static void
add_text(CrItem *group)
{
double x, y;
gboolean scaleable;
const char *text;
CrItem *item;
x = g_random_double_range(0, 380);
y = g_random_double_range(0, 380);
scaleable = g_random_boolean();
if (scaleable)
text = "This text will <b>scale</b>.";
else
text = "This text will <b>not</b>.";
item = cr_text_new(group, x, y, text,
"scaleable", scaleable,
"font", "Sans 12",
"anchor", GTK_ANCHOR_NW,
"use-markup", TRUE,
"fill_color_rgba", 0x000000ffL, NULL);
g_signal_connect(item, "event", (GCallback) item_event, NULL);
}
static void
add_line(CrItem *group)
{
int i, total;
double angle, dist, cx, cy, x, y;
GArray *array;
CrItem *line;
guint color;
cairo_pattern_t *pattern;
array = g_array_new(FALSE, FALSE, sizeof(double));
total = g_random_int_range(3, 30);
cx = g_random_double_range(40, 360);
cy = g_random_double_range(40, 360);
for (i = 0, angle = 0; i < total; angle += 2. * M_PI/total, i++) {
dist = g_random_double_range(10, 40);
x = cx + dist * sin(angle);
y = cy + dist * cos(angle);
g_array_append_val(array, x);
g_array_append_val(array, y);
}
line = cr_line_new(group, "array", array,
"outline_color_rgba", 0x000000ff,
"line_scaleable", TRUE,
"line_width", 3.0,
NULL);
if (g_random_boolean()) {
color = g_random_int_range(0,255) << 24 |
g_random_int_range(0,255) << 16 |
g_random_int_range(0,255) << 8 |
0xff;
g_object_set(line, "fill_color_rgba", color, NULL);
}
else {
pattern = cairo_pattern_create_linear(0, 0,
g_random_double_range(5, 20),
g_random_double_range(5, 20));
cairo_pattern_add_color_stop_rgb(pattern, 0, g_random_double(),
g_random_double(), g_random_double());
cairo_pattern_add_color_stop_rgb(pattern, 10, g_random_double(),
g_random_double(), g_random_double());
cairo_pattern_set_extend (pattern, CAIRO_EXTEND_REPEAT);
g_object_set(line, "pattern", pattern, NULL);
cairo_pattern_destroy(pattern);
}
g_signal_connect(line, "event", (GCallback) item_event, NULL);
}
void MapLoader::add_spawnpoint(xmlpp::Node *const &node) {
double x = to_game_coordinates(node->eval_to_number("@x"));
double y = to_game_coordinates(node->eval_to_number("@y"));
RigidBody *r_body = new RigidBody(new Vector(x, y));
GameObject *turtle;
if (g_random_boolean()) {
turtle = new GameObjectGreenTurtle(r_body, new CircleCollider(r_body, 0.5));
} else {
turtle = new GameObjectRedTurtle(r_body, new CircleCollider(r_body, 0.5));
}
engine_->add_game_object(turtle);
}
static GSList*
gslist_merge_random(GSList *l1, GSList *l2)
{
GSList *next, *result = NULL;
while (l1 || l2) {
if (l1 && l2) {
if (g_random_boolean())
PREPEND(result,l1);
else
PREPEND(result,l2);
}
else {
if (l1)
PREPEND(result,l1);
else
PREPEND(result,l2);
}
}
return result;
}
gint queue_cmp_random(gconstpointer a, gconstpointer b, gpointer user_data) {
return g_random_boolean() ? 1 : -1;
}
#include "iknowthis.h"
// Re-map a virtual memory address.
// void *mremap(void *old_address, size_t old_size, size_t new_size, int flags);
SYSFUZZ(mremap, __NR_mremap, SYS_NONE, CLONE_DEFAULT, 0)
{
glong retcode;
guintptr address;
gintptr newaddr;
gsize oldsize;
gsize newsize;
gint flags;
typelib_get_vma(this, &address, &oldsize);
newsize = g_random_boolean()
? (PAGE_SIZE * 1)
: (PAGE_SIZE * 2);
flags = typelib_get_integer_mask(MREMAP_FIXED | MREMAP_MAYMOVE);
// I don't currently handle MREMAP_FIXED.
flags &= ~MREMAP_FIXED;
retcode = syscall_fast_ret(&newaddr, __NR_mremap, // void *
address, // void *old_address
oldsize, // size_t old_size
newsize, // size_t new_size
flags, // int flags
typelib_get_integer()); // unsigned long new_addr
struct dirent *
readdir (DIR *dirp)
{
struct dirent *(*real_readdir)(DIR *dirp) = dlsym (RTLD_NEXT, READDIR);
struct dirent *ret;
gboolean cache_another = TRUE;
ensure_initialized ();
/* The core idea here is that each time through the loop, we read a
* directory entry. If there is one, we choose whether to cache it
* or to return it. Because multiple entries can be cached,
* ordering is randomized. Statistically, the order will still be
* *weighted* towards the ordering returned from the
* kernel/filesystem, but the goal here is just to provide some
* randomness in order to trigger bugs, not to be perfectly random.
