Fix crash on malformed files

oss-fuzz/449485443

.gitlab-ci.yml

@@ -16,7 +16,7 @@ include:
 
 image_json_validate:
   stage: validate
-  image: invent-registry.kde.org/sysadmin/ci-images/suse-qt611:latest
+  image: invent-registry.kde.org/sysadmin/ci-images/suse-qt69:latest
   tags:
     - Linux
   script:

.kde-ci.yml

@@ -7,5 +7,5 @@ Dependencies:
 Options:
  test-before-installing: True
  require-passing-tests-on: ['Linux', 'FreeBSD', 'Windows']
- cmake-options: "-DKIMAGEFORMATS_WITH_KNOWN_CRASHES_JXR=ON -DKIMAGEFORMATS_HEIF=ON -DKIMAGEFORMATS_HEIF_TEST:STRING=OFF -DKIMAGEFORMATS_HEJ2_TEST:STRING=OFF -DKIMAGEFORMATS_AVCI_TEST:STRING=OFF"
+ cmake-options: "-DKIMAGEFORMATS_DDS=ON -DKIMAGEFORMATS_JXR=ON -DKIMAGEFORMATS_HEIF=ON"
  per-test-timeout: 90

CMakeLists.txt

@@ -1,11 +1,11 @@
-cmake_minimum_required(VERSION 3.29)
+cmake_minimum_required(VERSION 3.16)
 
-set(KF_VERSION "6.28.0") # handled by release scripts
+set(KF_VERSION "6.20.0") # handled by release scripts
-set(KF_DEP_VERSION "6.27.0") # handled by release scripts
+set(KF_DEP_VERSION "6.19.0") # handled by release scripts
 project(KImageFormats VERSION ${KF_VERSION})
 
 include(FeatureSummary)
-find_package(ECM 6.27.0  NO_MODULE)
+find_package(ECM 6.19.0  NO_MODULE)
 set_package_properties(ECM PROPERTIES TYPE REQUIRED DESCRIPTION "Extra CMake Modules." URL "https://commits.kde.org/extra-cmake-modules")
 feature_summary(WHAT REQUIRED_PACKAGES_NOT_FOUND FATAL_ON_MISSING_REQUIRED_PACKAGES)
 
@@ -21,7 +21,7 @@ include(ECMDeprecationSettings)
 include(CheckIncludeFiles)
 include(FindPkgConfig)
 
-set(REQUIRED_QT_VERSION 6.9.0)
+set(REQUIRED_QT_VERSION 6.7.0)
 find_package(Qt6Gui ${REQUIRED_QT_VERSION} REQUIRED NO_MODULE)
 
 find_package(KF6Archive ${KF_DEP_VERSION})
@@ -65,14 +65,8 @@ set_package_properties(libavif PROPERTIES
 option(KIMAGEFORMATS_DDS "Enable plugin for DDS format" ON)
 
 option(KIMAGEFORMATS_HEIF "Enable plugin for HEIF format" OFF)
-set(KIMAGEFORMATS_HEIF_TEST "ALL" CACHE STRING "Enable HEIF tests: OFF, READ_ONLY, ALL")
-set_property(CACHE KIMAGEFORMATS_HEIF_TEST PROPERTY STRINGS "OFF" "READ_ONLY" "ALL")
-set(KIMAGEFORMATS_HEJ2_TEST "ALL" CACHE STRING "Enable HEJ2 tests: OFF, READ_ONLY, ALL")
-set_property(CACHE KIMAGEFORMATS_HEJ2_TEST PROPERTY STRINGS "OFF" "READ_ONLY" "ALL")
-set(KIMAGEFORMATS_AVCI_TEST "ALL" CACHE STRING "Enable AVCI tests: OFF, ALL")
-set_property(CACHE KIMAGEFORMATS_AVCI_TEST PROPERTY STRINGS "OFF" "ALL")
 if(KIMAGEFORMATS_HEIF)
-    pkg_check_modules(LibHeif IMPORTED_TARGET libheif>=1.17.0)
+    pkg_check_modules(LibHeif IMPORTED_TARGET libheif>=1.10.0)
 endif()
 add_feature_info(LibHeif LibHeif_FOUND "required for the QImage plugin for HEIF/HEIC images")
 
@@ -97,17 +91,16 @@ set_package_properties(LibRaw PROPERTIES
     PURPOSE "Required for the QImage plugin for RAW images"
 )
 
