FFmpeg
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
decoder_targeted.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 /* Targeted fuzzer that targets specific codecs depending on two
20  compile-time flags.
21  INSTRUCTIONS:
22 
23  * Get the very fresh clang, e.g. see http://libfuzzer.info#versions
24  * Get and build libFuzzer:
25  svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
26  ./Fuzzer/build.sh
27  * build ffmpeg for fuzzing:
28  FLAGS="-fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp -g" CC="clang $FLAGS" CXX="clang++ $FLAGS" ./configure --disable-yasm
29  make clean && make -j
30  * build the fuzz target.
31  Choose the value of FFMPEG_CODEC (e.g. AV_CODEC_ID_DVD_SUBTITLE) and
32  choose one of FUZZ_FFMPEG_VIDEO, FUZZ_FFMPEG_AUDIO, FUZZ_FFMPEG_SUBTITLE.
33  clang -fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp doc/examples/decoder_targeted.c -o decoder_targeted -I. -DFFMPEG_CODEC=AV_CODEC_ID_MPEG1VIDEO -DFUZZ_FFMPEG_VIDEO ../../libfuzzer/libFuzzer.a -Llibavcodec -Llibavdevice -Llibavfilter -Llibavformat -Llibavresample -Llibavutil -Llibpostproc -Llibswscale -Llibswresample -Wl,--as-needed -Wl,-z,noexecstack -Wl,--warn-common -Wl,-rpath-link=libpostproc:libswresample:libswscale:libavfilter:libavdevice:libavformat:libavcodec:libavutil:libavresample -lavdevice -lavfilter -lavformat -lavcodec -lswresample -lswscale -lavutil -ldl -lxcb -lxcb-shm -lxcb -lxcb-xfixes -lxcb -lxcb-shape -lxcb -lX11 -lasound -lm -lbz2 -lz -pthread
34  * create a corpus directory and put some samples there (empty dir is ok too):
35  mkdir CORPUS && cp some-files CORPUS
36 
37  * Run fuzzing:
38  ./decoder_targeted -max_len=100000 CORPUS
39 
40  More info:
41  http://libfuzzer.info
42  http://tutorial.libfuzzer.info
43  https://github.com/google/oss-fuzz
44  http://lcamtuf.coredump.cx/afl/
45  https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html
46 */
47 
48 #include "libavutil/avassert.h"
49 
50 #include "libavcodec/avcodec.h"
51 #include "libavformat/avformat.h"
52 
53 static void error(const char *err)
54 {
55  fprintf(stderr, "%s", err);
56  exit(1);
57 }
58 
59 static AVCodec *c = NULL;
61 {
62  AVCodec *res;
65  res = avcodec_find_decoder(codec_id);
66  if (!res)
67  error("Failed to find decoder");
68  return res;
69 }
70 
71 #if defined(FUZZ_FFMPEG_VIDEO)
72 #define decode_handler avcodec_decode_video2
73 #elif defined(FUZZ_FFMPEG_AUDIO)
74 #define decode_handler avcodec_decode_audio4
75 #elif defined(FUZZ_FFMPEG_SUBTITLE)
76 static int subtitle_handler(AVCodecContext *avctx, void *frame,
77  int *got_sub_ptr, AVPacket *avpkt)
78 {
79  AVSubtitle sub;
80  int ret = avcodec_decode_subtitle2(avctx, &sub, got_sub_ptr, avpkt);
81  if (ret >= 0 && *got_sub_ptr)
82  avsubtitle_free(&sub);
83  return ret;
84 }
85 
86 #define decode_handler subtitle_handler
87 #else
88 #error "Specify encoder type" // To catch mistakes
89 #endif
90 
91 // Class to handle buffer allocation and resize for each frame
92 typedef struct FuzzDataBuffer {
93  size_t size_;
96 
98  FDB->size_ = 0x1000;
99  FDB->data_ = av_malloc(FDB->size_);
100  if (!FDB->data_)
101  error("Failed memory allocation");
102 }
103 
104 void FDBDesroy(FuzzDataBuffer *FDB) { av_free(FDB->data_); }
105 
106 void FDBRealloc(FuzzDataBuffer *FDB, size_t size) {
107  size_t needed = size + FF_INPUT_BUFFER_PADDING_SIZE;
108  av_assert0(needed > size);
109  if (needed > FDB->size_) {
110  av_free(FDB->data_);
111  FDB->size_ = needed;
112  FDB->data_ = av_malloc(FDB->size_);
113  if (!FDB->data_)
114  error("Failed memory allocation");
115  }
116 }
117 
119  size_t size)
120 {
121  FDBRealloc(FDB, size);
122  memcpy(FDB->data_, data, size);
123  size_t padd = FDB->size_ - size;
124  if (padd > FF_INPUT_BUFFER_PADDING_SIZE)
126  memset(FDB->data_ + size, 0, padd);
127  av_init_packet(dst);
128  dst->data = FDB->data_;
129  dst->size = size;
130 }
131 
132 // Ensure we don't loop forever
133 const uint32_t maxiteration = 8096;
134 
135 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
136 
138  const uint64_t fuzz_tag = FUZZ_TAG;
140  const uint8_t *last = data;
141  const uint8_t *end = data + size;
142  uint32_t it = 0;
143 
144  if (!c)
145  c = AVCodecInitialize(FFMPEG_CODEC); // Done once.