*/
while (cache_another)
{
DirEntries *de;
errno = 0;
ret = real_readdir (dirp);
if (ret == NULL && errno != 0)
goto out;
g_mutex_lock (&direntcache_lock);
de = g_hash_table_lookup (direntcache, dirp);
if (ret)
{
if (g_random_boolean ())
{
struct dirent *copy;
if (!de)
{
de = dir_entries_new ();
g_hash_table_insert (direntcache, dirp, de);
}
copy = g_memdup (ret, sizeof (struct dirent));
g_ptr_array_add (de->entries, copy);
}
else
{
cache_another = FALSE;
}
}
else
{
if (de && de->offset < de->entries->len)
{
ret = de->entries->pdata[de->offset];
de->offset++;
}
cache_another = FALSE;
}
g_mutex_unlock (&direntcache_lock);
}
out:
return ret;
}
static void
paint (Data *data)
{
int i;
float diff_time;
/* Update all of the firework's positions */
for (i = 0; i < N_FIREWORKS; i++)
{
Firework *firework = data->fireworks + i;
if ((fabsf (firework->x - firework->start_x) > 2.0f) ||
firework->y < -1.0f)
{
firework->size = g_random_double_range (0.001f, 0.1f);
firework->start_x = 1.0f + firework->size;
firework->start_y = -1.0f;
firework->initial_x_velocity = g_random_double_range (-0.1f, -2.0f);
firework->initial_y_velocity = g_random_double_range (0.1f, 4.0f);
g_timer_reset (firework->timer);
/* Pick a random color out of six */
if (g_random_boolean ())
{
memset (&firework->color, 0, sizeof (Color));
((uint8_t *) &firework->color)[g_random_int_range (0, 3)] = 255;
}
else
{
memset (&firework->color, 255, sizeof (Color));
((uint8_t *) &firework->color)[g_random_int_range (0, 3)] = 0;
}
firework->color.alpha = 255;
/* Fire some of the fireworks from the other side */
if (g_random_boolean ())
{
firework->start_x = -firework->start_x;
firework->initial_x_velocity = -firework->initial_x_velocity;
}
}
diff_time = g_timer_elapsed (firework->timer, NULL);
firework->x = (firework->start_x +
firework->initial_x_velocity * diff_time);
firework->y = ((firework->initial_y_velocity * diff_time +
0.5f * GRAVITY * diff_time * diff_time) +
firework->start_y);
}
diff_time = g_timer_elapsed (data->last_spark_time, NULL);
if (diff_time < 0.0f || diff_time >= TIME_PER_SPARK)
{
/* Add a new spark for each firework, overwriting the oldest ones */
for (i = 0; i < N_FIREWORKS; i++)
{
Spark *spark = data->sparks + data->next_spark_num;
Firework *firework = data->fireworks + i;
spark->x = (firework->x +
g_random_double_range (-firework->size / 2.0f,
firework->size / 2.0f));
spark->y = (firework->y +
g_random_double_range (-firework->size / 2.0f,
firework->size / 2.0f));
spark->base_color = firework->color;
data->next_spark_num = (data->next_spark_num + 1) & (N_SPARKS - 1);
}
/* Update the colour of each spark */
for (i = 0; i < N_SPARKS; i++)
{
float color_value;
/* First spark is the oldest */
Spark *spark = data->sparks + ((data->next_spark_num + i)
& (N_SPARKS - 1));
color_value = i / (N_SPARKS - 1.0f);
spark->color.red = spark->base_color.red * color_value;
spark->color.green = spark->base_color.green * color_value;
spark->color.blue = spark->base_color.blue * color_value;
spark->color.alpha = 255.0f * color_value;
}
g_timer_reset (data->last_spark_time);
}
cogl_buffer_set_data (data->attribute_buffer,
0, /* offset */
data->sparks,
sizeof (data->sparks),
NULL /* error */);
cogl_framebuffer_clear4f (data->fb, COGL_BUFFER_BIT_COLOR, 0, 0, 0, 1);
cogl_primitive_draw (data->primitive,
data->fb,
data->pipeline);
cogl_onscreen_swap_buffers (data->fb);
}
#include "sysfuzz.h"
#include "typelib.h"
#include "iknowthis.h"
// Request a key from the kernel’s key management facility
// key_serial_t request_key(const char *type, const char *description,
// const char *callout_info, key_serial_t keyring);
// XXX: i bet i need typelib support for those f*****g serials.
SYSFUZZ(request_key, __NR_request_key, SYS_NONE, CLONE_DEFAULT, 0)
{
gpointer type;
gpointer desc;
gpointer callout;
glong retcode;
retcode = spawn_syscall_lwp(this, NULL, __NR_request_key, // key_serial_t
typelib_get_buffer(&type, g_random_int_range(0, 1024)), // const char *type
typelib_get_buffer(&desc, g_random_int_range(0, 1024)), // const char *desc
typelib_get_buffer(&callout, g_random_int_range(0, PAGE_SIZE)), // const void *callout
g_random_boolean()
? + typelib_get_integer()
: - typelib_get_integer_range(0, 32)); // key_serial_t keyring
typelib_clear_buffer(type);
typelib_clear_buffer(desc);
typelib_clear_buffer(callout);
return retcode;
}
