1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
// rasterfuzzer.cc
//
// A fuzzing function to test FreeType's rasterizers with libFuzzer.
//
// Copyright 2016-2018 by
// David Turner, Robert Wilhelm, and Werner Lemberg.
//
// This file is part of the FreeType project, and may only be used,
// modified, and distributed under the terms of the FreeType project
// license, LICENSE.TXT. By continuing to use, modify, or distribute
// this file you indicate that you have read the license and
// understand and accept it fully.
#include <stdint.h>
#include <vector>
using namespace std;
#include <ft2build.h>
#include FT_FREETYPE_H
#include FT_IMAGE_H
#include FT_OUTLINE_H
static FT_Library library;
static int InitResult;
struct FT_Global {
FT_Global() {
InitResult = FT_Init_FreeType( &library );
}
~FT_Global() {
FT_Done_FreeType( library );
}
};
FT_Global global_ft;
extern "C" int
LLVMFuzzerTestOneInput( const uint8_t* data,
size_t size_ )
{
unsigned char pixels[4];
FT_Bitmap bitmap_mono = {
1, // rows
1, // width
4, // pitch
pixels, // buffer
2, // num_grays
FT_PIXEL_MODE_MONO, // pixel_mode
0, // palette_mode
NULL // palette
};
FT_Bitmap bitmap_gray = {
1, // rows
1, // width
4, // pitch
pixels, // buffer
256, // num_grays
FT_PIXEL_MODE_GRAY, // pixel_mode
0, // palette_mode
NULL // palette
};
const size_t vsize = sizeof ( FT_Vector );
const size_t tsize = sizeof ( char );
// we use the input data for both points and tags
short n_points = short( size_ / ( vsize + tsize ) );
if ( n_points <= 2 )
return 0;
FT_Vector* points = reinterpret_cast<FT_Vector*>(
const_cast<uint8_t*>(
data ) );
char* tags = reinterpret_cast<char*>(
const_cast<uint8_t*>(
data + size_t( n_points ) * vsize ) );
// to reduce the number of invalid outlines that are immediately
// rejected in `FT_Outline_Render', limit values to 2^18 pixels
// (i.e., 2^24 bits)
for ( short i = 0; i < n_points; i++ )
{
if ( points[i].x == LONG_MIN )
points[i].x = 0;
else if ( points[i].x < 0 )
points[i].x = -( -points[i].x & 0xFFFFFF ) - 1;
else
points[i].x = ( points[i].x & 0xFFFFFF ) + 1;
if ( points[i].y == LONG_MIN )
points[i].y = 0;
else if ( points[i].y < 0 )
points[i].y = -( -points[i].y & 0xFFFFFF ) - 1;
else
points[i].y = ( points[i].y & 0xFFFFFF ) + 1;
}
short contours[1];
contours[0] = n_points - 1;
FT_Outline outline =
{
1, // n_contours
n_points, // n_points
points, // points
tags, // tags
contours, // contours
FT_OUTLINE_NONE // flags
};
FT_Outline_Get_Bitmap( library, &outline, &bitmap_mono );
FT_Outline_Get_Bitmap( library, &outline, &bitmap_gray );
return 0;
}
// END
|
