December 2015 - Gfxprim

[repo.or.cz] gfxprim.git branch master updated: 1.0.0-rc1-174-g9e95a6d
by metan 19 Dec '15

19 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project gfxprim.git. The branch, master has been updated via 9e95a6d7dbef8989e1d78061312a28f906e8d685 (commit) via cbce1e498c7c03fa90abd5fd8ade80388efc1f3f (commit) via def0e21e1d79b55757534896fd810dbdd4019d95 (commit) via c5eee130375dd816b5e5a94ac24d9b2b5a4bf168 (commit) via 619a12314f7dee80aff4bdcdcabd4918300af001 (commit) via 05404f10c561c4820f7ade3ac02489baaedb33ea (commit) via d34bd097e24e5ed2ff2f741e0dd939c0450b7963 (commit) via 5df4db8d8a90ee2b6dc54b7648e6f410e3a77815 (commit) from 9910a9b5e922bd0493e5c76efb27474c4310ca34 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- http://repo.or.cz/gfxprim.git/commit/9e95a6d7dbef8989e1d78061312a28f906e8d6… commit 9e95a6d7dbef8989e1d78061312a28f906e8d685 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 23:01:38 2015 +0100 demos: c_simple: x11_windows: Fix SYS_RESIZE handling Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/x11_windows.c b/demos/c_simple/x11_windows.c index 1c5b2d0..aa37c7b 100644 --- a/demos/c_simple/x11_windows.c +++ b/demos/c_simple/x11_windows.c @@ -68,6 +68,8 @@ static int ev_loop(struct GP_Backend *backend, const char *name) switch (ev.code) { case GP_EV_SYS_RESIZE: GP_BackendResizeAck(backend); + redraw(backend->context); + GP_BackendFlip(backend); break; case GP_EV_SYS_QUIT: GP_BackendExit(backend); http://repo.or.cz/gfxprim.git/commit/cbce1e498c7c03fa90abd5fd8ade80388efc1f… commit cbce1e498c7c03fa90abd5fd8ade80388efc1f3f Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:58:04 2015 +0100 demos: c_simple: virtual_backend_example: Handle SYS_RESIZE Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/virtual_backend_example.c b/demos/c_simple/virtual_backend_example.c index 5ef5a8e..f59f4ec 100644 --- a/demos/c_simple/virtual_backend_example.c +++ b/demos/c_simple/virtual_backend_example.c @@ -31,11 +31,61 @@ #include <GP.h> +static GP_Pixel white_pixel, black_pixel, red_pixel, blue_pixel, green_pixel; + +static void redraw(GP_Backend *backend) +{ + GP_Context *context = backend->context; + + /* Now draw some testing patters */ + black_pixel = GP_RGBToContextPixel(0x00, 0x00, 0x00, context); + white_pixel = GP_RGBToContextPixel(0xff, 0xff, 0xff, context); + red_pixel = GP_RGBToContextPixel(0xff, 0x00, 0x00, context); + blue_pixel = GP_RGBToContextPixel(0x00, 0x00, 0xff, context); + green_pixel = GP_RGBToContextPixel(0x00, 0xff, 0x00, context); + + GP_Fill(context, white_pixel); + + unsigned int i, j; + for (i = 0; i < 40; i++) { + GP_HLineXYW(context, 0, i, i, black_pixel); + GP_HLineXYW(context, 1, i + 40, i, black_pixel); + GP_HLineXYW(context, 2, i + 80, i, black_pixel); + GP_HLineXYW(context, 3, i + 120, i, black_pixel); + GP_HLineXYW(context, 4, i + 160, i, black_pixel); + GP_HLineXYW(context, 5, i + 200, i, black_pixel); + GP_HLineXYW(context, 6, i + 240, i, black_pixel); + GP_HLineXYW(context, 7, i + 280, i, black_pixel); + } + + for (i = 0; i < 256; i++) { + for (j = 0; j < 256; j++) { + uint8_t val = 1.00 * sqrt(i*i + j*j)/sqrt(2) + 0.5; + + GP_Pixel pix = GP_RGBToContextPixel(i, j, val, context); + GP_PutPixel(context, i + 60, j + 10, pix); + } + } + + GP_Text(context, NULL, 60, 270, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, + black_pixel, white_pixel, "Lorem Ipsum dolor sit..."); + + GP_Text(context, NULL, 60, 290, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, + red_pixel, white_pixel, "Lorem Ipsum dolor sit..."); + + GP_Text(context, NULL, 60, 310, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, + green_pixel, white_pixel, "Lorem Ipsum dolor sit..."); + + GP_Text(context, NULL, 60, 330, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, + blue_pixel, white_pixel, "Lorem Ipsum dolor sit..."); + + /* Update the backend screen */ + GP_BackendFlip(backend); +} + int main(int argc, char *argv[]) { GP_Backend *backend; - GP_Context *context; - GP_Pixel white_pixel, black_pixel, red_pixel, blue_pixel, green_pixel; const char *backend_opts = "X11:350x350"; int opt; GP_PixelType emul_type = GP_PIXEL_UNKNOWN; @@ -90,52 +140,7 @@ int main(int argc, char *argv[]) backend = emul; } - context = backend->context; - - /* Now draw some testing patters */ - black_pixel = GP_RGBToContextPixel(0x00, 0x00, 0x00, context); - white_pixel = GP_RGBToContextPixel(0xff, 0xff, 0xff, context); - red_pixel = GP_RGBToContextPixel(0xff, 0x00, 0x00, context); - blue_pixel = GP_RGBToContextPixel(0x00, 0x00, 0xff, context); - green_pixel = GP_RGBToContextPixel(0x00, 0xff, 0x00, context); - - GP_Fill(context, white_pixel); - - unsigned int i, j; - for (i = 0; i < 40; i++) { - GP_HLineXYW(context, 0, i, i, black_pixel); - GP_HLineXYW(context, 1, i + 40, i, black_pixel); - GP_HLineXYW(context, 2, i + 80, i, black_pixel); - GP_HLineXYW(context, 3, i + 120, i, black_pixel); - GP_HLineXYW(context, 4, i + 160, i, black_pixel); - GP_HLineXYW(context, 5, i + 200, i, black_pixel); - GP_HLineXYW(context, 6, i + 240, i, black_pixel); - GP_HLineXYW(context, 7, i + 280, i, black_pixel); - } - - for (i = 0; i < 256; i++) { - for (j = 0; j < 256; j++) { - uint8_t val = 1.00 * sqrt(i*i + j*j)/sqrt(2) + 0.5; - - GP_Pixel pix = GP_RGBToContextPixel(i, j, val, context); - GP_PutPixel(context, i + 60, j + 10, pix); - } - } - - GP_Text(context, NULL, 60, 270, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, - black_pixel, white_pixel, "Lorem Ipsum dolor sit..."); - - GP_Text(context, NULL, 60, 290, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, - red_pixel, white_pixel, "Lorem Ipsum dolor sit..."); - - GP_Text(context, NULL, 60, 310, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, - green_pixel, white_pixel, "Lorem Ipsum dolor sit..."); - - GP_Text(context, NULL, 60, 330, GP_VALIGN_BELOW|GP_ALIGN_RIGHT, - blue_pixel, white_pixel, "Lorem Ipsum dolor sit..."); - - /* Update the backend screen */ - GP_BackendFlip(backend); + redraw(backend); for (;;) { if (backend->Poll) @@ -159,6 +164,15 @@ int main(int argc, char *argv[]) return 0; break; } + break; + case GP_EV_SYS: + switch(ev.code) { + case GP_EV_SYS_RESIZE: + GP_BackendResizeAck(backend); + redraw(backend); + break; + } + break; } } } http://repo.or.cz/gfxprim.git/commit/def0e21e1d79b55757534896fd810dbdd4019d… commit def0e21e1d79b55757534896fd810dbdd4019d95 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:53:03 2015 +0100 demos: c_simple: textaligntest: Handle SYS_RESIZE Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/textaligntest.c b/demos/c_simple/textaligntest.c index 5e2fbd6..0c08140 100644 --- a/demos/c_simple/textaligntest.c +++ b/demos/c_simple/textaligntest.c @@ -144,6 +144,11 @@ static void event_loop(void) GP_BackendExit(win); exit(0); break; + case GP_EV_SYS_RESIZE: + GP_BackendResizeAck(win); + X = win->context->w; + Y = win->context->h; + break; } break; } http://repo.or.cz/gfxprim.git/commit/c5eee130375dd816b5e5a94ac24d9b2b5a4bf1… commit c5eee130375dd816b5e5a94ac24d9b2b5a4bf168 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:49:43 2015 +0100 demos: c_simple: showimage: Handle SYS_RESIZE Adds SYS_RESIZE event handling and centers the image in the window. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/showimage.c b/demos/c_simple/showimage.c index c78cff0..4934d4c 100644 --- a/demos/c_simple/showimage.c +++ b/demos/c_simple/showimage.c @@ -72,6 +72,19 @@ int main(int argc, char *argv[]) GP_BackendExit(backend); return 0; } + + if (ev.type == GP_EV_SYS && ev.code == GP_EV_SYS_RESIZE) { + int cx, cy; + + GP_BackendResizeAck(backend); + + cx = ((int)backend->context->w - (int)image->w) / 2; + cy = ((int)backend->context->h - (int)image->h) / 2; + + GP_Fill(backend->context, 0); + GP_Blit_Clipped(image, 0, 0, image->w, image->h, backend->context, cx, cy); + GP_BackendFlip(backend); + } } return 0; http://repo.or.cz/gfxprim.git/commit/619a12314f7dee80aff4bdcdcabd4918300af0… commit 619a12314f7dee80aff4bdcdcabd4918300af001 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:41:27 2015 +0100 demos: c_simple: fonttest: Handle SYS_RESIZE Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/fonttest.c b/demos/c_simple/fonttest.c index 9a3aff1..7d6a7ca 100644 --- a/demos/c_simple/fonttest.c +++ b/demos/c_simple/fonttest.c @@ -244,6 +244,16 @@ void event_loop(void) exit(0); break; } + break; + case GP_EV_SYS: + switch(ev.code) { + case GP_EV_SYS_RESIZE: + GP_BackendResizeAck(win); + redraw_screen(); + GP_BackendFlip(win); + break; + } + break; } } } http://repo.or.cz/gfxprim.git/commit/05404f10c561c4820f7ade3ac02489baaedb33… commit 05404f10c561c4820f7ade3ac02489baaedb33ea Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:39:38 2015 +0100 demos: c_simple: fileview: Handle SYS_RESIZE Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/fileview.c b/demos/c_simple/fileview.c index 972514b..e33a74a 100644 --- a/demos/c_simple/fileview.c +++ b/demos/c_simple/fileview.c @@ -198,6 +198,11 @@ void event_loop(void) GP_BackendExit(backend); exit(0); break; + case GP_EV_SYS_RESIZE: + GP_BackendResizeAck(backend); + redraw_screen(); + GP_BackendFlip(backend); + break; } break; } http://repo.or.cz/gfxprim.git/commit/d34bd097e24e5ed2ff2f741e0dd939c0450b79… commit d34bd097e24e5ed2ff2f741e0dd939c0450b7963 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:36:42 2015 +0100 demos: c_simple: blittest: Handle SYS_RESIZE Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/blittest.c b/demos/c_simple/blittest.c index ecdb39a..362ef8b 100644 --- a/demos/c_simple/blittest.c +++ b/demos/c_simple/blittest.c @@ -131,6 +131,11 @@ void event_loop(void) GP_BackendExit(win); exit(0); break; + case GP_EV_SYS_RESIZE: + GP_BackendResizeAck(win); + GP_Fill(win->context, black); + GP_BackendFlip(win); + break; } break; } http://repo.or.cz/gfxprim.git/commit/5df4db8d8a90ee2b6dc54b7648e6f410e3a778… commit 5df4db8d8a90ee2b6dc54b7648e6f410e3a77815 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:33:15 2015 +0100 demos: c_simple: koch: Handle SYS_RESIZE Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/koch.c b/demos/c_simple/koch.c index 5bb1538..27ce674 100644 --- a/demos/c_simple/koch.c +++ b/demos/c_simple/koch.c @@ -33,7 +33,7 @@ #include <GP.h> -#define TIMER_TICK 10000 +#define TIMER_TICK 20000 #define DISPLAY_W 640 #define DISPLAY_H 480 #define sqr(x) ((x)*(x)) @@ -173,6 +173,10 @@ int main(void) return 0; break; } + break; + case GP_EV_SYS: + if (ev.code == GP_EV_SYS_RESIZE) + GP_BackendResizeAck(backend); } } usleep(TIMER_TICK); ----------------------------------------------------------------------- Summary of changes: demos/c_simple/blittest.c | 5 ++ demos/c_simple/fileview.c | 5 ++ demos/c_simple/fonttest.c | 10 +++ demos/c_simple/koch.c | 6 +- demos/c_simple/showimage.c | 13 ++++ demos/c_simple/textaligntest.c | 5 ++ demos/c_simple/virtual_backend_example.c | 110 +++++++++++++++++-------------- demos/c_simple/x11_windows.c | 2 + 8 files changed, 107 insertions(+), 49 deletions(-) repo.or.cz automatic notification. Contact project admin jiri.bluebear.dluhos(a)gmail.com if you want to unsubscribe, or site admin admin(a)repo.or.cz if you receive no reply. -- gfxprim.git ("A simple 2D graphics library with emphasis on correctness and well-defined operation.")

