highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tools/target_dec_fuzzer: Also optionally fuzz with a parser

Browse Source 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-06-23 13:35:17 +02:00
parent 2aa9047486
commit 310a49f71d
1 changed files with 37 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
tools/target_dec_fuzzer.c
View File

@ -140,6 +140,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture, int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture,
int *got_picture_ptr, int *got_picture_ptr,
const AVPacket *avpkt) = NULL; const AVPacket *avpkt) = NULL;
AVCodecParserContext *parser = NULL;
if (!c) { if (!c) {
#ifdef FFMPEG_DECODER #ifdef FFMPEG_DECODER
@ -164,7 +166,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
} }
AVCodecContext* ctx = avcodec_alloc_context3(NULL); AVCodecContext* ctx = avcodec_alloc_context3(NULL);
if (!ctx) AVCodecContext* parser_avctx = avcodec_alloc_context3(NULL);
if (!ctx || !parser_avctx)
error("Failed memory allocation"); error("Failed memory allocation");
ctx->max_pixels = 4096 * 4096; //To reduce false positive OOM and hangs ctx->max_pixels = 4096 * 4096; //To reduce false positive OOM and hangs
@ -176,6 +179,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
ctx->height = bytestream2_get_le32(&gbc); ctx->height = bytestream2_get_le32(&gbc);
ctx->bit_rate = bytestream2_get_le64(&gbc); ctx->bit_rate = bytestream2_get_le64(&gbc);
ctx->bits_per_coded_sample = bytestream2_get_le32(&gbc); ctx->bits_per_coded_sample = bytestream2_get_le32(&gbc);
// Try to initialize a parser for this codec, note, this may fail which just means we test without one
if (bytestream2_get_byte(&gbc) & 1)
parser = av_parser_init(c->id);
if (av_image_check_size(ctx->width, ctx->height, 0, ctx)) if (av_image_check_size(ctx->width, ctx->height, 0, ctx))
ctx->width = ctx->height = 0; ctx->width = ctx->height = 0;
size -= 1024; size -= 1024;
@ -194,7 +200,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
error("Failed memory allocation"); error("Failed memory allocation");
// Read very simple container // Read very simple container
AVPacket avpkt; AVPacket avpkt, parsepkt;
while (data < end && it < maxiteration) { while (data < end && it < maxiteration) {
// Search for the TAG // Search for the TAG
while (data + sizeof(fuzz_tag) < end) { while (data + sizeof(fuzz_tag) < end) {
@ -205,12 +211,34 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (data + sizeof(fuzz_tag) > end) if (data + sizeof(fuzz_tag) > end)
data = end; data = end;
FDBPrepare(&buffer, &avpkt, last, data - last); FDBPrepare(&buffer, &parsepkt, last, data - last);
data += sizeof(fuzz_tag); data += sizeof(fuzz_tag);
last = data; last = data;
// Iterate through all data while (parsepkt.size > 0) {
while (avpkt.size > 0 && it++ < maxiteration) {
if (parser) {
av_init_packet(&avpkt);
int ret = av_parser_parse2(parser, parser_avctx, &avpkt.data, &avpkt.size,
parsepkt.data, parsepkt.size,
parsepkt.pts, parsepkt.dts, parsepkt.pos);
parsepkt.data += ret;
parsepkt.size -= ret;
parsepkt.pos += ret;
avpkt.pts = parser->pts;
avpkt.dts = parser->dts;
avpkt.pos = parser->pos;
if ( parser->key_frame == 1 ||
(parser->key_frame == -1 && parser->pict_type == AV_PICTURE_TYPE_I))
avpkt.flags |= AV_PKT_FLAG_KEY;
avpkt.flags |= parsepkt.flags & AV_PKT_FLAG_DISCARD;
} else {
avpkt = parsepkt;
parsepkt.size = 0;
}
// Iterate through all data
while (avpkt.size > 0 && it++ < maxiteration) {
av_frame_unref(frame); av_frame_unref(frame);
int ret = decode_handler(ctx, frame, &got_frame, &avpkt); int ret = decode_handler(ctx, frame, &got_frame, &avpkt);
@ -223,6 +251,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
ret = avpkt.size; ret = avpkt.size;
avpkt.data += ret; avpkt.data += ret;
avpkt.size -= ret; avpkt.size -= ret;
}
} }
} }
@ -238,6 +267,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
av_frame_free(&frame); av_frame_free(&frame);
avcodec_free_context(&ctx); avcodec_free_context(&ctx);
av_freep(&ctx); av_freep(&ctx);
avcodec_free_context(&parser_avctx);
av_freep(&parser_avctx);
av_parser_close(parser);
FDBDesroy(&buffer); FDBDesroy(&buffer);
return 0; return 0;
} }