Fuzz avifImage::properties

AOMediaCodec · Oct 4, 2024 · 213f331 · 213f331
1 parent 77f72d4
commit 213f331
Showing 1 changed file with 13 additions and 3 deletions.
diff --git a/tests/gtest/avif_fuzztest_dec.cc b/tests/gtest/avif_fuzztest_dec.cc
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: BSD-2-Clause
 // Decodes an arbitrary sequence of bytes.
 
+#include <algorithm>
 #include <cstdint>
 
 #include "avif/avif.h"
@@ -27,15 +28,24 @@ void Decode(const std::string& arbitrary_bytes, bool is_persistent,
   ImagePtr decoded(avifImageCreateEmpty());
   ASSERT_NE(decoded, nullptr);
 
-  avifIO* const io = avifIOCreateMemoryReader(
-      reinterpret_cast<const uint8_t*>(arbitrary_bytes.data()),
-      arbitrary_bytes.size());
+  const uint8_t* data =
+      reinterpret_cast<const uint8_t*>(arbitrary_bytes.data());
+  avifIO* const io = avifIOCreateMemoryReader(data, arbitrary_bytes.size());
   if (io == nullptr) return;
   // The Chrome's avifIO object is not persistent.
   io->persistent = is_persistent;
   avifDecoderSetIO(decoder.get(), io);
 
   if (avifDecoderParse(decoder.get()) != AVIF_RESULT_OK) return;
+
+  for (size_t i = 0; i < decoder->image->numProperties; ++i) {
+    const avifRWData& boxPayload = decoder->image->properties[i].boxPayload;
+    // Each custom property should be found as is in the input bitstream.
+    EXPECT_NE(std::search(data, data + arbitrary_bytes.size(), boxPayload.data,
+                          boxPayload.data + boxPayload.size),
+              data + arbitrary_bytes.size());
+  }
+
   while (avifDecoderNextImage(decoder.get()) == AVIF_RESULT_OK) {
     EXPECT_GT(decoder->image->width, 0u);
     EXPECT_GT(decoder->image->height, 0u);