1 0

[repo.or.cz] gfxprim.git branch master updated: 1.0.0-rc1-166-g9910a9b
by metan 19 Dec '15

19 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project gfxprim.git. The branch, master has been updated via 9910a9b5e922bd0493e5c76efb27474c4310ca34 (commit) from e9d8edec450a97a0b8741273bb5d5e90fb94c821 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- http://repo.or.cz/gfxprim.git/commit/9910a9b5e922bd0493e5c76efb27474c4310ca… commit 9910a9b5e922bd0493e5c76efb27474c4310ca34 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Sat Dec 19 22:28:16 2015 +0100 demos: c_simple: v4l2_show: Handle SYS_RESIZE Adds SYS_RESIZE event handling and centers the image in the window. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/v4l2_show.c b/demos/c_simple/v4l2_show.c index 97467b5..443d6d4 100644 --- a/demos/c_simple/v4l2_show.c +++ b/demos/c_simple/v4l2_show.c @@ -37,7 +37,7 @@ int main(int argc, char *argv[]) GP_Backend *backend; GP_Grabber *grabber; const char *v4l2_device = "/dev/video0"; - unsigned int w = 320, h = 240; + unsigned int w = 640, h = 480; int mode = 0; int opt; @@ -113,7 +113,10 @@ int main(int argc, char *argv[]) break; } - GP_Blit_Clipped(res, 0, 0, res->w, res->h, backend->context, 0, 0); + unsigned int c_x = (backend->context->w - res->w) / 2; + unsigned int c_y = (backend->context->h - res->h) / 2; + + GP_Blit_Clipped(res, 0, 0, res->w, res->h, backend->context, c_x, c_y); GP_BackendFlip(backend); if (mode) @@ -150,6 +153,13 @@ int main(int argc, char *argv[]) mode = 0; break; } + break; + case GP_EV_SYS: + if (ev.code == GP_EV_SYS_RESIZE) { + GP_BackendResizeAck(backend); + GP_Fill(backend->context, 0); + } + break; } } } ----------------------------------------------------------------------- Summary of changes: demos/c_simple/v4l2_show.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) repo.or.cz automatic notification. Contact project admin jiri.bluebear.dluhos(a)gmail.com if you want to unsubscribe, or site admin admin(a)repo.or.cz if you receive no reply. -- gfxprim.git ("A simple 2D graphics library with emphasis on correctness and well-defined operation.")

1 0

[repo.or.cz] gfxprim.git branch master updated: 1.0.0-rc1-165-ge9d8ede
by metan 09 Dec '15

09 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project gfxprim.git. The branch, master has been updated via e9d8edec450a97a0b8741273bb5d5e90fb94c821 (commit) via ffbfb62987085873f5996218fdf3fbb7ae0390e4 (commit) from 01cb569b20ec2962ccb1f4b845d2f396ad8b08df (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- http://repo.or.cz/gfxprim.git/commit/e9d8edec450a97a0b8741273bb5d5e90fb94c8… commit e9d8edec450a97a0b8741273bb5d5e90fb94c821 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Wed Dec 9 14:47:15 2015 +0100 loaders: JPG: Fix read callback Apparently when I/O read callback returns buffer of size 0 the libjpeg segfaults. So we now return FALSE from the callback even when read returns 0, which means end of the file when the underlying I/O is file based. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_JPG.c b/libs/loaders/GP_JPG.c index 4921f24..9ac4630 100644 --- a/libs/loaders/GP_JPG.c +++ b/libs/loaders/GP_JPG.c @@ -156,8 +156,8 @@ static boolean fill_input_buffer(struct jpeg_decompress_struct *cinfo) ret = GP_IORead(src->io, src->buffer, src->size); - if (ret < 0) { - GP_WARN("Failed to fill buffer"); + if (ret <= 0) { + GP_WARN("Failed to fill buffer, IORead returned %i", ret); return FALSE; } http://repo.or.cz/gfxprim.git/commit/ffbfb62987085873f5996218fdf3fbb7ae0390… commit ffbfb62987085873f5996218fdf3fbb7ae0390e4 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Wed Dec 9 14:11:17 2015 +0100 loaders: PCX: Make sure w < bytes_per_line * 8 / bpp Fixes crash on inconsistent header where w > bytes_per_line * 8 / bpp. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_PCX.c b/libs/loaders/GP_PCX.c index 20c6b20..2304bbd 100644 --- a/libs/loaders/GP_PCX.c +++ b/libs/loaders/GP_PCX.c @@ -292,7 +292,7 @@ static int read_16_palette(GP_IO *io, struct pcx_header *header, unsigned int i; uint8_t b[header->bytes_per_line]; GP_Pixel palette[16]; - uint8_t idx=0, mask, mod; + uint8_t idx = 0, mask, mod; for (i = 0; i < 16; i++) { palette[i] = (GP_Pixel)header->palette[3*i] << 16; @@ -543,6 +543,14 @@ int GP_ReadPCXEx(GP_IO *io, GP_Context **img, GP_DataStorage *storage, w = header.xe - header.xs + 1; h = header.ye - header.ys + 1; + uint32_t max_w = ((uint32_t)header.bytes_per_line * 8) / header.bpp; + + if (w > max_w) { + GP_WARN("Truncating image width (%u) to " + "bytes_per_line * 8 / bpp (%"PRIu32")", w, max_w); + w = max_w; + } + res = GP_ContextAlloc(w, h, pixel_type); if (!res) { ----------------------------------------------------------------------- Summary of changes: libs/loaders/GP_JPG.c | 4 ++-- libs/loaders/GP_PCX.c | 10 +++++++++- 2 files changed, 11 insertions(+), 3 deletions(-) repo.or.cz automatic notification. Contact project admin jiri.bluebear.dluhos(a)gmail.com if you want to unsubscribe, or site admin admin(a)repo.or.cz if you receive no reply. -- gfxprim.git ("A simple 2D graphics library with emphasis on correctness and well-defined operation.")