-# JXR plugin disabled by default due to security issues.
+# JXR plugin disabled by default due to security issues
-# You should not enable it unless you know what you are doing.
+option(KIMAGEFORMATS_JXR "Enable plugin for JPEG XR format" OFF)
-option(KIMAGEFORMATS_WITH_KNOWN_CRASHES_JXR "Enable plugin for JPEG XR format" OFF)
+if(KIMAGEFORMATS_JXR)
-if(KIMAGEFORMATS_WITH_KNOWN_CRASHES_JXR)
     find_package(LibJXR)
 endif()
 add_feature_info(LibJXR LibJXR_FOUND "required for the QImage plugin for JPEG XR images")
 
 ecm_set_disabled_deprecation_versions(
-    QT 6.11.0
+    QT 6.10.0
-    KF 6.27.0
+    KF 6.18.0
 )
 
 add_subdirectory(src)

README.md

@@ -16,13 +16,11 @@ The following image formats have read-only support:
 
 - Animated Windows cursors (ani)
 - Camera RAW images (arw, cr2, cr3, dcs, dng, ...)
-- Farbfeld (ff)
 - Gimp (xcf)
 - Interchange Format Files (iff, ilbm, lbm)
 - Krita (kra)
 - OpenRaster (ora)
 - Pixar raster (pxr)
-- PlayStation graphics (tim)
 - Portable FloatMap/HalfMap (pfm, phm)
 - Photoshop documents (psd, psb, pdd, psdt)
 - Radiance HDR (hdr)
@@ -156,31 +154,8 @@ About the image:
 - `Owner`: Name of the owner of the image.
 - `Software`: Name and version number of the software package(s) used to 
   create the image.
-- `Speed`: Floating-point number indicating the speed of GPS receiver 
-  movement in Km/h (e.g. 30.2).
 - `Title`: The title of the image.
 
-About the shot:
-- `DigitalZoomRatio`: Floating-point number indicating the digital zoom ratio
-  when the image was shot.
-- `ExposureMode`: Integer number indicating the exposure mode set when the 
-  image was shot as reported in the EXIF ​​specifications.
-- `ExposureProgram`: Integer number indicating the class of the program used 
-  by the camera to set exposure when the picture is taken as reported in the 
-  EXIF ​​specifications.
-- `ExposureTime`: Floating-point number indicating the exposure time, 
-  given in seconds (s).
-- `Flash`: Integer number indicating the status of flash when the image 
-  was shot as reported in the EXIF ​​specifications.
-- `FNumber`: Floating-point number indicating the F number.
-- `FocalLength`: Floating-point number indicating the actual focal length 
-  of the lens, in millimeters (mm).
-- `ISOSpeedRatings`: Integer number indicating the sensitivity of the camera 
-  or input device when the image was shot as reported in the EXIF 
-  ​​specifications.
-- `WhiteBalance`: Integer number indicating the white balance mode set when 
-  the image was shot as reported in the EXIF ​​specifications.
-
 About the camera:
 - `Manufacturer`: The manufacturer of the recording equipment.
 - `Model`: The model name or model number of the recording equipment.
@@ -244,23 +219,21 @@ RGB.
 Where possible, plugins support large images. By convention, many of the
 large image plugins are limited to a maximum of 300,000 x 300,000 pixels.
 Anyway, all plugins are also limited by the
-`QImageReader::allocationLimit()`.
+`QImageIOReader::allocationLimit()`.
 
 > [!note]
 > You can change the maximum limit of 300000 pixels by setting the constant
-> `KIF_LARGE_IMAGE_PIXEL_LIMIT` to the desired value in the cmake file. It 
+> `KIF_LARGE_IMAGE_PIXEL_LIMIT` to the desired value in the cmake file.
-> cannot be less than 65536.
 
 Below are the maximum sizes for each plugin ('n/a' means no limit, i.e. the 
 limit depends on the format encoding).
-- ANI: same size as Qt's ICO plugin
+- ANI: n/a
 - AVIF: 32,768 x 32,768 pixels, in any case no larger than 256 megapixels
 - DDS: 300,000 x 300,000 pixels
 - EXR: 300,000 x 300,000 pixels
 - EPS: same size as Qt's JPG plugin
-- FF: 300,000 x 300,000 pixels
 - HDR: 300,000 x 300,000 pixels
-- HEIF: 65,535 x 65,535 pixels
+- HEIF: n/a
 - IFF: 65,535 x 65,535 pixels
 - JP2: 300,000 x 300,000 pixels, in any case no larger than 2 gigapixels
 - JXL: 262,144 x 262,144 pixels, in any case no larger than 256 megapixels
@@ -277,7 +250,6 @@ limit depends on the format encoding).
 - RAW: 65,535 x 65,535 pixels
 - RGB: 65,535 x 65,535 pixels
 - SCT: 300,000 x 300,000 pixels
-- TIM: 65,535 x 65,535 pixels
 - TGA: 65,535 x 65,535 pixels
 - XCF: 300,000 x 300,000 pixels
 
@@ -300,18 +272,8 @@ consumption proportional to the size of the image to be saved.
 Normally this is not a source of problems because the affected plugins
 are limited to maximum images of 2GiB or less.
 
