advanced_api_fuzzer: add extreme config value coverage
this enables cases that might trigger overflows, but increases the risk
of OOM and timeouts
//
////////////////////////////////////////////////////////////////////////////////
+#include <string.h>
+
#include "./fuzz_utils.h"
#include "webp/decode.h"
int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
+ int i;
WebPDecoderConfig config;
if (!WebPInitDecoderConfig(&config)) return 0;
if (WebPGetFeatures(data, size, &config.input) != VP8_STATUS_OK) return 0;
@@ -59,6 +62,19 @@ int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
config.output.colorspace = (WEBP_CSP_MODE)(value % MODE_LAST);
#endif // WEBP_REDUCE_CSP
+ for (i = 0; i < 2; ++i) {
+ if (i == 1) {
+ // Use the bitstream data to generate extreme ranges for the options. An
+ // alternative approach would be to use a custom corpus containing webp
+ // files prepended with sizeof(config.options) zeroes to allow the fuzzer
+ // to modify these independently.
+ const int data_offset = 50;
+ if (size > data_offset + sizeof(config.options)) {
+ memcpy(&config.options, data + data_offset, sizeof(config.options));
+ } else {
+ break;
+ }
+ }
if (size % 3) {
// Decodes incrementally in chunks of increasing size.
WebPIDecoder* idec = WebPIDecode(NULL, 0, &config);
@@ -93,5 +109,6 @@ int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
}
WebPFreeDecBuffer(&config.output);
+ }
return 0;
}