1 0

[repo.or.cz] gfxprim.git branch master updated: 1.0.0-rc1-163-g01cb569
by metan 08 Dec '15

08 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project gfxprim.git. The branch, master has been updated via 01cb569b20ec2962ccb1f4b845d2f396ad8b08df (commit) via a8f40a07ec88adfc05232ea8b0a1174eeb03384d (commit) via 9132111c70875afe910de2c5fa90327c0947d0f4 (commit) via e7663526f7a8ee2ba10dbe1e85758c4ea4b3b12e (commit) via 266c9d02b03917a0bfd6bf7c5a2c94cdbaf43ea3 (commit) via ac4d7195b3f0ab79365c831f8c0bf26657d737f4 (commit) via c7f781854b28871c22794e5f43a7625583869edc (commit) via e450ba0813517e753c32371a58aac2c9c3134130 (commit) via e7186b166a3c5847490637818694e61a515341e4 (commit) via b392ec017ad30463f1761a2a66c565417acc153d (commit) via 71461948b59b8c7e839bd3b3541678449b8c4451 (commit) via f83e3fc6980bd4cdc1b0151bea961ccfe35aa006 (commit) via 39c170a76a85408c85175b434dd0250e7b01d314 (commit) via a5731b6a1f6532ad0b6348f3b198e930ee50f3ea (commit) from f7ec65e213cd4f5b98add6853202db0d6da72578 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- http://repo.or.cz/gfxprim.git/commit/01cb569b20ec2962ccb1f4b845d2f396ad8b08… commit 01cb569b20ec2962ccb1f4b845d2f396ad8b08df Author: Cyril Hrubis <metan(a)ucw.cz> Date: Tue Dec 8 15:25:08 2015 +0100 tests: Add 'make afl' Now all that we need to run the fuzzer is to type 'make afl'. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/Makefile b/Makefile index 2747b51..4d8de96 100644 --- a/Makefile +++ b/Makefile @@ -40,4 +40,14 @@ tar: $(MAKE) clean cd .. && tar cf gfxprim-`date +%Y-%b-%d-%HH%MM`.tar gfxprim +afl: + @if [ -z `which afl-gcc 2>/dev/null` ]; then \ + echo "ERROR: afl-gcc not installed!"; \ + exit 127; \ + fi + CC=afl-gcc ./configure + $(MAKE) -C include + $(MAKE) -C libs + $(MAKE) afl -C tests/afl + include $(TOPDIR)/post.mk diff --git a/tests/afl/.gitignore b/tests/afl/.gitignore new file mode 100644 index 0000000..2f32a21 --- /dev/null +++ b/tests/afl/.gitignore @@ -0,0 +1 @@ +loaders diff --git a/tests/afl/Makefile b/tests/afl/Makefile new file mode 100644 index 0000000..4b12b13 --- /dev/null +++ b/tests/afl/Makefile @@ -0,0 +1,17 @@ +TOPDIR=../.. +include $(TOPDIR)/pre.mk + +APPS=loaders + +CSOURCES=$(shell echo *.c) + +# Link the binary statically +LIBS=$(shell $(TOPDIR)/gfxprim-config --libs-loaders --libs) +RLIBS=$(subst -lgfxprim-loaders,$(TOPDIR)/build/libgfxprim-loaders.a,$(LIBS)) +LDLIBS=$(subst -lgfxprim,$(TOPDIR)/build/libgfxprim.a,$(RLIBS)) + +afl: loaders + ./run_afl.sh + +include $(TOPDIR)/app.mk +include $(TOPDIR)/post.mk diff --git a/tests/afl/data/1bpp-1x1.bmp b/tests/afl/data/1bpp-1x1.bmp new file mode 100644 index 0000000..508b73c Binary files /dev/null and b/tests/afl/data/1bpp-1x1.bmp differ diff --git a/tests/afl/data/1bpp-320x1-overlappingcolor.bmp b/tests/afl/data/1bpp-320x1-overlappingcolor.bmp new file mode 100644 index 0000000..324b66e Binary files /dev/null and b/tests/afl/data/1bpp-320x1-overlappingcolor.bmp differ diff --git a/tests/afl/data/1bpp-335x.bmp b/tests/afl/data/1bpp-335x.bmp new file mode 100644 index 0000000..bbf67b7 Binary files /dev/null and b/tests/afl/data/1bpp-335x.bmp differ diff --git a/tests/afl/data/1bpp-topdown-320x2.bmp b/tests/afl/data/1bpp-topdown-320x2.bmp new file mode 100644 index 0000000..cc1020d Binary files /dev/null and b/tests/afl/data/1bpp-topdown-320x2.bmp differ diff --git a/tests/afl/data/24bpp-1x1.bmp b/tests/afl/data/24bpp-1x1.bmp new file mode 100644 index 0000000..fa6c104 Binary files /dev/null and b/tests/afl/data/24bpp-1x1.bmp differ diff --git a/tests/afl/data/24bpp-323x2.bmp b/tests/afl/data/24bpp-323x2.bmp new file mode 100644 index 0000000..9db72c9 Binary files /dev/null and b/tests/afl/data/24bpp-323x2.bmp differ diff --git a/tests/afl/data/24bpp-topdown-32x24.bmp b/tests/afl/data/24bpp-topdown-32x24.bmp new file mode 100644 index 0000000..c1f072a Binary files /dev/null and b/tests/afl/data/24bpp-topdown-32x24.bmp differ diff --git a/tests/afl/data/32bpp-0x240.bmp b/tests/afl/data/32bpp-0x240.bmp new file mode 100644 index 0000000..ee541ee Binary files /dev/null and b/tests/afl/data/32bpp-0x240.bmp differ diff --git a/tests/afl/data/32bpp-101110-32x24.bmp b/tests/afl/data/32bpp-101110-32x24.bmp new file mode 100644 index 0000000..196b747 Binary files /dev/null and b/tests/afl/data/32bpp-101110-32x24.bmp differ diff --git a/tests/afl/data/32bpp-1x1.bmp b/tests/afl/data/32bpp-1x1.bmp new file mode 100644 index 0000000..d1b33e4 Binary files /dev/null and b/tests/afl/data/32bpp-1x1.bmp differ diff --git a/tests/afl/data/32bpp-320x0.bmp b/tests/afl/data/32bpp-320x0.bmp new file mode 100644 index 0000000..522dfc3 Binary files /dev/null and b/tests/afl/data/32bpp-320x0.bmp differ diff --git a/tests/afl/data/32bpp-888-optimalpalette-32x24.bmp b/tests/afl/data/32bpp-888-optimalpalette-32x24.bmp new file mode 100644 index 0000000..d11032d Binary files /dev/null and b/tests/afl/data/32bpp-888-optimalpalette-32x24.bmp differ diff --git a/tests/afl/data/4bpp-1x1.bmp b/tests/afl/data/4bpp-1x1.bmp new file mode 100644 index 0000000..edc72d8 Binary files /dev/null and b/tests/afl/data/4bpp-1x1.bmp differ diff --git a/tests/afl/data/4bpp-326x2.bmp b/tests/afl/data/4bpp-326x2.bmp new file mode 100644 index 0000000..913d4e8 Binary files /dev/null and b/tests/afl/data/4bpp-326x2.bmp differ diff --git a/tests/afl/data/4bpp-pixeldata-cropped.bmp b/tests/afl/data/4bpp-pixeldata-cropped.bmp new file mode 100644 index 0000000..76a7c41 Binary files /dev/null and b/tests/afl/data/4bpp-pixeldata-cropped.bmp differ diff --git a/tests/afl/data/555-1x1.bmp b/tests/afl/data/555-1x1.bmp new file mode 100644 index 0000000..b85d03c Binary files /dev/null and b/tests/afl/data/555-1x1.bmp differ diff --git a/tests/afl/data/555-pixeldata-cropped.bmp b/tests/afl/data/555-pixeldata-cropped.bmp new file mode 100644 index 0000000..161b2e8 Binary files /dev/null and b/tests/afl/data/555-pixeldata-cropped.bmp differ diff --git a/tests/afl/data/565-320x2-topdown.bmp b/tests/afl/data/565-320x2-topdown.bmp new file mode 100644 index 0000000..5d86c78 Binary files /dev/null and b/tests/afl/data/565-320x2-topdown.bmp differ diff --git a/tests/afl/data/8bpp-1x1.bmp b/tests/afl/data/8bpp-1x1.bmp new file mode 100644 index 0000000..27ec19a Binary files /dev/null and b/tests/afl/data/8bpp-1x1.bmp differ diff --git a/tests/afl/data/8bpp-320x2.bmp b/tests/afl/data/8bpp-320x2.bmp new file mode 100644 index 0000000..54c8221 Binary files /dev/null and b/tests/afl/data/8bpp-320x2.bmp differ diff --git a/tests/afl/data/8bpp-colorsused-negative.bmp b/tests/afl/data/8bpp-colorsused-negative.bmp new file mode 100644 index 0000000..d635597 Binary files /dev/null and b/tests/afl/data/8bpp-colorsused-negative.bmp differ diff --git a/tests/afl/data/8bpp-pixels-not-in-palette.bmp b/tests/afl/data/8bpp-pixels-not-in-palette.bmp new file mode 100644 index 0000000..faf1ac0 Binary files /dev/null and b/tests/afl/data/8bpp-pixels-not-in-palette.bmp differ diff --git a/tests/afl/data/bitdepth-odd.bmp b/tests/afl/data/bitdepth-odd.bmp new file mode 100644 index 0000000..2a0a207 Binary files /dev/null and b/tests/afl/data/bitdepth-odd.bmp differ diff --git a/tests/afl/data/bitdepth-zero.bmp b/tests/afl/data/bitdepth-zero.bmp new file mode 100644 index 0000000..935e49a Binary files /dev/null and b/tests/afl/data/bitdepth-zero.bmp differ diff --git a/tests/afl/data/colormasks-missing.bmp b/tests/afl/data/colormasks-missing.bmp new file mode 100644 index 0000000..5fb8fab Binary files /dev/null and b/tests/afl/data/colormasks-missing.bmp differ diff --git a/tests/afl/data/compression-unknown.bmp b/tests/afl/data/compression-unknown.bmp new file mode 100644 index 0000000..4841f05 Binary files /dev/null and b/tests/afl/data/compression-unknown.bmp differ diff --git a/tests/afl/data/emptyfile.bmp b/tests/afl/data/emptyfile.bmp new file mode 100644 index 0000000..e69de29 diff --git a/tests/afl/data/infoheader-cropped.bmp b/tests/afl/data/infoheader-cropped.bmp new file mode 100644 index 0000000..81ab1c3 Binary files /dev/null and b/tests/afl/data/infoheader-cropped.bmp differ diff --git a/tests/afl/data/infoheadersize-large.bmp b/tests/afl/data/infoheadersize-large.bmp new file mode 100644 index 0000000..2d797c0 Binary files /dev/null and b/tests/afl/data/infoheadersize-large.bmp differ diff --git a/tests/afl/data/infoheadersize-small.bmp b/tests/afl/data/infoheadersize-small.bmp new file mode 100644 index 0000000..73fcf97 Binary files /dev/null and b/tests/afl/data/infoheadersize-small.bmp