FFmpeg  4.3.7
target_bsf_fuzzer.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 #include "config.h"
20 #include "libavutil/imgutils.h"
21 
22 #include "libavcodec/avcodec.h"
24 #include "libavcodec/bytestream.h"
25 #include "libavcodec/internal.h"
26 
27 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
28 
29 static void error(const char *err)
30 {
31  fprintf(stderr, "%s", err);
32  exit(1);
33 }
34 
36 
37 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
38 
39 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
40  const uint64_t fuzz_tag = FUZZ_TAG;
41  const uint8_t *last = data;
42  const uint8_t *end = data + size;
43  AVBSFContext *bsf = NULL;
44  AVPacket in, out;
45  uint64_t keyframes = 0;
46  int res;
47 
48  if (!f) {
49 #ifdef FFMPEG_BSF
50 #define BSF_SYMBOL0(BSF) ff_##BSF##_bsf
51 #define BSF_SYMBOL(BSF) BSF_SYMBOL0(BSF)
52  extern AVBitStreamFilter BSF_SYMBOL(FFMPEG_BSF);
53  f = &BSF_SYMBOL(FFMPEG_BSF);
54 #else
56  f = &ff_null_bsf;
57 #endif
59  }
60 
61  res = av_bsf_alloc(f, &bsf);
62  if (res < 0)
63  error("Failed memory allocation");
64 
65  if (size > 1024) {
66  GetByteContext gbc;
67  int extradata_size;
68  size -= 1024;
69  bytestream2_init(&gbc, data + size, 1024);
70  bsf->par_in->width = bytestream2_get_le32(&gbc);
71  bsf->par_in->height = bytestream2_get_le32(&gbc);
72  bsf->par_in->bit_rate = bytestream2_get_le64(&gbc);
73  bsf->par_in->bits_per_coded_sample = bytestream2_get_le32(&gbc);
74 
75  if (f->codec_ids) {
76  int i, id;
77  for (i = 0; f->codec_ids[i] != AV_CODEC_ID_NONE; i++);
78  id = f->codec_ids[bytestream2_get_byte(&gbc) % i];
79  bsf->par_in->codec_id = id;
80  bsf->par_in->codec_tag = bytestream2_get_le32(&gbc);
81  }
82 
83  extradata_size = bytestream2_get_le32(&gbc);
84 
85  bsf->par_in->sample_rate = bytestream2_get_le32(&gbc);
86  bsf->par_in->channels = (unsigned)bytestream2_get_le32(&gbc) % FF_SANE_NB_CHANNELS;
87  bsf->par_in->block_align = bytestream2_get_le32(&gbc);
88  keyframes = bytestream2_get_le64(&gbc);
89 
90  if (extradata_size < size) {
91  bsf->par_in->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
92  if (bsf->par_in->extradata) {
93  bsf->par_in->extradata_size = extradata_size;
94  size -= bsf->par_in->extradata_size;
95  memcpy(bsf->par_in->extradata, data + size, bsf->par_in->extradata_size);
96  }
97  }
98  if (av_image_check_size(bsf->par_in->width, bsf->par_in->height, 0, bsf))
99  bsf->par_in->width = bsf->par_in->height = 0;
100  }
101 
102  res = av_bsf_init(bsf);
103  if (res < 0) {
104  av_bsf_free(&bsf);
105  return 0; // Failure of av_bsf_init() does not imply that a issue was found
106  }
107 
108  av_init_packet(&in);
109  av_init_packet(&out);
110  out.data = NULL;
111  out.size = 0;
112  while (data < end) {
113  // Search for the TAG
114  while (data + sizeof(fuzz_tag) < end) {
115  if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
116  break;
117  data++;
118  }
119  if (data + sizeof(fuzz_tag) > end)
120  data = end;
121 
122  res = av_new_packet(&in, data - last);
123  if (res < 0)
124  error("Failed memory allocation");
125  memcpy(in.data, last, data - last);
126  in.flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY;
127  keyframes = (keyframes >> 2) + (keyframes<<62);
128  data += sizeof(fuzz_tag);
129  last = data;
130 
131  while (in.size) {
132  res = av_bsf_send_packet(bsf, &in);
133  if (res < 0 && res != AVERROR(EAGAIN))
134  break;
135  res = av_bsf_receive_packet(bsf, &out);
136  if (res < 0)
137  break;
138  av_packet_unref(&out);
139  }
140  av_packet_unref(&in);
141  }
142 
143  res = av_bsf_send_packet(bsf, NULL);
144  while (!res) {
145  res = av_bsf_receive_packet(bsf, &out);
146  if (res < 0)
147  break;
148  av_packet_unref(&out);
149  }
150 
151  av_bsf_free(&bsf);
152  return 0;
153 }
#define FF_SANE_NB_CHANNELS
Definition: internal.h:97
#define NULL
Definition: coverity.c:32
int size
misc image utilities
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
void av_log_set_level(int level)
Set the log level.
