1 files changed, 129 insertions, 0 deletions
diff --git a/src/3rdparty/freetype/src/tools/ftfuzzer/rasterfuzzer.cc b/src/3rdparty/freetype/src/tools/ftfuzzer/rasterfuzzer.cc
new file mode 100644
index 0000000000..c69b95ea0f
--- /dev/null
+++ b/src/3rdparty/freetype/src/tools/ftfuzzer/rasterfuzzer.cc
@@ -0,0 +1,129 @@
+// rasterfuzzer.cc
+//
+//   A fuzzing function to test FreeType's rasterizers with libFuzzer.
+//
+// Copyright 2016-2018 by
+// David Turner, Robert Wilhelm, and Werner Lemberg.
+//
+// This file is part of the FreeType project, and may only be used,
+// modified, and distributed under the terms of the FreeType project
+// license, LICENSE.TXT.  By continuing to use, modify, or distribute
+// this file you indicate that you have read the license and
+// understand and accept it fully.
+
+
+#include <stdint.h>
+
+#include <vector>
+
+
+  using namespace std;
+
+
+#include <ft2build.h>
+
+#include FT_FREETYPE_H
+#include FT_IMAGE_H
+#include FT_OUTLINE_H
+
+
+  static FT_Library  library;
+  static int         InitResult;
+
+
+  struct FT_Global {
+    FT_Global() {
+      InitResult = FT_Init_FreeType( &library );
+    }
+    ~FT_Global() {
+      FT_Done_FreeType( library );
+    }
+  };
+
+  FT_Global  global_ft;
+
+
+  extern "C" int
+  LLVMFuzzerTestOneInput( const uint8_t*  data,
+                          size_t          size_ )
+  {
+    unsigned char  pixels[4];
+
+    FT_Bitmap  bitmap_mono = {
+      1,                  // rows
+      1,                  // width
+      4,                  // pitch
+      pixels,             // buffer
+      2,                  // num_grays
+      FT_PIXEL_MODE_MONO, // pixel_mode
+      0,                  // palette_mode
+      NULL                // palette
+    };
+
+    FT_Bitmap  bitmap_gray = {
+      1,                  // rows
+      1,                  // width
+      4,                  // pitch
+      pixels,             // buffer
+      256,                // num_grays
+      FT_PIXEL_MODE_GRAY, // pixel_mode
+      0,                  // palette_mode
+      NULL                // palette
+    };
+
+    const size_t vsize = sizeof ( FT_Vector );
+    const size_t tsize = sizeof ( char );
+
+    // we use the input data for both points and tags
+    short  n_points = short( size_ / ( vsize + tsize ) );
+    if ( n_points <= 2 )
+      return 0;
+
+    FT_Vector*  points = reinterpret_cast<FT_Vector*>(
+                           const_cast<uint8_t*>(
+                             data ) );
+    char*       tags   = reinterpret_cast<char*>(
+                           const_cast<uint8_t*>(
+                             data + size_t( n_points ) * vsize ) );
+
+    // to reduce the number of invalid outlines that are immediately
+    // rejected in `FT_Outline_Render', limit values to 2^18 pixels
+    // (i.e., 2^24 bits)
+    for ( short  i = 0; i < n_points; i++ )
+    {
+      if ( points[i].x == LONG_MIN )
+        points[i].x = 0;
+      else if ( points[i].x < 0 )
+        points[i].x = -( -points[i].x & 0xFFFFFF ) - 1;
+      else
+        points[i].x = ( points[i].x & 0xFFFFFF ) + 1;
+
+      if ( points[i].y == LONG_MIN )
+        points[i].y = 0;
+      else if ( points[i].y < 0 )
+        points[i].y = -( -points[i].y & 0xFFFFFF ) - 1;
+      else
+        points[i].y = ( points[i].y & 0xFFFFFF ) + 1;
+    }
+
+    short  contours[1];
+    contours[0] = n_points - 1;
+
+    FT_Outline  outline =
+    {
+      1,               // n_contours
+      n_points,        // n_points
+      points,          // points
+      tags,            // tags
+      contours,        // contours
+      FT_OUTLINE_NONE  // flags
+    };
+
+    FT_Outline_Get_Bitmap( library, &outline, &bitmap_mono );
+    FT_Outline_Get_Bitmap( library, &outline, &bitmap_gray );
+
+    return 0;
+  }
+
+
+// END