OSS-Fuzz: OSS-Fuzz fuzzing integration

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,70 @@
+[package]
+name = "ttf-parser-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+serde = "1.0"
+serde_json = "1.0"
+ttf-parser = { path = "..", features = ["apple-layout"] }
+
+[[bin]]
+name = "fuzz-base"
+path = "fuzz_targets/fuzz-base.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-aat"
+path = "fuzz_targets/fuzz-aat.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-cpal"
+path = "fuzz_targets/fuzz-cpal.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-table"
+path = "fuzz_targets/fuzz-table.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-table-with-builder"
+path = "fuzz_targets/fuzz-table-with-builder.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-glyph-index"
+path = "fuzz_targets/fuzz-glyph-index.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-outline"
+path = "fuzz_targets/fuzz-outline.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz-variable-outline"
+path = "fuzz_targets/fuzz-variable-outline.rs"
+test = false
+doc = false
+bench = false

fuzz/fuzz_targets/fuzz-aat.rs

@@ -0,0 +1,109 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use std::num::NonZeroU16;
+use ttf_parser::{GlyphId, apple_layout::Lookup};
+
+fn u16_to_u8_vec(data: &[u16]) -> Vec<u8> {
+    let mut u8_data = Vec::with_capacity(data.len() * 2);
+    for &value in data {
+        u8_data.push((value >> 8) as u8);
+        u8_data.push(value as u8);
+    }
+    u8_data
+}
+
+fuzz_target!(|data: &[u8]| {
+    // Skip this iteration if data not enough
+    if data.len() < 4 {
+        return;
+    }
+
+    let (format_data, rest) = data.split_at(2);
+    let format = u16::from_be_bytes([format_data[0], format_data[1]]);
+
+    let random_u16 = |data: &[u8], idx: usize| -> Option<u16> {
+        if data.len() > idx + 1 {
+            Some(u16::from_be_bytes([data[idx], data[idx + 1]]))
+        } else {
+            None
+        }
+    };
+
+    let lookup_len = NonZeroU16::new(1).unwrap();
+
+    // Use valid fromat 0 2 4 6 8 10 for fuzzing chioce
+    match format {
+        0 => {
+            if let Some(value) = random_u16(rest, 0) {
+                let lookup_data = u16_to_u8_vec(&[0, value]);
+                if let Some(table) = Lookup::parse(lookup_len, &lookup_data) {
+                    let _ = table.value(GlyphId(0));
+                    let _ = table.value(GlyphId(1));
+                }
+            }
+        }
+        2 => {
+            if let Some(segment_size) = random_u16(rest, 2) {
+                let lookup_data = u16_to_u8_vec(&[2, segment_size, 1]);
+                if let Some(table) = Lookup::parse(lookup_len, &lookup_data) {
+                    let _ = table.value(GlyphId(118));
+                    let _ = table.value(GlyphId(5));
+                }
+            }
+        }
+        4 => {
+            if let Some(segment_size) = random_u16(rest, 2) {
+                let lookup_data = u16_to_u8_vec(&[4, segment_size, 1]);
+                if let Some(table) = Lookup::parse(lookup_len, &lookup_data) {
+                    let _ = table.value(GlyphId(118));
+                    let _ = table.value(GlyphId(7));
+                }
+            }
+        }
+        6 => {
+            if let Some(segment_size) = random_u16(rest, 2) {
+                let lookup_data = u16_to_u8_vec(&[6, segment_size]);
+                if let Some(table) = Lookup::parse(lookup_len, &lookup_data) {
+                    let _ = table.value(GlyphId(0));
+                    let _ = table.value(GlyphId(10));
+                }
+            }
+        }
+        8 => {
+            if let Some(glyph_count) = random_u16(rest, 2) {
+                let lookup_data = u16_to_u8_vec(&[8, 0, glyph_count]);
+                if let Some(table) = Lookup::parse(lookup_len, &lookup_data) {
+                    let _ = table.value(GlyphId(0));
+                    let _ = table.value(GlyphId(5));
+                }
+            }
+        }
+        10 => {
+            if let Some(value_size) = random_u16(rest, 2) {
+                let lookup_data = u16_to_u8_vec(&[10, value_size, 0]);
+                if let Some(table) = Lookup::parse(lookup_len, &lookup_data) {
+                    let _ = table.value(GlyphId(0));
+                    let _ = table.value(GlyphId(1));
+                }
+            }
+        }
+        _ => {
+          // Ignore invliad format of 1 3 5 7 9        
+        }
+    }
+});