146 
148  if (!ctx)
149  error("Failed memory allocation");
150 
151  ctx->max_pixels = 4096 * 4096; //To reduce false positive OOM and hangs
152 
153  int res = avcodec_open2(ctx, c, NULL);
154  if (res < 0)
155  return res;
156 
157  FDBCreate(&buffer);
158  int got_frame;
159  AVFrame *frame = av_frame_alloc();
160  if (!frame)
161  error("Failed memory allocation");
162 
163  // Read very simple container
164  AVPacket avpkt;
165  while (data < end && it < maxiteration) {
166  // Search for the TAG
167  while (data + sizeof(fuzz_tag) < end) {
168  if (data[0] == (fuzz_tag & 0xFF) && *(const uint64_t *)(data) == fuzz_tag)
169  break;
170  data++;
171  }
172  if (data + sizeof(fuzz_tag) > end)
173  data = end;
174 
175  FDBPrepare(&buffer, &avpkt, last, data - last);
176  data += sizeof(fuzz_tag);
177  last = data;
178 
179  // Iterate through all data
180  while (avpkt.size > 0 && it++ < maxiteration) {
181  av_frame_unref(frame);
182  int ret = decode_handler(ctx, frame, &got_frame, &avpkt);
183  if (ret <= 0 || ret > avpkt.size)
184  break;
185  avpkt.data += ret;
186  avpkt.size -= ret;
187  }
188  }
189 
190  av_init_packet(&avpkt);
191  avpkt.data = NULL;
192  avpkt.size = 0;
193 
194  do {
195  got_frame = 0;
196  decode_handler(ctx, frame, &got_frame, &avpkt);
197  } while (got_frame == 1 && it++ < maxiteration);
198 
199  av_frame_free(&frame);
200  avcodec_free_context(&ctx);
201  av_freep(&ctx);
202  FDBDesroy(&buffer);
203  return 0;
204 }
#define NULL
Definition: coverity.c:32
This structure describes decoded (raw) audio or video data.
Definition: frame.h:190
ptrdiff_t const GLvoid * data
Definition: opengl_enc.c:101
void av_log_set_level(int level)
Set the log level.
Definition: log.c:391
int size
Definition: avcodec.h:1613
const uint32_t maxiteration
int avcodec_decode_subtitle2(AVCodecContext *avctx, AVSubtitle *sub, int *got_sub_ptr, AVPacket *avpkt)
Decode a subtitle message.
Definition: utils.c:2649
AVCodec.
Definition: avcodec.h:3620
void FDBDesroy(FuzzDataBuffer *FDB)
#define FF_INPUT_BUFFER_PADDING_SIZE
Definition: avcodec.h:752
#define av_assert0(cond)
assert() equivalent, that is always enabled.
Definition: avassert.h:37
uint8_t
#define av_malloc(s)
AVFrame * av_frame_alloc(void)
Allocate an AVFrame and set its fields to default values.
Definition: frame.c:145
static const uint64_t FUZZ_TAG
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:163
static av_cold int end(AVCodecContext *avctx)
Definition: avrndec.c:90
static AVFrame * frame
uint8_t * data
Definition: avcodec.h:1612
ptrdiff_t size
Definition: opengl_enc.c:101
static AVCodec * AVCodecInitialize(enum AVCodecID codec_id)
AVCodecID
Identify the syntax and semantics of the bitstream.
Definition: avcodec.h:191
void av_frame_free(AVFrame **frame)
Free the frame and any dynamically allocated objects in it, e.g.
Definition: frame.c:158
simple assert() macros that are a bit more flexible than ISO C assert().
int64_t max_pixels
The number of pixels per image to maximally accept.
Definition: avcodec.h:3584
static void error(const char *err)
AVCodecContext * avcodec_alloc_context3(const AVCodec *codec)
Allocate an AVCodecContext and set its fields to default values.
Definition: options.c:156
AVFormatContext * ctx
Definition: movenc.c:48
enum AVCodecID codec_id
Definition: vaapi_decode.c:234
Libavcodec external API header.
void avcodec_free_context(AVCodecContext **avctx)
Free the codec context and everything associated with it and write NULL to the provided pointer...
Definition: options.c:171
main external API structure.
Definition: avcodec.h:1687
AVCodec * avcodec_find_decoder(enum AVCodecID id)
Find a registered decoder with a matching codec ID.
Definition: utils.c:3133
void avsubtitle_free(AVSubtitle *sub)
Free all allocated data in the given subtitle struct.
Definition: utils.c:2754
void FDBCreate(FuzzDataBuffer *FDB)
int avcodec_open2(AVCodecContext *avctx, const AVCodec *codec, AVDictionary **options)
Initialize the AVCodecContext to use the given AVCodec.
Definition: utils.c:1247
void av_frame_unref(AVFrame *frame)
Unreference all the buffers referenced by frame and reset the frame fields.
Definition: frame.c:495
Main libavformat public API header.
void av_init_packet(AVPacket *pkt)
Initialize optional fields of a packet with default values.
Definition: avpacket.c:33
#define av_free(p)
static AVCodec * c
void FDBRealloc(FuzzDataBuffer *FDB, size_t size)
#define av_freep(p)
void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data, size_t size)
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
This structure stores compressed data.
Definition: avcodec.h:1589
void av_register_all(void)
Initialize libavformat and register all the muxers, demuxers and protocols.
Definition: allformats.c:44
GLuint buffer
Definition: opengl_enc.c:102