diff --git a/fuzzing/pdf_surface_fuzzer.c b/fuzzing/pdf_surface_fuzzer.c index c8ae6913a..aafc51c13 100644 --- a/fuzzing/pdf_surface_fuzzer.c +++ b/fuzzing/pdf_surface_fuzzer.c @@ -21,14 +21,19 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { return 0; } - flags = CAIRO_PDF_OUTLINE_FLAG_BOLD | CAIRO_PDF_OUTLINE_FLAG_OPEN; - cairo_pdf_surface_set_page_label(surface, data); - cairo_pdf_surface_set_metadata(surface, CAIRO_PDF_METADATA_TITLE, data); - cairo_tag_begin(cr, data, NULL); - cairo_tag_end(cr, data); + char *buf = (char *) malloc(size + 1); + memcpy(buf, data, size); + buf[size] = '\0'; - cairo_surface_destroy(surface); + flags = CAIRO_PDF_OUTLINE_FLAG_BOLD | CAIRO_PDF_OUTLINE_FLAG_OPEN; + cairo_pdf_surface_set_metadata(surface, CAIRO_PDF_METADATA_TITLE, buf); + cr = cairo_create(surface); + cairo_tag_begin(cr, buf, NULL); + cairo_tag_end(cr, buf); + + free(buf); cairo_destroy(cr); + cairo_surface_destroy(surface); fuzzer_release_tmpfile(tmpfile); return 0; } diff --git a/fuzzing/raster_fuzzer.c b/fuzzing/raster_fuzzer.c index bd6bdaf54..87224c450 100644 --- a/fuzzing/raster_fuzzer.c +++ b/fuzzing/raster_fuzzer.c @@ -39,14 +39,20 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { w = cairo_image_surface_get_width(surface); h = cairo_image_surface_get_height(surface); - pattern = cairo_pattern_create_raster_source(data, content, w, h); + char *buf = (char *) malloc(size + 1); + memcpy(buf, data, size); + buf[size] = '\0'; + + pattern = cairo_pattern_create_raster_source(buf, content, w, h); cairo_raster_source_pattern_set_acquire (pattern, acquire, release); cairo_set_source(cr, pattern); + cairo_pdf_surface_set_page_label(surface, buf); cairo_paint(cr); cairo_destroy(cr); cairo_pattern_destroy(pattern); cairo_surface_destroy(surface); + free(buf); fuzzer_release_tmpfile(tmpfile); return 0; } diff --git a/fuzzing/text_glyphs_fuzzer.c b/fuzzing/text_glyphs_fuzzer.c index 91a96dc7d..3661799df 100644 --- a/fuzzing/text_glyphs_fuzzer.c +++ b/fuzzing/text_glyphs_fuzzer.c @@ -25,8 +25,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { return 0; } + char *buf = (char *) malloc(size + 1); + memcpy(buf, data, size); + buf[size] = '\0'; + cr = cairo_create(surface); - cairo_text_extents(cr, data, &extents); + cairo_text_extents(cr, buf, &extents); cluster.num_bytes = size; cluster.num_glyphs = 1; for (int i = 0; i < 9; i++) { @@ -34,11 +38,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { cairo_glyph_t glyph = { index[i], 10 * i, 25 }; - cairo_show_text_glyphs(cr, data, size, &glyph, 1, &cluster, 1, 0); + cairo_show_text_glyphs(cr, buf, size, &glyph, 1, &cluster, 1, 0); } cairo_destroy(cr); cairo_surface_destroy(surface); + free(buf); fuzzer_release_tmpfile(tmpfile); return 0; }