LLVMFuzzerTestOneInput:
   35|    176|{
   36|    176|    FuzzHelper f(data, size);
   37|    176|    f.run();
   38|    176|    return 0;
   39|    176|}
_ZN10FuzzHelperC2EPKhm:
   10|    176|        data(data),
   11|    176|        size(size)
   12|    176|    {
   13|    176|    }
_ZN10FuzzHelper3runEv:
   17|    176|    {
   18|    176|        Pl_Discard discard;
   19|    176|        Pl_PNGFilter p("decode", &discard, Pl_PNGFilter::a_decode, 32, 1, 8);
   20|    176|        try {
   21|    176|            p.write(data, size);
   22|    176|            p.finish();
   23|    176|        } catch (std::runtime_error const& e) {
   24|      0|            std::cerr << "runtime_error: " << e.what() << '\n';
   25|      0|        }
   26|    176|    }

_ZN8PipelineD2Ev:
   52|    352|    virtual ~Pipeline() = default;
_ZNK8Pipeline4nextEv:
  103|   226k|    {
  104|   226k|        return next_;
  105|   226k|    }

_ZN5QUtil17make_shared_arrayIhEENSt3__110shared_ptrIT_EEm:
  183|    352|    {
  184|    352|        return std::shared_ptr<T>(new T[n], std::default_delete<T[]>());
  185|    352|    }

_ZN8PipelineC2EPKcPS_:
   11|    352|    identifier(identifier),
   12|    352|    next_(next)
   13|    352|{
   14|    352|}

_ZN10Pl_DiscardC2Ev:
    9|    176|    Pipeline("discard", nullptr)
   10|    176|{
   11|    176|}
_ZN10Pl_DiscardD2Ev:
   14|    176|Pl_Discard::~Pl_Discard() = default;
_ZN10Pl_Discard5writeEPKhm:
   18|   226k|{
   19|   226k|}
_ZN10Pl_Discard6finishEv:
   23|    176|{
   24|    176|}

