1/*
2 * Copyright 2016 Google Inc.
3 *
4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file.
6 */
7
8#ifndef Fuzz_DEFINED
9#define Fuzz_DEFINED
10
11#include "SkData.h"
12#include "../tools/Registry.h"
13#include "SkMalloc.h"
14#include "SkTypes.h"
15
16#include <cmath>
17#include <signal.h>
18
19class Fuzz : SkNoncopyable {
20public:
21    explicit Fuzz(sk_sp<SkData> bytes) : fBytes(bytes), fNextByte(0) {}
22
23    // Returns the total number of "random" bytes available.
24    size_t size() { return fBytes->size(); }
25    // Returns if there are no bytes remaining for fuzzing.
26    bool exhausted(){
27        return fBytes->size() == fNextByte;
28    }
29
30    // next() loads fuzzed bytes into the variable passed in by pointer.
31    // We use this approach instead of T next() because different compilers
32    // evaluate function parameters in different orders. If fuzz->next()
33    // returned 5 and then 7, foo(fuzz->next(), fuzz->next()) would be
34    // foo(5, 7) when compiled on GCC and foo(7, 5) when compiled on Clang.
35    // By requiring params to be passed in, we avoid the temptation to call
36    // next() in a way that does not consume fuzzed bytes in a single
37    // platform-independent order.
38    template <typename T>
39    void next(T* t);
40
41    // This is a convenient way to initialize more than one argument at a time.
42    template <typename Arg, typename... Args>
43    void next(Arg* first, Args... rest);
44
45    // nextRange returns values only in [min, max].
46    template <typename T, typename Min, typename Max>
47    void nextRange(T*, Min, Max);
48
49    // nextN loads n * sizeof(T) bytes into ptr
50    template <typename T>
51    void nextN(T* ptr, int n);
52
53    void signalBug(){
54        // Tell the fuzzer that these inputs found a bug.
55        SkDebugf("Signal bug\n");
56        raise(SIGSEGV);
57    }
58
59private:
60    template <typename T>
61    T nextT();
62
63    sk_sp<SkData> fBytes;
64    size_t fNextByte;
65};
66
67// UBSAN reminds us that bool can only legally hold 0 or 1.
68template <>
69inline void Fuzz::next(bool* b) {
70  uint8_t n;
71  this->next(&n);
72  *b = (n & 1) == 1;
73}
74
75template <typename T>
76inline void Fuzz::next(T* n) {
77    if ((fNextByte + sizeof(T)) > fBytes->size()) {
78        sk_bzero(n, sizeof(T));
79        memcpy(n, fBytes->bytes() + fNextByte, fBytes->size() - fNextByte);
80        fNextByte = fBytes->size();
81        return;
82    }
83    memcpy(n, fBytes->bytes() + fNextByte, sizeof(T));
84    fNextByte += sizeof(T);
85}
86
87template <typename Arg, typename... Args>
88inline void Fuzz::next(Arg* first, Args... rest) {
89   this->next(first);
90   this->next(rest...);
91}
92
93template <>
94inline void Fuzz::nextRange(float* f, float min, float max) {
95    this->next(f);
96    if (!std::isnormal(*f) && *f != 0.0f) {
97        // Don't deal with infinity or other strange floats.
98        *f = max;
99    }
100    *f = min + std::fmod(std::abs(*f), (max - min + 1));
101}
102
103template <typename T, typename Min, typename Max>
104inline void Fuzz::nextRange(T* n, Min min, Max max) {
105    this->next<T>(n);
106    if (min == max) {
107        *n = min;
108        return;
109    }
110    if (min > max) {
111        // Avoid misuse of nextRange
112        SkDebugf("min > max (%d > %d) \n", min, max);
113        this->signalBug();
114    }
115    if (*n < 0) { // Handle negatives
116        if (*n != std::numeric_limits<T>::lowest()) {
117            *n *= -1;
118        }
119        else {
120            *n = std::numeric_limits<T>::max();
121        }
122    }
123    *n = min + (*n % ((size_t)max - min + 1));
124}
125
126template <typename T>
127inline void Fuzz::nextN(T* ptr, int n) {
128   for (int i = 0; i < n; i++) {
129       this->next(ptr+i);
130   }
131}
132
133struct Fuzzable {
134    const char* name;
135    void (*fn)(Fuzz*);
136};
137
138// Not static so that we can link these into oss-fuzz harnesses if we like.
139#define DEF_FUZZ(name, f)                                               \
140    void fuzz_##name(Fuzz*);                                            \
141    sk_tools::Registry<Fuzzable> register_##name({#name, fuzz_##name}); \
142    void fuzz_##name(Fuzz* f)
143
144#endif//Fuzz_DEFINED
145