summaryrefslogtreecommitdiff
path: root/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/libpng/libpng-src/contrib/oss-fuzz')
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt32
-rwxr-xr-xBuild/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh47
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc154
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options2
-rw-r--r--Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict39
5 files changed, 274 insertions, 0 deletions
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt
new file mode 100644
index 00000000000..a75cba487ff
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/README.txt
@@ -0,0 +1,32 @@
+Last changed in libpng 1.6.32 [August 24, 2017]
+Copyright (c) 2017 Glenn Randers-Pehrson
+
+This code is released under the libpng license.
+For conditions of distribution and use, see the disclaimer
+and license in png.h
+
+Files in this directory are used by the oss-fuzz project
+(https://github.com/google/oss-fuzz/tree/master/projects/libpng).
+for "fuzzing" libpng.
+
+They were licensed by Google Inc, using the BSD-like Chromium license,
+which may be found at https://cs.chromium.org/chromium/src/LICENSE, or, if
+noted in the source, under the Apache-2.0 license, which may
+be found at http://www.apache.org/licenses/LICENSE-2.0 .
+If they have been modified, the derivatives are copyright Glenn Randers-Pehson
+and are released under the same licenses as the originals. Several of
+the original files (libpng_read_fuzzer.options, png.dict, project.yaml)
+had no licensing information; we assumed that these were under the Chromium
+license. Any new files are released under the libpng license (see png.h).
+
+The files are
+ Original
+ Filename or derived Copyright License
+ ========================= ========== ================ ==========
+ build.sh derived 2017, Glenn R-P Apache 2.0
+ libpng_read_fuzzer.cc derived 2017, Glenn R-P Chromium
+ libpng_read_fuzzer.options original 2015, Chrome Devs Chromium
+ png.dict original 2015, Chrome Devs Chromium
+ README.txt (this file) original 2017, GLenn R-P libpng
+
+To do: exercise the progressive reader.
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh
new file mode 100755
index 00000000000..cf5a9dad507
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/build.sh
@@ -0,0 +1,47 @@
+#!/bin/bash -eu
+# Copyright 2017 Glenn Randers-Pehrson
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Last changed in libpng 1.6.32 [August 24, 2017]
+#
+# Revisions by Glenn Randers-Pehson, 2017:
+# 1. Build only the library, not the tools (changed "make -j$(nproc) all" to
+# "make -j$(nproc) libpng16.la").
+# 2. Disabled WARNING and WRITE options in pnglibconf.dfa.
+################################################################################
+
+# Disable logging via library build configuration control.
+cat scripts/pnglibconf.dfa | \
+ sed -e "s/option STDIO/option STDIO disabled/" \
+ -e "s/option WARNING /option WARNING disabled/" \
+ -e "s/option WRITE enables WRITE_INT_FUNCTIONS/option WRITE disabled/" \
+> scripts/pnglibconf.dfa.temp
+mv scripts/pnglibconf.dfa.temp scripts/pnglibconf.dfa
+
+# build the library.
+autoreconf -f -i
+./configure
+make -j$(nproc) clean
+make -j$(nproc) libpng16.la
+
+# build libpng_read_fuzzer.
+$CXX $CXXFLAGS -std=c++11 -I. \
+ $SRC/libpng_read_fuzzer.cc -o $OUT/libpng_read_fuzzer \
+ -lFuzzingEngine .libs/libpng16.a -lz
+
+# add seed corpus.
+find $SRC/libpng/contrib/pngsuite -name "*.png" | xargs zip $OUT/libpng_read_fuzzer_seed_corpus.zip
+
+cp $SRC/*.dict $SRC/*.options $OUT/
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc
new file mode 100644
index 00000000000..c1b16249db0
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc
@@ -0,0 +1,154 @@
+
+// libpng_read_fuzzer.cc
+// Copyright 2017 Glenn Randers-Pehrson
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that may
+// be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE
+
+// Last changed in libpng 1.6.32 [August 24, 2017]
+
+// The modifications in 2017 by Glenn Randers-Pehrson include
+// 1. addition of a PNG_CLEANUP macro,
+// 2. setting the option to ignore ADLER32 checksums,
+// 3. adding "#include <string.h>" which is needed on some platforms
+// to provide memcpy().
