sergiotarxz/libvips
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

block fuzz data over 100kb

Browse Source 
Many codecs can take a huge amount of time attempting to read large
random objects. jpeg_read_header(), for example, can take ~10s on a 1mb
of random data.

Ignore fuzz objects over 100kb.

See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24383
This commit is contained in:
John Cupitt 2020-07-25 14:46:44 +01:00
parent 213533e03c
commit cb1634dd31
8 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fuzz/jpegsave_buffer_fuzzer.cc
View File

@ -14,6 +14,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
void *buf; void *buf;
size_t len; size_t len;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );

3
fuzz/jpegsave_file_fuzzer.cc
View File

@ -42,6 +42,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
{ {
char *name; char *name;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(name = vips__temp_name( "%s" )) ) if( !(name = vips__temp_name( "%s" )) )
return( 0 ); return( 0 );

3
fuzz/mosaic_fuzzer.cc
View File

@ -25,6 +25,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
if( size < sizeof( struct mosaic_opt ) ) if( size < sizeof( struct mosaic_opt ) )
return( 0 ); return( 0 );
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(ref = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(ref = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );

3
fuzz/pngsave_buffer_fuzzer.cc
View File

@ -14,6 +14,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
void *buf; void *buf;
size_t len; size_t len;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );

3
fuzz/sharpen_fuzzer.cc
View File

@ -13,6 +13,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
VipsImage *image, *out; VipsImage *image, *out;
double d; double d;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );

3
fuzz/smartcrop_fuzzer.cc
View File

@ -13,6 +13,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
VipsImage *image, *out; VipsImage *image, *out;
double d; double d;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );

3
fuzz/thumbnail_fuzzer.cc
View File

@ -13,6 +13,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
VipsImage *image, *out; VipsImage *image, *out;
double d; double d;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );

3
fuzz/webpsave_buffer_fuzzer.cc
View File

@ -14,6 +14,9 @@ LLVMFuzzerTestOneInput( const guint8 *data, size_t size )
void *buf; void *buf;
size_t len; size_t len;
if( size > 100 * 1024 * 1024 )
return( 0 );
if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) ) if( !(image = vips_image_new_from_buffer( data, size, "", NULL )) )
return( 0 ); return( 0 );