LLVMFuzzerTestOneInput:
   39|    129|{
   40|    129|    FuzzHelper f(data, size);
   41|    129|    f.run();
   42|    129|    return 0;
   43|    129|}
_ZN10FuzzHelperC2EPKhm:
   10|    129|        data(data),
   11|    129|        size(size)
   12|    129|    {
   13|    129|    }
_ZN10FuzzHelper3runEv:
   17|    129|    {
   18|    129|        Pl_Discard discard;
   19|    129|        Pl_TIFFPredictor p("decoder", &discard, Pl_TIFFPredictor::a_decode, 16, 1, 8);
   20|       |        // Exercise with strange values for some of the parameters.
   21|    129|        Pl_TIFFPredictor p2("decoder", &discard, Pl_TIFFPredictor::a_decode, 16, 2, 5);
   22|    129|        try {
   23|    129|            p.write(data, size);
   24|    129|            p.finish();
   25|    129|            p2.write(data, size);
   26|    129|            p2.finish();
   27|    129|        } catch (std::runtime_error const& e) {
   28|      0|            std::cerr << "runtime_error: " << e.what() << '\n';
   29|      0|        }
   30|    129|    }

_ZN8PipelineD2Ev:
   52|    387|    virtual ~Pipeline() = default;
_ZNK8Pipeline4nextEv:
  103|  9.04k|    {
  104|  9.04k|        return next_;
  105|  9.04k|    }

_ZN5QIntC7to_uintImEEjRKT_:
  208|  3.91k|    {
  209|  3.91k|        return IntConverter<T, unsigned int>::convert(i);
  210|  3.91k|    }
_ZN5QIntC12IntConverterImjLb0ELb0EE7convertERKm:
   69|  3.91k|        {
   70|       |            // From and To are both unsigned.
   71|  3.91k|            if (i > std::numeric_limits<To>::max()) {
  ------------------
  |  Branch (71:17): [True: 0, False: 3.91k]
  ------------------
   72|      0|                error(i);
   73|      0|            }
   74|  3.91k|            return static_cast<To>(i);
   75|  3.91k|        }

_ZN3QTC2TCEPKcS1_i:
   36|  8.79k|    {
   37|       |#ifndef QPDF_DISABLE_QTC
   38|       |        TC_real(scope, ccase, n);
   39|       |#endif // QPDF_DISABLE_QTC
   40|  8.79k|    }

_ZN9BitStreamC2EPKhm:
   13|  3.91k|    start(p),
   14|  3.91k|    nbytes(nbytes)
   15|  3.91k|{
   16|  3.91k|    reset();
   17|  3.91k|}
_ZN9BitStream5resetEv:
   21|  3.91k|{
   22|  3.91k|    p = start;
   23|  3.91k|    bit_offset = 7;
   24|  3.91k|    if (QIntC::to_uint(nbytes) > static_cast<unsigned int>(-1) / 8) {
  ------------------
  |  Branch (24:9): [True: 0, False: 3.91k]
  ------------------
   25|      0|        throw std::runtime_error("array too large for bitstream");
   26|      0|    }
   27|  3.91k|    bits_available = 8 * nbytes;
   28|  3.91k|}
_ZN9BitStream13getBitsSignedEm:
   38|   125k|{
   39|   125k|    unsigned long long bits = read_bits(this->p, this->bit_offset, this->bits_available, nbits);
   40|   125k|    long long result = 0;
   41|   125k|    if (static_cast<long long>(bits) > 1LL << (nbits - 1)) {
  ------------------
  |  Branch (41:9): [True: 54.2k, False: 71.0k]
  ------------------
   42|  54.2k|        result = static_cast<long long>(bits - (1ULL << nbits));
   43|  71.0k|    } else {
   44|  71.0k|        result = static_cast<long long>(bits);
   45|  71.0k|    }
   46|   125k|    return result;
   47|   125k|}