differ diff --git a/tests/afl/data/magicnumber-bad.bmp b/tests/afl/data/magicnumber-bad.bmp new file mode 100644 index 0000000..be94c5a Binary files /dev/null and b/tests/afl/data/magicnumber-bad.bmp differ diff --git a/tests/afl/data/offbits-negative.bmp b/tests/afl/data/offbits-negative.bmp new file mode 100644 index 0000000..baba6d3 Binary files /dev/null and b/tests/afl/data/offbits-negative.bmp differ diff --git a/tests/afl/data/planes-zero.bmp b/tests/afl/data/planes-zero.bmp new file mode 100644 index 0000000..b07e590 Binary files /dev/null and b/tests/afl/data/planes-zero.bmp differ diff --git a/tests/afl/data/rle4-encoded-320x2.bmp b/tests/afl/data/rle4-encoded-320x2.bmp new file mode 100644 index 0000000..08ee760 Binary files /dev/null and b/tests/afl/data/rle4-encoded-320x2.bmp differ diff --git a/tests/afl/data/rle8-64000x1.bmp b/tests/afl/data/rle8-64000x1.bmp new file mode 100644 index 0000000..6ded0a3 Binary files /dev/null and b/tests/afl/data/rle8-64000x1.bmp differ diff --git a/tests/afl/data/rle8-absolute-320x2.bmp b/tests/afl/data/rle8-absolute-320x2.bmp new file mode 100644 index 0000000..d294f41 Binary files /dev/null and b/tests/afl/data/rle8-absolute-320x2.bmp differ diff --git a/tests/afl/data/rle8-absolute-cropped.bmp b/tests/afl/data/rle8-absolute-cropped.bmp new file mode 100644 index 0000000..c8d8619 Binary files /dev/null and b/tests/afl/data/rle8-absolute-cropped.bmp differ diff --git a/tests/afl/data/rle8-blank-160x1.bmp b/tests/afl/data/rle8-blank-160x1.bmp new file mode 100644 index 0000000..25976fe Binary files /dev/null and b/tests/afl/data/rle8-blank-160x1.bmp differ diff --git a/tests/afl/data/rle8-delta-320x2.bmp b/tests/afl/data/rle8-delta-320x2.bmp new file mode 100644 index 0000000..8a56903 Binary files /dev/null and b/tests/afl/data/rle8-delta-320x2.bmp differ diff --git a/tests/afl/data/rle8-delta-cropped.bmp b/tests/afl/data/rle8-delta-cropped.bmp new file mode 100644 index 0000000..44ebc8e Binary files /dev/null and b/tests/afl/data/rle8-delta-cropped.bmp differ diff --git a/tests/afl/data/rle8-deltaleavesimage.bmp b/tests/afl/data/rle8-deltaleavesimage.bmp new file mode 100644 index 0000000..bb31c8a Binary files /dev/null and b/tests/afl/data/rle8-deltaleavesimage.bmp differ diff --git a/tests/afl/data/rle8-encoded-320x2.bmp b/tests/afl/data/rle8-encoded-320x2.bmp new file mode 100644 index 0000000..885ac9a Binary files /dev/null and b/tests/afl/data/rle8-encoded-320x2.bmp differ diff --git a/tests/afl/data/rle8-no-end-of-bitmap-marker.bmp b/tests/afl/data/rle8-no-end-of-bitmap-marker.bmp new file mode 100644 index 0000000..72134b7 Binary files /dev/null and b/tests/afl/data/rle8-no-end-of-bitmap-marker.bmp differ diff --git a/tests/afl/data/rle8-no-end-of-line-marker.bmp b/tests/afl/data/rle8-no-end-of-line-marker.bmp new file mode 100644 index 0000000..64d5cdc Binary files /dev/null and b/tests/afl/data/rle8-no-end-of-line-marker.bmp differ diff --git a/tests/afl/data/rle8-runlength-cropped.bmp b/tests/afl/data/rle8-runlength-cropped.bmp new file mode 100644 index 0000000..c2733f7 Binary files /dev/null and b/tests/afl/data/rle8-runlength-cropped.bmp differ diff --git a/tests/afl/data/ver3_0_palette_1bpp_10x10_white.pcx b/tests/afl/data/ver3_0_palette_1bpp_10x10_white.pcx new file mode 100644 index 0000000..9fe5a00 Binary files /dev/null and b/tests/afl/data/ver3_0_palette_1bpp_10x10_white.pcx differ diff --git a/tests/afl/data/ver3_0_palette_24bpp_10x10_white.pcx b/tests/afl/data/ver3_0_palette_24bpp_10x10_white.pcx new file mode 100644 index 0000000..9bc48fb Binary files /dev/null and b/tests/afl/data/ver3_0_palette_24bpp_10x10_white.pcx differ diff --git a/tests/afl/data/ver3_0_palette_2bpp_10x10_white.pcx b/tests/afl/data/ver3_0_palette_2bpp_10x10_white.pcx new file mode 100644 index 0000000..080a9af Binary files /dev/null and b/tests/afl/data/ver3_0_palette_2bpp_10x10_white.pcx differ diff --git a/tests/afl/data/ver3_0_palette_4bpp_10x10_white.pcx b/tests/afl/data/ver3_0_palette_4bpp_10x10_white.pcx new file mode 100644 index 0000000..da88d77 Binary files /dev/null and b/tests/afl/data/ver3_0_palette_4bpp_10x10_white.pcx differ diff --git a/tests/afl/data/ver3_0_palette_8bpp_10x10_white.pcx b/tests/afl/data/ver3_0_palette_8bpp_10x10_white.pcx new file mode 100644 index 0000000..2f7e71e Binary files /dev/null and b/tests/afl/data/ver3_0_palette_8bpp_10x10_white.pcx differ diff --git a/tests/afl/data/width-times-height-overflow.bmp b/tests/afl/data/width-times-height-overflow.bmp new file mode 100644 index 0000000..1dd3a5b Binary files /dev/null and b/tests/afl/data/width-times-height-overflow.bmp differ diff --git a/tests/afl/loaders.c b/tests/afl/loaders.c new file mode 100644 index 0000000..7f3b482 --- /dev/null +++ b/tests/afl/loaders.c @@ -0,0 +1,49 @@ +/***************************************************************************** + * This file is part of gfxprim library. * + * * + * Gfxprim is free software; you can redistribute it and/or * + * modify it under the terms of the GNU Lesser General Public * + * License as published by the Free Software Foundation; either * + * version 2.1 of the License, or (at your option) any later version. * + * * + * Gfxprim is distributed in the hope that it will be useful, * + * but WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * + * Lesser General Public License for more details. * + * * + * You should have received a copy of the GNU Lesser General Public * + * License along with gfxprim; if not, write to the Free Software * + * Foundation, Inc., 51 Franklin Street, Fifth Floor, * + * Boston, MA 02110-1301 USA * + * * + * Copyright (C) 2009-2015 Cyril Hrubis <metan(a)ucw.cz> * + * * + *****************************************************************************/ + + /* + + Minimal loaders call to be used by american fuzzy lop (afl). + + */ + +#include <stdio.h> +#include <string.h> +#include <errno.h> + +#include <GP.h> + +int main(int argc, char *argv[]) +{ + GP_Context *img; + + if (argc != 2) { + fprintf(stderr, "Takes an image as an parameter\n"); + return 1; + } + + img = GP_LoadImage(argv[1], NULL); + + GP_ContextFree(img); + + return 0; +} diff --git a/tests/afl/run_afl.sh b/tests/afl/run_afl.sh new file mode 100755 index 0000000..4785387 --- /dev/null +++ b/tests/afl/run_afl.sh @@ -0,0 +1,16 @@ +#!/bin/sh +# +# Start afl in NCPU + 1 threads to saturate CPU +# + +NCPU=$(getconf _NPROCESSORS_ONLN) + +DATADIR=data/ +OUTDIR=result/ +EXEC="./loaders @@" + +for i in $(seq -w 1 $NCPU); do + afl-fuzz -i "$DATADIR" -o "$OUTDIR" -S fuzzer$i $EXEC > /dev/null& +done + +afl-fuzz -i "$DATADIR" -o "$OUTDIR" -M fuzzer00 $EXEC http://repo.or.cz/gfxprim.git/commit/a8f40a07ec88adfc05232ea8b0a1174eeb0338… commit a8f40a07ec88adfc05232ea8b0a1174eeb03384d Author: Cyril Hrubis <metan(a)ucw.cz> Date: Tue Dec 8 12:19:48 2015 +0100 build: app.mk: Do not append -lgfxprim Since we may want to build binaries statically linked with gfxprim. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/app.mk b/app.mk index 2e10fff..20015ab 100644 --- a/app.mk +++ b/app.mk @@ -3,8 +3,8 @@ CLEAN+=$(APPS) %: %.o ifdef VERBOSE - $(CC) $(CFLAGS) $(LDFLAGS) -Wl,--start-group $^ $(LDLIBS) -lgfxprim -Wl,--end-group -o $@ + $(CC) $(CFLAGS) $(LDFLAGS) -Wl,--start-group $^ $(LDLIBS) -Wl,--end-group -o $@ else @echo "LD $@" - @$(CC) $(CFLAGS) $(LDFLAGS) -Wl,--start-group $^ $(LDLIBS) -lgfxprim -Wl,--end-group -o $@ + @$(CC) $(CFLAGS) $(LDFLAGS) -Wl,--start-group $^ $(LDLIBS) -Wl,--end-group -o $@ endif diff --git a/demos/bogoman/Makefile b/demos/bogoman/Makefile index c998522..005d784 100644 --- a/demos/bogoman/Makefile +++ b/demos/bogoman/Makefile @@ -4,7 +4,7 @@ include $(TOPDIR)/pre.mk CSOURCES=$(shell echo *.c) INCLUDE= -LDLIBS+=-lgfxprim-backends -lgfxprim-loaders +LDLIBS+=-lgfxprim-backends -lgfxprim-loaders -lgfxprim APPS=bogoman diff --git a/demos/c_simple/Makefile b/demos/c_simple/Makefile index 1346423..0525e72 100644 --- a/demos/c_simple/Makefile +++ b/demos/c_simple/Makefile @@ -10,7 +10,7 @@ CSOURCES=$(SOURCES) endif INCLUDE= -LDLIBS+=-lrt +LDLIBS+=-lrt -lgfxprim APPS=backend_example loaders_example loaders filters_symmetry gfx_koch\ virtual_backend_example meta_data showimage\ diff --git a/demos/grinder/Makefile b/demos/grinder/Makefile index 6e53dc3..5abbc1e 100644 --- a/demos/grinder/Makefile +++ b/demos/grinder/Makefile @@ -5,7 +5,7 @@ CSOURCES=$(shell echo *.c) INCLUDE=core gfx LDLIBS+=-lrt -lm -LDLIBS+=-lgfxprim-loaders +LDLIBS+=-lgfxprim-loaders -lgfxprim APPS=grinder diff --git a/demos/particle/Makefile b/demos/particle/Makefile index 7b553e5..f4670ec 100644 --- a/demos/particle/Makefile +++ b/demos/particle/Makefile @@ -4,7 +4,7 @@ CSOURCES=$(shell echo *.c) INCLUDE= LDFLAGS+=-L$(TOPDIR)/build/ -LDLIBS+=-lrt -lm -lgfxprim-backends +LDLIBS+=-lrt -lm -lgfxprim-backends -lgfxprim APPS=particle_demo diff --git a/demos/spiv/Makefile b/demos/spiv/Makefile index 9376ee4..e3bc8fe 100644 --- a/demos/spiv/Makefile +++ b/demos/spiv/Makefile @@ -7,7 +7,7 @@ INCLUDE= LDFLAGS+=-L$(TOPDIR)/build/ LDLIBS+=-lrt -LDLIBS+=-lgfxprim-loaders -lgfxprim-backends +LDLIBS+=-lgfxprim-loaders -lgfxprim-backends -lgfxprim APPS=spiv diff --git a/demos/ttf2img/Makefile b/demos/ttf2img/Makefile index 636b04b..bdd0992 100644 --- a/demos/ttf2img/Makefile +++ b/demos/ttf2img/Makefile @@ -4,7 +4,7 @@ include $(TOPDIR)/pre.mk CSOURCES=$(shell echo *.c) INCLUDE= -LDLIBS+=-lgfxprim-loaders +LDLIBS+=-lgfxprim-loaders -lgfxprim APPS=ttf2img http://repo.or.cz/gfxprim.git/commit/9132111c70875afe910de2c5fa90327c0947d0… commit 9132111c70875afe910de2c5fa90327c0947d0f4 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Tue Dec 8 11:33:23 2015 +0100 loaders: BMP: RLE8: Fix stop at end. The RLE8_move() must be called after we decode repeat or undecoded byte since otherwise we may reset the decoder state to RLE_START after RLE8_move() set it to RLE_STOP because all image data has been read. This fixes crash with corrupted RLE8 BMP images. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_BMP_RLE.h b/libs/loaders/GP_BMP_RLE.h index 2b1a3ba..6d5625b 100644 --- a/libs/loaders/GP_BMP_RLE.h +++ b/libs/loaders/GP_BMP_RLE.h @@ -174,8 +174,6 @@ static int RLE8_next_undecoded(struct RLE *rle) { GETC(rle); - RLE8_move(rle); - //GP_DEBUG(4, "RLE unencoded %u %u -> %02x", rle->x, rle->y, rle->c); if (--rle->rep == 0) { @@ -185,6 +183,8 @@ static int RLE8_next_undecoded(struct RLE *rle) GETC(rle); } + RLE8_move(rle); + rle->move = 1; return 0; @@ -192,13 +192,13 @@ static int RLE8_next_undecoded(struct RLE *rle) static int RLE8_next_repeat(struct RLE *rle) { - RLE8_move(rle); - //GP_DEBUG(4, "RLE repeat %u %u -> %02x", rle->x, rle->y, rle->c); if (--rle->rep == 0) rle->state = RLE_START; + RLE8_move(rle); + rle->move = 1; return 0; http://repo.or.cz/gfxprim.git/commit/e7663526f7a8ee2ba10dbe1e85758c4ea4b3b1… commit e7663526f7a8ee2ba10dbe1e85758c4ea4b3b12e Author: Cyril Hrubis <metan(a)ucw.cz> Date: Tue Dec 8 10:37:48 2015 +0100 loaders: BMP: Add sanity check for palette size The palette size is 32bit integer in BMP header which when set to absurdly large number makes the process go out of memory when palette is initialized. Now we check that palette size is <= 1<<bpp and truncate it otherwise. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_BMP.c b/libs/loaders/GP_BMP.c index 385fa3d..2112f04 100644 --- a/libs/loaders/GP_BMP.c +++ b/libs/loaders/GP_BMP.c @@ -339,9 +339,8 @@ static int read_bitmap_header(GP_IO *io, struct bitmap_info_header *header) * Reads palette, the format is R G B X, each one byte. */ static int read_bitmap_palette(GP_IO *io, struct bitmap_info_header *header, - GP_Pixel *palette) + GP_Pixel *palette, uint32_t palette_colors) { - uint32_t palette_colors = get_palette_size(header); uint32_t palette_offset = header->header_size + 14; uint8_t pixel_size; uint32_t i; @@ -367,7 +366,7 @@ static int read_bitmap_palette(GP_IO *io, struct bitmap_info_header *header, return err; } - uint32_t palette_size = pixel_size * palette_colors; + size_t palette_size = pixel_size * palette_colors; uint8_t *buf = GP_TempAlloc(palette_size); if (GP_IOFill(io, buf, palette_size)) { @@ -517,7 +516,7 @@ static int read_palette(GP_IO *io, struct bitmap_info_header *header, GP_Pixel *palette = GP_TempAllocArr(tmp, GP_Pixel, palette_size); - if ((err = read_bitmap_palette(io, header, palette))) + if ((err = read_bitmap_palette(io, header, palette, palette_size))) goto err; if ((err = seek_pixels_offset(io, header))) @@ -631,11 +630,23 @@ static int read_bitfields_or_rgb(GP_IO *io, struct bitmap_info_header *header, return 0; } +static void check_palette_size(struct bitmap_info_header *header) +{ + if (header->palette_colors > 1u << header->bpp) { + GP_WARN("Corrupted header bpp=%"PRIu16" palette_size=%"PRIu32 + ", truncating palette_size to %u", + header->bpp, header->palette_colors, 1u << header->bpp); + header->palette_colors = 0; + } +} + static int read_bitmap_pixels(GP_IO *io, struct bitmap_info_header *header, GP_Context *context, GP_ProgressCallback *callback) { - if (header->compress_type == COMPRESS_RLE8) + if (header->compress_type == COMPRESS_RLE8) { + check_palette_size(header); return read_RLE8(io, header, context, callback); + } switch (header->bpp) { case 1: @@ -643,6 +654,7 @@ static int read_bitmap_pixels(GP_IO *io, struct bitmap_info_header *header, case 2: case 4: case 8: + check_palette_size(header); return read_palette(io, header, context, callback); case 16: case 24: diff --git a/libs/loaders/GP_BMP_RLE.h b/libs/loaders/GP_BMP_RLE.h index a3592ed..2b1a3ba 100644 --- a/libs/loaders/GP_BMP_RLE.h +++ b/libs/loaders/GP_BMP_RLE.h @@ -279,7 +279,7 @@ static int read_RLE8(GP_IO *io, struct bitmap_info_header *header, GP_Pixel *palette = GP_TempAlloc(palette_size * sizeof(GP_Pixel)); - if ((err = read_bitmap_palette(io, header, palette))) + if ((err = read_bitmap_palette(io, header, palette, palette_size))) goto err; if ((err = seek_pixels_offset(io, header))) http://repo.or.cz/gfxprim.git/commit/266c9d02b03917a0bfd6bf7c5a2c94cdbaf43e… commit 266c9d02b03917a0bfd6bf7c5a2c94cdbaf43ea3 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 18:49:44 2015 +0100 loaders: BMP: RLE8: Add header consistency check. Make sure that the allocated context is RGB888 since corrupted header may say something different and the end result is that the RLE8 decoder writes after the allocated pixmap buffer. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_BMP_RLE.h b/libs/loaders/GP_BMP_RLE.h index e282f0d..a3592ed 100644 --- a/libs/loaders/GP_BMP_RLE.h +++ b/libs/loaders/GP_BMP_RLE.h @@ -270,6 +270,13 @@ static int read_RLE8(GP_IO *io, struct bitmap_info_header *header, DECLARE_RLE(rle, header->w, GP_ABS(header->h), io); int err; + if (context->pixel_type != GP_PIXEL_RGB888) { + GP_WARN("Corrupted BMP header! " + "RLE8 is 24bit (RGB888) palette but header says %s", + GP_PixelTypeName(context->pixel_type)); + return EINVAL; + } + GP_Pixel *palette = GP_TempAlloc(palette_size * sizeof(GP_Pixel)); if ((err = read_bitmap_palette(io, header, palette))) http://repo.or.cz/gfxprim.git/commit/ac4d7195b3f0ab79365c831f8c0bf26657d737… commit ac4d7195b3f0ab79365c831f8c0bf26657d737f4 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 16:31:01 2015 +0100 core: GP_ContextAlloc() Fix overflow in get_bpr() Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/core/GP_Context.c b/libs/core/GP_Context.c index 8a6ab30..050c4dd 100644 --- a/libs/core/GP_Context.c +++ b/libs/core/GP_Context.c @@ -36,7 +36,15 @@ static uint32_t get_bpr(uint32_t bpp, uint32_t w) { - return (bpp * w) / 8 + !!((bpp * w) % 8); + uint64_t bits_per_row = (uint64_t)bpp * w; + uint8_t padd = !!(bits_per_row % 8); + + if (bits_per_row / 8 + padd > UINT32_MAX) { + GP_WARN("Context too wide %u (overflow detected)", w); + return 0; + } + + return bits_per_row / 8 + padd; } GP_Context *GP_ContextAlloc(GP_Size w, GP_Size h, GP_PixelType type) @@ -62,7 +70,9 @@ GP_Context *GP_ContextAlloc(GP_Size w, GP_Size h, GP_PixelType type) w, h, GP_PixelTypeName(type)); bpp = GP_PixelSize(type); - bpr = get_bpr(bpp, w); + + if (!(bpr = get_bpr(bpp, w))) + return NULL; size_t size = bpr * h; http://repo.or.cz/gfxprim.git/commit/c7f781854b28871c22794e5f43a7625583869e… commit c7f781854b28871c22794e5f43a7625583869edc Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 15:32:04 2015 +0100 Loaders: BMP_RLE: Fix unbounded stack allocation. