LLVMFuzzerTestOneInput:
   39|    123|{
   40|    123|    FuzzHelper f(data, size);
   41|    123|    f.run();
   42|    123|    return 0;
   43|    123|}
_ZN10FuzzHelperC2EPKhm:
   10|    123|        data(data),
   11|    123|        size(size)
   12|    123|    {
   13|    123|    }
_ZN10FuzzHelper3runEv:
   17|    123|    {
   18|    123|        Pl_Discard discard;
   19|    123|        Pl_TIFFPredictor p("decoder", &discard, Pl_TIFFPredictor::a_decode, 16, 1, 8);
   20|       |        // Exercise with strange values for some of the parameters.
   21|    123|        Pl_TIFFPredictor p2("decoder", &discard, Pl_TIFFPredictor::a_decode, 16, 2, 5);
   22|    123|        try {
   23|    123|            p.write(data, size);
   24|    123|            p.finish();
   25|    123|            p2.write(data, size);
   26|    123|            p2.finish();
   27|    123|        } catch (std::runtime_error const& e) {
   28|      0|            std::cerr << "runtime_error: " << e.what() << '\n';
   29|      0|        }
   30|    123|    }

_ZN8PipelineD2Ev:
   52|    369|    virtual ~Pipeline() = default;
_ZNK8Pipeline4nextEv:
  103|  9.01k|    {
  104|  9.01k|        return next_;
  105|  9.01k|    }

_ZN5QIntC7to_uintImEEjRKT_:
  208|  3.90k|    {
  209|  3.90k|        return IntConverter<T, unsigned int>::convert(i);
  210|  3.90k|    }
_ZN5QIntC12IntConverterImjLb0ELb0EE7convertERKm:
   69|  3.90k|        {
   70|       |            // From and To are both unsigned.
   71|  3.90k|            if (i > std::numeric_limits<To>::max()) {
  ------------------
  |  Branch (71:17): [True: 0, False: 3.90k]
  ------------------
   72|      0|                error(i);
   73|      0|            }
   74|  3.90k|            return static_cast<To>(i);
   75|  3.90k|        }

_ZN3QTC2TCEPKcS1_i:
   36|  8.77k|    {
   37|       |#ifndef QPDF_DISABLE_QTC
   38|       |        TC_real(scope, ccase, n);
   39|       |#endif // QPDF_DISABLE_QTC
   40|  8.77k|    }

_ZN9BitStreamC2EPKhm:
   13|  3.90k|    start(p),
   14|  3.90k|    nbytes(nbytes)
   15|  3.90k|{
   16|  3.90k|    reset();
   17|  3.90k|}
_ZN9BitStream5resetEv:
   21|  3.90k|{
   22|  3.90k|    p = start;
   23|  3.90k|    bit_offset = 7;
   24|  3.90k|    if (QIntC::to_uint(nbytes) > static_cast<unsigned int>(-1) / 8) {
  ------------------
  |  Branch (24:9): [True: 0, False: 3.90k]
  ------------------
   25|      0|        throw std::runtime_error("array too large for bitstream");
   26|      0|    }
   27|  3.90k|    bits_available = 8 * nbytes;
   28|  3.90k|}
_ZN9BitStream13getBitsSignedEm:
   38|   125k|{
   39|   125k|    unsigned long long bits = read_bits(this->p, this->bit_offset, this->bits_available, nbits);
   40|   125k|    long long result = 0;
   41|   125k|    if (static_cast<long long>(bits) > 1LL << (nbits - 1)) {
  ------------------
  |  Branch (41:9): [True: 59.6k, False: 65.3k]
  ------------------
   42|  59.6k|        result = static_cast<long long>(bits - (1ULL << nbits));
   43|  65.3k|    } else {
   44|  65.3k|        result = static_cast<long long>(bits);
   45|  65.3k|    }
   46|   125k|    return result;
   47|   125k|}

