Commit graph

233 commits

Author SHA1 Message Date
Tim Ledbetter
03fbd6c0c8 Fuzzers: Add a fuzzer for JsonParser 2023-10-24 07:54:37 +02:00
implicitfield
1b3ad1c721 LibCrypto: Add support for BLAKE2b 2023-09-17 16:49:35 +03:30
Tim Schumacher
dbc25f18ec LibCompress: Let BrotliDecompressionStream take a MaybeOwned 2023-08-23 12:03:37 +01:00
Tim Schumacher
8a853278d0 LibCompress: Port ZlibDecompressor to AK::Stream 2023-08-23 12:03:37 +01:00
Nicolas Ramz
0986533c11 Meta+Tests: Add a fuzzer and a test for the ILBM decoder 2023-08-15 18:36:11 +01:00
Andreas Kling
3bb06cc719 Fuzzers: Use the LibJS bytecode VM 2023-08-08 13:07:13 +02:00
Andreas Kling
18c54d8d40 LibJS: Make Cell::initialize() return void
Stop worrying about tiny OOMs.

Work towards #20405
2023-08-08 07:39:11 +02:00
Sam Atkins
bf1d680a75 FuzzPDF: Initialize document so page count is accurate
Without calling `initialize()`, the page count is 0, so the loop never
ran and we never actually tested any of the code in `get_page()`.
2023-07-26 06:22:34 -04:00
MacDue
b5658d75f5 Fuzzers: Add a DDS fuzzer 2023-07-19 06:52:06 +02:00
MacDue
581236b24a Fuzzers: Add a TinyVG fuzzer 2023-07-19 06:52:06 +02:00
Lucas CHOLLET
4291288a31 LibGfx: Remove ImageDecoderPlugin::initialize()
No plugin is currently overriding the default implementation, which is a
no-op. So we can safely delete it.
2023-07-18 14:34:35 +01:00
kleines Filmröllchen
8df714ff1e Meta/Fuzzers: Extract common audio fuzzing code
Apart from the class used audio fuzzers have identical behavior: Create
a memory stream from the fuzzer input and pass this to the loader, then
try to load audio until an error occurs. Since the loader plugins need
to have the same static create() function anyways for LibAudio itself,
we can unify the fuzzer implementations and reduce code duplication.
2023-07-05 11:58:50 +01:00
kleines Filmröllchen
5f1dbbaaa6 LibAudio: Extract loader stream creation from the plugins
This removes a lot of duplicated stream creation code from the plugins,
and also simplifies the way that the appropriate plugin is found. This
mirrors the ImageDecoderPlugin design and necessitates new sniffing
methods on the loaders.
2023-06-27 15:28:22 +01:00
implicitfield
b6af5eaa72 Fuzzers: Unbreak FuzzHttpRequest
Previously, the exit condition was inverted, causing the fuzzer to
try to read the value of an error.
2023-05-24 16:25:13 +02:00
Tim Schumacher
0f2b6345c6 test-fuzz: Add all the missing fuzzers 2023-05-23 06:11:33 +02:00
Tim Schumacher
9690b4011b Lagom: Extract the list of fuzzing targets to a separate file 2023-05-23 06:11:33 +02:00
Tim Schumacher
e2ec8f6584 Fuzzers: Add a fuzzer for roundtrip LZMA compression/decompression 2023-05-19 23:40:33 +02:00
Ben Wiederhake
da394abe04 LibGfx+Fuzz: Convert ImageDecoder::initialize to ErrorOr
This prevents callers from accidentally discarding the result of
initialize(), which was the root cause of this OSS Fuzz bug:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55896&q=label%3AProj-serenity&sort=summary
2023-05-12 09:40:24 +01:00
Tim Schumacher
ad60a0b522 Fuzzers: Stop loading audio frames once the end is reached
Previously, the condition was reversed, so we would stop immediately on
a file that has at least one working chunk, and we would infinitely loop
on a file with no chunks.
2023-04-12 14:03:20 -04:00
Ben Wiederhake
560133a0c6 Everywhere: Remove unused DeprecatedString includes 2023-04-09 22:00:54 +02:00
Nico Weber
a34b300393 Fuzzers: Add a WebP fuzzer 2023-04-08 18:58:14 +02:00
stelar7
d527edf0ab LibTLS: Change Certificate parsing to use ErrorOr
Loads of changes that are tightly connected... :/
* Change lambdas to static functions
* Add spec docs to those functions
* Keep the current scope around as a parameter
* Add wrapping classes for some Certificate members
* Parse ec and ecdsa data from certificates
2023-04-06 09:57:31 +03:30
Aliaksandr Kalenik
9220cdc285 LibHTTP+WebDriver+WebServer: Return error from HTTP request parser 2023-03-26 17:56:17 +02:00
Lucas CHOLLET
496b7ffb2b LibGfx: Move all image loaders and writers to a subdirectory 2023-03-21 22:39:25 +01:00
Tim Schumacher
123e9fa5d0 Lagom: Add a fuzzer for LZMA decompression 2023-03-20 12:15:38 +02:00
Andrew Kaster
958f9e960d Fuzzers: Use correct type name in FuzzilliJs fuzzer 2023-03-19 14:31:10 -06:00
Timothy Flynn
1b260ab1f8 Meta: Move global VM creation to fuzzer "global" structure
Turns out LLVMFuzzerTestOneInput may be called more than once per
process.
2023-03-19 00:15:05 +00:00
Andrew Kaster
cabc99e953 Fuzzers: Skip trying to parse invalid UTF-8 in LibJS Fuzzers
Invalid UTF-8 crashes JS::Script::Parse.
2023-03-18 15:56:18 +01:00
Timothy Flynn
5d7a85bc37 Meta: Ensure the main thread VM is created before use in the CSS fuzzer 2023-03-17 16:48:43 +00:00
Timothy Flynn
13dfadba79 LibJS: Propagate errors from VM creation 2023-03-17 16:39:08 +00:00
kleines Filmröllchen
264cc76ab4 LibAudio: Move audio stream buffering into the loader
Before, some loader plugins implemented their own buffering (FLAC&MP3),
some didn't require any (WAV), and some didn't buffer at all (QOA). This
meant that in practice, while you could load arbitrary amounts of
samples from some loader plugins, you couldn't do that with some others.
Also, it was ill-defined how many samples you would actually get back
from a get_more_samples call.

