diff --git a/fuzz/.gitignore b/fuzz/.gitignore new file mode 100644 index 0000000..a092511 --- /dev/null +++ b/fuzz/.gitignore @@ -0,0 +1,3 @@ +target +corpus +artifacts diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml new file mode 100644 index 0000000..f971d29 --- /dev/null +++ b/fuzz/Cargo.toml @@ -0,0 +1,25 @@ +[package] +name = "tiff-fuzz" +version = "0.0.0" +authors = ["Automatically generated"] +publish = false +edition = "2018" + +[package.metadata] +cargo-fuzz = true + +[dependencies] +libfuzzer-sys = "0.4" + +[dependencies.tiff] +path = ".." + +# Prevent this from interfering with workspaces +[workspace] +members = ["."] + +[[bin]] +name = "decode_image" +path = "fuzz_targets/decode_image.rs" +test = false +doc = false diff --git a/fuzz/fuzz_targets/decode_image.rs b/fuzz/fuzz_targets/decode_image.rs new file mode 100644 index 0000000..1ee6ae3 --- /dev/null +++ b/fuzz/fuzz_targets/decode_image.rs @@ -0,0 +1,19 @@ +#![no_main] +use libfuzzer_sys::fuzz_target; + +fuzz_target!(|data: &[u8]| { + let mut decoder = if let Ok(d) = tiff::decoder::Decoder::new(std::io::Cursor::new(data)) { + d + } else { + return; + }; + + let mut limits = tiff::decoder::Limits::default(); + limits.decoding_buffer_size = 1_000_000; + limits.ifd_value_size = 1_000_000; + limits.intermediate_buffer_size = 1_000_000; + + decoder = decoder.with_limits(limits); + + let _ = decoder.read_image(); +});