lcms: add seeds and profile fuzzer (#8063)

projects/lcms/Dockerfile

@@ -17,5 +17,14 @@
 FROM gcr.io/oss-fuzz-base/base-builder
 RUN apt-get update && apt-get install -y make autoconf automake libtool
 RUN git clone --depth 1 https://github.com/mm2/Little-CMS.git lcms
+RUN mkdir $SRC/seeds && \
+    cd seeds && \
+    cp $SRC/lcms/testbed/bad.icc . && \
+    cp $SRC/lcms/testbed/toosmall.icc . && \
+    cp $SRC/lcms/testbed/test1.icc . && \
+    cp $SRC/lcms/testbed/crayons.icc . && \
+    cp $SRC/lcms/testbed/ibm-t61.icc . && \
+    zip -rj $SRC/seed_corpus.zip $SRC/seeds/*
+
 WORKDIR lcms
-COPY build.sh cmsIT8_load_fuzzer.* cms_transform_fuzzer.* cms_overwrite_transform_fuzzer.* cms_transform_all_fuzzer.c icc.dict $SRC/
+COPY build.sh *.c *.options *.dict $SRC/

projects/lcms/build.sh

@@ -20,7 +20,7 @@
 make -j$(nproc) all
 
 # build your fuzzer(s)
-FUZZERS="cmsIT8_load_fuzzer cms_transform_fuzzer cms_overwrite_transform_fuzzer cms_transform_all_fuzzer"
+FUZZERS="cmsIT8_load_fuzzer cms_transform_fuzzer cms_overwrite_transform_fuzzer cms_transform_all_fuzzer cms_profile_fuzzer"
 for F in $FUZZERS; do
     $CC $CFLAGS -c -Iinclude \
         $SRC/$F.c -o $SRC/$F.o
@@ -30,3 +30,5 @@ for F in $FUZZERS; do
 done
 
 cp $SRC/icc.dict $SRC/*.options $OUT/
+cp $SRC/seed_corpus.zip $OUT/cms_transform_fuzzer_seed_corpus.zip
+cp $SRC/seed_corpus.zip $OUT/cms_profile_fuzzer_seed_corpus.zip

projects/lcms/cms_profile_fuzzer.c

@@ -0,0 +1,53 @@
+/* Copyright 2022 Google LLC
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include <stdint.h>
+#include <assert.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "lcms2.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  if (size == 0)
+    return 0;
+
+  char filename[256];
+  sprintf(filename, "/tmp/libfuzzer.%d.icc", getpid());
+  FILE *fp = fopen(filename, "wb");
+  if (!fp) {
+    return 0;
+  }
+  fwrite(data, size, 1, fp);
+  fclose(fp);
+
+  cmsHPROFILE hProfile = cmsOpenProfileFromFile(filename, "r");
+  // If we have a profile, perform a set of operations
+  if (hProfile) {
+    char tagBuffer[4];
+
+    // Perform multiple tag reads
+    cmsReadRawTag(hProfile, cmsSigGreenColorantTag, tagBuffer, 4);
+    cmsReadRawTag(hProfile, cmsSigGreenColorantTag, NULL, 0);
+    cmsReadRawTag(hProfile, cmsSigGreenColorantTag, tagBuffer, 4);
+    cmsReadTag(hProfile, cmsSigGamutTag);
+
+    // Save to random file
+    cmsSaveProfileToFile(hProfile, "random.icc");
+
+    cmsCloseProfile(hProfile);
+  }
+
+  unlink(filename);
+
+  return 0;
+}