-Note that the value of `QImageReader::allocationLimit()` is only used when 
-allocating a new `QImage`. Since this parameter was created to limit damage 
-caused by corrupted files, any conversion of `QImage` (for example, with 
-`QImage::convertTo()`) is not subject to this limit.
-
 On plugins for formats that support large images, progressive conversion has
 been used or the maximum size of the image that can be saved has been limited.
-Plugins that use external libraries don't always allow progressive decoding 
-(e.g., the JPEG series). In these cases, the memory required for reading 
-may be much larger than the entire decoded image. When the external library has 
-a maximum memory limit function, the value of `QImageReader::allocationLimit()` 
-is set.
 
 ### Non-RGB formats
 
@@ -328,14 +290,9 @@ in your cmake options.**
 
 The following defines can be defined in cmake to modify the behavior of the 
 plugin:
-- `DDS_DISABLE_STRIDE_ALIGNMENT`: disable the stride alignment based on DDS 
+- `DDS_DISABLE_STRIDE_ALIGNMENT`: disable the stride aligment based on DDS 
   pitch: it is known that some writers do not set it correctly.
 
-When writing, it is possible to set which pixel format to use by setting the
-subtypes. The default is `Automatic` which chooses the most appropriate format
-based on the image. For a complete list of subformats, please use the
-appropriate [`QImageWriter`](https://doc.qt.io/qt-6/qimagewriter.html) APIs.
-
 ### The HEIF plugin
 
 **This plugin is disabled by default. It can be enabled by settings
@@ -346,24 +303,6 @@ distributions. In particular, it is necessary that the HEIF library has
 support for HEVC codec. If HEVC codec is not available the plugin
 will compile but will fail the tests.
 
-The following defines can be defined in cmake to modify the behavior of the 
-plugin:
-- `HEIF_DISABLE_QT_TRANSFORMATION`: HEIF transformations, in addition to 
-  rotations and reflections, also support image cropping. Consequently, the 
-  Qt plugin, must also honor the crop. This define is useful in case 
-  of problems: activating it disables Qt's support for transformations, 
-  delegating them to the HEIF libraries (which will therefore always apply 
-  them regardless of what is requested from Qt).
-
-**If you are interested in compiling the plugin without running the tests, 
-also use the following string options:**
-- `KIMAGEFORMATS_HEIF_TEST` to change the behaviour of HEIF tests. Set to 
-`"OFF"` (no test at all) or `"READ_ONLY"` (run read tests only).
-- `KIMAGEFORMATS_HEJ2_TEST` to change the behaviour of HEJ2 tests. Set to 
-`"OFF"` (no test at all) or `"READ_ONLY"` (run read tests only)..
-- `KIMAGEFORMATS_AVCI_TEST` to change the behaviour of AVCI tests. Set to 
-`"OFF"` (no test at all).
-
 ### The EXR plugin
 
 The following defines can be defined in cmake to modify the behavior of the 
@@ -374,10 +313,6 @@ plugin:
   attribute named "xmp". Note that Gimp reads the "xmp" attribute and Darktable 
   writes it as well.
 
-The plugin can set the following additional metadata:
-- `EXRLayerName`: A string containing the name of the EXR layer used to decode 
-   the image.
-
 ### The EPS plugin
 
 The plugin uses `Ghostscript` to convert the raster image. When reading it
@@ -413,17 +348,9 @@ The plugin supports the following image data:
   type 4.
 - FORM PBM: PBM is a chunky version of IFF pictures. It supports 8-bit images 
   with color map only.
-- FORM IMAG (Compact Disc-Interactive): It supports CLut4, CLut7, CLut8, Rle7
-  and DYuv formats.
-- FORM RGFX: It supports uncompressed images only.
-- FORM DEEP: It supports uncompressed, RLE and TVDC images.
 - FOR4 CIMG (Maya Image File Format): It supports 24/48-bit RGB and 32/64-bit 
   RGBA images.
 