_ZN9BitWriterC2EP8Pipeline:
    8|  3.90k|    pl(pl)
    9|  3.90k|{
   10|  3.90k|}
_ZN9BitWriter9writeBitsEym:
   14|   125k|{
   15|   125k|    write_bits(this->ch, this->bit_offset, val, bits, this->pl);
   16|   125k|}
_ZN9BitWriter15writeBitsSignedExm:
   20|   125k|{
   21|   125k|    unsigned long long uval = 0;
   22|   125k|    if (val < 0) {
  ------------------
  |  Branch (22:9): [True: 57.1k, False: 67.8k]
  ------------------
   23|  57.1k|        uval = (1ULL << bits) + static_cast<unsigned long long>(val);
   24|  67.8k|    } else {
   25|  67.8k|        uval = static_cast<unsigned long long>(val);
   26|  67.8k|    }
   27|   125k|    writeBits(uval, bits);
   28|   125k|}
_ZN9BitWriter5flushEv:
   38|  3.90k|{
   39|  3.90k|    if (bit_offset < 7) {
  ------------------
  |  Branch (39:9): [True: 0, False: 3.90k]
  ------------------
   40|      0|        size_t bits_to_write = bit_offset + 1;
   41|      0|        write_bits(this->ch, this->bit_offset, 0, bits_to_write, this->pl);
   42|      0|    }
   43|  3.90k|}

_ZN8PipelineC2EPKcPS_:
   11|    369|    identifier(identifier),
   12|    369|    next_(next)
   13|    369|{
   14|    369|}

_ZN10Pl_DiscardC2Ev:
    9|    123|    Pipeline("discard", nullptr)
   10|    123|{
   11|    123|}
_ZN10Pl_DiscardD2Ev:
   14|    123|Pl_Discard::~Pl_Discard() = default;
_ZN10Pl_Discard5writeEPKhm:
   18|  83.0k|{
   19|  83.0k|}
_ZN10Pl_Discard6finishEv:
   23|    246|{
   24|    246|}

