blob: 55f6046f6ebde515d36ebef34073ff5db1e10d1b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
/*
* Copyright 2016 Google Inc.
*
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*/
#include "Fuzz.h"
#include <stdlib.h>
#include <signal.h>
int main(int argc, char** argv) {
if (argc < 3) {
SkDebugf("Usage: %s <fuzz name> <path/to/fuzzed.data>\n", argv[0]);
return 1;
}
const char* name = argv[1];
const char* path = argv[2];
SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path));
Fuzz fuzz(bytes);
for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) {
auto fuzzable = r->factory();
if (0 == strcmp(name, fuzzable.name)) {
SkDebugf("Running %s\n", fuzzable.name);
fuzzable.fn(&fuzz);
return 0;
}
}
return 1;
}
Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {}
void Fuzz::signalBug () { raise(SIGSEGV); }
void Fuzz::signalBoring() { exit(0); }
template <typename T>
T Fuzz::nextT() {
if (fNextByte + sizeof(T) > fBytes->size()) {
this->signalBoring();
}
T val;
memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T));
fNextByte += sizeof(T);
return val;
}
uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); }
uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); }
float Fuzz::nextF() { return this->nextT<float >(); }
|
