[Pixman] [PATCH 2/3] test: 'scaling-crash-test' added
Siarhei Siamashka
siarhei.siamashka at gmail.com
Mon Jul 19 13:42:43 PDT 2010
From: Siarhei Siamashka <siarhei.siamashka at nokia.com>
This test tries to exploit some corner cases and previously known
bugs in nearest neighbor scaling fast path code, attempting to
crash pixman or cause some other nasty effect.
---
test/Makefile.am | 2 +
test/scaling-crash-test.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 121 insertions(+), 0 deletions(-)
create mode 100644 test/scaling-crash-test.c
diff --git a/test/Makefile.am b/test/Makefile.am
index 20cb00f..2a7aea2 100644
--- a/test/Makefile.am
+++ b/test/Makefile.am
@@ -13,6 +13,7 @@ TESTPROGRAMS = \
gradient-crash-test \
trap-crasher \
alphamap \
+ scaling-crash-test \
blitters-test \
scaling-test \
composite
@@ -24,6 +25,7 @@ gradient_crash_test_LDADD = $(TEST_LDADD)
trap_crasher_LDADD = $(TEST_LDADD)
oob_test_LDADD = $(TEST_LDADD)
window_test_LDADD = $(TEST_LDADD)
+scaling_crash_test_LDADD = $(TEST_LDADD)
region_test_LDADD = $(TEST_LDADD)
region_test_SOURCES = region-test.c utils.c utils.h
diff --git a/test/scaling-crash-test.c b/test/scaling-crash-test.c
new file mode 100644
index 0000000..4250394
--- /dev/null
+++ b/test/scaling-crash-test.c
@@ -0,0 +1,119 @@
+#include <assert.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "pixman.h"
+
+/*
+ * We have a source image filled with solid color, set NORMAL or PAD repeat,
+ * and some transform which results in nearest neighbour scaling.
+ *
+ * The expected result is the destination image filled with this solid
+ * color.
+ */
+static int
+do_test (int32_t dst_size,
+ int32_t src_size,
+ int32_t src_offs,
+ int32_t scale_factor,
+ pixman_repeat_t repeat)
+{
+ int i;
+ pixman_image_t * src_img;
+ pixman_image_t * dst_img;
+ pixman_transform_t transform;
+ uint32_t * srcbuf;
+ uint32_t * dstbuf;
+
+ srcbuf = (uint32_t *)malloc (src_size * 4);
+ dstbuf = (uint32_t *)malloc (dst_size * 4);
+
+ /* horizontal test */
+ memset (srcbuf, 0xCC, src_size * 4);
+ memset (dstbuf, 0x33, dst_size * 4);
+
+ src_img = pixman_image_create_bits (
+ PIXMAN_a8r8g8b8, src_size, 1, srcbuf, src_size * 4);
+ dst_img = pixman_image_create_bits (
+ PIXMAN_a8r8g8b8, dst_size, 1, dstbuf, dst_size * 4);
+
+ pixman_transform_init_scale (&transform, scale_factor, 65536);
+ pixman_image_set_transform (src_img, &transform);
+ pixman_image_set_repeat (src_img, repeat);
+ pixman_image_set_filter (src_img, PIXMAN_FILTER_NEAREST, NULL, 0);
+
+ pixman_image_composite (PIXMAN_OP_SRC, src_img, NULL, dst_img,
+ src_offs, 0, 0, 0, 0, 0, dst_size, 1);
+
+ pixman_image_unref (src_img);
+ pixman_image_unref (dst_img);
+
+ for (i = 0; i < dst_size; i++)
+ {
+ if (dstbuf[i] != 0xCCCCCCCC)
+ {
+ free (srcbuf);
+ free (dstbuf);
+ return 1;
+ }
+ }
+
+ /* vertical test */
+ memset (srcbuf, 0xCC, src_size * 4);
+ memset (dstbuf, 0x33, dst_size * 4);
+
+ src_img = pixman_image_create_bits (
+ PIXMAN_a8r8g8b8, 1, src_size, srcbuf, 4);
+ dst_img = pixman_image_create_bits (
+ PIXMAN_a8r8g8b8, 1, dst_size, dstbuf, 4);
+
+ pixman_transform_init_scale (&transform, 65536, scale_factor);
+ pixman_image_set_transform (src_img, &transform);
+ pixman_image_set_repeat (src_img, repeat);
+ pixman_image_set_filter (src_img, PIXMAN_FILTER_NEAREST, NULL, 0);
+
+ pixman_image_composite (PIXMAN_OP_SRC, src_img, NULL, dst_img,
+ 0, src_offs, 0, 0, 0, 0, 1, dst_size);
+
+ pixman_image_unref (src_img);
+ pixman_image_unref (dst_img);
+
+ for (i = 0; i < dst_size; i++)
+ {
+ if (dstbuf[i] != 0xCCCCCCCC)
+ {
+ free (srcbuf);
+ free (dstbuf);
+ return 1;
+ }
+ }
+
+ free (srcbuf);
+ free (dstbuf);
+ return 0;
+}
+
+int
+main (int argc, char *argv[])
+{
+ pixman_disable_out_of_bounds_workaround ();
+
+ /* can potentially crash */
+ assert (do_test (
+ 48000, 32767, 1, 65536 * 128, PIXMAN_REPEAT_NORMAL) == 0);
+
+ /* can potentially get into a deadloop */
+ assert (do_test (
+ 16384, 65536, 32, 32768, PIXMAN_REPEAT_NORMAL) == 0);
+
+ /* can potentially access memory outside source image buffer */
+ assert (do_test (
+ 10, 10, 0, 0, PIXMAN_REPEAT_PAD) == 0);
+
+#if 0
+ /* can potentially provide invalid results (out of range matrix stuff) */
+ assert (do_test (
+ 48000, 32767, 16384, 65536 * 128, PIXMAN_REPEAT_NORMAL) == 0);
+#endif
+
+ return 0;
+}
--
1.6.4.4
More information about the Pixman
mailing list