_ZN16Pl_TIFFPredictorC2EPKcP8PipelineNS_8action_eEjjj:
   26|    246|    Pipeline(identifier, next),
   27|    246|    action(action),
   28|    246|    columns(columns),
   29|    246|    samples_per_pixel(samples_per_pixel),
   30|    246|    bits_per_sample(bits_per_sample)
   31|    246|{
   32|    246|    util::assertion(next, "Attempt to create Pl_TIFFPredictor with nullptr as next");
   33|    246|    util::no_ci_rt_error_if(
   34|    246|        samples_per_pixel < 1, "TIFFPredictor created with invalid samples_per_pixel");
   35|    246|    util::no_ci_rt_error_if(
   36|    246|        bits_per_sample < 1 || bits_per_sample > (8 * (sizeof(unsigned long long))),
  ------------------
  |  Branch (36:9): [True: 0, False: 246]
  |  Branch (36:32): [True: 0, False: 246]
  ------------------
   37|    246|        "TIFFPredictor created with invalid bits_per_sample");
   38|    246|    auto bits_per_pixel = 1ULL * bits_per_sample * samples_per_pixel;
   39|    246|    util::no_ci_rt_error_if(
   40|    246|        !util::fits<uint32_t>(bits_per_pixel + 7),
   41|    246|        "TIFFPredictor created with bits_per_sample and samples_per_pixel values that cause "
   42|    246|        "overflow");
   43|    246|    auto bpr = (columns * bits_per_pixel + 7) / 8;
   44|    246|    util::no_ci_rt_error_if(
   45|    246|        bpr == 0 || !util::fits<uint32_t>(bpr), "TIFFPredictor created with invalid columns value");
  ------------------
  |  Branch (45:9): [True: 0, False: 246]
  |  Branch (45:21): [True: 0, False: 246]
  ------------------
   46|    246|    util::no_ci_rt_error_if(
   47|    246|        memory_limit > 0 && bpr > (memory_limit / 2ULL), "TIFFPredictor memory limit exceeded");
  ------------------
  |  Branch (47:9): [True: 0, False: 246]
  |  Branch (47:29): [True: 0, False: 0]
  ------------------
   48|    246|    bytes_per_row = static_cast<uint32_t>(bpr);
   49|    246|}
_ZN16Pl_TIFFPredictor5writeEPKhm:
   59|    246|{
   60|    246|    auto end = data + len;
   61|    246|    auto row_end = data + (bytes_per_row - cur_row.size());
   62|  8.79k|    while (row_end <= end) {
  ------------------
  |  Branch (62:12): [True: 8.55k, False: 246]
  ------------------
   63|       |        // finish off current row
   64|  8.55k|        cur_row.insert(cur_row.end(), data, row_end);
   65|  8.55k|        data = row_end;
   66|  8.55k|        row_end += bytes_per_row;
   67|       |
   68|  8.55k|        processRow();
   69|       |
   70|       |        // Prepare for next row
   71|  8.55k|        cur_row.clear();
   72|  8.55k|    }
   73|       |
   74|    246|    cur_row.insert(cur_row.end(), data, end);
   75|    246|}
_ZN16Pl_TIFFPredictor10processRowEv:
   79|  8.77k|{
   80|  8.77k|    QTC::TC("libtests", "Pl_TIFFPredictor processRow", (action == a_decode ? 0 : 1));
  ------------------
  |  Branch (80:57): [True: 8.77k, False: 0]
  ------------------
   81|  8.77k|    previous.assign(samples_per_pixel, 0);
   82|  8.77k|    if (bits_per_sample != 8) {
  ------------------
  |  Branch (82:9): [True: 3.90k, False: 4.86k]
  ------------------
   83|  3.90k|        BitWriter bw(next());
   84|  3.90k|        BitStream in(cur_row.data(), cur_row.size());
   85|  66.4k|        for (uint32_t col = 0; col < this->columns; ++col) {
  ------------------
  |  Branch (85:32): [True: 62.5k, False: 3.90k]
  ------------------
   86|   125k|            for (auto& prev: previous) {
  ------------------
  |  Branch (86:28): [True: 125k, False: 62.5k]
  ------------------
   87|   125k|                long long sample = in.getBitsSigned(this->bits_per_sample);
   88|   125k|                long long new_sample = sample;
   89|   125k|                if (action == a_encode) {
  ------------------
  |  Branch (89:21): [True: 0, False: 125k]
  ------------------
   90|      0|                    new_sample -= prev;
   91|      0|                    prev = sample;
   92|   125k|                } else {
   93|   125k|                    new_sample += prev;
   94|   125k|                    prev = new_sample;
   95|   125k|                }
   96|   125k|                bw.writeBitsSigned(new_sample, this->bits_per_sample);
   97|   125k|            }
   98|  62.5k|        }
   99|  3.90k|        bw.flush();
  100|  4.86k|    } else {
  101|  4.86k|        out.clear();
  102|  4.86k|        auto next_it = cur_row.begin();
  103|  4.86k|        auto cr_end = cur_row.end();
  104|  4.86k|        auto pr_end = previous.end();
  105|       |
  106|  82.6k|        while (next_it != cr_end) {
  ------------------
  |  Branch (106:16): [True: 77.8k, False: 4.86k]
  ------------------
  107|   155k|            for (auto prev = previous.begin(); prev != pr_end && next_it != cr_end;
  ------------------
  |  Branch (107:48): [True: 77.8k, False: 77.8k]
  |  Branch (107:66): [True: 77.8k, False: 0]
  ------------------
  108|  77.8k|                 ++prev, ++next_it) {
  109|  77.8k|                long long sample = *next_it;
  110|  77.8k|                long long new_sample = sample;
  111|  77.8k|                if (action == a_encode) {
  ------------------
  |  Branch (111:21): [True: 0, False: 77.8k]
  ------------------
  112|      0|                    new_sample -= *prev;
  113|      0|                    *prev = sample;
  114|  77.8k|                } else {
  115|  77.8k|                    new_sample += *prev;
  116|  77.8k|                    *prev = new_sample;
  117|  77.8k|                }
  118|  77.8k|                out.push_back(static_cast<unsigned char>(255U & new_sample));
  119|  77.8k|            }
  120|  77.8k|        }
  121|  4.86k|        next()->write(out.data(), out.size());
  122|  4.86k|    }
  123|  8.77k|}
_ZN16Pl_TIFFPredictor6finishEv:
  127|    246|{
  128|    246|    if (!cur_row.empty()) {
  ------------------
  |  Branch (128:9): [True: 221, False: 25]
  ------------------
  129|       |        // write partial row
  130|    221|        cur_row.insert(cur_row.end(), bytes_per_row - cur_row.size(), 0);
  131|    221|        processRow();
  132|    221|    }
  133|    246|    cur_row.clear();
  134|    246|    next()->finish();
  135|    246|}