_ZN12Pl_PNGFilterC2EPKcP8PipelineNS_8action_eEjjj:
   30|    176|    Pipeline(identifier, next),
   31|    176|    action(action)
   32|    176|{
   33|    176|    util::assertion(next, "Attempt to create Pl_PNGFilter with nullptr as next");
   34|    176|    util::no_ci_rt_error_if(
   35|    176|        samples_per_pixel < 1, "PNGFilter created with invalid samples_per_pixel");
   36|    176|    util::no_ci_rt_error_if(
   37|    176|        !(bits_per_sample == 1 || bits_per_sample == 2 || bits_per_sample == 4 ||
  ------------------
  |  Branch (37:11): [True: 0, False: 176]
  |  Branch (37:35): [True: 0, False: 176]
  |  Branch (37:59): [True: 0, False: 176]
  ------------------
   38|    176|          bits_per_sample == 8 || bits_per_sample == 16),
  ------------------
  |  Branch (38:11): [True: 176, False: 0]
  |  Branch (38:35): [True: 0, False: 0]
  ------------------
   39|    176|        "PNGFilter created with invalid bits_per_sample not 1, 2, 4, 8, or 16");
   40|    176|    auto bits_per_pixel = 1ULL * bits_per_sample * samples_per_pixel;
   41|    176|    util::no_ci_rt_error_if(
   42|    176|        !util::fits<uint32_t>(bits_per_pixel + 7),
   43|    176|        "PNGFilter created with bits_per_sample and samples_per_pixel values that cause overflow");
   44|    176|    bytes_per_pixel = static_cast<uint32_t>((bits_per_pixel + 7) / 8);
   45|    176|    auto bpr = ((columns * bits_per_pixel) + 7) / 8;
   46|    176|    util::no_ci_rt_error_if(
   47|    176|        bpr == 0 || !util::fits<uint32_t>(bpr), "PNGFilter created with invalid columns value");
  ------------------
  |  Branch (47:9): [True: 0, False: 176]
  |  Branch (47:21): [True: 0, False: 176]
  ------------------
   48|    176|    util::no_ci_rt_error_if(
   49|    176|        memory_limit > 0 && bpr > (memory_limit / 2U), "PNGFilter memory limit exceeded");
  ------------------
  |  Branch (49:9): [True: 0, False: 176]
  |  Branch (49:29): [True: 0, False: 0]
  ------------------
   50|    176|    bytes_per_row = static_cast<uint32_t>(bpr);
   51|    176|    buf1 = QUtil::make_shared_array<unsigned char>(bytes_per_row + 1);
   52|    176|    buf2 = QUtil::make_shared_array<unsigned char>(bytes_per_row + 1);
   53|    176|    memset(buf1.get(), 0, bytes_per_row + 1);
   54|    176|    memset(buf2.get(), 0, bytes_per_row + 1);
   55|    176|    cur_row = buf1.get();
   56|    176|    prev_row = buf2.get();
   57|       |
   58|       |    // number of bytes per incoming row
   59|    176|    incoming = (action == a_encode ? bytes_per_row : bytes_per_row + 1);
  ------------------
  |  Branch (59:17): [True: 0, False: 176]
  ------------------
   60|    176|}
_ZN12Pl_PNGFilter5writeEPKhm:
   70|    176|{
   71|    176|    size_t left = incoming - pos;
   72|    176|    size_t offset = 0;
   73|   226k|    while (len >= left) {
  ------------------
  |  Branch (73:12): [True: 226k, False: 176]
  ------------------
   74|       |        // finish off current row
   75|   226k|        memcpy(cur_row + pos, data + offset, left);
   76|   226k|        offset += left;
   77|   226k|        len -= left;
   78|       |
   79|   226k|        processRow();
   80|       |
   81|       |        // Swap rows
   82|   226k|        unsigned char* t = prev_row;
   83|   226k|        prev_row = cur_row;
   84|   226k|        cur_row = t ? t : buf2.get();
  ------------------
  |  Branch (84:19): [True: 226k, False: 0]
  ------------------
   85|   226k|        memset(cur_row, 0, bytes_per_row + 1);
   86|   226k|        left = incoming;
   87|   226k|        pos = 0;
   88|   226k|    }
   89|    176|    if (len) {
  ------------------
  |  Branch (89:9): [True: 161, False: 15]
  ------------------
   90|    161|        memcpy(cur_row + pos, data + offset, len);
   91|    161|    }
   92|    176|    pos += len;
   93|    176|}
_ZN12Pl_PNGFilter10processRowEv:
   97|   226k|{
   98|   226k|    if (action == a_encode) {
  ------------------
  |  Branch (98:9): [True: 0, False: 226k]
  ------------------
   99|      0|        encodeRow();
  100|   226k|    } else {
  101|   226k|        decodeRow();
  102|   226k|    }
  103|   226k|}
_ZN12Pl_PNGFilter9decodeRowEv:
  107|   226k|{
  108|   226k|    int filter = cur_row[0];
  109|   226k|    if (prev_row) {
  ------------------
  |  Branch (109:9): [True: 226k, False: 0]
  ------------------
  110|   226k|        switch (filter) {
  111|   127k|        case 0:
  ------------------
  |  Branch (111:9): [True: 127k, False: 98.4k]
  ------------------
  112|   127k|            break;
  113|  8.31k|        case 1:
  ------------------
  |  Branch (113:9): [True: 8.31k, False: 218k]
  ------------------
  114|  8.31k|            decodeSub();
  115|  8.31k|            break;
  116|  2.23k|        case 2:
  ------------------
  |  Branch (116:9): [True: 2.23k, False: 224k]
  ------------------
  117|  2.23k|            decodeUp();
  118|  2.23k|            break;
  119|  5.60k|        case 3:
  ------------------
  |  Branch (119:9): [True: 5.60k, False: 220k]
