diff options
| author | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-09-23 10:34:40 -0500 |
|---|---|---|
| committer | Glenn Randers-Pehrson <glennrp at users.sourceforge.net> | 2017-09-23 10:34:40 -0500 |
| commit | 96333b6bea59dd8d0659e46ec9426119d3fe5753 (patch) | |
| tree | 7fdee9bf276db2e55a6d819d01e8c682be5276ae | |
| parent | 90dd185aeda890024579cbd7bbe7950202c35573 (diff) | |
| download | libpng-96333b6bea59dd8d0659e46ec9426119d3fe5753.tar.gz | |
[libpng16] Defeat optimization that removes reading rows in the fuzzer.
| -rw-r--r-- | contrib/oss-fuzz/libpng_read_fuzzer.cc | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/contrib/oss-fuzz/libpng_read_fuzzer.cc b/contrib/oss-fuzz/libpng_read_fuzzer.cc index b17681b40..efd8cf16a 100644 --- a/contrib/oss-fuzz/libpng_read_fuzzer.cc +++ b/contrib/oss-fuzz/libpng_read_fuzzer.cc @@ -5,7 +5,7 @@ // Use of this source code is governed by a BSD-style license that may // be found in the LICENSE file https://cs.chromium.org/chromium/src/LICENSE -// Last changed in libpng 1.6.33beta03 [September 20, 2017] +// Last changed in libpng 1.6.33beta03 [September 23, 2017] // The modifications in 2017 by Glenn Randers-Pehrson include // 1. addition of a PNG_CLEANUP macro, @@ -169,13 +169,21 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { int passes = png_set_interlace_handling(png_handler.png_ptr); png_start_read_image(png_handler.png_ptr); + int max_filter = 0; for (int pass = 0; pass < passes; ++pass) { for (png_uint_32 y = 0; y < height; ++y) { png_read_row(png_handler.png_ptr, static_cast<png_bytep>(png_handler.row_ptr), nullptr); + max_filter = png_handler.row_buf[0] > max_filter ? + png_handler.row_buf[0] : max_filter; } } + if (max_filter > 5) { + PNG_CLEANUP + return 0; + } + png_read_end(png_handler.png_ptr, png_handler.end_info_ptr); PNG_CLEANUP |