This commit fixes that by introducing a layer of abstraction between the
loader and its plugins (because that's the whole point of having the
extra class!). The plugins now only implement a load_chunks() function,
which is much simpler to implement and allows plugins to play fast and
loose with what they actually return. Basically, they can return many
chunks of samples, where one chunk is simply a convenient block of
samples to load. In fact, some loaders such as FLAC and QOA have
separate internal functions for loading exactly one chunk. The loaders
*should* load as many chunks as necessary for the sample count to be
reached or surpassed (the latter simplifies loading loops in the
implementations, since you don't need to know how large your next chunk
is going to be; a problem for e.g. FLAC). If a plugin has no problems
returning data of arbitrary size (currently WAV), it can return a single
chunk that exactly (or roughly) matches the requested sample count. If a
plugin is at the stream end, it can also return less samples than was
requested! The loader can handle all of these cases and may call into
load_chunk multiple times. If the plugin returns an empty chunk list (or
only empty chunks; again, they can play fast and loose), the loader
takes that as a stream end signal. Otherwise, the loader will always
return exactly as many samples as the user requested. Buffering is
handled by the loader, allowing any underlying plugin to deal with any
weird sample count requirement the user throws at it (looking at you,
SoundPlayer!).

This (not accidentally!) makes QOA work in SoundPlayer.
2023-03-13 13:25:42 +01:00
kleines Filmröllchen
0f7a5006d1 Meta/Lagom: Add a fuzzer for QOA 2023-03-10 04:07:14 -07:00
Linus Groh
f068ddb79f LibIMAP: Propagate OOM errors from decode_quoted_printable() 2023-03-09 14:47:45 +00:00
kleines Filmröllchen
5ec5c68ed4 Meta: Allow disabling LibWeb fuzzers
The LibWeb fuzzer build is really slow, so for local builds it is useful
to disable it when you're not interested in running that fuzzer.