_ZN9BitWriterC2EP8Pipeline:
    8|  3.91k|    pl(pl)
    9|  3.91k|{
   10|  3.91k|}
_ZN9BitWriter9writeBitsEym:
   14|   125k|{
   15|   125k|    write_bits(this->ch, this->bit_offset, val, bits, this->pl);
   16|   125k|}
_ZN9BitWriter15writeBitsSignedExm:
   20|   125k|{
   21|   125k|    unsigned long long uval = 0;
   22|   125k|    if (val < 0) {
  ------------------
  |  Branch (22:9): [True: 57.1k, False: 68.1k]
  ------------------
   23|  57.1k|        uval = (1ULL << bits) + static_cast<unsigned long long>(val);
   24|  68.1k|    } else {
   25|  68.1k|        uval = static_cast<unsigned long long>(val);
   26|  68.1k|    }
   27|   125k|    writeBits(uval, bits);
   28|   125k|}
_ZN9BitWriter5flushEv:
   38|  3.91k|{
   39|  3.91k|    if (bit_offset < 7) {
  ------------------
  |  Branch (39:9): [True: 0, False: 3.91k]
  ------------------
   40|      0|        size_t bits_to_write = bit_offset + 1;
   41|      0|        write_bits(this->ch, this->bit_offset, 0, bits_to_write, this->pl);
   42|      0|    }
   43|  3.91k|}

_ZN8PipelineC2EPKcPS_:
   11|    387|    identifier(identifier),
   12|    387|    next_(next)
   13|    387|{
   14|    387|}

_ZN10Pl_DiscardC2Ev:
    9|    129|    Pipeline("discard", nullptr)
   10|    129|{
   11|    129|}
_ZN10Pl_DiscardD2Ev:
   14|    129|Pl_Discard::~Pl_Discard() = default;
_ZN10Pl_Discard5writeEPKhm:
   18|  83.1k|{
   19|  83.1k|}
_ZN10Pl_Discard6finishEv:
   23|    258|{
   24|    258|}

_ZN16Pl_TIFFPredictorC2EPKcP8PipelineNS_8action_eEjjj:
   26|    258|    Pipeline(identifier, next),
   27|    258|    action(action),
   28|    258|    columns(columns),
   29|    258|    samples_per_pixel(samples_per_pixel),
   30|    258|    bits_per_sample(bits_per_sample)
   31|    258|{
   32|    258|    util::assertion(next, "Attempt to create Pl_TIFFPredictor with nullptr as next");
   33|    258|    util::no_ci_rt_error_if(
   34|    258|        samples_per_pixel < 1, "TIFFPredictor created with invalid samples_per_pixel");
   35|    258|    util::no_ci_rt_error_if(
   36|    258|        bits_per_sample < 1 || bits_per_sample > (8 * (sizeof(unsigned long long))),
  ------------------
  |  Branch (36:9): [True: 0, False: 258]
  |  Branch (36:32): [True: 0, False: 258]
  ------------------
   37|    258|        "TIFFPredictor created with invalid bits_per_sample");
   38|    258|    auto bits_per_pixel = 1ULL * bits_per_sample * samples_per_pixel;
   39|    258|    util::no_ci_rt_error_if(
   40|    258|        !util::fits<uint32_t>(bits_per_pixel + 7),
   41|    258|        "TIFFPredictor created with bits_per_sample and samples_per_pixel values that cause "
   42|    258|        "overflow");
   43|    258|    auto bpr = (columns * bits_per_pixel + 7) / 8;
   44|    258|    util::no_ci_rt_error_if(
   45|    258|        bpr == 0 || !util::fits<uint32_t>(bpr), "TIFFPredictor created with invalid columns value");
  ------------------
  |  Branch (45:9): [True: 0, False: 258]
  |  Branch (45:21): [True: 0, False: 258]
  ------------------
   46|    258|    util::no_ci_rt_error_if(
   47|    258|        memory_limit > 0 && bpr > (memory_limit / 2ULL), "TIFFPredictor memory limit exceeded");
  ------------------
  |  Branch (47:9): [True: 0, False: 258]
  |  Branch (47:29): [True: 0, False: 0]
  ------------------
   48|    258|    bytes_per_row = static_cast<uint32_t>(bpr);
   49|    258|}
_ZN16Pl_TIFFPredictor5writeEPKhm:
   59|    258|{
   60|    258|    auto end = data + len;
   61|    258|    auto row_end = data + (bytes_per_row - cur_row.size());
   62|  8.81k|    while (row_end <= end) {
  ------------------
  |  Branch (62:12): [True: 8.55k, False: 258]
  ------------------
   63|       |        // finish off current row
   64|  8.55k|        cur_row.insert(cur_row.end(), data, row_end);
   65|  8.55k|        data = row_end;
   66|  8.55k|        row_end += bytes_per_row;
   67|       |
   68|  8.55k|        processRow();
   69|       |
   70|       |        // Prepare for next row
   71|  8.55k|        cur_row.clear();
   72|  8.55k|    }
   73|       |
   74|    258|    cur_row.insert(cur_row.end(), data, end);
   75|    258|}
_ZN16Pl_TIFFPredictor10processRowEv:
   79|  8.79k|{
   80|  8.79k|    QTC::TC("libtests", "Pl_TIFFPredictor processRow", (action == a_decode ? 0 : 1));
  ------------------
  |  Branch (80:57): [True: 8.79k, False: 0]
  ------------------
   81|  8.79k|    previous.assign(samples_per_pixel, 0);
   82|  8.79k|    if (bits_per_sample != 8) {
  ------------------
  |  Branch (82:9): [True: 3.91k, False: 4.87k]
  ------------------
   83|  3.91k|        BitWriter bw(next());
   84|  3.91k|        BitStream in(cur_row.data(), cur_row.size());
   85|  66.5k|        for (uint32_t col = 0; col < this->columns; ++col) {
  ------------------
  |  Branch (85:32): [True: 62.6k, False: 3.91k]
  ------------------
   86|   125k|            for (auto& prev: previous) {
  ------------------
  |  Branch (86:28): [True: 125k, False: 62.6k]
  ------------------
   87|   125k|                long long sample = in.getBitsSigned(this->bits_per_sample);
   88|   125k|                long long new_sample = sample;
   89|   125k|                if (action == a_encode) {
  ------------------
  |  Branch (89:21): [True: 0, False: 125k]
  ------------------
   90|      0|                    new_sample -= prev;
   91|      0|                    prev = sample;
   92|   125k|                } else {
   93|   125k|                    new_sample += prev;
   94|   125k|                    prev = new_sample;
   95|   125k|                }
   96|   125k|                bw.writeBitsSigned(new_sample, this->bits_per_sample);
   97|   125k|            }
   98|  62.6k|        }
   99|  3.91k|        bw.flush();
  100|  4.87k|    } else {
  101|  4.87k|        out.clear();
  102|  4.87k|        auto next_it = cur_row.begin();
  103|  4.87k|        auto cr_end = cur_row.end();
  104|  4.87k|        auto pr_end = previous.end();
  105|       |
  106|  82.8k|        while (next_it != cr_end) {
  ------------------
  |  Branch (106:16): [True: 78.0k, False: 4.87k]
  ------------------
  107|   156k|            for (auto prev = previous.begin(); prev != pr_end && next_it != cr_end;
  ------------------
  |  Branch (107:48): [True: 78.0k, False: 78.0k]
  |  Branch (107:66): [True: 78.0k, False: 0]
  ------------------
  108|  78.0k|                 ++prev, ++next_it) {
  109|  78.0k|                long long sample = *next_it;
  110|  78.0k|                long long new_sample = sample;
  111|  78.0k|                if (action == a_encode) {
  ------------------
  |  Branch (111:21): [True: 0, False: 78.0k]
  ------------------
  112|      0|                    new_sample -= *prev;
  113|      0|                    *prev = sample;
  114|  78.0k|                } else {
  115|  78.0k|                    new_sample += *prev;
  116|  78.0k|                    *prev = new_sample;
  117|  78.0k|                }
  118|  78.0k|                out.push_back(static_cast<unsigned char>(255U & new_sample));
  119|  78.0k|            }
  120|  78.0k|        }
  121|  4.87k|        next()->write(out.data(), out.size());
  122|  4.87k|    }
  123|  8.79k|}
_ZN16Pl_TIFFPredictor6finishEv:
  127|    258|{
  128|    258|    if (!cur_row.empty()) {
  ------------------
  |  Branch (128:9): [True: 233, False: 25]
  ------------------
  129|       |        // write partial row
  130|    233|        cur_row.insert(cur_row.end(), bytes_per_row - cur_row.size(), 0);
  131|    233|        processRow();
  132|    233|    }
  133|    258|    cur_row.clear();
  134|    258|    next()->finish();
  135|    258|}