_ZN16Pl_TIFFPredictorD2Ev:
   24|    246|    ~Pl_TIFFPredictor() override = default;

_ZN4qpdf4util4fitsIjTkNSt3__18integralEyQsr3stdE8integralIT_EEEbT0_:
   63|    492|    {
   64|       |        if constexpr (std::cmp_less(
   65|       |                          std::numeric_limits<decltype(val)>::min(),
   66|       |                          std::numeric_limits<T>::min())) {
   67|       |            if (std::cmp_less(val, std::numeric_limits<T>::min())) {
   68|       |                return false;
   69|       |            }
   70|       |        }
   71|       |        if constexpr (std::cmp_greater(
   72|       |                          std::numeric_limits<decltype(val)>::max(),
   73|    492|                          std::numeric_limits<T>::max())) {
   74|    492|            if (std::cmp_greater(val, std::numeric_limits<T>::max())) {
  ------------------
  |  Branch (74:17): [True: 0, False: 492]
  ------------------
   75|      0|                return false;
   76|      0|            }
   77|    492|        }
   78|    492|        return true;
   79|    492|    }
_ZN4qpdf4util9assertionIRA56_KcEEvbOT_:
   27|    246|    {
   28|    246|        if (!cond) {
  ------------------
  |  Branch (28:13): [True: 0, False: 246]
  ------------------
   29|      0|            throw std::logic_error(std::forward<T>(msg));
   30|      0|        }
   31|    246|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA53_KcEEvbOT_:
   48|    246|    {
   49|    246|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 246]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    246|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA51_KcEEvbOT_:
   48|    246|    {
   49|    246|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 246]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    246|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA92_KcEEvbOT_:
   48|    246|    {
   49|    246|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 246]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    246|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA49_KcEEvbOT_:
   48|    246|    {
   49|    246|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 246]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    246|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA36_KcEEvbOT_:
   48|    246|    {
   49|    246|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 246]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    246|    }

