image/png: add Fuzz function

Add a Fuzz function to package png, under the gofuzz build
tag. This function is based on the png/png.go code, from
github.com/dvyukov/go-fuzz-corpus, modified to use direct
comparison of image bounds rather than reflect.DeepEqual.

Updates #30979
Updates #19109

Change-Id: Idb86e7ded0c2d78e6cadbeda84c7b1f35b8c579c
Reviewed-on: https://go-review.googlesource.com/c/go/+/168558
Reviewed-by: thepudds <thepudds1460@gmail.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Run-TryBot: Dmitry Vyukov <dvyukov@google.com>

diff --git a/src/image/png/fuzz.go b/src/image/png/fuzz.go
new file mode 100644 (file)
index 0000000..d9cb392
--- /dev/null
+++ b/src/image/png/fuzz.go
@@ -0,0 +1,52 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build gofuzz
+
+package png
+
+import (
+       "bytes"
+       "fmt"
+)
+
+func Fuzz(data []byte) int {
+       cfg, err := DecodeConfig(bytes.NewReader(data))
+       if err != nil {
+               return 0
+       }
+       if cfg.Width*cfg.Height > 1e6 {
+               return 0
+       }
+       img, err := Decode(bytes.NewReader(data))
+       if err != nil {
+               return 0
+       }
+       levels := []CompressionLevel{
+               DefaultCompression,
+               NoCompression,
+               BestSpeed,
+               BestCompression,
+       }
+       for _, l := range levels {
+               var w bytes.Buffer
+               e := &Encoder{CompressionLevel: l}
+               err = e.Encode(&w, img)
+               if err != nil {
+                       panic(err)
+               }
+               img1, err := Decode(&w)
+               if err != nil {
+                       panic(err)
+               }
+               got := img1.Bounds()
+               want := img.Bounds()
+               if !got.Eq(want) {
+                       fmt.Printf("bounds0: %#v\n", want)
+                       fmt.Printf("bounds1: %#v\n", got)
+                       panic("bounds have changed")
+               }
+       }
+       return 1
+}