Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a fuzzer for ImageCms.buildTransform #7792

Closed
wants to merge 2 commits into from
Closed

Add a fuzzer for ImageCms.buildTransform #7792

wants to merge 2 commits into from

Conversation

jvoisin
Copy link

@jvoisin jvoisin commented Feb 10, 2024

No description provided.

def fuzz_cms(profile1, profile2, trans1, trans2) -> None:
p1 = ImageCms.createProfile(profile1)
p2 = ImageCms.createProfile(profile2)
t = ImageCms.buildTransform(p1, p2, trans1, trans2)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
t = ImageCms.buildTransform(p1, p2, trans1, trans2)
ImageCms.buildTransform(p1, p2, trans1, trans2)

Lint fix.

@radarhere
Copy link
Member

Hi. A few questions.

  1. Could you tell us what inspired you to add this? What about ImageCms.buildTransform() or ImageCms.createProfile() made you think that additional testing was necessary?

  2. If I understand your code correctly, you're picking a random mode from a list for each of four arguments for fuzz_cms(). The first argument goes to ImageCms.createProfile(). Looking at

    Pillow/src/PIL/ImageCms.py

    Lines 767 to 769 in 6782a07

    :param colorSpace: String, the color space of the profile you wish to
    create.
    Currently only "LAB", "XYZ", and "sRGB" are supported.

    only "LAB", "XYZ" and "sRGB" are supported though, and of those, only "LAB" is in your list of modes. The only time your code passes is when all four arguments are "LAB" . Otherwise, your code fails with Color space not supported for on-the-fly profile creation, right?

  3. Our other fuzzing scenarios are for when a user is opening an image or a font, scenarios were the input is not trusted and may have come from anywhere. What made you think this was a scenario for fuzzing, and not something that could be exhaustively tested in our normal test suite?

@jvoisin jvoisin closed this Feb 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants