1 // Copyright 2020 Google Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include "examples/anim_util.h"
18 #include "imageio/imageio_util.h"
19 #include "src/webp/demux.h"
20
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)21 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
22 // WebPAnimDecoderGetInfo() is too late to check the canvas size as
23 // WebPAnimDecoderNew() will handle the allocations.
24 WebPBitstreamFeatures features;
25 if (WebPGetFeatures(data, size, &features) == VP8_STATUS_OK) {
26 if (!ImgIoUtilCheckSizeArgumentsOverflow(features.width * 4,
27 features.height)) {
28 return 0;
29 }
30 }
31
32 // decode everything as an animation
33 WebPData webp_data = { data, size };
34 WebPAnimDecoder* const dec = WebPAnimDecoderNew(&webp_data, NULL);
35 if (dec == NULL) return 0;
36
37 WebPAnimInfo info;
38 if (!WebPAnimDecoderGetInfo(dec, &info)) goto End;
39 if (!ImgIoUtilCheckSizeArgumentsOverflow(info.canvas_width * 4,
40 info.canvas_height)) {
41 goto End;
42 }
43
44 while (WebPAnimDecoderHasMoreFrames(dec)) {
45 uint8_t* buf;
46 int timestamp;
47 if (!WebPAnimDecoderGetNext(dec, &buf, ×tamp)) break;
48 }
49 End:
50 WebPAnimDecoderDelete(dec);
51 return 0;
52 }
53