Definition: log.c:440
enum AVCodecID codec_id
Specific type of the encoded data (the codec used).
Definition: codec_par.h:60
The bitstream filter state.
Definition: bsf.h:49
int size
Definition: packet.h:356
static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)
Definition: bytestream.h:133
static void error(const char *err)
uint8_t
int width
Video only.
Definition: codec_par.h:126
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:163
static av_cold int end(AVCodecContext *avctx)
Definition: avrndec.c:92
const char data[16]
Definition: mxf.c:91
uint8_t * data
Definition: packet.h:355
int64_t bit_rate
The average bitrate of the encoded data (in bits per second).
Definition: codec_par.h:89
#define AV_PKT_FLAG_KEY
The packet contains a keyframe.
Definition: packet.h:388
int av_new_packet(AVPacket *pkt, int size)
Allocate the payload of a packet and initialize its fields with default values.
Definition: avpacket.c:88
int av_bsf_alloc(const AVBitStreamFilter *filter, AVBSFContext **pctx)
Allocate a context for a given bitstream filter.
Definition: bsf.c:91
#define i(width, name, range_min, range_max)
Definition: cbs_h2645.c:269
#define AVERROR(e)
Definition: error.h:43
enum AVCodecID * codec_ids
A list of codec ids supported by the filter, terminated by AV_CODEC_ID_NONE.
Definition: bsf.h:106
void * av_mallocz(size_t size)
Allocate a memory block with alignment suitable for all memory accesses (including vectors if availab...
Definition: mem.c:237
int flags
A combination of AV_PKT_FLAG values.
Definition: packet.h:361
int av_bsf_init(AVBSFContext *ctx)
Prepare the filter for use, after all the parameters and options have been set.
Definition: bsf.c:144
int extradata_size
Size of the extradata content in bytes.
Definition: codec_par.h:78
int block_align
Audio only.
Definition: codec_par.h:177
int av_image_check_size(unsigned int w, unsigned int h, int log_offset, void *log_ctx)
Check if the given dimension of an image is valid, meaning that all bytes of the image can be address...
Definition: imgutils.c:282
static const uint64_t FUZZ_TAG
int av_bsf_send_packet(AVBSFContext *ctx, AVPacket *pkt)
Submit a packet for filtering.
Definition: bsf.c:197
Libavcodec external API header.
void av_packet_unref(AVPacket *pkt)
Wipe the packet.
Definition: avpacket.c:605
int av_bsf_receive_packet(AVBSFContext *ctx, AVPacket *pkt)
Retrieve a filtered packet.