_ZN16Pl_TIFFPredictorD2Ev:
   24|    258|    ~Pl_TIFFPredictor() override = default;

_ZN4qpdf4util4fitsIjTkNSt3__18integralEyQsr3stdE8integralIT_EEEbT0_:
   63|    516|    {
   64|       |        if constexpr (std::cmp_less(
   65|       |                          std::numeric_limits<decltype(val)>::min(),
   66|       |                          std::numeric_limits<T>::min())) {
   67|       |            if (std::cmp_less(val, std::numeric_limits<T>::min())) {
   68|       |                return false;
   69|       |            }
   70|       |        }
   71|       |        if constexpr (std::cmp_greater(
   72|       |                          std::numeric_limits<decltype(val)>::max(),
   73|    516|                          std::numeric_limits<T>::max())) {
   74|    516|            if (std::cmp_greater(val, std::numeric_limits<T>::max())) {
  ------------------
  |  Branch (74:17): [True: 0, False: 516]
  ------------------
   75|      0|                return false;
   76|      0|            }
   77|    516|        }
   78|    516|        return true;
   79|    516|    }
_ZN4qpdf4util9assertionIRA56_KcEEvbOT_:
   27|    258|    {
   28|    258|        if (!cond) {
  ------------------
  |  Branch (28:13): [True: 0, False: 258]
  ------------------
   29|      0|            throw std::logic_error(std::forward<T>(msg));
   30|      0|        }
   31|    258|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA53_KcEEvbOT_:
   48|    258|    {
   49|    258|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 258]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    258|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA51_KcEEvbOT_:
   48|    258|    {
   49|    258|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 258]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    258|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA92_KcEEvbOT_:
   48|    258|    {
   49|    258|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 258]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    258|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA49_KcEEvbOT_:
   48|    258|    {
   49|    258|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 258]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    258|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA36_KcEEvbOT_:
   48|    258|    {
   49|    258|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 258]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    258|    }

