Merge pull request #1067 from zeux/gltf-fuzz

gltfpack: Improve fuzzing infrastructure

Author: zeux

gltf/fuzz.dict

@@ -69,6 +69,12 @@
 "\"MAT3\""
 "\"MAT4\""
 "\"OPAQUE\""
+"\"POSITION\""
+"\"NORMAL\""
+"\"TANGENT\""
+"\"TEXCOORD\""
+"\"JOINTS\""
+"\"WEIGHTS\""
 "\"SCALAR\""
 "\"STEP\""
 "\"VEC2\""
@@ -181,6 +187,7 @@
 # AFL dictionary for GLTF extensions
 # -----------------------
 "\"KHR_materials_unlit\""
+"\"KHR_draco_mesh_compression\""
 "\"KHR_texture_basisu\""
 
 "\"KHR_materials_pbrSpecularGlossiness\""
@@ -198,7 +205,12 @@
 
 "\"KHR_lights_punctual\""
 "\"color\""
+"\"directional\""
 "\"intensity\""
+"\"light\""
+"\"lights\""
+"\"point\""
+"\"spot\""
 "\"type\""
 "\"range\""
 "\"innerConeAngle\""
@@ -221,4 +233,71 @@
 "\"sheenRoughnessTexture\""
 
 "\"KHR_materials_emissive_strength\""
-"\"emissiveStrength"\""
+"\"emissiveStrength\""
+
+"\"KHR_materials_clearcoat\""
+"\"clearcoatFactor\""
+"\"clearcoatTexture\""
+"\"clearcoatRoughnessFactor\""
+"\"clearcoatRoughnessTexture\""
+"\"clearcoatNormalTexture\""
+
+"\"KHR_materials_ior\""
+"\"ior\""
+
+"\"KHR_materials_specular\""
+"\"specularFactor\""
+"\"specularTexture\""
+"\"specularColorFactor\""
+"\"specularColorTexture\""
+
+"\"KHR_materials_iridescence\""
+"\"iridescenceFactor\""
+"\"iridescenceTexture\""
+"\"iridescenceIor\""
+"\"iridescenceThicknessMinimum\""
+"\"iridescenceThicknessMaximum\""
+"\"iridescenceThicknessTexture\""
+
+"\"KHR_materials_anisotropy\""
+"\"anisotropyStrength\""
+"\"anisotropyRotation\""
+"\"anisotropyTexture\""
+
+"\"KHR_materials_dispersion\""
+"\"dispersion\""
+
+"\"KHR_materials_diffuse_transmission\""
+"\"diffuseTransmissionFactor\""
+"\"diffuseTransmissionTexture\""
+"\"diffuseTransmissionColorFactor\""
+"\"diffuseTransmissionColorTexture\""
+
+"\"KHR_materials_variants\""
+"\"mappings\""
+"\"targetNames\""
+"\"variants\""
+
+"\"EXT_texture_webp\""
+
+"\"EXT_mesh_gpu_instancing\""
+"\"TRANSLATION\""
+"\"ROTATION\""
+"\"SCALE\""
+"\"_COLOR_0\""
+
+"\"EXT_meshopt_compression\""
+"\"KHR_meshopt_compression\""
+"\"mode\""
+"\"filter\""
+"\"fallback\""
+"\"ATTRIBUTES\""
+"\"TRIANGLES\""
+"\"INDICES\""
+"\"NONE\""
+"\"OCTAHEDRAL\""
+"\"QUATERNION\""
+"\"EXPONENTIAL\""
+"\"COLOR\""
+
+"\"KHR_mesh_quantization\""

