chore(oss-fuzz): Fix the lint errors
diff --git a/contrib/oss-fuzz/build.sh b/contrib/oss-fuzz/build.sh index 2655d9f..3e8e365 100755 --- a/contrib/oss-fuzz/build.sh +++ b/contrib/oss-fuzz/build.sh
@@ -36,7 +36,10 @@ make -j$(nproc) clean make -j$(nproc) libpng16.la -for f in libpng_read_fuzzer libpng_colormap_fuzzer libpng_readapi_fuzzer libpng_transformations_fuzzer; +for f in libpng_read_fuzzer \ + libpng_colormap_fuzzer \ + libpng_readapi_fuzzer \ + libpng_transformations_fuzzer; do # build libpng_read_fuzzer. $CXX $CXXFLAGS -std=c++11 -I. \
diff --git a/contrib/oss-fuzz/libpng_colormap_fuzzer.cc b/contrib/oss-fuzz/libpng_colormap_fuzzer.cc index c91172b..8b542b6 100644 --- a/contrib/oss-fuzz/libpng_colormap_fuzzer.cc +++ b/contrib/oss-fuzz/libpng_colormap_fuzzer.cc
@@ -9,17 +9,17 @@ png_image image; memset(&image, 0, sizeof(image)); image.version = PNG_IMAGE_VERSION; - + if (!png_image_begin_read_from_memory(&image, data, size)) { return; } - + /* Limit image size for performance */ if (image.width > 1024 || image.height > 1024) { png_image_free(&image); return; } - + /* Test different colormap formats to trigger uncovered functions */ png_uint_32 formats[] = { PNG_FORMAT_GRAY, @@ -29,11 +29,11 @@ PNG_FORMAT_RGB_COLORMAP, PNG_FORMAT_RGBA_COLORMAP }; - + int i; for (i = 0; i < 6; i++) { image.format = formats[i]; - + size_t buffer_size = PNG_IMAGE_SIZE(image); if (buffer_size > 0 && buffer_size < 5*1024*1024) { /* Limit to 5MB */ void *img_buffer = malloc(buffer_size); @@ -51,7 +51,7 @@ free(img_buffer); } } - + /* Reset for next format */ if (i < 5) { png_image_free(&image); @@ -62,15 +62,15 @@ } } } - + png_image_free(&image); } extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size < 8) return 0; - + /* Test 2: PNG image API with colormap processing */ test_png_image_colormap(data, size); - + return 0; }
diff --git a/contrib/oss-fuzz/libpng_readapi_fuzzer.cc b/contrib/oss-fuzz/libpng_readapi_fuzzer.cc index 8a9d06a..b2cbf62 100644 --- a/contrib/oss-fuzz/libpng_readapi_fuzzer.cc +++ b/contrib/oss-fuzz/libpng_readapi_fuzzer.cc
@@ -25,37 +25,37 @@ static void test_png_read_png_api(const uint8_t *data, size_t size) { png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); if (!png_ptr) return; - + png_infop info_ptr = png_create_info_struct(png_ptr); if (!info_ptr) { png_destroy_read_struct(&png_ptr, NULL, NULL); return; } - + if (setjmp(png_jmpbuf(png_ptr))) { png_destroy_read_struct(&png_ptr, &info_ptr, NULL); return; } - + struct png_mem_buffer buffer = {data, size, 0}; png_set_read_fn(png_ptr, &buffer, png_read_from_buffer); - + /* Set up transformations before reading */ png_set_scale_16(png_ptr); png_set_packing(png_ptr); png_set_expand(png_ptr); - + /* Use png_read_png which should trigger OSS_FUZZ_png_read_png path */ png_read_png(png_ptr, info_ptr, PNG_TRANSFORM_IDENTITY, NULL); - + png_destroy_read_struct(&png_ptr, &info_ptr, NULL); } extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size < 8) return 0; - + /* Test 3: png_read_png API */ test_png_read_png_api(data, size); - + return 0; }
diff --git a/contrib/oss-fuzz/libpng_transformations_fuzzer.cc b/contrib/oss-fuzz/libpng_transformations_fuzzer.cc index 8906d68..54d2050 100644 --- a/contrib/oss-fuzz/libpng_transformations_fuzzer.cc +++ b/contrib/oss-fuzz/libpng_transformations_fuzzer.cc
