From 420667955a7453326f5192543b95c620cce19ba2 Mon Sep 17 00:00:00 2001
From: 5225225 <5225225@mailbox.org>
Date: Sat, 29 May 2021 12:47:39 +0100
Subject: [PATCH] Add fuzzer with 1MB size limits decoding image

---
 fuzz/.gitignore                   |  3 +++
 fuzz/Cargo.toml                   | 25 +++++++++++++++++++++++++
 fuzz/fuzz_targets/decode_image.rs | 19 +++++++++++++++++++
 3 files changed, 47 insertions(+)
 create mode 100644 fuzz/.gitignore
 create mode 100644 fuzz/Cargo.toml
 create mode 100644 fuzz/fuzz_targets/decode_image.rs

diff --git a/fuzz/.gitignore b/fuzz/.gitignore
new file mode 100644
index 0000000..a092511
--- /dev/null
+++ b/fuzz/.gitignore
@@ -0,0 +1,3 @@
+target
+corpus
+artifacts
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
new file mode 100644
index 0000000..f971d29
--- /dev/null
+++ b/fuzz/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "tiff-fuzz"
+version = "0.0.0"
+authors = ["Automatically generated"]
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[dependencies.tiff]
+path = ".."
+
+# Prevent this from interfering with workspaces
+[workspace]
+members = ["."]
+
+[[bin]]
+name = "decode_image"
+path = "fuzz_targets/decode_image.rs"
+test = false
+doc = false
diff --git a/fuzz/fuzz_targets/decode_image.rs b/fuzz/fuzz_targets/decode_image.rs
new file mode 100644
index 0000000..1ee6ae3
--- /dev/null
+++ b/fuzz/fuzz_targets/decode_image.rs
@@ -0,0 +1,19 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let mut decoder = if let Ok(d) = tiff::decoder::Decoder::new(std::io::Cursor::new(data)) {
+        d
+    } else {
+        return;
+    };
+
+    let mut limits = tiff::decoder::Limits::default();
+    limits.decoding_buffer_size = 1_000_000;
+    limits.ifd_value_size = 1_000_000;
+    limits.intermediate_buffer_size = 1_000_000;
+
+    decoder = decoder.with_limits(limits);
+
+    let _ = decoder.read_image();
+});