mirror of
https://github.com/libjpeg-turbo/libjpeg-turbo.git
synced 2026-01-18 13:31:21 +01:00
739d1ae1bc
- Modify the existing fuzzers to extend default coverage to the
following code paths:
* ICC profile writing/reading, basic marker processing
* NULL color conversion with 3 or 4 components
* Huffman encoding with a destination buffer size < 512 bytes
* Partial image decompression
This was previously untouched by default because
2a5a3c6f0a was overly strict. Some
images will fail to decompress on the first iteration due to a
mismatch between the JPEG colorspace and the destination pixel
format. Thus, this commit modifies the decompression fuzzers to
detect whether the error thrown by tj3Decompress*() is due to an
excessive number of scans and bails out only in that case.
* Generating baseline-compatible quantization tables with low JPEG
quality levels
* 1/8 and 1/4 scaled IDCTs
- Add a new libjpeg-based decompression fuzzer that exercises code
paths not covered by the other fuzzers (or by the TurboJPEG API in
general):
* JCS_UNKNOWN (NULL color conversion with a component count other
than 3 or 4)
* Floating point IDCT
* Buffered-image mode
* Interstitial line skipping
* jpeg_save_markers() with a length limit
* Custom marker processor
Based on
5593bb138b
- Fall back to directly injecting fuzz data into the compressor if
tj3LoadImage*() fails. This prevents the packed-pixel image loaders
from acting as gatekeepers and thus preventing some fuzz data from
getting through to the codec.
Based on:
5593bb138b
- Add a JPEG dictionary to guide the decompression fuzzers.
Based on:
5593bb138b
- Remove duplication of effort in the cjpeg fuzzer.
Closes #845
71 lines
2.4 KiB
CMake
71 lines
2.4 KiB
CMake
if(NOT ENABLE_STATIC)
|
|
message(FATAL_ERROR "Fuzz targets require static libraries.")
|
|
endif()
|
|
if(NOT WITH_TURBOJPEG)
|
|
message(FATAL_ERROR "Fuzz targets require the TurboJPEG API library.")
|
|
endif()
|
|
|
|
set(FUZZ_BINDIR "" CACHE PATH
|
|
"Directory into which fuzz targets should be installed")
|
|
if(NOT FUZZ_BINDIR)
|
|
message(FATAL_ERROR "FUZZ_BINDIR must be specified.")
|
|
endif()
|
|
message(STATUS "FUZZ_BINDIR = ${FUZZ_BINDIR}")
|
|
|
|
set(FUZZ_LIBRARY "" CACHE STRING
|
|
"Path to fuzzer library or flags necessary to link with it")
|
|
if(NOT FUZZ_LIBRARY)
|
|
message(FATAL_ERROR "FUZZ_LIBRARY must be specified.")
|
|
endif()
|
|
message(STATUS "FUZZ_LIBRARY = ${FUZZ_LIBRARY}")
|
|
|
|
enable_language(CXX)
|
|
|
|
set(EFFECTIVE_CXX_FLAGS
|
|
"${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE_UC}}")
|
|
message(STATUS "C++ Compiler flags = ${EFFECTIVE_CXX_FLAGS}")
|
|
|
|
add_executable(cjpeg_fuzzer${FUZZER_SUFFIX} cjpeg.cc ../src/cdjpeg.c
|
|
../src/rdbmp.c ../src/rdgif.c ../src/rdppm.c ../src/rdswitch.c
|
|
../src/rdtarga.c)
|
|
set_property(TARGET cjpeg_fuzzer${FUZZER_SUFFIX} PROPERTY COMPILE_FLAGS
|
|
${COMPILE_FLAGS})
|
|
target_link_libraries(cjpeg_fuzzer${FUZZER_SUFFIX} ${FUZZ_LIBRARY} jpeg-static)
|
|
install(TARGETS cjpeg_fuzzer${FUZZER_SUFFIX}
|
|
RUNTIME DESTINATION ${FUZZ_BINDIR} COMPONENT bin)
|
|
|
|
macro(add_fuzz_target target source_file)
|
|
add_executable(${target}_fuzzer${FUZZER_SUFFIX} ${source_file})
|
|
target_link_libraries(${target}_fuzzer${FUZZER_SUFFIX} ${FUZZ_LIBRARY}
|
|
turbojpeg-static)
|
|
install(TARGETS ${target}_fuzzer${FUZZER_SUFFIX}
|
|
RUNTIME DESTINATION ${FUZZ_BINDIR} COMPONENT bin)
|
|
endmacro()
|
|
|
|
add_fuzz_target(compress compress.cc)
|
|
|
|
add_fuzz_target(compress_yuv compress_yuv.cc)
|
|
|
|
add_fuzz_target(compress_lossless compress_lossless.cc)
|
|
|
|
add_fuzz_target(compress12 compress12.cc)
|
|
|
|
add_fuzz_target(compress12_lossless compress12_lossless.cc)
|
|
|
|
add_fuzz_target(compress16_lossless compress16_lossless.cc)
|
|
|
|
# NOTE: This target is named libjpeg_turbo_fuzzer instead of decompress_fuzzer
|
|
# in order to preserve the corpora from Google's OSS-Fuzz target for
|
|
# libjpeg-turbo, which this target replaces.
|
|
add_fuzz_target(libjpeg_turbo decompress.cc)
|
|
|
|
add_executable(decompress_libjpeg_fuzzer${FUZZER_SUFFIX} decompress_libjpeg.cc)
|
|
target_link_libraries(decompress_libjpeg_fuzzer${FUZZER_SUFFIX} ${FUZZ_LIBRARY}
|
|
jpeg-static)
|
|
install(TARGETS decompress_libjpeg_fuzzer${FUZZER_SUFFIX}
|
|
RUNTIME DESTINATION ${FUZZ_BINDIR} COMPONENT bin)
|
|
|
|
add_fuzz_target(decompress_yuv decompress_yuv.cc)
|
|
|
|
add_fuzz_target(transform transform.cc)
|