-> [!note]
-> The plugin only supports the IFF, ILBM, and LBM file extensions. You'll 
-> need to rename files with different extensions to open them.
-
 ### The JP2 plugin
 
 **This plugin can be disabled by setting `KIMAGEFORMATS_JP2` to `OFF` 
@@ -434,11 +361,6 @@ JP2 plugin has the following limitations due to the lack of support by OpenJPEG:
 - Image resolution is not supported.
 - To write ICC profiles you need OpenJPEG V2.5.4 or higher
 
-When writing, it is possible to set which format to use by setting the 
-following subtypes:
-- `JP2` (default): Save data using the JP2 container.
-- `J2K`: Save only the compressed codestream.
-
 ### The JXL plugin
 
 **The current version of the plugin limits the image size to 256 megapixels
@@ -454,23 +376,13 @@ plugin:
 ### The JXR plugin
 
 **This plugin is disabled by default. It can be enabled by settings
-`KIMAGEFORMATS_WITH_KNOWN_CRASHES_JXR` to `ON` in your cmake options.**
+`KIMAGEFORMATS_JXR` to `ON` in your cmake options.**
-
-> [!caution]
-> The plugin disabled by default due to security issues in [jxrlib](https://github.com/4creators/jxrlib): 
-> the upstream jxrlib is dead and there is no "hope" they will fix the issues.
->
-> **You should not enable it unless you know what you are doing.**
-
-> [!note]
-> Security issues in the jxrlib discovered by the [KImageFormats OSS-Fuzz project](https://github.com/google/oss-fuzz/tree/master/projects/kimageformats) 
-> should be fixed in this [jxrlib fork](https://github.com/mircomir/jxrlib).
 
 The following defines can be defined in cmake to modify the behavior of the 
 plugin:
 - `JXR_DENY_FLOAT_IMAGE`: disables the use of float images and consequently 
   any HDR data will be lost.
-- `JXR_DISABLE_DEPTH_CONVERSION`: remove the needs of additional memory by 
+- `JXR_DISABLE_DEPTH_CONVERSION`: remove the neeeds of additional memory by 
   disabling the conversion between different color depths (e.g. RGBA64bpp to 
   RGBA32bpp) at the cost of reduced compatibility.
 - `JXR_DISABLE_BGRA_HACK`: Windows displays and opens JXR files correctly out 
@@ -478,6 +390,9 @@ plugin:
   it only wants (P)BGRA32bpp files (a format not supported by Qt). Only for 
   this format an hack is activated to guarantee total compatibility of the 
   plugin with Windows.
+- `JXR_ENABLE_ADVANCED_METADATA`: enable metadata support (e.g. XMP). Some 
+  distributions use an incomplete JXR library that does not allow reading 
+  metadata, causing compilation errors.
 
 ### The KRA plugin
 
@@ -499,8 +414,6 @@ PSD support has the following limitations:
 - Multichannel images are treated as CMYK if they have 2 or more channels.
 - Multichannel images are treated as Grayscale if they have 1 channel.
 - Duotone images are treated as grayscale images.
-- Grayscale images with alpha channel or at 32 bit depth are converted to 
-  RGBA due to the lack of the appropriate Qt grayscale container.
 - Extra channels other than alpha are discarded.
 
 The following defines can be defined in cmake to modify the behavior of the 
@@ -510,13 +423,6 @@ plugin:
 - `PSD_NATIVE_CMYK_SUPPORT_DISABLED`: disable native support for CMYK images 
   when compiled with Qt 6.8+
 
-The plugin can set the following additional metadata:
-  - `PSDDuotoneOptions`: Byte array in hexadecimal format of color data of the 
-     duotone specification (the format of which is not documented). From the PSD 
-     specification: *"Other applications that read Photoshop files can treat a 
-     duotone image as a gray image, and just preserve the contents of the duotone 
-     information when reading and writing the file."*
-
 ### The RAW plugin
 
 Loading RAW images always requires a conversion. To allow the user to

autotests/CMakeLists.txt

@@ -76,7 +76,6 @@ endmacro()
 # Loads each <format> image in read/<format>/, and compares the
 # result against the data read from the corresponding png file
 kimageformats_read_tests(
-    ff
     hdr
     iff
     pcx
@@ -87,7 +86,6 @@ kimageformats_read_tests(
     ras
     rgb
     sct
-    tim
     tga
 )
 