  ------------------
  120|  5.60k|            decodeAverage();
  121|  5.60k|            break;
  122|  5.34k|        case 4:
  ------------------
  |  Branch (122:9): [True: 5.34k, False: 221k]
  ------------------
  123|  5.34k|            decodePaeth();
  124|  5.34k|            break;
  125|  76.9k|        default:
  ------------------
  |  Branch (125:9): [True: 76.9k, False: 149k]
  ------------------
  126|       |            // ignore
  127|  76.9k|            break;
  128|   226k|        }
  129|   226k|    }
  130|       |
  131|   226k|    next()->write(cur_row + 1, bytes_per_row);
  132|   226k|}
_ZN12Pl_PNGFilter9decodeSubEv:
  136|  8.31k|{
  137|  8.31k|    unsigned char* buffer = cur_row + 1;
  138|  8.31k|    unsigned int bpp = bytes_per_pixel;
  139|       |
  140|   274k|    for (unsigned int i = 0; i < bytes_per_row; ++i) {
  ------------------
  |  Branch (140:30): [True: 266k, False: 8.31k]
  ------------------
  141|   266k|        unsigned char left = 0;
  142|       |
  143|   266k|        if (i >= bpp) {
  ------------------
  |  Branch (143:13): [True: 257k, False: 8.31k]
  ------------------
  144|   257k|            left = buffer[i - bpp];
  145|   257k|        }
  146|       |
  147|   266k|        buffer[i] = static_cast<unsigned char>(buffer[i] + left);
  148|   266k|    }
  149|  8.31k|}
_ZN12Pl_PNGFilter8decodeUpEv:
  153|  2.23k|{
  154|  2.23k|    unsigned char* buffer = cur_row + 1;
  155|  2.23k|    unsigned char* above_buffer = prev_row + 1;
  156|       |
  157|  73.7k|    for (unsigned int i = 0; i < bytes_per_row; ++i) {
  ------------------
  |  Branch (157:30): [True: 71.5k, False: 2.23k]
  ------------------
  158|  71.5k|        unsigned char up = above_buffer[i];
  159|  71.5k|        buffer[i] = static_cast<unsigned char>(buffer[i] + up);
  160|  71.5k|    }
  161|  2.23k|}
_ZN12Pl_PNGFilter13decodeAverageEv:
  165|  5.60k|{
  166|  5.60k|    unsigned char* buffer = cur_row + 1;
  167|  5.60k|    unsigned char* above_buffer = prev_row + 1;
  168|  5.60k|    auto bpp = bytes_per_pixel;
  169|       |
  170|   184k|    for (unsigned int i = 0; i < bytes_per_row; ++i) {
  ------------------
  |  Branch (170:30): [True: 179k, False: 5.60k]
  ------------------
  171|   179k|        int left = 0;
  172|   179k|        int up = 0;
  173|       |
  174|   179k|        if (i >= bpp) {
  ------------------
  |  Branch (174:13): [True: 173k, False: 5.60k]
  ------------------
  175|   173k|            left = buffer[i - bpp];
  176|   173k|        }
  177|       |
  178|   179k|        up = above_buffer[i];
  179|   179k|        buffer[i] = static_cast<unsigned char>(buffer[i] + (left + up) / 2);
  180|   179k|    }
  181|  5.60k|}
_ZN12Pl_PNGFilter11decodePaethEv:
  185|  5.34k|{
  186|  5.34k|    unsigned char* buffer = cur_row + 1;
  187|  5.34k|    unsigned char* above_buffer = prev_row + 1;
  188|  5.34k|    auto bpp = bytes_per_pixel;
  189|       |
  190|   176k|    for (unsigned int i = 0; i < bytes_per_row; ++i) {
  ------------------
  |  Branch (190:30): [True: 171k, False: 5.34k]
  ------------------
  191|   171k|        int left = 0;
  192|   171k|        int up = above_buffer[i];
  193|   171k|        int upper_left = 0;
  194|       |
  195|   171k|        if (i >= bpp) {
  ------------------
  |  Branch (195:13): [True: 165k, False: 5.34k]
  ------------------
  196|   165k|            left = buffer[i - bpp];
  197|   165k|            upper_left = above_buffer[i - bpp];
  198|   165k|        }
  199|       |
  200|   171k|        buffer[i] = static_cast<unsigned char>(buffer[i] + PaethPredictor(left, up, upper_left));
  201|   171k|    }
  202|  5.34k|}
_ZN12Pl_PNGFilter14PaethPredictorEiii:
  206|   171k|{
  207|   171k|    int p = a + b - c;
  208|   171k|    int pa = abs_diff(p, a);
  209|   171k|    int pb = abs_diff(p, b);
  210|   171k|    int pc = abs_diff(p, c);
  211|       |
  212|   171k|    if (pa <= pb && pa <= pc) {
  ------------------
  |  Branch (212:9): [True: 126k, False: 44.8k]
  |  Branch (212:21): [True: 122k, False: 3.87k]
  ------------------
  213|   122k|        return a;
  214|   122k|    }
  215|  48.6k|    if (pb <= pc) {
  ------------------
  |  Branch (215:9): [True: 42.1k, False: 6.57k]
  ------------------
  216|  42.1k|        return b;
  217|  42.1k|    }
  218|  6.57k|    return c;
  219|  48.6k|}
_ZN12Pl_PNGFilter6finishEv:
  239|    176|{
  240|    176|    if (pos) {
  ------------------
  |  Branch (240:9): [True: 161, False: 15]
  ------------------
  241|       |        // write partial row
  242|    161|        processRow();
  243|    161|    }
  244|    176|    prev_row = nullptr;
  245|    176|    cur_row = buf1.get();
  246|    176|    pos = 0;
  247|    176|    memset(cur_row, 0, bytes_per_row + 1);
  248|       |
  249|    176|    next()->finish();
  250|    176|}
Pl_PNGFilter.cc:_ZL8abs_diffii:
   19|   513k|{
   20|   513k|    return a > b ? a - b : b - a;
  ------------------
  |  Branch (20:12): [True: 331k, False: 182k]
  ------------------
   21|   513k|}

