Coverage Report

Created: 2025-08-29 06:35

/src/skcms/fuzz/fuzz_iccprofile_transform.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2018 Google Inc.
3
 *
4
 * Use of this source code is governed by a BSD-style license that can be
5
 * found in the LICENSE file.
6
 */
7
8
// This fuzz target parses an ICCProfile and attempts to do some transforms
9
// between a known profile and that profile.
10
11
#include "../src/skcms_public.h"
12
13
// This is profiles/sRGB_Facebook.icc, copied here (xxd -i ...) so that this
14
// binary does not need any files as input, other than the fuzzed input.
15
static unsigned char profiles_sRGB_Facebook_icc[] = {
16
  0x00, 0x00, 0x02, 0x0c, 0x6c, 0x63, 0x6d, 0x73, 0x02, 0x10, 0x00, 0x00,
17
  0x6d, 0x6e, 0x74, 0x72, 0x52, 0x47, 0x42, 0x20, 0x58, 0x59, 0x5a, 0x20,
18
  0x07, 0xdc, 0x00, 0x01, 0x00, 0x19, 0x00, 0x03, 0x00, 0x29, 0x00, 0x39,
19
  0x61, 0x63, 0x73, 0x70, 0x41, 0x50, 0x50, 0x4c, 0x00, 0x00, 0x00, 0x00,
20
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
21
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0xd6,
22
  0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xd3, 0x2d, 0x6c, 0x63, 0x6d, 0x73,
23
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
24
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
25
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
26
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a,
27
  0x64, 0x65, 0x73, 0x63, 0x00, 0x00, 0x00, 0xfc, 0x00, 0x00, 0x00, 0x5e,
28
  0x63, 0x70, 0x72, 0x74, 0x00, 0x00, 0x01, 0x5c, 0x00, 0x00, 0x00, 0x0b,
29
  0x77, 0x74, 0x70, 0x74, 0x00, 0x00, 0x01, 0x68, 0x00, 0x00, 0x00, 0x14,
30
  0x62, 0x6b, 0x70, 0x74, 0x00, 0x00, 0x01, 0x7c, 0x00, 0x00, 0x00, 0x14,
31
  0x72, 0x58, 0x59, 0x5a, 0x00, 0x00, 0x01, 0x90, 0x00, 0x00, 0x00, 0x14,
32
  0x67, 0x58, 0x59, 0x5a, 0x00, 0x00, 0x01, 0xa4, 0x00, 0x00, 0x00, 0x14,
33
  0x62, 0x58, 0x59, 0x5a, 0x00, 0x00, 0x01, 0xb8, 0x00, 0x00, 0x00, 0x14,
34
  0x72, 0x54, 0x52, 0x43, 0x00, 0x00, 0x01, 0xcc, 0x00, 0x00, 0x00, 0x40,
35
  0x67, 0x54, 0x52, 0x43, 0x00, 0x00, 0x01, 0xcc, 0x00, 0x00, 0x00, 0x40,
36
  0x62, 0x54, 0x52, 0x43, 0x00, 0x00, 0x01, 0xcc, 0x00, 0x00, 0x00, 0x40,
37
  0x64, 0x65, 0x73, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
38
  0x63, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
39
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
40
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
41
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
42
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
43
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
44
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
45
  0x74, 0x65, 0x78, 0x74, 0x00, 0x00, 0x00, 0x00, 0x46, 0x42, 0x00, 0x00,
46
  0x58, 0x59, 0x5a, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0xd6,
47
  0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xd3, 0x2d, 0x58, 0x59, 0x5a, 0x20,
48
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x16, 0x00, 0x00, 0x03, 0x33,
49
  0x00, 0x00, 0x02, 0xa4, 0x58, 0x59, 0x5a, 0x20, 0x00, 0x00, 0x00, 0x00,
50
  0x00, 0x00, 0x6f, 0xa2, 0x00, 0x00, 0x38, 0xf5, 0x00, 0x00, 0x03, 0x90,
51
  0x58, 0x59, 0x5a, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x99,
52
  0x00, 0x00, 0xb7, 0x85, 0x00, 0x00, 0x18, 0xda, 0x58, 0x59, 0x5a, 0x20,
53
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0xa0, 0x00, 0x00, 0x0f, 0x84,
54
  0x00, 0x00, 0xb6, 0xcf, 0x63, 0x75, 0x72, 0x76, 0x00, 0x00, 0x00, 0x00,
55
  0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00, 0xcb, 0x01, 0xc9, 0x03, 0x63,
56
  0x05, 0x92, 0x08, 0x6b, 0x0b, 0xf6, 0x10, 0x3f, 0x15, 0x51, 0x1b, 0x34,
57
  0x21, 0xf1, 0x29, 0x90, 0x32, 0x18, 0x3b, 0x92, 0x46, 0x05, 0x51, 0x77,
58
  0x5d, 0xed, 0x6b, 0x70, 0x7a, 0x05, 0x89, 0xb1, 0x9a, 0x7c, 0xac, 0x69,
59
  0xbf, 0x7d, 0xd3, 0xc3, 0xe9, 0x30, 0xff, 0xff
60
};
61
62
void exit(int);
63
64
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
65
3.46k
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
66
3.46k
    skcms_ICCProfile p;
67
3.46k
    if (!skcms_Parse(data, size, &p)) {
68
2.57k
        return 0;
69
2.57k
    }
70
893
    skcms_ICCProfile srgb;
71
893
    if (!skcms_Parse(profiles_sRGB_Facebook_icc, sizeof(profiles_sRGB_Facebook_icc), &srgb)) {
72
        // This should never happen, but if it does, we want to make
73
        // a big fuss about it (exiting kills libfuzzer, as if it crashed).
74
0
        exit(1);
75
0
    }
76
77
2.67k
    for (int mode = 0; mode < 2; mode++) {
78
1.78k
        if (mode == 1) {
79
893
            (void)skcms_MakeUsableAsDestination(&p);
80
893
        }
81
82
1.78k
        uint8_t src[256],
83
1.78k
                dst[256];
84
1.78k
        for (skcms_AlphaFormat srcAlpha = skcms_AlphaFormat_Opaque;
85
7.14k
             srcAlpha <= skcms_AlphaFormat_PremulAsEncoded; ++srcAlpha) {
86
5.35k
            for (skcms_AlphaFormat dstAlpha = skcms_AlphaFormat_Opaque;
87
21.4k
                 dstAlpha <= skcms_AlphaFormat_PremulAsEncoded; ++dstAlpha) {
88
4.13M
                for (int i = 0; i < 256; i++) {
89
4.11M
                    src[i] = (uint8_t)i;
90
4.11M
                }
91
16.0k
                skcms_Transform(src, skcms_PixelFormat_RGBA_8888, srcAlpha, &srgb,
92
16.0k
                                dst, skcms_PixelFormat_RGBA_8888, dstAlpha, &p,
93
16.0k
                                64);
94
95
16.0k
                skcms_Transform(src, skcms_PixelFormat_RGBA_8888, srcAlpha, &p,
96
16.0k
                                dst, skcms_PixelFormat_RGBA_8888, dstAlpha, &srgb,
97
16.0k
                                64);
98
16.0k
            }
99
5.35k
        }
100
1.78k
    }
101
893
    return 0;
102
893
}