@@ -104,52 +102,36 @@ if (KF6Archive_FOUND)
 endif()
 
 if (TARGET avif)
-    if(${libavif_VERSION} VERSION_GREATER_EQUAL "1.2.0")
+    kimageformats_read_tests(
-        kimageformats_read_tests(
+        avif
-            avif
+    )
-        )
-    else()
-        message(WARNING "libavif ${libavif_VERSION} doesn't support decoding new AVIF files!\n"
-                        "AVIF read tests are disabled, consider updating libavif.")
-    endif()
-
     kimageformats_write_tests(
         avif-nodatacheck-lossless
     )
 endif()
 
 if (LibHeif_FOUND)
-    if (KIMAGEFORMATS_HEIF_TEST STREQUAL "ALL" OR KIMAGEFORMATS_HEIF_TEST STREQUAL "READ_ONLY")
+    kimageformats_read_tests(
-        kimageformats_read_tests(
+        heif
-            heif
+    )
-        )
+    # because the plug-ins use RGB->YUV conversion which sometimes results in 1 value difference.
-    endif()
+    kimageformats_write_tests(FUZZ 1
-    if (KIMAGEFORMATS_HEIF_TEST STREQUAL "ALL")
+        heif-nodatacheck-lossless
-        # because the plug-ins use RGB->YUV conversion which sometimes results in 1 value difference.
+    )
-        kimageformats_write_tests(FUZZ 1
-            heif-nodatacheck-lossless
-        )
-    endif()
 
     if (LibHeif_VERSION VERSION_GREATER_EQUAL "1.17.0")
-        if (KIMAGEFORMATS_HEJ2_TEST STREQUAL "ALL" OR KIMAGEFORMATS_HEJ2_TEST STREQUAL "READ_ONLY")
+        kimageformats_read_tests(FUZZ 1
-            kimageformats_read_tests(FUZZ 1
+            hej2
-                hej2
+        )
-            )
+        kimageformats_write_tests(FUZZ 1
-        endif()
+            hej2-nodatacheck-lossless
-        if (KIMAGEFORMATS_HEJ2_TEST STREQUAL "ALL")
+        )
-            kimageformats_write_tests(FUZZ 1
-                hej2-nodatacheck-lossless
-            )
-        endif()
     endif()
 
     if (LibHeif_VERSION VERSION_GREATER_EQUAL "1.19.6")
-        if (KIMAGEFORMATS_AVCI_TEST STREQUAL "ALL")
+        kimageformats_read_tests(FUZZ 4
-            kimageformats_read_tests(FUZZ 4
+            avci
-                avci
+        )
-            )
-        endif()
     endif()
 endif()
 

autotests/README.md

@@ -48,7 +48,7 @@ Depending on the format, you can specify the following additional options.
 
 - `--help`: Displays help on commandline options.
 - `--fuzz <max>`: The fuzziness. Used to add some deviation in ARGB data 
-(normally used on lossy codec).
+(nornally used on lossy codec).
 - `--perceptive-fuzz`: Used to scale dynamically the fuzziness based on 
 the alpha channel value. This is useful on images with pre-multiplied and 
 small alphas. Qt can use different roundings based on optimizations resulting 

autotests/anitest.cpp

@@ -48,7 +48,7 @@ private Q_SLOTS:
         QCOMPARE(reader.text(QStringLiteral("Author")), QStringLiteral("KDE Community"));
     }
 
-    void testRead()
+    void textRead()
     {
         QImageReader reader(QFINDTESTDATA("ani/test.ani"));
         QVERIFY(reader.canRead());

autotests/ossfuzz/build_fuzzers.sh

@@ -18,11 +18,6 @@
 # limitations under the License.
 #
 ################################################################################
-LDFLAGS=""
-if [[ $FUZZING_ENGINE == "afl" ]]; then
-    LDFLAGS="-fuse-ld=lld"
-fi
-export LDFLAGS
 
 # build zstd
 cd $SRC/zstd
@@ -162,7 +157,6 @@ HANDLER_TYPES="ANIHandler ani
         QAVIFHandler avif
         QDDSHandler dds
         EXRHandler exr
-        FFHandler ff
         HDRHandler hdr
         HEIFHandler heif
         IFFHandler iff
@@ -181,7 +175,6 @@ HANDLER_TYPES="ANIHandler ani
         RAWHandler raw
         RGBHandler rgb
         ScitexHandler sct
-        TIMHandler tim
         TGAHandler tga
         XCFHandler xcf"
 
