All rights reserved. |
2 | | // Use of this source code is governed by a BSD-style license that can be |
3 | | // found in the LICENSE file. |
4 | | |
5 | | #include <stddef.h> |
6 | | #include <stdint.h> |
7 | | #ifndef OTS_FUZZER_NO_MAIN |
8 | | #include <fstream> |
9 | | #include <iostream> |
10 | | #include <iterator> |
11 | | #endif |
12 | | |
13 | | #include "opentype-sanitiser.h" |
14 | | #include "ots-memory-stream.h" |
15 | | #include "ots.h" |
16 | | |
17 | | namespace { |
18 | | |
19 | | class Context: public ots::OTSContext { |
20 | | public: |
21 | 13.2k | Context() {} |
22 | 1.65M | void Message(int, const char*, ...) {} |
23 | | }; |
24 | | |
25 | | } |
26 | | |
27 | | // Entry point for LibFuzzer. |
28 | 13.2k | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
29 | 13.2k | Context context; |
30 | 13.2k | ots::ExpandingMemoryStream stream(size /*initial*/, size * 8 /*limit*/); |
31 | 13.2k | bool ok = context.Process(&stream, data, size); |
32 | | |
33 | 13.2k | if (ok) { |
34 | 2.70k | ots::Buffer file(data, size); |
35 | 2.70k | uint32_t tag; |
36 | 2.70k | if (file.ReadU32(&tag) && tag == OTS_TAG('t','t','c','f')) { |
37 | 2.15k | uint32_t num_fonts; |
38 | 2.15k | if (file.Skip(sizeof(uint32_t)) && file.ReadU32(&num_fonts)) { |
39 | 18.8k | for (uint32_t i = 0; i < num_fonts; i++) { |
40 | 16.6k | stream.Seek(0); |
41 | 16.6k | context.Process(&stream, data, size, i); |
42 | 16.6k | } |
43 | 2.15k | } |
44 | 2.15k | } |
45 | 2.70k | } |
46 | | |
47 | 13.2k | return 0; |
48 | 13.2k | } |
49 | | |
50 | | #ifndef OTS_FUZZER_NO_MAIN |
51 | | int main(int argc, char **argv) { |
52 | | for (int i = 1; i < argc; i++) { |
53 | | std::cout << argv[i] << std::endl; |
54 | | |
55 | | std::ifstream f(argv[i], std::ifstream::binary); |
56 | | if (!f.good()) |
57 | | return 1; |
58 | | |
59 | | std::string s((std::istreambuf_iterator<char>(f)), |
60 | | (std::istreambuf_iterator<char>())); |
61 | | LLVMFuzzerTestOneInput((const uint8_t*)s.data(), s.size()); |
62 | | } |
63 | | return 0; |
64 | | } |
65 | | #endif |