Definition: bsf.c:223
uint8_t pi<< 24) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_U8, uint8_t,(*(const uint8_t *) pi - 0x80) *(1.0f/(1<< 7))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_U8, uint8_t,(*(const uint8_t *) pi - 0x80) *(1.0/(1<< 7))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_S16, int16_t,(*(const int16_t *) pi >> 8)+0x80) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_S16, int16_t, *(const int16_t *) pi *(1.0f/(1<< 15))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_S16, int16_t, *(const int16_t *) pi *(1.0/(1<< 15))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_S32, int32_t,(*(const int32_t *) pi >> 24)+0x80) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_S32, int32_t, *(const int32_t *) pi *(1.0f/(1U<< 31))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_S32, int32_t, *(const int32_t *) pi *(1.0/(1U<< 31))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_FLT, float, av_clip_uint8(lrintf(*(const float *) pi *(1<< 7))+0x80)) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S16, int16_t, AV_SAMPLE_FMT_FLT, float, av_clip_int16(lrintf(*(const float *) pi *(1<< 15)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S32, int32_t, AV_SAMPLE_FMT_FLT, float, av_clipl_int32(llrintf(*(const float *) pi *(1U<< 31)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_DBL, double, av_clip_uint8(lrint(*(const double *) pi *(1<< 7))+0x80)) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S16, int16_t, AV_SAMPLE_FMT_DBL, double, av_clip_int16(lrint(*(const double *) pi *(1<< 15)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S32, int32_t, AV_SAMPLE_FMT_DBL, double, av_clipl_int32(llrint(*(const double *) pi *(1U<< 31)))) #define SET_CONV_FUNC_GROUP(ofmt, ifmt) static void set_generic_function(AudioConvert *ac) { } void ff_audio_convert_free(AudioConvert **ac) { if(! *ac) return;ff_dither_free(&(*ac) ->dc);av_freep(ac);} AudioConvert *ff_audio_convert_alloc(AVAudioResampleContext *avr, enum AVSampleFormat out_fmt, enum AVSampleFormat in_fmt, int channels, int sample_rate, int apply_map) { AudioConvert *ac;int in_planar, out_planar;ac=av_mallocz(sizeof(*ac));if(!ac) return NULL;ac->avr=avr;ac->out_fmt=out_fmt;ac->in_fmt=in_fmt;ac->channels=channels;ac->apply_map=apply_map;if(avr->dither_method !=AV_RESAMPLE_DITHER_NONE &&av_get_packed_sample_fmt(out_fmt)==AV_SAMPLE_FMT_S16 &&av_get_bytes_per_sample(in_fmt) > 2) { ac->dc=ff_dither_alloc(avr, out_fmt, in_fmt, channels, sample_rate, apply_map);if(!ac->dc) { av_free(ac);return NULL;} return ac;} in_planar=ff_sample_fmt_is_planar(in_fmt, channels);out_planar=ff_sample_fmt_is_planar(out_fmt, channels);if(in_planar==out_planar) { ac->func_type=CONV_FUNC_TYPE_FLAT;ac->planes=in_planar ? ac->channels :1;} else if(in_planar) ac->func_type=CONV_FUNC_TYPE_INTERLEAVE;else ac->func_type=CONV_FUNC_TYPE_DEINTERLEAVE;set_generic_function(ac);if(ARCH_AARCH64) ff_audio_convert_init_aarch64(ac);if(ARCH_ARM) ff_audio_convert_init_arm(ac);if(ARCH_X86) ff_audio_convert_init_x86(ac);return ac;} int ff_audio_convert(AudioConvert *ac, AudioData *out, AudioData *in) { int use_generic=1;int len=in->nb_samples;int p;if(ac->dc) { av_log(ac->avr, AV_LOG_TRACE, "%d samples - audio_convert: %s to %s (dithered)\", len, av_get_sample_fmt_name(ac->in_fmt), av_get_sample_fmt_name(ac->out_fmt));return ff_convert_dither(ac-> in
const AVBitStreamFilter ff_null_bsf
Definition: null_bsf.c:27
static AVBitStreamFilter * f
int sample_rate
Audio only.
Definition: codec_par.h:170
#define AV_PKT_FLAG_DISCARD
Flag is used to discard packets which are required to maintain valid decoder state but are not requir...
Definition: packet.h:395
common internal api header.
void av_init_packet(AVPacket *pkt)
Initialize optional fields of a packet with default values.
Definition: avpacket.c:35
#define AV_INPUT_BUFFER_PADDING_SIZE
Required number of additionally allocated bytes at the end of the input bitstream for decoding...
Definition: avcodec.h:215
#define AV_RN64(p)
Definition: intreadwrite.h:368
int bits_per_coded_sample
The number of bits per sample in the codedwords.
Definition: codec_par.h:102
uint8_t * extradata
Extra binary data needed for initializing the decoder, codec-dependent.
Definition: codec_par.h:74
int channels
Audio only.
Definition: codec_par.h:166
FILE * out
Definition: movenc.c:54
void av_bsf_free(AVBSFContext **pctx)
Free a bitstream filter context and everything associated with it; write NULL into the supplied point...
Definition: bsf.c:40
uint32_t codec_tag
Additional information about the codec (corresponds to the AVI FOURCC).
Definition: codec_par.h:64
enum AVCodecID id
This structure stores compressed data.
Definition: packet.h:332
AVCodecParameters * par_in
Parameters of the input stream.
Definition: bsf.h:77