1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fuzzing: Don't explicitly restrict sizes before loading images

Browse Source 
Since Qt 6.0, QImageIOHandlers by default take care of this themselves
by not allocating more than 128 MiB for an image.

This change will not significantly reduce code coverage of the fuzzer
because QImage::loadFromData() calls QImageReader::read() which does
everything QImageReader::size() does except for returning the read size
in the end. On the other hand, it will speed up the execution because
the same image will not be read twice by different QImageReaders anymore.

Change-Id: Iab63d9e5ec02fbe5765fbf7ccb0b82896ec37692
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
This commit is contained in:
Robert Löhning 2022-01-04 21:49:05 +01:00
parent 2baa7eb260
commit 90f0d522bf
1 changed files with 2 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
tests/libfuzzer/gui/image/qimage/loadfromdata/main.cpp
View File

@ -1,6 +1,6 @@
/****************************************************************************
**
** Copyright (C) 2020 The Qt Company Ltd.
** Copyright (C) 2022 The Qt Company Ltd.
** Contact: https://www.qt.io/licensing/
**
** This file is part of the test suite of the Qt Toolkit.
@ -26,11 +26,8 @@
**
****************************************************************************/
#include <QBuffer>
#include <QGuiApplication>
#include <QImage>
#include <QImageReader>
#include <QSize>
#include <QtGlobal>
// silence warnings
@ -44,12 +41,6 @@ extern "C" int LLVMFuzzerTestOneInput(const char *Data, size_t Size) {
static char arg3[] = "minimal";
static char *argv[] = {arg1, arg2, arg3, nullptr};
static QGuiApplication qga(argc, argv);
QByteArray input(QByteArray::fromRawData(Data, Size));
QBuffer buf(&input);
const QSize size = QImageReader(&buf).size();
// Don't try to load huge valid images.
// They are justified in using huge memory.
if (!size.isValid() || uint64_t(size.width()) * size.height() < 64 * 1024 * 1024)
QImage().loadFromData(input);
QImage().loadFromData(QByteArray::fromRawData(Data, Size));
return 0;
}