/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ /* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "FuzzingInterface.h" #include "FuzzingBufferReader.h" #include "mozilla/webrender/webrender_ffi.h" static int testInitMoz2D(int* argc, char*** argv) { return 0; } static int testMoz2DRenderCallback(const uint8_t* buf, size_t size) { FuzzingBufferReader fuzzBuf(buf, size); uint8_t imageFormat = MOZ_TRY(fuzzBuf.Read()); mozilla::wr::LayoutIntRect renderRect; renderRect.min.x = MOZ_TRY(fuzzBuf.Read()); renderRect.min.y = MOZ_TRY(fuzzBuf.Read()); renderRect.max.x = MOZ_TRY(fuzzBuf.Read()); renderRect.max.y = MOZ_TRY(fuzzBuf.Read()); mozilla::wr::DeviceIntRect visibleRect; visibleRect.min.x = MOZ_TRY(fuzzBuf.Read()); visibleRect.min.y = MOZ_TRY(fuzzBuf.Read()); visibleRect.max.x = MOZ_TRY(fuzzBuf.Read()); visibleRect.max.y = MOZ_TRY(fuzzBuf.Read()); uint16_t tileSize = MOZ_TRY(fuzzBuf.Read()); mozilla::wr::TileOffset tileOffset; if (tileSize) { tileOffset.x = MOZ_TRY(fuzzBuf.Read()); tileOffset.y = MOZ_TRY(fuzzBuf.Read()); } uint8_t haveDirtyRect = MOZ_TRY(fuzzBuf.Read()); mozilla::wr::LayoutIntRect dirtyRect; if (!!haveDirtyRect) { dirtyRect.min.x = MOZ_TRY(fuzzBuf.Read()); dirtyRect.min.y = MOZ_TRY(fuzzBuf.Read()); dirtyRect.max.x = MOZ_TRY(fuzzBuf.Read()); dirtyRect.max.y = MOZ_TRY(fuzzBuf.Read()); } uint32_t outLength = MOZ_TRY(fuzzBuf.Read()); if (outLength >= 10 * 1024 * 1024) { return 0; } uint32_t blobLength = fuzzBuf.Length(); // limit buffer lengths to prevent oom if (blobLength >= 10 * 1024 * 1024) { return 0; } UniquePtr blobBuffer(new uint8_t[blobLength]); memcpy(blobBuffer.get(), fuzzBuf.Pos(), blobLength); UniquePtr outBuffer(new uint8_t[outLength]); wr_moz2d_render_cb(mozilla::wr::ByteSlice{blobBuffer.get(), blobLength}, static_cast(imageFormat), &renderRect, &visibleRect, tileSize, tileSize ? &tileOffset : nullptr, !!haveDirtyRect ? &dirtyRect : nullptr, mozilla::wr::MutByteSlice{outBuffer.get(), outLength}); return 0; } MOZ_FUZZING_INTERFACE_RAW(testInitMoz2D, testMoz2DRenderCallback, Moz2D);