@@ -192,7 +185,7 @@ echo "$HANDLER_TYPES" | while read class format; do
   /usr/libexec/moc $SRC/kimageformats/src/imageformats/$format.cpp -o $format.moc
   header=`ls $SRC/kimageformats/src/imageformats/$format*.h`
   /usr/libexec/moc $header -o moc_`basename $header .h`.cpp
-  $CXX $CXXFLAGS $LDFLAGS -fPIC -DHANDLER=$class -std=c++17 autotests/ossfuzz/kimgio_fuzzer.cc $SRC/kimageformats/src/imageformats/$format.cpp $SRC/kimageformats/src/imageformats/scanlineconverter.cpp $SRC/kimageformats/src/imageformats/microexif.cpp $SRC/kimageformats/src/imageformats/chunks.cpp -o $OUT/$fuzz_target_name -DJXL_STATIC_DEFINE -DJXL_THREADS_STATIC_DEFINE -DJXL_CMS_STATIC_DEFINE -DINITGUID -I $SRC/kimageformats/src/imageformats/ -I $SRC/libavif/include/ -I $SRC/libjxl/build/lib/include/ -I $SRC/libjxl/lib/include/ -I /usr/local/include/OpenEXR/ -I /usr/local/include/KF6/KArchive/ -I /usr/local/include/openjpeg-2.5 -I /usr/local/include/Imath -I $SRC/jxrlib/common/include -I $SRC/jxrlib/jxrgluelib -I $SRC/jxrlib/image/sys -I /usr/include/QtCore/ -I /usr/include/QtGui/ -I . $SRC/libavif/build/libavif.a /usr/local/lib/libheif.a /usr/local/lib/libde265.a /usr/local/lib/libopenh264.a $SRC/aom/build.libavif/libaom.a $SRC/libjxl/build/lib/libjxl_threads.a $SRC/libjxl/build/lib/libjxl.a $SRC/libjxl/build/lib/libjxl_cms.a $SRC/libjxl/build/third_party/highway/libhwy.a $SRC/libjxl/build/third_party/brotli/libbrotlidec.a $SRC/libjxl/build/third_party/brotli/libbrotlienc.a $SRC/libjxl/build/third_party/brotli/libbrotlicommon.a -lQt6Gui -lQt6Core -lQt6BundledLibpng -lQt6BundledHarfbuzz -lm -lQt6BundledPcre2 -ldl -lpthread $LIB_FUZZING_ENGINE /usr/local/lib/libz.a /usr/local/lib/x86_64-linux-gnu/libKF6Archive.a /usr/local/lib/libz.a /usr/local/lib/libraw.a /usr/local/lib/libOpenEXR-3_3.a /usr/local/lib/libIex-3_3.a /usr/local/lib/libImath-3_1.a /usr/local/lib/libIlmThread-3_3.a /usr/local/lib/libOpenEXRCore-3_3.a /usr/local/lib/libOpenEXRUtil-3_3.a /usr/local/lib/libopenjp2.a /usr/local/lib/libzstd.a $SRC/jxrlib/build/libjxrglue.a $SRC/jxrlib/build/libjpegxr.a /usr/local/lib/liblzma.a /usr/local/lib/libbz2.a -lclang_rt.builtins
+  $CXX $CXXFLAGS -fPIC -DHANDLER=$class -std=c++17 autotests/ossfuzz/kimgio_fuzzer.cc $SRC/kimageformats/src/imageformats/$format.cpp $SRC/kimageformats/src/imageformats/scanlineconverter.cpp $SRC/kimageformats/src/imageformats/microexif.cpp $SRC/kimageformats/src/imageformats/chunks.cpp -o $OUT/$fuzz_target_name -DJXL_STATIC_DEFINE -DJXL_THREADS_STATIC_DEFINE -DJXL_CMS_STATIC_DEFINE -DINITGUID -I $SRC/kimageformats/src/imageformats/ -I $SRC/libavif/include/ -I $SRC/libjxl/build/lib/include/ -I $SRC/libjxl/lib/include/ -I /usr/local/include/OpenEXR/ -I /usr/local/include/KF6/KArchive/ -I /usr/local/include/openjpeg-2.5 -I /usr/local/include/Imath -I $SRC/jxrlib/common/include -I $SRC/jxrlib/jxrgluelib -I $SRC/jxrlib/image/sys -I /usr/include/QtCore/ -I /usr/include/QtGui/ -I . $SRC/libavif/build/libavif.a /usr/local/lib/libheif.a /usr/local/lib/libde265.a /usr/local/lib/libopenh264.a $SRC/aom/build.libavif/libaom.a $SRC/libjxl/build/lib/libjxl_threads.a $SRC/libjxl/build/lib/libjxl.a $SRC/libjxl/build/lib/libjxl_cms.a $SRC/libjxl/build/third_party/highway/libhwy.a $SRC/libjxl/build/third_party/brotli/libbrotlidec.a $SRC/libjxl/build/third_party/brotli/libbrotlienc.a $SRC/libjxl/build/third_party/brotli/libbrotlicommon.a -lQt6Gui -lQt6Core -lQt6BundledLibpng -lQt6BundledHarfbuzz -lm -lQt6BundledPcre2 -ldl -lpthread $LIB_FUZZING_ENGINE /usr/local/lib/libz.a -lKF6Archive /usr/local/lib/libz.a /usr/local/lib/libraw.a /usr/local/lib/libOpenEXR-3_3.a /usr/local/lib/libIex-3_3.a /usr/local/lib/libImath-3_1.a /usr/local/lib/libIlmThread-3_3.a /usr/local/lib/libOpenEXRCore-3_3.a /usr/local/lib/libOpenEXRUtil-3_3.a /usr/local/lib/libopenjp2.a /usr/local/lib/libzstd.a $SRC/jxrlib/build/libjxrglue.a $SRC/jxrlib/build/libjpegxr.a -llzma /usr/local/lib/libbz2.a -lclang_rt.builtins
 
