summaryrefslogtreecommitdiff
path: root/testing/libfuzzer
diff options
context:
space:
mode:
authortsepez <tsepez@chromium.org>2016-08-18 14:37:07 -0700
committerCommit bot <commit-bot@chromium.org>2016-08-18 14:37:07 -0700
commit7996fe888cb98597cd1608af05fb59f45c837fc6 (patch)
treeecfcf15f788be1d2982a279de77d49d8e20a6c94 /testing/libfuzzer
parent1a8946b09884393d7dc4941e59b3172a7e473b01 (diff)
downloadpdfium-7996fe888cb98597cd1608af05fb59f45c837fc6.tar.xz
Add llvm fuzzer for CPDF_PSEngine
Put class definition into its own header file so fuzzer can find it. Fix a pair of div by 0s immediately hit by the fuzzer. Review-Url: https://codereview.chromium.org/2253193003
Diffstat (limited to 'testing/libfuzzer')
-rw-r--r--testing/libfuzzer/BUILD.gn15
-rw-r--r--testing/libfuzzer/pdf_psengine_fuzzer.cc14
2 files changed, 29 insertions, 0 deletions
diff --git a/testing/libfuzzer/BUILD.gn b/testing/libfuzzer/BUILD.gn
index 1b7a7fb456..718a1db3c0 100644
--- a/testing/libfuzzer/BUILD.gn
+++ b/testing/libfuzzer/BUILD.gn
@@ -168,3 +168,18 @@ source_set("pdf_jpx_fuzzer") {
":libfuzzer_config",
]
}
+
+source_set("pdf_psengine_fuzzer") {
+ testonly = true
+ sources = [
+ "pdf_psengine_fuzzer.cc",
+ ]
+ deps = [
+ "//third_party/pdfium:pdfium",
+ ]
+ configs -= [ "//build/config/compiler:chromium_code" ]
+ configs += [
+ "//build/config/compiler:no_chromium_code",
+ ":libfuzzer_config",
+ ]
+}
diff --git a/testing/libfuzzer/pdf_psengine_fuzzer.cc b/testing/libfuzzer/pdf_psengine_fuzzer.cc
new file mode 100644
index 0000000000..89f582ec64
--- /dev/null
+++ b/testing/libfuzzer/pdf_psengine_fuzzer.cc
@@ -0,0 +1,14 @@
+// Copyright 2016 The PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/fpdfapi/fpdf_page/cpdf_psengine.h"
+
+#include <cstdint>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+ CPDF_PSEngine engine;
+ if (engine.Parse(reinterpret_cast<const char*>(data), size))
+ engine.Execute();
+ return 0;
+}