fuzz/fuzz_targets/fuzz-base.rs

@@ -0,0 +1,162 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use ttf_parser::{Face, GlyphId, name_id};
+
+fn get_fuzzed_char(data: &[u8]) -> char {
+    if data.len() >= 4 {
+        let code_point = u32::from_le_bytes([data[0], data[1], data[2], data[3]]);
+        std::char::from_u32(code_point).unwrap_or('A')
+    } else {
+        'A'
+    }
+}
+
+fuzz_target!(|data: &[u8]| {
+    // Skip this iteration if no data is provided
+    if data.is_empty() {
+        return;
+    }
+
+    let choice = data[0] % 15;
+    let fuzz_data = &data[1..];
+
+    let face_result = Face::parse(fuzz_data, 0);
+    let id = if !data.is_empty() { data[0] as u16 } else { 0 };
+    let glyph_id = GlyphId(id);
+    let random_char = get_fuzzed_char(fuzz_data);
+
+    // Randomly fuzz functions from base ttf-parser
+    match choice {
+        0 => {
+            if let Ok(face) = face_result {
+                let mut family_names = Vec::new();
+                for name in face.names() {
+                    if name.name_id == name_id::FULL_NAME && name.is_unicode() {
+                        if let Some(family_name) = name.to_string() {
+                            let language = name.language();
+                            family_names.push(format!(
+                                "{} ({}, {})",
+                                family_name,
+                                language.primary_language(),
+                                language.region()
+                            ));
+                        }
+                    }
+                }
+                let _ = family_names;
+            }
+        },
+        1 => {
+            if let Ok(face) = face_result {
+                let _ = face.units_per_em();
+                let _ = face.ascender();
+                let _ = face.descender();
+                let _ = face.line_gap();
+                let _ = face.global_bounding_box();
+            }
+        },
+        2 => {
+            if let Ok(face) = face_result {
+                let _ = face.is_regular();
+                let _ = face.is_bold();
+                let _ = face.is_italic();
+                let _ = face.is_oblique();
+                let _ = face.is_variable();
+            }
+        },
+        3 => {
+            if let Ok(face) = face_result {
+                let _ = face.number_of_glyphs();
+                let _ = face.glyph_bounding_box(glyph_id);
+                let _ = face.glyph_hor_advance(glyph_id);
+                let _ = face.glyph_index(random_char);
+            }
+        },
+        4 => {
+            if let Ok(face) = face_result {
+                let _ = face.underline_metrics();
+                let _ = face.strikeout_metrics();
+                let _ = face.subscript_metrics();
+                let _ = face.superscript_metrics();
+            }
+        },
+        5 => {
+            if let Ok(face) = face_result {
+                let post_script_name = face.names().into_iter()
+                    .find(|name| name.name_id == name_id::POST_SCRIPT_NAME && name.is_unicode())
+                    .and_then(|name| name.to_string());
+                let _ = post_script_name;
+            }
+        },
+        6 => { 
+            if let Ok(face) = face_result {
+                let _ = face.glyph_raster_image(glyph_id, u16::MAX);
+            }
+        },
+        7 => {
+            if let Ok(face) = face_result {
+                if let Some(stat) = face.tables().stat {
+                    for axis in stat.axes {
+                        let _ = axis.tag;
+                    }
+                }
+            }
+        },
+        8 => {
+            if let Ok(face) = face_result {
+                if let Some(svg_table) = face.tables().svg {
+                    let _ = svg_table.documents.find(glyph_id);
+                }
+            }
+        },
+        9 => {
+            if let Ok(face) = face_result {
+                let _ = face.permissions();
+                let _ = face.is_variable();
+            }
+        },
+        10 => {
+            if let Ok(face) = face_result {
+                let _ = face.glyph_hor_side_bearing(glyph_id);
+                let _ = face.glyph_ver_advance(glyph_id);
+                let _ = face.glyph_ver_side_bearing(glyph_id);
+            }
+        },
+        11 => {
+            if let Ok(face) = face_result {
+                let _ = face.tables().os2;
+            }
+        },
+        12 => {
+            if let Ok(face) = face_result {
+                let _ = face.tables().head;
+            }
+        },
+        13 => {
+            if let Ok(face) = face_result {
+                let _ = face.tables().maxp;
+            }
+        },
+        14 => {
+            if let Ok(face) = face_result {
+                let _ = face.tables().hhea;
+            }
+        },
+        _ => return,
+    }
+});