   # -lclang_rt.builtins in the previous line is a temporary workaround to avoid a linker error "undefined reference to __truncsfhf2". Investigate why this is needed here, but not anywhere else, and possibly remove it.
 

autotests/ossfuzz/kimgio_fuzzer.cc

@@ -23,19 +23,17 @@
   Usage:
     python infra/helper.py build_image kimageformats
     python infra/helper.py build_fuzzers --sanitizer undefined|address|memory kimageformats
-    python infra/helper.py run_fuzzer kimageformats kimgio_[ani|avif|dds|exr|ff|hdr|heif|iff|jp2|jxl|jxr|kra|ora|pcx|pfm|pic|psd|pxr|qoi|ras|raw|rgb|sct|tim|tga|xcf]_fuzzer
+    python infra/helper.py run_fuzzer kimageformats kimgio_[ani|avif|dds|exr|hdr|heif|iff|jp2|jxl|jxr|kra|ora|pcx|pfm|pic|psd|pxr|qoi|ras|raw|rgb|sct|tga|xcf]_fuzzer
 */
 
 #include <QBuffer>
 #include <QCoreApplication>
 #include <QImage>
-#include <QImageReader>
 
 #include "ani_p.h"
 #include "avif_p.h"
 #include "dds_p.h"
 #include "exr_p.h"
-#include "ff_p.h"
 #include "hdr_p.h"
 #include "heif_p.h"
 #include "iff_p.h"
@@ -54,7 +52,6 @@
 #include "raw_p.h"
 #include "rgb_p.h"
 #include "sct_p.h"
-#include "tim_p.h"
 #include "tga_p.h"
 #include "xcf_p.h"
 
@@ -63,8 +60,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     int argc = 0;
     QCoreApplication a(argc, nullptr);
 
-    QImageReader::setAllocationLimit(512);
-
     QImageIOHandler* handler = new HANDLER();
 
     QImage i;

autotests/ossfuzz/prepare_build.sh

@@ -33,12 +33,12 @@ git clone --depth 1 -b master https://invent.kde.org/frameworks/extra-cmake-modu
 git clone --depth 1 --branch=dev git://code.qt.io/qt/qtbase.git
 git clone --depth 1 --branch=dev git://code.qt.io/qt/qttools.git
 git clone --depth 1 -b master https://invent.kde.org/frameworks/karchive.git
-git clone --depth 1 -b v3.13.1 https://aomedia.googlesource.com/aom
+git clone --depth 1 -b v3.12.0 https://aomedia.googlesource.com/aom
-git clone --depth 1 -b v1.3.0 https://github.com/AOMediaCodec/libavif.git
+git clone --depth 1 -b v1.2.1 https://github.com/AOMediaCodec/libavif.git
 git clone --depth 1 https://github.com/strukturag/libde265.git
-git clone --depth 1 -b v2.5.4 https://github.com/uclouvain/openjpeg.git
+git clone --depth 1 -b v2.5.3 https://github.com/uclouvain/openjpeg.git
 git clone --depth 1 https://github.com/strukturag/libheif.git
-git clone --depth=1 --recursive --shallow-submodules https://github.com/libjxl/libjxl.git
+git clone --depth=1 --branch v0.11.x --recursive --shallow-submodules https://github.com/libjxl/libjxl.git
 git clone --depth 1 https://github.com/LibRaw/LibRaw
 git clone --depth 1 https://github.com/mircomir/jxrlib.git
 git clone --depth 1 -b v2.6.0 https://github.com/cisco/openh264.git

autotests/read/avif/profile_gray.avif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "profile_gray.png",
-        "colorSpace" : {
-            "colorModel" : "Gray",
-            "primaries" : "Custom",
-            "transferFunction" : "SRgb",
-            "gamma" : 2.31
-        }
-    }
-]

autotests/read/avif/profile_gray_gamma22.avif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "profile_gray_gamma22.png",
-        "colorSpace" : {
-            "colorModel" : "Gray",
-            "primaries" : "Custom",
-            "transferFunction" : "Gamma",
-            "gamma" : 2.2
-        }
-    }
-]