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <vector>
+
+#define PNG_INTERNAL
+#include "png.h"
+
+#define PNG_CLEANUP \
+ if(png_handler.png_ptr) \
+ { \
+ if (png_handler.info_ptr) \
+ png_destroy_read_struct(&png_handler.png_ptr, &png_handler.info_ptr,\
+ nullptr); \
+ else \
+ png_destroy_read_struct(&png_handler.png_ptr, nullptr, nullptr); \
+ }
+
+struct BufState {
+ const uint8_t* data;
+ size_t bytes_left;
+};
+
+struct PngObjectHandler {
+ png_infop info_ptr = nullptr;
+ png_structp png_ptr = nullptr;
+ png_voidp row_ptr = nullptr;
+ BufState* buf_state = nullptr;
+
+ ~PngObjectHandler() {
+ if (row_ptr && png_ptr) {
+ png_free(png_ptr, row_ptr);
+ }
+ if (png_ptr && info_ptr) {
+ png_destroy_read_struct(&png_ptr, &info_ptr, nullptr);
+ }
+ delete buf_state;
+ }
+};
+
+void user_read_data(png_structp png_ptr, png_bytep data, png_size_t length) {
+ BufState* buf_state = static_cast<BufState*>(png_get_io_ptr(png_ptr));
+ if (length > buf_state->bytes_left) {
+ png_error(png_ptr, "read error");
+ }
+ memcpy(data, buf_state->data, length);
+ buf_state->bytes_left -= length;
+ buf_state->data += length;
+}
+
+static const int kPngHeaderSize = 8;
+
+// Entry point for LibFuzzer.
+// Roughly follows the libpng book example:
+// http://www.libpng.org/pub/png/book/chapter13.html
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ if (size < kPngHeaderSize) {
+ return 0;
+ }
+
+ std::vector<unsigned char> v(data, data + size);
+ if (png_sig_cmp(v.data(), 0, kPngHeaderSize)) {
+ // not a PNG.
+ return 0;
+ }
+
+ PngObjectHandler png_handler;
+ png_handler.png_ptr = png_create_read_struct
+ (PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr);
+ if (!png_handler.png_ptr) {
+ return 0;
+ }
+
+ png_handler.info_ptr = png_create_info_struct(png_handler.png_ptr);
+ if (!png_handler.info_ptr) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ png_set_crc_action(png_handler.png_ptr, PNG_CRC_QUIET_USE, PNG_CRC_QUIET_USE);
+#ifdef PNG_IGNORE_ADLER32
+ png_set_option(png_handler.png_ptr, PNG_IGNORE_ADLER32, PNG_OPTION_ON);
+#endif
+
+ // Setting up reading from buffer.
+ png_handler.buf_state = new BufState();
+ png_handler.buf_state->data = data + kPngHeaderSize;
+ png_handler.buf_state->bytes_left = size - kPngHeaderSize;
+ png_set_read_fn(png_handler.png_ptr, png_handler.buf_state, user_read_data);
+ png_set_sig_bytes(png_handler.png_ptr, kPngHeaderSize);
+
+ if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ // Reading.
+ png_read_info(png_handler.png_ptr, png_handler.info_ptr);
+ png_handler.row_ptr = png_malloc(
+ png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr,
+ png_handler.info_ptr));
+
+ // reset error handler to put png_deleter into scope.
+ if (setjmp(png_jmpbuf(png_handler.png_ptr))) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ png_uint_32 width, height;
+ int bit_depth, color_type, interlace_type, compression_type;
+ int filter_type;
+
+ if (!png_get_IHDR(png_handler.png_ptr, png_handler.info_ptr, &width,
+ &height, &bit_depth, &color_type, &interlace_type,
+ &compression_type, &filter_type)) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ // This is going to be too slow.
+ if (width && height > 100000000 / width) {
+ PNG_CLEANUP
+ return 0;
+ }
+
+ int passes = png_set_interlace_handling(png_handler.png_ptr);
+ png_start_read_image(png_handler.png_ptr);
+
+ for (int pass = 0; pass < passes; ++pass) {
+ for (png_uint_32 y = 0; y < height; ++y) {
+ png_read_row(png_handler.png_ptr,
+ static_cast<png_bytep>(png_handler.row_ptr), nullptr);
+ }
+ }
+
+ PNG_CLEANUP
+ return 0;
+}
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options
new file mode 100644
index 00000000000..2005291a0f7
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.options
@@ -0,0 +1,2 @@
+[libfuzzer]
+dict = png.dict
diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict
new file mode 100644
index 00000000000..3a8a113830f
--- /dev/null
+++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/png.dict
@@ -0,0 +1,39 @@
+#
+# AFL dictionary for PNG images
+# -----------------------------
+#
+# Just the basic, standard-originating sections; does not include vendor
+# extensions.
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_png="\x89PNG\x0d\x0a\x1a\x0a"
+
+section_IDAT="IDAT"
+section_IEND="IEND"
+section_IHDR="IHDR"
+section_PLTE="PLTE"
+section_bKGD="bKGD"
+section_cHRM="cHRM"
+section_eXIf="eXIf"
+section_fRAc="fRAc"
+section_gAMA="gAMA"
+section_gIFg="gIFg"
+section_gIFt="gIFt"
+section_gIFx="gIFx"
+section_hIST="hIST"
+section_iCCP="iCCP"
+section_iTXt="iTXt"
+section_oFFs="oFFs"
+section_pCAL="pCAL"
+section_pHYs="pHYs"
+section_sBIT="sBIT"
+section_sCAL="sCAL"
+section_sPLT="sPLT"
+section_sRGB="sRGB"
+section_sTER="sTER"
+section_tEXt="tEXt"
+section_tIME="tIME"
+section_tRNS="tRNS"
+section_zTXt="zTXt"