Fuzz avifDecoder.imageContentToDecode (#2982)

tests/gtest/avif_fuzztest_dec.cc

diff --git a/tests/gtest/avif_fuzztest_dec.cc b/tests/gtest/avif_fuzztest_dec.cc
index b27f095..be38e9e 100644
--- a/tests/gtest/avif_fuzztest_dec.cc
+++ b/tests/gtest/avif_fuzztest_dec.cc
@@ -12,6 +12,7 @@
 #include "gtest/gtest.h"
 
 using ::fuzztest::Arbitrary;
+using ::fuzztest::ElementOf;
 
 namespace avif {
 namespace testutil {
@@ -20,7 +21,7 @@
 //------------------------------------------------------------------------------
 
 void Decode(const std::string& arbitrary_bytes, bool is_persistent,
-            DecoderPtr decoder) {
+            DecoderPtr decoder, avifImageContentTypeFlags content_to_decode) {
   ASSERT_FALSE(GetSeedDataDirs().empty());  // Make sure seeds are available.
 
   ImagePtr decoded(avifImageCreateEmpty());
@@ -33,6 +34,8 @@
   // The Chrome's avifIO object is not persistent.
   io->persistent = is_persistent;
   avifDecoderSetIO(decoder.get(), io);
+  // This can lead to AVIF_RESULT_NO_CONTENT.
+  decoder->imageContentToDecode = content_to_decode;
 
   if (avifDecoderParse(decoder.get()) != AVIF_RESULT_OK) return;
 
@@ -56,8 +59,11 @@
 }
 
 FUZZ_TEST(DecodeAvifTest, Decode)
-    .WithDomains(ArbitraryImageWithSeeds({AVIF_APP_FILE_FORMAT_AVIF}),
-                 Arbitrary<bool>(), ArbitraryAvifDecoder());
+    .WithDomains(
+        ArbitraryImageWithSeeds({AVIF_APP_FILE_FORMAT_AVIF}),
+        /*is_persistent=*/Arbitrary<bool>(), ArbitraryAvifDecoder(),
+        ElementOf({AVIF_IMAGE_CONTENT_NONE, AVIF_IMAGE_CONTENT_COLOR_AND_ALPHA,
+                   AVIF_IMAGE_CONTENT_GAIN_MAP, AVIF_IMAGE_CONTENT_ALL}));
 
 //------------------------------------------------------------------------------
 

tests/gtest/avif_fuzztest_dec_incr.cc

diff --git a/tests/gtest/avif_fuzztest_dec_incr.cc b/tests/gtest/avif_fuzztest_dec_incr.cc
index 5d02212..19879b0 100644
--- a/tests/gtest/avif_fuzztest_dec_incr.cc
+++ b/tests/gtest/avif_fuzztest_dec_incr.cc
@@ -14,6 +14,7 @@
 #include "gtest/gtest.h"
 
 using ::fuzztest::Arbitrary;
+using ::fuzztest::ElementOf;
 
 namespace avif {
 namespace testutil {
@@ -46,7 +47,9 @@
 //------------------------------------------------------------------------------
 
 void DecodeIncr(const std::string& arbitrary_bytes, bool is_persistent,
-                bool give_size_hint, bool use_nth_image_api) {
+                bool give_size_hint,
+                avifImageContentTypeFlags content_to_decode,
+                bool use_nth_image_api) {
   ASSERT_FALSE(GetSeedDataDirs().empty());  // Make sure seeds are available.
 
   ImagePtr reference(avifImageCreateEmpty());
@@ -77,6 +80,8 @@
   static_assert(kImageSizeLimit <= AVIF_DEFAULT_IMAGE_SIZE_LIMIT,
                 "Too big an image size limit");
   decoder->imageSizeLimit = kImageSizeLimit;
+  // This can lead to AVIF_RESULT_NO_CONTENT.
+  decoder->imageContentToDecode = content_to_decode;
 
   if (avifDecoderRead(decoder.get(), reference.get()) == AVIF_RESULT_OK) {
     // Avoid timeouts by discarding big images decoded many times.
@@ -109,8 +114,13 @@
 }
 
 FUZZ_TEST(DecodeAvifFuzzTest, DecodeIncr)
-    .WithDomains(ArbitraryImageWithSeeds({AVIF_APP_FILE_FORMAT_AVIF}),
-                 Arbitrary<bool>(), Arbitrary<bool>(), Arbitrary<bool>());
+    .WithDomains(
+        ArbitraryImageWithSeeds({AVIF_APP_FILE_FORMAT_AVIF}),
+        /*is_persistent=*/Arbitrary<bool>(),
+        /*give_size_hint=*/Arbitrary<bool>(),
+        ElementOf({AVIF_IMAGE_CONTENT_NONE, AVIF_IMAGE_CONTENT_COLOR_AND_ALPHA,
+                   AVIF_IMAGE_CONTENT_GAIN_MAP, AVIF_IMAGE_CONTENT_ALL}),
+        /*use_nth_image_api=*/Arbitrary<bool>());
 
 //------------------------------------------------------------------------------