_ZN12Pl_PNGFilterD2Ev:
   26|    176|    ~Pl_PNGFilter() final = default;

_ZN4qpdf4util4fitsIjTkNSt3__18integralEyQsr3stdE8integralIT_EEEbT0_:
   63|    352|    {
   64|       |        if constexpr (std::cmp_less(
   65|       |                          std::numeric_limits<decltype(val)>::min(),
   66|       |                          std::numeric_limits<T>::min())) {
   67|       |            if (std::cmp_less(val, std::numeric_limits<T>::min())) {
   68|       |                return false;
   69|       |            }
   70|       |        }
   71|       |        if constexpr (std::cmp_greater(
   72|       |                          std::numeric_limits<decltype(val)>::max(),
   73|    352|                          std::numeric_limits<T>::max())) {
   74|    352|            if (std::cmp_greater(val, std::numeric_limits<T>::max())) {
  ------------------
  |  Branch (74:17): [True: 0, False: 352]
  ------------------
   75|      0|                return false;
   76|      0|            }
   77|    352|        }
   78|    352|        return true;
   79|    352|    }
_ZN4qpdf4util9assertionIRA52_KcEEvbOT_:
   27|    176|    {
   28|    176|        if (!cond) {
  ------------------
  |  Branch (28:13): [True: 0, False: 176]
  ------------------
   29|      0|            throw std::logic_error(std::forward<T>(msg));
   30|      0|        }
   31|    176|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA49_KcEEvbOT_:
   48|    176|    {
   49|    176|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 176]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    176|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA69_KcEEvbOT_:
   48|    176|    {
   49|    176|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 176]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    176|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA88_KcEEvbOT_:
   48|    176|    {
   49|    176|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 176]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    176|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA45_KcEEvbOT_:
   48|    176|    {
   49|    176|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 176]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    176|    }
_ZN4qpdf4util17no_ci_rt_error_ifIRA32_KcEEvbOT_:
   48|    176|    {
   49|    176|        if (cond) {
  ------------------
  |  Branch (49:13): [True: 0, False: 176]
  ------------------
   50|      0|            throw std::runtime_error(std::forward<T>(msg));
   51|      0|        }
   52|    176|    }

_ZN4qpdf6global6Limits14png_max_memoryEv:
  116|      2|        {
  117|      2|            return l.png_max_memory_;
  118|      2|        }