1 // Copyright 2018 Google Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include <stdio.h>
18 #include <stdlib.h>
19
20 #include "./fuzz_utils.h"
21 #include "webp/encode.h"
22 #include "webp/mux.h"
23
24 namespace {
25
26 const VP8CPUInfo default_VP8GetCPUInfo = VP8GetCPUInfo;
27
AddFrame(WebPAnimEncoder ** const enc,const WebPAnimEncoderOptions & anim_config,int * const width,int * const height,int timestamp_ms,const uint8_t data[],size_t size,uint32_t * const bit_pos)28 int AddFrame(WebPAnimEncoder** const enc,
29 const WebPAnimEncoderOptions& anim_config, int* const width,
30 int* const height, int timestamp_ms, const uint8_t data[],
31 size_t size, uint32_t* const bit_pos) {
32 if (enc == nullptr || width == nullptr || height == nullptr) {
33 fprintf(stderr, "NULL parameters.\n");
34 if (enc != nullptr) WebPAnimEncoderDelete(*enc);
35 abort();
36 }
37
38 // Init the source picture.
39 WebPPicture pic;
40 if (!WebPPictureInit(&pic)) {
41 fprintf(stderr, "WebPPictureInit failed.\n");
42 WebPAnimEncoderDelete(*enc);
43 abort();
44 }
45 pic.use_argb = Extract(1, data, size, bit_pos);
46
47 // Read the source picture.
48 if (!ExtractSourcePicture(&pic, data, size, bit_pos)) {
49 fprintf(stderr, "Can't read input image.\n");
50 WebPPictureFree(&pic);
51 abort();
52 }
53
54 // Crop and scale.
55 if (*enc == nullptr) { // First frame will set canvas width and height.
56 if (!ExtractAndCropOrScale(&pic, data, size, bit_pos)) {
57 fprintf(stderr, "ExtractAndCropOrScale failed.");
58 WebPPictureFree(&pic);
59 abort();
60 }
61 } else { // Other frames will be resized to the first frame's dimensions.
62 if (!WebPPictureRescale(&pic, *width, *height)) {
63 fprintf(stderr, "WebPPictureRescale failed. Size: %d,%d\n", *width,
64 *height);
65 WebPAnimEncoderDelete(*enc);
66 WebPPictureFree(&pic);
67 abort();
68 }
69 }
70
71 // Create encoder if it doesn't exist.
72 if (*enc == nullptr) {
73 *width = pic.width;
74 *height = pic.height;
75 *enc = WebPAnimEncoderNew(*width, *height, &anim_config);
76 if (*enc == nullptr) {
77 fprintf(stderr, "WebPAnimEncoderNew failed.\n");
78 WebPPictureFree(&pic);
79 abort();
80 }
81 }
82
83 // Create frame encoding config.
84 WebPConfig config;
85 if (!ExtractWebPConfig(&config, data, size, bit_pos)) {
86 fprintf(stderr, "ExtractWebPConfig failed.\n");
87 WebPAnimEncoderDelete(*enc);
88 WebPPictureFree(&pic);
89 abort();
90 }
91 // Skip slow settings on big images, it's likely to timeout.
92 if (pic.width * pic.height > 32 * 32) {
93 config.method = (config.method > 4) ? 4 : config.method;
94 config.quality = (config.quality > 99.0f) ? 99.0f : config.quality;
95 config.alpha_quality =
96 (config.alpha_quality > 99) ? 99 : config.alpha_quality;
97 }
98
99 // Encode.
100 if (!WebPAnimEncoderAdd(*enc, &pic, timestamp_ms, &config)) {
101 fprintf(stderr, "WebPEncode failed. Error code: %d\n", pic.error_code);
102 WebPAnimEncoderDelete(*enc);
103 WebPPictureFree(&pic);
104 abort();
105 }
106
107 WebPPictureFree(&pic);
108 return 1;
109 }
110
111 } // namespace
112
LLVMFuzzerTestOneInput(const uint8_t * const data,size_t size)113 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* const data, size_t size) {
114 WebPAnimEncoder* enc = nullptr;
115 int width = 0, height = 0, timestamp_ms = 0;
116 uint32_t bit_pos = 0;
117
118 ExtractAndDisableOptimizations(default_VP8GetCPUInfo, data, size, &bit_pos);
119
120 // Extract a configuration from the packed bits.
121 WebPAnimEncoderOptions anim_config;
122 if (!WebPAnimEncoderOptionsInit(&anim_config)) {
123 fprintf(stderr, "WebPAnimEncoderOptionsInit failed.\n");
124 abort();
125 }
126 anim_config.minimize_size = Extract(1, data, size, &bit_pos);
127 anim_config.kmax = Extract(15, data, size, &bit_pos);
128 const int min_kmin = (anim_config.kmax > 1) ? (anim_config.kmax / 2) : 0;
129 const int max_kmin = (anim_config.kmax > 1) ? (anim_config.kmax - 1) : 0;
130 anim_config.kmin =
131 min_kmin + Extract((uint32_t)(max_kmin - min_kmin), data, size, &bit_pos);
132 anim_config.allow_mixed = Extract(1, data, size, &bit_pos);
133 anim_config.verbose = 0;
134
135 const int nb_frames = 1 + Extract(15, data, size, &bit_pos);
136
137 // For each frame.
138 for (int i = 0; i < nb_frames; ++i) {
139 if (!AddFrame(&enc, anim_config, &width, &height, timestamp_ms, data, size,
140 &bit_pos)) {
141 return 0;
142 }
143
144 timestamp_ms += (1 << (2 + Extract(15, data, size, &bit_pos))) +
145 Extract(1, data, size, &bit_pos); // [1..131073], arbitrary
146 }
147
148 // Assemble.
149 if (!WebPAnimEncoderAdd(enc, nullptr, timestamp_ms, nullptr)) {
150 fprintf(stderr, "Last WebPAnimEncoderAdd failed.");
151 WebPAnimEncoderDelete(enc);
152 abort();
153 }
154 WebPData webp_data;
155 WebPDataInit(&webp_data);
156 if (!WebPAnimEncoderAssemble(enc, &webp_data)) {
157 fprintf(stderr, "WebPAnimEncoderAssemble failed.");
158 WebPAnimEncoderDelete(enc);
159 WebPDataClear(&webp_data);
160 abort();
161 }
162
163 WebPAnimEncoderDelete(enc);
164 WebPDataClear(&webp_data);
165 return 0;
166 }
167