autotests/read/avif/profile_gray_gamma28.avif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "profile_gray_gamma28.png",
-        "colorSpace" : {
-            "colorModel" : "Gray",
-            "primaries" : "Custom",
-            "transferFunction" : "Gamma",
-            "gamma" : 2.8
-        }
-    }
-]

autotests/read/avif/profile_gray_linear.avif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "profile_gray_linear.png",
-        "colorSpace" : {
-            "colorModel" : "Gray",
-            "primaries" : "Custom",
-            "transferFunction" : "Linear",
-            "gamma" : 1
-        }
-    }
-]

autotests/read/avif/profile_gray_prophoto.avif.json

@@ -1,12 +0,0 @@
-[
-    {
-        "fileName" : "profile_gray_prophoto.png",
-        "colorSpace" : {
-            "description" : "grayscale D50 with ProPhoto TRC",
-            "colorModel" : "Gray",
-            "primaries" : "Custom",
-            "transferFunction" : "Custom",
-            "gamma" : 0
-        }
-    }
-]

autotests/read/exr/ps2026_testcard_rgb.exr.json

@@ -1,15 +0,0 @@
-[
-    {
-        "fileName" : "ps2026_testcard_rgb.png",
-        "colorSpace" : {
-            "description" : "sRGB build-in (Profilo RGB lineare)",
-            "primaries" : "SRgb",
-            "transferFunction" : "Linear",
-            "gamma" : 1
-        },
-        "resolution" : {
-            "dotsPerMeterX" : 3937,
-            "dotsPerMeterY" : 3937
-        }
-    }
-]

autotests/read/exr/rgb-gimp.exr.json

@@ -2,7 +2,7 @@
     {
         "fileName" : "rgb-gimp.png",
         "colorSpace" : {
-            "description" : "Embedded RGB (linear)",
+            "description" : "",
             "primaries" : "Custom",
             "transferFunction" : "Linear",
             "gamma" : 1

autotests/read/heif/orientation1.heif.json

@@ -1,17 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "colorSpace" : {
-            "description" : "GIMP built-in sRGB",
-            "primaries" : "SRgb",
-            "transferFunction" : "SRgb",
-            "gamma" : 0
-        },
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation2.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation3.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation4.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation5.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation6.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation7.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/heif/orientation8.heif.json

@@ -1,11 +0,0 @@
-[
-    {
-        "fileName" : "orientation_all.png",
-        "metadata" : [
-            {
-                "key" : "Software" ,
-                "value" : "LIFE Pro 2.20.35 (Linux)"
-            }
-        ]
-    }
-]

autotests/read/iff/cdi_dyuv_each.iff.json

@@ -1,9 +0,0 @@
-[
-    {
-        "fileName" : "cdi_dyuv_each.iff",
-        "resolution" : {
-            "dotsPerMeterX" : 3937,
-            "dotsPerMeterY" : 5249
-        }
-    }
-]

autotests/read/iff/sv5_rgba32_rgx.iff.json

@@ -1,37 +0,0 @@
-[
-    {
-        "fileName" : "sv5_rgba32_rgx.png",
-        "colorSpace" : {
-            "description" : "TIFF ICC Profile",
-            "primaries" : "SRgb",
-            "transferFunction" : "SRgb",
-            "gamma" : 0
-        },
-        "metadata" : [
-            {
-                "key" : "Author",
-                "value" : "KDE Project"
-            },
-            {
-                "key" : "Copyright",
-                "value" : "@2025 KDE Project"
-            },
-            {
-                "key" : "CreationDate",
-                "value" : "2025-01-14T10:34:51"
-            },
-            {
-                "key" : "Description",
-                "value" : "TV broadcast test image."
-            },
-            {
-                "key" : "Title",
-                "value" : "Test Card"
-            }
-        ],
-        "resolution" : {
-            "dotsPerMeterX" : 2835,
-            "dotsPerMeterY" : 2835
-        }
-    }
-]

autotests/read/jxl/gray_linear_lossy.jxl.json

@@ -1,14 +0,0 @@
-[
-    {
-        "fileName" : "gray_linear_lossy.png",
-        "fuzziness" : 1,
-        "description" : "Minimum fuzziness value to pass the test on all architectures.",
-        "colorSpace" : {
-            "description" : "Gra_D65_Rel_SRG",
-            "primaries" : "Custom",
-            "transferFunction" : "SRgb",
-            "gamma" : 0,
-            "colorModel" : "Gray"
-        }
-    }
-]