commit f63c349053b491f46ed8883684329353c6255194
author Leon Scroggins III <scroggo@google.com> Wed Jan 13 14:32:59 2021 -0500
committer Leon Scroggins III <scroggo@google.com> Thu Jan 14 11:57:39 2021 -0500
tree 2be45be5dfb2fc350f2434c9713adbac26d5e1c7
parent cc60f0d7334dd6557596fe4e1f87f9ef96e87be9

Improve AImageDecoder fuzzer

Bug: 169137236
Bug: 169139756
Test: this (fuzzer)

Extend the fuzzer to test animations.

Also test a lossless webp, left out of
Ib227639bf8da75f0e8e31e216bc6d1371e24cb75.

Change-Id: I81d35d6fa7d560b33b6a2b5d6c1992cbdd77bc87

native/graphics/jni/corpus/webp-color-profile-lossless.webp

diff --git a/native/graphics/jni/corpus/webp-color-profile-lossless.webp b/native/graphics/jni/corpus/webp-color-profile-lossless.webp
new file mode 100644
index 0000000..4fd63d5
--- /dev/null
+++ b/native/graphics/jni/corpus/webp-color-profile-lossless.webp
Binary files differ

native/graphics/jni/fuzz_imagedecoder.cpp

diff --git a/native/graphics/jni/fuzz_imagedecoder.cpp b/native/graphics/jni/fuzz_imagedecoder.cpp
index f2cd1a8..015aca7 100644
--- a/native/graphics/jni/fuzz_imagedecoder.cpp
+++ b/native/graphics/jni/fuzz_imagedecoder.cpp
@@ -73,6 +73,12 @@
         return 0;
     }
 
-    AImageDecoder_decodeImage(decoder.get(), pixels.get(), stride, pixelSize);
+    while (true) {
+        int result = AImageDecoder_decodeImage(decoder.get(), pixels.get(), stride, pixelSize);
+        if (result != ANDROID_IMAGE_DECODER_SUCCESS) break;
+
+        result = AImageDecoder_advanceFrame(decoder.get());
+        if (result != ANDROID_IMAGE_DECODER_SUCCESS) break;
+    }
     return 0;
 }