gltf/gltfpack.cpp

@@ -1794,6 +1794,54 @@ extern "C" int pack(int argc, char** argv)
 #endif
 
 #ifdef GLTFFUZZ
+extern "C" size_t LLVMFuzzerMutate(uint8_t* data, size_t size, size_t max_size);
+
+extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data, size_t size, size_t max_size, unsigned int seed)
+{
+	// parse glTF/JSON chunk headers
+	if (size < 28 || memcmp(data, "glTF", 4) != 0 || memcmp(data + 16, "JSON", 4) != 0)
+		return LLVMFuzzerMutate(data, size, max_size);
+
+	uint32_t total_size, json_size;
+	memcpy(&total_size, data + 8, 4);
+	memcpy(&json_size, data + 12, 4);
+
+	// parse BIN chunk header (note, we assume it's required for simplicity)
+	if (json_size > size - 28 || memcmp(data + 24 + json_size, "BIN", 4) != 0)
+		return LLVMFuzzerMutate(data, size, max_size);
+
+	uint32_t bin_size;
+	memcpy(&bin_size, data + 20 + json_size, 4);
+
+	// final validation; note that all chunks must be 4 byte aligned
+	if (total_size != size || bin_size > size - 28 - json_size || 28 + json_size + bin_size != size || ((bin_size | json_size) & 3) != 0)
+		return LLVMFuzzerMutate(data, size, max_size);
+
+	// pick chunk to mutate; we default to mutating JSON but mutate BIN with 10% probability
+	bool mutate_bin = seed % 10 == 0;
+	size_t target_offset = mutate_bin ? 28 + json_size : 20;
+	size_t target_size = mutate_bin ? bin_size : json_size;
+
+	size_t target_capacity = (max_size - (size - target_size)) & ~3;
+
+	// mutate chunk and pad it to 4 byte boundary to maintain GLB alignment
+	std::vector<uint8_t> target(data + target_offset, data + target_offset + target_size);
+	target.resize(target_capacity);
+	target.resize(LLVMFuzzerMutate(target.data(), target_size, target_capacity));
+	target.resize((target.size() + 3) & ~3, mutate_bin ? 0 : ' ');
+
+	uint32_t new_target_size = uint32_t(target.size());
+	uint32_t new_total_size = uint32_t(size - target_size + new_target_size);
+
+	// patch the target chunk and update chunk length as well as total length
+	memmove(data + target_offset + new_target_size, data + target_offset + target_size, size - target_offset - target_size);
+	memcpy(data + target_offset, target.data(), new_target_size);
+	memcpy(data + 8, &new_total_size, 4);
+	memcpy(data + target_offset - 8, &new_target_size, 4);
+
+	return new_total_size;
+}
+
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* buffer, size_t size)
 {
 	Settings settings = defaults();
@@ -1816,7 +1864,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* buffer, size_t size)
 
 	std::string json, bin, fallback;
 	size_t fallback_size = 0;
-	process(data, NULL, NULL, NULL, meshes, animations, settings, json, bin, fallback, fallback_size, NULL);
+	process(data, NULL, NULL, NULL, meshes, animations, settings, json, bin, fallback, fallback_size, "KHR_meshopt_compression");
 
 	cgltf_free(data);
 

gltf/parsegltf.cpp

@@ -181,6 +181,14 @@ static void parseMeshesGltf(cgltf_data* data, std::vector<Mesh>& meshes, std::ve
 				continue;
 			}
 
+			const cgltf_accessor* positions = cgltf_find_accessor(&primitive, cgltf_attribute_type_position, 0);
+
+			if (!positions)
+			{
+				fprintf(stderr, "Warning: ignoring primitive %d of mesh %d because it has no position data\n", int(pi), int(mi));
+				continue;
+			}
+
 			meshes.push_back(Mesh());
 			Mesh& result = meshes.back();
 
@@ -191,7 +199,7 @@ static void parseMeshesGltf(cgltf_data* data, std::vector<Mesh>& meshes, std::ve
 
 			result.streams.reserve(primitive.attributes_count);
 
-			size_t vertex_count = primitive.attributes_count ? primitive.attributes[0].data->count : 0;
+			size_t vertex_count = positions->count;
 
 			if (primitive.indices)
 			{