1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
// Copyright 2018 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stddef.h>
#include <stdint.h>
#include <string.h>
#include <fuzzer/FuzzedDataProvider.h>
#include <vector>
#include "base/command_line.h"
#include "components/viz/common/hit_test/hit_test_query.h"
#include "ui/gfx/geometry/test/fuzzer_util.h"
namespace {
void AddHitTestRegion(FuzzedDataProvider* fuzz,
std::vector<viz::AggregatedHitTestRegion>* regions,
std::vector<viz::FrameSinkId>* frame_sink_ids,
const uint32_t depth = 0) {
constexpr uint32_t kMaxDepthAllowed = 25;
if (fuzz->remaining_bytes() < sizeof(viz::AggregatedHitTestRegion))
return;
viz::FrameSinkId frame_sink_id(fuzz->ConsumeIntegralInRange<uint32_t>(
1, std::numeric_limits<uint32_t>::max()),
fuzz->ConsumeIntegralInRange<uint32_t>(
1, std::numeric_limits<uint32_t>::max()));
uint32_t flags = fuzz->ConsumeIntegral<uint32_t>();
// The reasons' value is kNotAsyncHitTest if the flag's value is kHitTestAsk.
uint32_t reasons = (flags & viz::HitTestRegionFlags::kHitTestAsk)
? fuzz->ConsumeIntegralInRange<uint32_t>(
1, std::numeric_limits<uint32_t>::max())
: viz::AsyncHitTestReasons::kNotAsyncHitTest;
gfx::Rect rect(
fuzz->ConsumeIntegralInRange<int>(std::numeric_limits<int>::min() + 1,
std::numeric_limits<int>::max()),
fuzz->ConsumeIntegralInRange<int>(std::numeric_limits<int>::min() + 1,
std::numeric_limits<int>::max()),
fuzz->ConsumeIntegral<int>(), fuzz->ConsumeIntegral<int>());
int32_t child_count =
depth < kMaxDepthAllowed ? fuzz->ConsumeIntegralInRange(0, 10) : 0;
regions->emplace_back(frame_sink_id, flags, rect,
gfx::ConsumeTransform(*fuzz), child_count, reasons);
// Always add the first frame sink id, because the root needs to be in the
// list of FrameSinkId.
if (regions->size() == 1 || fuzz->ConsumeBool())
frame_sink_ids->push_back(frame_sink_id);
while (child_count-- > 0)
AddHitTestRegion(fuzz, regions, frame_sink_ids, depth + 1);
}
class Environment {
public:
Environment() { base::CommandLine::Init(0, nullptr); }
};
} // namespace
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t num_bytes) {
// Initialize the environment only once.
static Environment environment;
// If there isn't enough memory to have a single AggregatedHitTestRegion, then
// skip.
if (num_bytes < sizeof(viz::AggregatedHitTestRegion))
return 0;
// Create the list of AggregatedHitTestRegion objects.
std::vector<viz::AggregatedHitTestRegion> regions;
std::vector<viz::FrameSinkId> frame_sink_ids;
FuzzedDataProvider fuzz(data, num_bytes);
AddHitTestRegion(&fuzz, ®ions, &frame_sink_ids);
// Create the HitTestQuery and send hit-test data.
viz::HitTestQuery query{std::nullopt};
query.OnAggregatedHitTestRegionListUpdated(regions);
for (float x = 0; x < 1000.; x += 10) {
for (float y = 0; y < 1000.; y += 10) {
gfx::PointF location(x, y);
query.FindTargetForLocation(viz::EventSource::MOUSE, location);
query.TransformLocationForTarget(frame_sink_ids, location, &location);
}
}
return 0;
}
|