@@ -25,39 +25,39 @@ static void test_png_transformations(const uint8_t *data, size_t size) { png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); if (!png_ptr) return; - + png_infop info_ptr = png_create_info_struct(png_ptr); if (!info_ptr) { png_destroy_read_struct(&png_ptr, NULL, NULL); return; } - + if (setjmp(png_jmpbuf(png_ptr))) { png_destroy_read_struct(&png_ptr, &info_ptr, NULL); return; } - + struct png_mem_buffer buffer = {data, size, 0}; png_set_read_fn(png_ptr, &buffer, png_read_from_buffer); - + png_read_info(png_ptr, info_ptr); - + int width = png_get_image_width(png_ptr, info_ptr); int height = png_get_image_height(png_ptr, info_ptr); int color_type = png_get_color_type(png_ptr, info_ptr); int bit_depth = png_get_bit_depth(png_ptr, info_ptr); - + /* Sanity check dimensions */ if (width <= 0 || height <= 0 || width > 2048 || height > 2048) { png_destroy_read_struct(&png_ptr, &info_ptr, NULL); return; } - + /* Target 1: 16-bit depth processing (triggers png_do_chop) */ if (bit_depth == 16) { png_set_scale_16(png_ptr); } - + /* Target 2: Color quantization (triggers png_do_quantize) */ if (color_type == PNG_COLOR_TYPE_RGB || color_type == PNG_COLOR_TYPE_RGB_ALPHA) { png_colorp palette = (png_colorp)malloc(256 * sizeof(png_color)); @@ -70,24 +70,24 @@ free(palette); } } - + /* Target 3: Alpha channel transformations */ if (color_type & PNG_COLOR_MASK_ALPHA) { png_set_invert_alpha(png_ptr); /* png_do_read_invert_alpha */ png_set_swap_alpha(png_ptr); /* png_do_read_swap_alpha */ } - + /* Target 4: Bit shifting (triggers png_do_unshift) */ if (bit_depth < 8) { png_set_packing(png_ptr); } - + /* Target 5: Alpha encoding (triggers png_do_encode_alpha) */ png_set_alpha_mode(png_ptr, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR); - + /* Update transformations */ png_read_update_info(png_ptr, info_ptr); - + /* Read image data to execute transformations */ size_t rowbytes = png_get_rowbytes(png_ptr, info_ptr); png_bytep row = (png_bytep)malloc(rowbytes); @@ -98,7 +98,7 @@ } free(row); } - + png_destroy_read_struct(&png_ptr, &info_ptr, NULL); } @@ -107,17 +107,17 @@ png_image image; memset(&image, 0, sizeof(image)); image.version = PNG_IMAGE_VERSION; - + if (!png_image_begin_read_from_memory(&image, data, size)) { return; } - + /* Limit image size for performance */ if (image.width > 1024 || image.height > 1024) { png_image_free(&image); return; } - + /* Test different colormap formats to trigger uncovered functions */ png_uint_32 formats[] = { PNG_FORMAT_GRAY, @@ -127,11 +127,11 @@ PNG_FORMAT_RGB_COLORMAP, PNG_FORMAT_RGBA_COLORMAP }; - + int i; for (i = 0; i < 6; i++) { image.format = formats[i]; - + size_t buffer_size = PNG_IMAGE_SIZE(image); if (buffer_size > 0 && buffer_size < 5*1024*1024) { /* Limit to 5MB */ void *img_buffer = malloc(buffer_size); @@ -149,7 +149,7 @@ free(img_buffer); } } - + /* Reset for next format */ if (i < 5) { png_image_free(&image); @@ -160,7 +160,7 @@ } } } - + png_image_free(&image); } @@ -169,43 +169,43 @@ static void test_png_read_png_api(const uint8_t *data, size_t size) { png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL); if (!png_ptr) return; - + png_infop info_ptr = png_create_info_struct(png_ptr); if (!info_ptr) { png_destroy_read_struct(&png_ptr, NULL, NULL); return; } - + if (setjmp(png_jmpbuf(png_ptr))) { png_destroy_read_struct(&png_ptr, &info_ptr, NULL); return; } - + struct png_mem_buffer buffer = {data, size, 0}; png_set_read_fn(png_ptr, &buffer, png_read_from_buffer); - + /* Set up transformations before reading */ png_set_scale_16(png_ptr); png_set_packing(png_ptr); png_set_expand(png_ptr); - + /* Use png_read_png which should trigger OSS_FUZZ_png_read_png path */ png_read_png(png_ptr, info_ptr, PNG_TRANSFORM_IDENTITY, NULL); - + png_destroy_read_struct(&png_ptr, &info_ptr, NULL); } extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size < 8) return 0; - + /* Test 1: Standard PNG reading with transformations */ test_png_transformations(data, size); - + /* Test 2: PNG image API with colormap processing */ test_png_image_colormap(data, size); - + /* Test 3: png_read_png API */ test_png_read_png_api(data, size); - + return 0; }