1 files changed, 42 insertions, 0 deletions
diff --git a/testing/libfuzzer/pdf_codec_fax_fuzzer.cc b/testing/libfuzzer/pdf_codec_fax_fuzzer.cc
new file mode 100644
index 0000000000..1a04c31aa0
--- /dev/null
+++ b/testing/libfuzzer/pdf_codec_fax_fuzzer.cc
@@ -0,0 +1,42 @@
+// Copyright 2016 The PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cstdint>
+#include <memory>
+
+#include "core/fxcodec/codec/ccodec_faxmodule.h"
+#include "core/fxcodec/codec/ccodec_scanlinedecoder.h"
+
+static int GetInteger(const uint8_t* data) {
+  return data[0] | data[1] << 8 | data[2] << 16 | data[3] << 24;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  const int kParameterSize = 21;
+  if (size < kParameterSize)
+    return 0;
+
+  int width = GetInteger(data);
+  int height = GetInteger(data + 4);
+  int K = GetInteger(data + 8);
+  int Columns = GetInteger(data + 12);
+  int Rows = GetInteger(data + 16);
+  FX_BOOL EndOfLine = (data[20] & 0x01) == 0;
+  FX_BOOL ByteAlign = (data[20] & 0x02) == 0;
+  FX_BOOL BlackIs1 = (data[20] & 0x04) == 0;
+  data += kParameterSize;
+  size -= kParameterSize;
+
+  CCodec_FaxModule fax_module;
+  std::unique_ptr<CCodec_ScanlineDecoder> decoder;
+  decoder.reset(fax_module.CreateDecoder(data, size, width, height, K,
+                                         EndOfLine, ByteAlign, BlackIs1,
+                                         Columns, Rows));
+
+  int line = 0;
+  while (decoder->GetScanline(line))
+    line++;
+
+  return 0;
+}