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_BMP_RLE.h b/libs/loaders/GP_BMP_RLE.h index 4c228fb..e282f0d 100644 --- a/libs/loaders/GP_BMP_RLE.h +++ b/libs/loaders/GP_BMP_RLE.h @@ -267,15 +267,16 @@ static int read_RLE8(GP_IO *io, struct bitmap_info_header *header, GP_Context *context, GP_ProgressCallback *callback) { uint32_t palette_size = get_palette_size(header); - GP_Pixel palette[get_palette_size(header)]; DECLARE_RLE(rle, header->w, GP_ABS(header->h), io); int err; + GP_Pixel *palette = GP_TempAlloc(palette_size * sizeof(GP_Pixel)); + if ((err = read_bitmap_palette(io, header, palette))) - return err; + goto err; if ((err = seek_pixels_offset(io, header))) - return err; + goto err; int cnt = 0; @@ -289,7 +290,7 @@ static int read_RLE8(GP_IO *io, struct bitmap_info_header *header, for (;;) { if ((err = RLE8_next(&rle))) - return err; + goto err; if (rle.state == RLE_STOP) break; @@ -319,11 +320,14 @@ static int read_RLE8(GP_IO *io, struct bitmap_info_header *header, if (GP_ProgressCallbackReport(callback, rle.y, context->h, context->w)) { GP_DEBUG(1, "Operation aborted"); - return ECANCELED; + err = ECANCELED; + goto err; } } } GP_ProgressCallbackDone(callback); - return 0; +err: + GP_TempFree(palette_size * sizeof(GP_Pixel), palette); + return err; } http://repo.or.cz/gfxprim.git/commit/e450ba0813517e753c32371a58aac2c9c31341… commit e450ba0813517e753c32371a58aac2c9c3134130 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 15:22:21 2015 +0100 core: GP_ContextAlloc() add overflow detection. Check that bpp * w * h does not overflow before we pass it to the malloc() to allcate context bitmap buffer. Otherwise we end up with context with w and h pointing outside the allocate pixel buffer. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/core/GP_Context.c b/libs/core/GP_Context.c index 8e61ce0..8a6ab30 100644 --- a/libs/core/GP_Context.c +++ b/libs/core/GP_Context.c @@ -43,7 +43,7 @@ GP_Context *GP_ContextAlloc(GP_Size w, GP_Size h, GP_PixelType type) { GP_Context *context; uint32_t bpp; - uint32_t bpr; + size_t bpr; void *pixels; if (!GP_VALID_PIXELTYPE(type)) { @@ -64,7 +64,14 @@ GP_Context *GP_ContextAlloc(GP_Size w, GP_Size h, GP_PixelType type) bpp = GP_PixelSize(type); bpr = get_bpr(bpp, w); - pixels = malloc(bpr * h); + size_t size = bpr * h; + + if (size / h != bpr) { + GP_WARN("Context too big %u x %u (owerflow detected)", w, h); + return NULL; + } + + pixels = malloc(size); context = malloc(sizeof(GP_Context)); if (pixels == NULL || context == NULL) { http://repo.or.cz/gfxprim.git/commit/e7186b166a3c5847490637818694e61a515341… commit e7186b166a3c5847490637818694e61a515341e4 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 14:49:51 2015 +0100 Loaders: BMP: Fix two unbounded stack allocations. Special thanks to the american fuzzy lop (afl). Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/libs/loaders/GP_BMP.c b/libs/loaders/GP_BMP.c index 8b890f9..385fa3d 100644 --- a/libs/loaders/GP_BMP.c +++ b/libs/loaders/GP_BMP.c @@ -39,6 +39,7 @@ #include "core/GP_Debug.h" #include "core/GP_Pixel.h" #include "core/GP_GetPutPixel.h" +#include "core/GP_TempAlloc.h" #include "loaders/GP_LineConvert.h" #include "loaders/GP_BMP.h" @@ -366,10 +367,12 @@ static int read_bitmap_palette(GP_IO *io, struct bitmap_info_header *header, return err; } - uint8_t buf[pixel_size * palette_colors]; + uint32_t palette_size = pixel_size * palette_colors; + uint8_t *buf = GP_TempAlloc(palette_size); - if (GP_IOFill(io, buf, sizeof(buf))) { + if (GP_IOFill(io, buf, palette_size)) { GP_DEBUG(1, "Failed to read palette: %s", strerror(errno)); + GP_TempFree(palette_size, buf); return EIO; } @@ -384,6 +387,7 @@ static int read_bitmap_palette(GP_IO *io, struct bitmap_info_header *header, GP_Pixel_GET_B_RGB888(palette[i])); } + GP_TempFree(palette_size, buf); return 0; } @@ -505,27 +509,30 @@ static int read_palette(GP_IO *io, struct bitmap_info_header *header, GP_Context *context, GP_ProgressCallback *callback) { uint32_t palette_size = get_palette_size(header); - GP_Pixel palette[get_palette_size(header)]; + uint32_t row_size = bitmap_row_size(header); + int32_t y; int err; + GP_TempAllocCreate(tmp, sizeof(GP_Pixel) * palette_size + row_size); + + GP_Pixel *palette = GP_TempAllocArr(tmp, GP_Pixel, palette_size); + if ((err = read_bitmap_palette(io, header, palette))) - return err; + goto err; if ((err = seek_pixels_offset(io, header))) - return err; + goto err; - uint32_t row_size = bitmap_row_size(header); - int32_t y; + uint8_t *row = GP_TempAllocArr(tmp, uint8_t, row_size); for (y = 0; y < GP_ABS(header->h); y++) { int32_t x; - uint8_t row[row_size]; if (GP_IOFill(io, row, row_size)) { err = errno; GP_DEBUG(1, "Failed to read row %"PRId32": %s", y, strerror(errno)); - return err; + goto err; } for (x = 0; x < header->w; x++) { @@ -552,12 +559,15 @@ static int read_palette(GP_IO *io, struct bitmap_info_header *header, if (GP_ProgressCallbackReport(callback, y, context->h, context->w)) { GP_DEBUG(1, "Operation aborted"); - return ECANCELED; + err = ECANCELED; + goto err; } } GP_ProgressCallbackDone(callback); - return 0; +err: + GP_TempAllocFree(tmp); + return err; } static int read_bitfields_or_rgb(GP_IO *io, struct bitmap_info_header *header, http://repo.or.cz/gfxprim.git/commit/b392ec017ad30463f1761a2a66c565417acc15… commit b392ec017ad30463f1761a2a66c565417acc153d Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 14:30:46 2015 +0100 core: GP_TempAlloc.c: Add simpler interface. Add GP_TempAlloc() and GP_TempFree() to be used for single temporary allocations. Also adds GP_TempAllocArr(self, type, len) to allocate len size array of type members. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/include/core/GP_TempAlloc.h b/include/core/GP_TempAlloc.h index e17adff..78cfeb0 100644 --- a/include/core/GP_TempAlloc.h +++ b/include/core/GP_TempAlloc.h @@ -79,9 +79,20 @@ struct GP_TempAlloc { (void*)(((char*)(self.buffer)) + _pos); \ }) +#define GP_TempAllocArr(self, type, len) \ + GP_TempAllocGet(self, sizeof(type) * len) + #define GP_TempAllocFree(self) do { \ if (self.size > GP_ALLOCA_THRESHOLD) \ free(self.buffer); \ } while (0) +#define GP_TempAlloc(size) GP_TEMP_ALLOC(size) + +static inline void GP_TempFree(size_t size, void *ptr) +{ + if (size > GP_ALLOCA_THRESHOLD) + free(ptr); +} + #endif /* CORE_GP_TEMP_ALLOC_H */ http://repo.or.cz/gfxprim.git/commit/71461948b59b8c7e839bd3b3541678449b8c44… commit 71461948b59b8c7e839bd3b3541678449b8c4451 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Mon Dec 7 12:07:49 2015 +0100 lib,build: Correct static library filename. The static library filename should apparently be without the version string. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/build/Makefile b/build/Makefile index 5f88872..13b901a 100644 --- a/build/Makefile +++ b/build/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/libver.mk LIB_NAME=libgfxprim -STATIC_LIB=$(LIB_NAME).$(LIB_VERSION).a +STATIC_LIB=$(LIB_NAME).a DYNAMIC_LIB=$(LIB_NAME).so.$(LIB_VERSION).$(LIB_RELEASE) SONAME=$(LIB_NAME).so.$(LIB_MAJOR) SYMLINKS=$(LIB_NAME).so.$(LIB_MAJOR) $(LIB_NAME).so diff --git a/lib.mk b/lib.mk index 6afa462..23b7fcb 100644 --- a/lib.mk +++ b/lib.mk @@ -17,7 +17,7 @@ include $(TOPDIR)/config.mk LIB_NAME=libgfxprim-$(LIBNAME) BUILD_DIR=$(TOPDIR)/build/ -STATIC_LIB=$(LIB_NAME).$(LIB_VERSION).a +STATIC_LIB=$(LIB_NAME).a DYNAMIC_LIB=$(LIB_NAME).so.$(LIB_VERSION).$(LIB_RELEASE) SONAME=$(LIB_NAME).so.$(LIB_MAJOR) SYMLINKS=$(LIB_NAME).so.$(LIB_MAJOR) $(LIB_NAME).so http://repo.or.cz/gfxprim.git/commit/f83e3fc6980bd4cdc1b0151bea961ccfe35aa0… commit f83e3fc6980bd4cdc1b0151bea961ccfe35aa006 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Tue Sep 15 19:43:55 2015 +0200 shapetest: Fix segfault on rotation (R key) Make use of the GP_ContextW() and GP_ContextH() accessors as changing the backend->context->w and backend->context->h leads to undefined behavior and crashes. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/demos/c_simple/shapetest.c b/demos/c_simple/shapetest.c index b114fd8..14e832c 100644 --- a/demos/c_simple/shapetest.c +++ b/demos/c_simple/shapetest.c @@ -251,12 +251,17 @@ void redraw_screen(void) /* axes */ if (show_axes) { - GP_HLine(win, 0, win->w, center_y, gray); - GP_HLine(win, 0, win->w, center_y-yradius, darkgray); - GP_HLine(win, 0, win->w, center_y+yradius, darkgray); - GP_VLine(win, center_x, 0, win->h, gray); - GP_VLine(win, center_x-xradius, 0, win->h, darkgray); - GP_VLine(win, center_x+xradius, 0, win->h, darkgray); + int w, h; + + w = GP_ContextW(win); + h = GP_ContextH(win); + + GP_HLine(win, 0, w, center_y, gray); + GP_HLine(win, 0, w, center_y-yradius, darkgray); + GP_HLine(win, 0, w, center_y+yradius, darkgray); + GP_VLine(win, center_x, 0, h, gray); + GP_VLine(win, center_x-xradius, 0, h, darkgray); + GP_VLine(win, center_x+xradius, 0, h, darkgray); } /* the shape */ @@ -305,7 +310,7 @@ void redraw_screen(void) static void xradius_add(int xradius_add) { if (xradius + xradius_add > 1 && - xradius + xradius_add < (int)win->w) + xradius + xradius_add < (int)GP_ContextW(win)) xradius += xradius_add; } @@ -313,21 +318,21 @@ static void xradius_add(int xradius_add) static void yradius_add(int yradius_add) { if (yradius + yradius_add > 1 && - yradius + yradius_add < (int)win->h) + yradius + yradius_add < (int)GP_ContextH(win)) yradius += yradius_add; } static void xcenter_add(int xcenter_add) { if (center_x + xcenter_add > 1 && - center_x + xcenter_add < (int)win->w/2) + center_x + xcenter_add < (int)GP_ContextW(win)/2) center_x += xcenter_add; } static void ycenter_add(int ycenter_add) { if (center_y + ycenter_add > 1 && - center_y + ycenter_add < (int)win->h/2) + center_y + ycenter_add < (int)GP_ContextH(win)/2) center_y += ycenter_add; } @@ -359,7 +364,8 @@ void event_loop(void) break; case GP_KEY_R: win->axes_swap = !win->axes_swap; - GP_SWAP(win->w, win->h); + center_x = GP_ContextW(win) / 2; + center_y = GP_ContextH(win) / 2; break; case GP_KEY_F: fill = !fill; @@ -445,8 +451,9 @@ void event_loop(void) break; case GP_EV_SYS_RESIZE: GP_BackendResizeAck(backend); - center_x = backend->context->w / 2; - center_y = backend->context->h / 2; + win = backend->context; + center_x = GP_ContextW(win) / 2; + center_y = GP_ContextH(win) / 2; break; } break; http://repo.or.cz/gfxprim.git/commit/39c170a76a85408c85175b434dd0250e7b01d3… commit 39c170a76a85408c85175b434dd0250e7b01d314 Author: Cyril Hrubis <metan(a)ucw.cz> Date: Thu Apr 16 12:09:25 2015 +0200 tests: framework: Call mktime() on init as well. mktime() allocates memory that is not freed, calling it at start avoids most of the false possitives. Unfortunatelly it reallocates one buffer on each iteration which turns out in the final result :( Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/tests/framework/tst_preload.c b/tests/framework/tst_preload.c index fa0a5cf..871abdf 100644 --- a/tests/framework/tst_preload.c +++ b/tests/framework/tst_preload.c @@ -16,7 +16,7 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, * * Boston, MA 02110-1301 USA * * * - * Copyright (C) 2009-2013 Cyril Hrubis <metan(a)ucw.cz> * + * Copyright (C) 2009-2015 Cyril Hrubis <metan(a)ucw.cz> * * * *****************************************************************************/ @@ -27,6 +27,7 @@ #include <string.h> #include <dlfcn.h> #include <execinfo.h> +#include <time.h> #include "tst_test.h" #include "tst_preload.h" @@ -48,12 +49,23 @@ void tst_malloc_check_start(void) { void *buf[1]; char *str_verbose; + /* * Call backtrace() before we start tracking memory, because it calls * dlopen() on first invocation, which allocates memory that is never * freed... */ backtrace(buf, 1); + + /* + * And so does mktime(), it allocates memory which is not freed in tzset() + * + * Unfortunatelly this still leaves one chunk of size 15 that is reallocated + * on each call to mktime() :( + */ + struct tm tm; + mktime(&tm); + check_malloc = 1; str_verbose = getenv("TST_MALLOC_VERBOSE"); http://repo.or.cz/gfxprim.git/commit/a5731b6a1f6532ad0b6348f3b198e930ee50f3… commit a5731b6a1f6532ad0b6348f3b198e930ee50f3ea Author: Cyril Hrubis <metan(a)ucw.cz> Date: Thu Apr 16 11:04:50 2015 +0200 tests: framework: Add calloc() tracking && verbose mode * Add calloc tracking * Simplify realloc() (fixes bugs with chunks added twice because realloc() may call malloc() internally) * Add verbose mode The verbose mode is controlled by TST_MALLOC_VEBOSE variable. If TST_MALLOC_VERBOSE=1 is exported all allocations with addresses are printed. If TST_MALLOC_VERBOSE=2 is exported the log includes also stack trace for each allocation. Signed-off-by: Cyril Hrubis <metan(a)ucw.cz> diff --git a/tests/framework/tst_preload.c b/tests/framework/tst_preload.c index 42457aa..fa0a5cf 100644 --- a/tests/framework/tst_preload.c +++ b/tests/framework/tst_preload.c @@ -23,14 +23,17 @@ #define _GNU_SOURCE #include <stdio.h> #include <stdint.h> +#include <stdlib.h> #include <string.h> #include <dlfcn.h> +#include <execinfo.h> #include "tst_test.h" #include "tst_preload.h" #include "tst_malloc_canaries.h" static int check_malloc = 0; +static int verbose = 0; static int malloc_canary = MALLOC_CANARY_OFF; static size_t cur_size = 0; @@ -43,23 +46,30 @@ static unsigned int max_chunks = 0; void tst_malloc_check_start(void) { + void *buf[1]; + char *str_verbose; + /* + * Call backtrace() before we start tracking memory, because it calls + * dlopen() on first invocation, which allocates memory that is never + * freed... + */ + backtrace(buf, 1); check_malloc = 1; + + str_verbose = getenv("TST_MALLOC_VERBOSE"); + if (str_verbose) + verbose = atoi(str_verbose); } -void tst_malloc_check_stop(void) +static void print_c_trace(void) { - /* - * We cannot stop the tracing when canaries are on - * because we need the chunk table to keep track - * which allocations are with canary and their - * sizes for free and realloc. - */ - if (malloc_canary != MALLOC_CANARY_OFF) { - tst_warn("Cannot turn malloc checks off when canaries are on"); - return; - } + void *buffer[128]; + int size = backtrace(buffer, 128); - check_malloc = 0; + fprintf(stderr, "C stack trace (most recent call first):\n"); + fflush(stderr); + backtrace_symbols_fd(buffer, size, fileno(stderr)); + fprintf(stderr, "\n"); } void tst_malloc_canaries_set(enum tst_malloc_canary canary) @@ -102,6 +112,18 @@ struct chunk { static struct chunk chunks[MAX_CHUNKS]; static unsigned int chunks_top = 0; +static struct chunk *get_chunk(void *ptr) +{ + unsigned int i; + + for (i = 0; i < chunks_top; i++) { + if (chunks[i].ptr == ptr) + return &chunks[i]; + } + + return NULL; +} + static void add_chunk(size_t size, void *ptr) { if (chunks_top >= MAX_CHUNKS) { @@ -110,6 +132,12 @@ static void add_chunk(size_t size, void *ptr) return; } + if (get_chunk(ptr)) + tst_warn("Duplicate chunk addres added %p\n", ptr); + + if (verbose > 1) + fprintf(stderr, " (adding chunk %p %6zu %i)\n", ptr, size, chunks_top); + /* Store chunk */ chunks[chunks_top].size = size; chunks[chunks_top].ptr = ptr; @@ -133,6 +161,9 @@ static void rem_chunk(void *ptr) { unsigned int i; + if (verbose > 1) + fprintf(stderr, " (removing chunk %p)\n", ptr); + for (i = 0; i < chunks_top; i++) { if (chunks[i].ptr == ptr) { /* Update global stats */ @@ -149,21 +180,35 @@ static void rem_chunk(void *ptr) tst_warn("Chunk passed to free not found (%p)", ptr); } -static struct chunk *get_chunk(void *ptr) +void tst_malloc_check_stop(void) { + /* + * We cannot stop the tracing when canaries are on + * because we need the chunk table to keep track + * which allocations are with canary and their + * sizes for free and realloc. + */ + if (malloc_canary != MALLOC_CANARY_OFF) { + tst_warn("Cannot turn malloc checks off when canaries are on"); + return; + } + + check_malloc = 0; + unsigned int i; - for (i = 0; i < chunks_top; i++) { - if (chunks[i].ptr == ptr) - return &chunks[i]; + if (verbose) { + for (i = 0; i < chunks_top; i++) { + fprintf(stderr, "LOST CHUNK: %p %6zu\n", + chunks[i].ptr, chunks[i].size); + } } - - return NULL; } +static void *(*real_malloc)(size_t) = NULL; + void *malloc(size_t size) { - static void *(*real_malloc)(size_t) = NULL; void *ptr; if (!real_malloc) @@ -179,13 +224,40 @@ void *malloc(size_t size) case MALLOC_CANARY_END: ptr = tst_malloc_canary_right(size); break; - /* Shut up gcc */ default: return NULL; } - if (check_malloc && ptr) + if (check_malloc && ptr) { + if (verbose) + fprintf(stderr, "MALLOC %p\n", ptr); + if (verbose > 1) + print_c_trace(); add_chunk(size, ptr); + } + + return ptr; +} + +void *calloc(size_t nmemb, size_t size) +{ + static int been_here = 0; + void *ptr; + + /* + * Fail calloc() before dlsym(RTLD_NEXT, "calloc") returns. + * + * The glibc seems to work with this failure just fine. + */ + if (!real_malloc && been_here) + return NULL; + + been_here = 1; + + ptr = malloc(nmemb * size); + + if (ptr) + memset(ptr, 0, nmemb * size); return ptr; } @@ -221,6 +293,9 @@ void free(void *ptr) break; } + if (verbose) + fprintf(stderr, "FREE %p\n", ptr); + rem_chunk(ptr); } @@ -229,8 +304,8 @@ void free(void *ptr) void *realloc(void *optr, size_t size) { static void *(*real_realloc)(void*, size_t) = NULL; - struct chunk *chunk; void *ptr; + struct chunk *chunk; if (!real_realloc) real_realloc = dlsym(RTLD_NEXT, "realloc"); @@ -238,44 +313,31 @@ void *realloc(void *optr, size_t size) if (!optr) return malloc(size); - switch (malloc_canary) { - case MALLOC_CANARY_OFF: - ptr = real_realloc(optr, size); - break; - case MALLOC_CANARY_BEGIN: - case MALLOC_CANARY_END: - chunk = get_chunk(optr); - - if (!chunk) { - tst_warn("%p allocated before checking was turned on, " - "using using real_realloc()", optr); - - ptr = real_realloc(optr, size); + chunk = get_chunk(optr); - goto out; - } + if (!chunk) { + /* + * We don't know old size -> have to use real_realloc() + */ + ptr = real_realloc(optr, size); - ptr = malloc(size); + /* + * realloc() may call malloc(), add the chunk only if it + * haven't been added previously. + */ + if (ptr && !get_chunk(ptr)) + add_chunk(size, ptr); - if (ptr) { - memcpy(ptr, optr, min(chunk->size, size)); - free(optr); - } - break; - /* Shut up gcc */ - default: - return NULL; + return ptr; } -out: + ptr = malloc(size); + if (!ptr) return NULL; - if (check_malloc) { - if (optr) - rem_chunk(optr); - add_chunk(size, ptr); - } + memcpy(ptr, optr, min(chunk->size, size)); + free(optr); return ptr; } ----------------------------------------------------------------------- Summary of changes: Makefile | 10 ++ app.mk | 4 +- build/Makefile | 2 +- demos/bogoman/Makefile | 2 +- demos/c_simple/Makefile | 2 +- demos/c_simple/shapetest.c | 33 ++-- demos/grinder/Makefile | 2 +- demos/particle/Makefile | 2 +- demos/spiv/Makefile | 2 +- demos/ttf2img/Makefile | 2 +- include/core/GP_TempAlloc.h | 11 ++ lib.mk | 2 +- libs/core/GP_Context.c | 25 ++- libs/loaders/GP_BMP.c | 52 ++++-- libs/loaders/GP_BMP_RLE.h | 33 ++-- tests/afl/.gitignore | 1 + tests/afl/Makefile | 17 ++ .../bmp/bitmaps/valid => afl/data}/1bpp-1x1.bmp | Bin tests/afl/data/1bpp-320x1-overlappingcolor.bmp | Bin 0 -> 102 bytes tests/afl/data/1bpp-335x.bmp | Bin 0 -> 150 bytes tests/afl/data/1bpp-topdown-320x2.bmp | Bin 0 -> 142 bytes .../bmp/bitmaps/valid => afl/data}/24bpp-1x1.bmp | Bin tests/afl/data/24bpp-323x2.bmp | Bin 0 -> 1998 bytes tests/afl/data/24bpp-topdown-32x24.bmp | Bin 0 -> 2358 bytes .../questionable => afl/data}/32bpp-0x240.bmp | Bin tests/afl/data/32bpp-101110-32x24.bmp | Bin 0 -> 3138 bytes .../bmp/bitmaps/valid => afl/data}/32bpp-1x1.bmp | Bin .../questionable => afl/data}/32bpp-320x0.bmp | Bin tests/afl/data/32bpp-888-optimalpalette-32x24.bmp | Bin 0 -> 3162 bytes .../bmp/bitmaps/valid => afl/data}/4bpp-1x1.bmp | Bin tests/afl/data/4bpp-326x2.bmp | Bin 0 -> 406 bytes tests/afl/data/4bpp-pixeldata-cropped.bmp | Bin 0 -> 261 bytes .../bmp/bitmaps/valid => afl/data}/555-1x1.bmp | Bin tests/afl/data/555-pixeldata-cropped.bmp | Bin 0 -> 789 bytes tests/afl/data/565-320x2-topdown.bmp | Bin 0 -> 1346 bytes .../bmp/bitmaps/valid => afl/data}/8bpp-1x1.bmp | Bin tests/afl/data/8bpp-320x2.bmp | Bin 0 -> 718 bytes tests/afl/data/8bpp-colorsused-negative.bmp | Bin 0 -> 846 bytes tests/afl/data/8bpp-pixels-not-in-palette.bmp | Bin 0 -> 398 bytes tests/afl/data/bitdepth-odd.bmp | Bin 0 -> 846 bytes tests/afl/data/bitdepth-zero.bmp | Bin 0 -> 158 bytes tests/afl/data/colormasks-missing.bmp | Bin 0 -> 54 bytes tests/afl/data/compression-unknown.bmp | Bin 0 -> 158 bytes .../bmp/bitmaps/corrupt => afl/data}/emptyfile.bmp | 0 tests/afl/data/infoheader-cropped.bmp | Bin 0 -> 53 bytes tests/afl/data/infoheadersize-large.bmp | Bin 0 -> 158 bytes tests/afl/data/infoheadersize-small.bmp | Bin 0 -> 142 bytes tests/afl/data/magicnumber-bad.bmp | Bin 0 -> 158 bytes tests/afl/data/offbits-negative.bmp | Bin 0 -> 158 bytes tests/afl/data/planes-zero.bmp | Bin 0 -> 158 bytes tests/afl/data/rle4-encoded-320x2.bmp | Bin 0 -> 96 bytes .../bitmaps/valid => afl/data}/rle8-64000x1.bmp | Bin tests/afl/data/rle8-absolute-320x2.bmp | Bin 0 -> 736 bytes tests/afl/data/rle8-absolute-cropped.bmp | Bin 0 -> 543 bytes .../data/rle8-blank-160x1.bmp} | Bin 1080 -> 1080 bytes .../data/rle8-delta-320x2.bmp} | Bin 1080 -> 1100 bytes .../data/rle8-delta-cropped.bmp} | Bin 1080 -> 1229 bytes tests/afl/data/rle8-deltaleavesimage.bmp | Bin 0 -> 428 bytes tests/afl/data/rle8-encoded-320x2.bmp | Bin 0 -> 96 bytes tests/afl/data/rle8-no-end-of-bitmap-marker.bmp | Bin 0 -> 422 bytes tests/afl/data/rle8-no-end-of-line-marker.bmp | Bin 0 -> 376 bytes tests/afl/data/rle8-runlength-cropped.bmp | Bin 0 -> 251 bytes .../data}/ver3_0_palette_1bpp_10x10_white.pcx | Bin .../data}/ver3_0_palette_24bpp_10x10_white.pcx | Bin .../data}/ver3_0_palette_2bpp_10x10_white.pcx | Bin .../data}/ver3_0_palette_4bpp_10x10_white.pcx | Bin .../data}/ver3_0_palette_8bpp_10x10_white.pcx | Bin tests/afl/data/width-times-height-overflow.bmp | Bin 0 -> 1602 bytes .../loaders_example.c => tests/afl/loaders.c | 18 +-- tests/afl/run_afl.sh | 16 ++ tests/framework/tst_preload.c | 180 +++++++++++++++------ 71 files changed, 295 insertions(+), 121 deletions(-) create mode 100644 tests/afl/.gitignore create mode 100644 tests/afl/Makefile copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/1bpp-1x1.bmp (100%) create mode 100644 tests/afl/data/1bpp-320x1-overlappingcolor.bmp create mode 100644 tests/afl/data/1bpp-335x.bmp create mode 100644 tests/afl/data/1bpp-topdown-320x2.bmp copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/24bpp-1x1.bmp (100%) create mode 100644 tests/afl/data/24bpp-323x2.bmp create mode 100644 tests/afl/data/24bpp-topdown-32x24.bmp copy tests/{loaders/data/bmp/bitmaps/questionable => afl/data}/32bpp-0x240.bmp (100%) create mode 100644 tests/afl/data/32bpp-101110-32x24.bmp copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/32bpp-1x1.bmp (100%) copy tests/{loaders/data/bmp/bitmaps/questionable => afl/data}/32bpp-320x0.bmp (100%) create mode 100644 tests/afl/data/32bpp-888-optimalpalette-32x24.bmp copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/4bpp-1x1.bmp (100%) create mode 100644 tests/afl/data/4bpp-326x2.bmp create mode 100644 tests/afl/data/4bpp-pixeldata-cropped.bmp copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/555-1x1.bmp (100%) create mode 100644 tests/afl/data/555-pixeldata-cropped.bmp create mode 100644 tests/afl/data/565-320x2-topdown.bmp copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/8bpp-1x1.bmp (100%) create mode 100644 tests/afl/data/8bpp-320x2.bmp create mode 100644 tests/afl/data/8bpp-colorsused-negative.bmp create mode 100644 tests/afl/data/8bpp-pixels-not-in-palette.bmp create mode 100644 tests/afl/data/bitdepth-odd.bmp create mode 100644 tests/afl/data/bitdepth-zero.bmp create mode 100644 tests/afl/data/colormasks-missing.bmp create mode 100644 tests/afl/data/compression-unknown.bmp copy tests/{loaders/data/bmp/bitmaps/corrupt => afl/data}/emptyfile.bmp (100%) create mode 100644 tests/afl/data/infoheader-cropped.bmp create mode 100644 tests/afl/data/infoheadersize-large.bmp create mode 100644 tests/afl/data/infoheadersize-small.bmp create mode 100644 tests/afl/data/magicnumber-bad.bmp create mode 100644 tests/afl/data/offbits-negative.bmp create mode 100644 tests/afl/data/planes-zero.bmp create mode 100644 tests/afl/data/rle4-encoded-320x2.bmp copy tests/{loaders/data/bmp/bitmaps/valid => afl/data}/rle8-64000x1.bmp (100%) create mode 100644 tests/afl/data/rle8-absolute-320x2.bmp create mode 100644 tests/afl/data/rle8-absolute-cropped.bmp copy tests/{loaders/data/bmp/bitmaps/valid/rle8-blank-160x120.bmp => afl/data/rle8-blank-160x1.bmp} (88%) copy tests/{loaders/data/bmp/bitmaps/valid/rle8-blank-160x120.bmp => afl/data/rle8-delta-320x2.bmp} (87%) copy tests/{loaders/data/bmp/bitmaps/valid/rle8-blank-160x120.bmp => afl/data/rle8-delta-cropped.bmp} (78%) create mode 100644 tests/afl/data/rle8-deltaleavesimage.bmp create mode 100644 tests/afl/data/rle8-encoded-320x2.bmp create mode 100644 tests/afl/data/rle8-no-end-of-bitmap-marker.bmp create mode 100644 tests/afl/data/rle8-no-end-of-line-marker.bmp create mode 100644 tests/afl/data/rle8-runlength-cropped.bmp copy tests/{loaders/data/pcx/valid => afl/data}/ver3_0_palette_1bpp_10x10_white.pcx (100%) copy tests/{loaders/data/pcx/valid => afl/data}/ver3_0_palette_24bpp_10x10_white.pcx (100%) copy tests/{loaders/data/pcx/valid => afl/data}/ver3_0_palette_2bpp_10x10_white.pcx (100%) copy tests/{loaders/data/pcx/valid => afl/data}/ver3_0_palette_4bpp_10x10_white.pcx (100%) copy tests/{loaders/data/pcx/valid => afl/data}/ver3_0_palette_8bpp_10x10_white.pcx (100%) create mode 100644 tests/afl/data/width-times-height-overflow.bmp copy demos/c_simple/loaders_example.c => tests/afl/loaders.c (82%) create mode 100755 tests/afl/run_afl.sh repo.or.cz automatic notification. Contact project admin jiri.bluebear.dluhos(a)gmail.com if you want to unsubscribe, or site admin admin(a)repo.or.cz if you receive no reply. -- gfxprim.git ("A simple 2D graphics library with emphasis on correctness and well-defined operation.")

1 0