BitStream.cc:_ZL9read_bitsRPKhRmS2_m:
   21|   125k|{
   22|       |    // View p as a stream of bits:
   23|       |
   24|       |    // 76543210 76543210 ....
   25|       |
   26|       |    // bit_offset is the bit number within the first byte that marks
   27|       |    // the first bit that we would read.
   28|       |
   29|   125k|    if (bits_wanted > bits_available) {
  ------------------
  |  Branch (29:9): [True: 0, False: 125k]
  ------------------
   30|      0|        throw std::runtime_error(
   31|      0|            "overflow reading bit stream: wanted = " + std::to_string(bits_wanted) +
   32|      0|            "; available = " + std::to_string(bits_available));
   33|      0|    }
   34|   125k|    if (bits_wanted > 32) {
  ------------------
  |  Branch (34:9): [True: 0, False: 125k]
  ------------------
   35|      0|        throw std::out_of_range("read_bits: too many bits requested");
   36|      0|    }
   37|       |
   38|   125k|    unsigned long result = 0;
   39|       |# ifdef BITS_TESTING
   40|       |    if (bits_wanted == 0) {
   41|       |        QTC::TC("libtests", "bits zero bits wanted");
   42|       |    }
   43|       |# endif
   44|   313k|    while (bits_wanted > 0) {
  ------------------
  |  Branch (44:12): [True: 187k, False: 125k]
  ------------------
   45|       |        // Grab bits from the first byte clearing anything before
   46|       |        // bit_offset.
   47|   187k|        unsigned char byte = static_cast<unsigned char>(*p & ((1U << (bit_offset + 1U)) - 1U));
   48|       |
   49|       |        // There are bit_offset + 1 bits available in the first byte.
   50|   187k|        size_t to_copy = std::min(bits_wanted, bit_offset + 1);
   51|   187k|        size_t leftover = (bit_offset + 1) - to_copy;
   52|       |
   53|       |# ifdef BITS_TESTING
   54|       |        QTC::TC("libtests", "bits bit_offset", ((bit_offset == 0) ? 0 : (bit_offset == 7) ? 1 : 2));
   55|       |        QTC::TC("libtests", "bits leftover", (leftover > 0) ? 1 : 0);
   56|       |# endif
   57|       |
   58|       |        // Right shift so that all the bits we want are right justified.
   59|   187k|        byte = static_cast<unsigned char>(byte >> leftover);
   60|       |
   61|       |        // Copy the bits into result
   62|   187k|        result <<= to_copy;
   63|   187k|        result |= byte;
   64|       |
   65|       |        // Update pointers
   66|   187k|        if (leftover) {
  ------------------
  |  Branch (66:13): [True: 109k, False: 78.3k]
  ------------------
   67|   109k|            bit_offset = leftover - 1;
   68|   109k|        } else {
   69|  78.3k|            bit_offset = 7;
   70|  78.3k|            ++p;
   71|  78.3k|        }
   72|   187k|        bits_wanted -= to_copy;
   73|   187k|        bits_available -= to_copy;
   74|       |
   75|       |# ifdef BITS_TESTING
   76|       |        QTC::TC("libtests", "bits iterations", ((bits_wanted > 8) ? 0 : (bits_wanted > 0) ? 1 : 2));
   77|       |# endif
   78|   187k|    }
   79|       |
   80|   125k|    return result;
   81|   125k|}
BitWriter.cc:_ZL10write_bitsRhRmymP8Pipeline:
   88|   125k|{
   89|   125k|    if (bits > 32) {
  ------------------
  |  Branch (89:9): [True: 0, False: 125k]
  ------------------
   90|      0|        throw std::out_of_range("write_bits: too many bits requested");
   91|      0|    }
   92|       |
   93|       |    // bit_offset + 1 is the number of bits left in ch
   94|       |# ifdef BITS_TESTING
   95|       |    if (bits == 0) {
   96|       |        QTC::TC("libtests", "bits write zero bits");
   97|       |    }
   98|       |# endif
   99|   313k|    while (bits > 0) {
  ------------------
  |  Branch (99:12): [True: 187k, False: 125k]
  ------------------
  100|   187k|        size_t bits_to_write = std::min(bits, bit_offset + 1);
  101|   187k|        unsigned char newval = static_cast<unsigned char>(
  102|   187k|            (val >> (bits - bits_to_write)) & ((1U << bits_to_write) - 1));
  103|   187k|        size_t bits_left_in_ch = bit_offset + 1 - bits_to_write;
  104|   187k|        newval = static_cast<unsigned char>(newval << bits_left_in_ch);
  105|   187k|        ch |= newval;
  106|   187k|        if (bits_left_in_ch == 0) {
  ------------------
  |  Branch (106:13): [True: 78.3k, False: 109k]
  ------------------
  107|       |# ifdef BITS_TESTING
  108|       |            QTC::TC("libtests", "bits write pipeline");
  109|       |# endif
  110|  78.3k|            pipeline->write(&ch, 1);
  111|  78.3k|            bit_offset = 7;
  112|  78.3k|            ch = 0;
  113|   109k|        } else {
  114|       |# ifdef BITS_TESTING
  115|       |            QTC::TC("libtests", "bits write leftover");
  116|       |# endif
  117|   109k|            bit_offset -= bits_to_write;
  118|   109k|        }
  119|   187k|        bits -= bits_to_write;
  120|       |# ifdef BITS_TESTING
  121|       |        QTC::TC("libtests", "bits write iterations", ((bits > 8) ? 0 : (bits > 0) ? 1 : 2));
  122|       |# endif
  123|   187k|    }
  124|   125k|}

_ZN4qpdf6global6Limits15tiff_max_memoryEv:
  140|      2|        {
  141|      2|            return l.tiff_max_memory_;
  142|      2|        }