BitStream.cc:_ZL9read_bitsRPKhRmS2_m:
   21|   125k|{
   22|       |    // View p as a stream of bits:
   23|       |
   24|       |    // 76543210 76543210 ....
   25|       |
   26|       |    // bit_offset is the bit number within the first byte that marks
   27|       |    // the first bit that we would read.
   28|       |
   29|   125k|    if (bits_wanted > bits_available) {
  ------------------
  |  Branch (29:9): [True: 0, False: 125k]
  ------------------
   30|      0|        throw std::runtime_error(
   31|      0|            "overflow reading bit stream: wanted = " + std::to_string(bits_wanted) +
   32|      0|            "; available = " + std::to_string(bits_available));
   33|      0|    }
   34|   125k|    if (bits_wanted > 32) {
  ------------------
  |  Branch (34:9): [True: 0, False: 125k]
  ------------------
   35|      0|        throw std::out_of_range("read_bits: too many bits requested");
   36|      0|    }
   37|       |
   38|   125k|    unsigned long result = 0;
   39|       |# ifdef BITS_TESTING
   40|       |    if (bits_wanted == 0) {
   41|       |        QTC::TC("libtests", "bits zero bits wanted");
   42|       |    }
   43|       |# endif
   44|   312k|    while (bits_wanted > 0) {
  ------------------
  |  Branch (44:12): [True: 187k, False: 125k]
  ------------------
   45|       |        // Grab bits from the first byte clearing anything before
   46|       |        // bit_offset.
   47|   187k|        unsigned char byte = static_cast<unsigned char>(*p & ((1U << (bit_offset + 1U)) - 1U));
   48|       |
   49|       |        // There are bit_offset + 1 bits available in the first byte.
   50|   187k|        size_t to_copy = std::min(bits_wanted, bit_offset + 1);
   51|   187k|        size_t leftover = (bit_offset + 1) - to_copy;
   52|       |
   53|       |# ifdef BITS_TESTING
   54|       |        QTC::TC("libtests", "bits bit_offset", ((bit_offset == 0) ? 0 : (bit_offset == 7) ? 1 : 2));
   55|       |        QTC::TC("libtests", "bits leftover", (leftover > 0) ? 1 : 0);
   56|       |# endif
   57|       |
   58|       |        // Right shift so that all the bits we want are right justified.
   59|   187k|        byte = static_cast<unsigned char>(byte >> leftover);
   60|       |
   61|       |        // Copy the bits into result
   62|   187k|        result <<= to_copy;
   63|   187k|        result |= byte;
   64|       |
   65|       |        // Update pointers
   66|   187k|        if (leftover) {
  ------------------
  |  Branch (66:13): [True: 109k, False: 78.1k]
  ------------------
   67|   109k|            bit_offset = leftover - 1;
   68|   109k|        } else {
   69|  78.1k|            bit_offset = 7;
   70|  78.1k|            ++p;
   71|  78.1k|        }
   72|   187k|        bits_wanted -= to_copy;
   73|   187k|        bits_available -= to_copy;
   74|       |
   75|       |# ifdef BITS_TESTING
   76|       |        QTC::TC("libtests", "bits iterations", ((bits_wanted > 8) ? 0 : (bits_wanted > 0) ? 1 : 2));
   77|       |# endif
   78|   187k|    }
   79|       |
   80|   125k|    return result;
   81|   125k|}
BitWriter.cc:_ZL10write_bitsRhRmymP8Pipeline:
   88|   125k|{
   89|   125k|    if (bits > 32) {
  ------------------
  |  Branch (89:9): [True: 0, False: 125k]
  ------------------
   90|      0|        throw std::out_of_range("write_bits: too many bits requested");
   91|      0|    }
   92|       |
   93|       |    // bit_offset + 1 is the number of bits left in ch
   94|       |# ifdef BITS_TESTING
   95|       |    if (bits == 0) {
   96|       |        QTC::TC("libtests", "bits write zero bits");
   97|       |    }
   98|       |# endif
   99|   312k|    while (bits > 0) {
  ------------------
  |  Branch (99:12): [True: 187k, False: 125k]
  ------------------
  100|   187k|        size_t bits_to_write = std::min(bits, bit_offset + 1);
  101|   187k|        unsigned char newval = static_cast<unsigned char>(
  102|   187k|            (val >> (bits - bits_to_write)) & ((1U << bits_to_write) - 1));
  103|   187k|        size_t bits_left_in_ch = bit_offset + 1 - bits_to_write;
  104|   187k|        newval = static_cast<unsigned char>(newval << bits_left_in_ch);
  105|   187k|        ch |= newval;
  106|   187k|        if (bits_left_in_ch == 0) {
  ------------------
  |  Branch (106:13): [True: 78.1k, False: 109k]
  ------------------
  107|       |# ifdef BITS_TESTING
  108|       |            QTC::TC("libtests", "bits write pipeline");
  109|       |# endif
  110|  78.1k|            pipeline->write(&ch, 1);
  111|  78.1k|            bit_offset = 7;
  112|  78.1k|            ch = 0;
  113|   109k|        } else {
  114|       |# ifdef BITS_TESTING
  115|       |            QTC::TC("libtests", "bits write leftover");
  116|       |# endif
  117|   109k|            bit_offset -= bits_to_write;
  118|   109k|        }
  119|   187k|        bits -= bits_to_write;
  120|       |# ifdef BITS_TESTING
  121|       |        QTC::TC("libtests", "bits write iterations", ((bits > 8) ? 0 : (bits > 0) ? 1 : 2));
  122|       |# endif
  123|   187k|    }
  124|   125k|}

_ZN4qpdf6global6Limits15tiff_max_memoryEv:
  140|      2|        {
  141|      2|            return l.tiff_max_memory_;
  142|      2|        }