Co-authored-by: Andrew Kaster <akaster@serenityos.org>
2023-02-25 19:39:04 +01:00
Sam Atkins
2db168acc1 LibTextCodec+Everywhere: Port Decoders to new Strings 2023-02-19 17:15:47 +01:00
Sam Atkins
f2a9426885 LibTextCodec+Everywhere: Return Optional<Decoder&> from decoder_for() 2023-02-19 17:15:47 +01:00
Lucas CHOLLET
856d0202f2 LibGfx: Rename JPGLoader to JPEGLoader
The patch also contains modifications on several classes, functions or
files that are related to the `JPGLoader`.

Renaming include:
 - JPGLoader{.h, .cpp}
 - JPGImageDecoderPlugin
 - JPGLoadingContext
 - JPG_DEBUG
 - decode_jpg
 - FuzzJPGLoader.cpp
 - Few string literals or texts
2023-02-18 23:56:24 +01:00
Sam Atkins
d6075ef5b5 LibTextCodec+Everywhere: Make TextCodec::decoder_for() take a StringView
We don't need a full String/DeprecatedString inside this function, so we
might as well not force users to create one.
2023-02-15 12:48:26 -05:00
Ali Mohammad Pur
617d112780 Meta: Add a Shell --posix parser fuzzer 2023-02-13 23:00:15 +03:30
Tim Schumacher
874c7bba28 LibCore: Remove Stream.h 2023-02-13 00:50:07 +00:00
Tim Schumacher
220fbcaa7e AK: Remove the fallible constructor from FixedMemoryStream 2023-02-08 17:44:32 +00:00
Tim Schumacher
093cf428a3 AK: Move memory streams from LibCore 2023-01-29 19:16:44 -07:00
Timothy Flynn
2692db8699 LibJS+Everywhere: Allow Cell::initialize overrides to throw OOM errors
Note that as of this commit, there aren't any such throwers, and the
call site in Heap::allocate will drop exceptions on the floor. This
commit only serves to change the declaration of the overrides, make sure
they return an empty value, and to propagate OOM errors frm their base
initialize invocations.
2023-01-29 00:02:45 +00:00
Linus Groh
ee0297d9ec LibAudio: Remove try_ prefix from fallible LoaderPlugin methods 2023-01-28 22:41:36 +01:00
Nico Weber
721b280849 LibGfx: Move ICCProfile.{h,cpp} to ICC/Profile.{h,cpp} 2023-01-28 00:27:07 +00:00
Tim Schumacher
982ebbc304 LibWasm: Port the parser to Core::Stream 2023-01-25 17:10:05 +03:30
Liav A
57e19a7e56 LibGfx: Re-structure the whole initialization pattern for image decoders
When trying to figure out the correct implementation, we now have a very
strong distinction on plugins that are well suited for sniffing, and
plugins that need a MIME type to be chosen.

Instead of having multiple calls to non-static virtual sniff methods for
each Image decoding plugin, we have 2 static methods for each
implementation:
1. The sniff method, which in contrast to the old method, gets a
    ReadonlyBytes parameter and ensures we can figure out the result
    with zero heap allocations for most implementations.
2. The create method, which just creates a new instance so we don't
    expose the constructor to everyone anymore.

In addition to that, we have a new virtual method called initialize,
which has a per-implementation initialization pattern to actually ensure
each implementation can construct a decoder object, and then have a
correct context being applied to it for the actual decoding.
2023-01-20 15:13:31 +00:00
Timothy Flynn
5a1ac851aa FuzzilliJs: Print the result of JS::Value::to_string using AK::outln
JS::Value::to_string now returns a String, which does not have a null-
terminated characters() accessor.
2023-01-18 12:52:25 +00:00
Nico Weber
cbb6f8de65 Lagom/Fuzzers: Add fuzzer for ICCProfile 2023-01-17 22:25:33 -05:00
Liav A
b2626d3bc1 Lagom/Fuzzers: Add fuzzer for the TGALoader code 2023-01-15 12:43:03 +01:00