From bb3faa4d6bfce9baecc84539f560d8e518228e04 Mon Sep 17 00:00:00 2001 From: Akira Kakuto Date: Mon, 16 Jul 2018 23:33:39 +0000 Subject: libpng 1.6.35 git-svn-id: svn://tug.org/texlive/trunk@48212 c570f23f-e606-0410-a88d-b1316a301751 --- .../contrib/oss-fuzz/libpng_read_fuzzer.cc | 24 +++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) (limited to 'Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc') diff --git a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc index 78c7c9ff096..7b305509cde 100644 --- a/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc +++ b/Build/source/libs/libpng/libpng-src/contrib/oss-fuzz/libpng_read_fuzzer.cc @@ -1,11 +1,11 @@ // libpng_read_fuzzer.cc -// Copyright 2017 Glenn Randers-Pehrson +// Copyright 2017-2018 Glenn Randers-Pehrson // Copyright 2015 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that may // be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE -// Last changed in libpng 1.6.32 [August 24, 2017] +// Last changed in libpng 1.6.35 [July 15, 2018] // The modifications in 2017 by Glenn Randers-Pehrson include // 1. addition of a PNG_CLEANUP macro, @@ -13,6 +13,7 @@ // 3. adding "#include " which is needed on some platforms // to provide memcpy(). // 4. adding read_end_info() and creating an end_info structure. +// 5. adding calls to png_set_*() transforms commonly used by browsers. #include #include @@ -67,7 +68,7 @@ struct PngObjectHandler { } }; -void user_read_data(png_structp png_ptr, png_bytep data, png_size_t length) { +void user_read_data(png_structp png_ptr, png_bytep data, size_t length) { BufState* buf_state = static_cast(png_get_io_ptr(png_ptr)); if (length > buf_state->bytes_left) { png_error(png_ptr, "read error"); @@ -136,9 +137,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { // Reading. png_read_info(png_handler.png_ptr, png_handler.info_ptr); - png_handler.row_ptr = png_malloc( - png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr, - png_handler.info_ptr)); // reset error handler to put png_deleter into scope. if (setjmp(png_jmpbuf(png_handler.png_ptr))) { @@ -163,8 +161,20 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { return 0; } + // Set several transforms that browsers typically use: + png_set_gray_to_rgb(png_handler.png_ptr); + png_set_expand(png_handler.png_ptr); + png_set_packing(png_handler.png_ptr); + png_set_scale_16(png_handler.png_ptr); + png_set_tRNS_to_alpha(png_handler.png_ptr); + int passes = png_set_interlace_handling(png_handler.png_ptr); - png_start_read_image(png_handler.png_ptr); + + png_read_update_info(png_handler.png_ptr, png_handler.info_ptr); + + png_handler.row_ptr = png_malloc( + png_handler.png_ptr, png_get_rowbytes(png_handler.png_ptr, + png_handler.info_ptr)); for (int pass = 0; pass < passes; ++pass) { for (png_uint_32 y = 0; y < height; ++y) { -- cgit v1.2.3