FFmpeg
target_dem_fuzzer.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 #include "config.h"
20 #include "libavutil/avassert.h"
21 
22 #include "libavcodec/avcodec.h"
23 #include "libavcodec/bytestream.h"
24 #include "libavformat/avformat.h"
25 
26 
27 typedef struct IOContext {
28  int64_t pos;
29  int64_t filesize;
31  int fuzz_size;
32 } IOContext;
33 
34 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
35 
36 static void error(const char *err)
37 {
38  fprintf(stderr, "%s", err);
39  exit(1);
40 }
41 
42 static int io_read(void *opaque, uint8_t *buf, int buf_size)
43 {
44  IOContext *c = opaque;
45  int size = FFMIN(buf_size, c->fuzz_size);
46 
47  if (!c->fuzz_size) {
48  c->filesize = FFMIN(c->pos, c->filesize);
49  return AVERROR_EOF;
50  }
51 
52  memcpy(buf, c->fuzz, size);
53  c->fuzz += size;
54  c->fuzz_size -= size;
55  c->pos += size;
56  c->filesize = FFMAX(c->filesize, c->pos);
57 
58  return size;
59 }
60 
61 static int64_t io_seek(void *opaque, int64_t offset, int whence)
62 {
63  IOContext *c = opaque;
64 
65  if (whence == SEEK_CUR) {
66  if (offset > INT64_MAX - c->pos)
67  return -1;
68  offset += c->pos;
69  } else if (whence == SEEK_END) {
70  if (offset > INT64_MAX - c->filesize)
71  return -1;
72  offset += c->filesize;
73  }
74  if (offset < 0 || offset > c->filesize)
75  return -1;
76  c->pos = offset;
77  return 0;
78 }
79 
80 // Ensure we don't loop forever
81 const uint32_t maxiteration = 8096;
82 
83 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
84 
85 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
86  const uint64_t fuzz_tag = FUZZ_TAG;
87  uint32_t it = 0;
89  AVPacket pkt;
90  char filename[1025] = {0};
91  AVIOContext *fuzzed_pb = NULL;
92  uint8_t *io_buffer;
93  int io_buffer_size = 32768;
94  int64_t filesize = size;
95  IOContext opaque;
96  static int c;
97  int seekable = 0;
98  int ret;
99 
100  if (!c) {
101  av_register_all();
104  c=1;
105  }
106 
107  if (!avfmt)
108  error("Failed avformat_alloc_context()");
109 
110  if (size > 2048) {
111  GetByteContext gbc;
112  memcpy (filename, data + size - 1024, 1024);
113  bytestream2_init(&gbc, data + size - 2048, 1024);
114  size -= 2048;
115 
116  io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF;
117  seekable = bytestream2_get_byte(&gbc) & 1;
118  filesize = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF;
119  }
120  io_buffer = av_malloc(io_buffer_size);
121  if (!io_buffer)
122  error("Failed to allocate io_buffer");
123 
124  opaque.filesize = filesize;
125  opaque.pos = 0;
126  opaque.fuzz = data;
127  opaque.fuzz_size= size;
128  fuzzed_pb = avio_alloc_context(io_buffer, io_buffer_size, 0, &opaque,
129  io_read, NULL, seekable ? io_seek : NULL);
130  if (!fuzzed_pb)
131  error("avio_alloc_context failed");
132 
133  avfmt->pb = fuzzed_pb;
134 
135  ret = avformat_open_input(&avfmt, filename, NULL, NULL);
136  if (ret < 0) {
137  av_freep(&fuzzed_pb->buffer);
138  av_freep(&fuzzed_pb);
139  avformat_free_context(avfmt);
140  return 0;
141  }
142 
143  ret = avformat_find_stream_info(avfmt, NULL);
144 
145  av_init_packet(&pkt);
146 
147  //TODO, test seeking
148 
149  for(it = 0; it < maxiteration; it++) {
150  ret = av_read_frame(avfmt, &pkt);
151  if (ret < 0)
152  break;
153  av_packet_unref(&pkt);
154  }
155 end:
156  av_freep(&fuzzed_pb->buffer);
157  av_freep(&fuzzed_pb);
158  avformat_close_input(&avfmt);
159 
160  return 0;
161 }
#define NULL
Definition: coverity.c:32
Bytestream IO Context.
Definition: avio.h:161
ptrdiff_t const GLvoid * data
Definition: opengl_enc.c:100
void av_log_set_level(int level)
Set the log level.
Definition: log.c:385
const uint32_t maxiteration
unsigned char * buffer
Start of the buffer.
Definition: avio.h:226
static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)
Definition: bytestream.h:133
int avformat_open_input(AVFormatContext **ps, const char *url, ff_const59 AVInputFormat *fmt, AVDictionary **options)
Open an input stream and read the header.
Definition: utils.c:539
static AVPacket pkt
static int io_read(void *opaque, uint8_t *buf, int buf_size)
Format I/O context.
Definition: avformat.h:1358
uint8_t
#define av_malloc(s)
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:163
it s the only field you need to keep assuming you have a context There is some magic you don t need to care about around this just let it vf offset
static av_cold int end(AVCodecContext *avctx)
Definition: avrndec.c:90
Undefined Behavior In the C some operations are like signed integer dereferencing freed accessing outside allocated Undefined Behavior must not occur in a C it is not safe even if the output of undefined operations is unused The unsafety may seem nit picking but Optimizing compilers have in fact optimized code on the assumption that no undefined Behavior occurs Optimizing code based on wrong assumptions can and has in some cases lead to effects beyond the output of computations The signed integer overflow problem in speed critical code Code which is highly optimized and works with signed integers sometimes has the problem that often the output of the computation does not c
Definition: undefined.txt:32
static const uint64_t FUZZ_TAG
AVFormatContext * avformat_alloc_context(void)
Allocate an AVFormatContext.
Definition: options.c:144
s EdgeDetect Foobar g libavfilter vf_edgedetect c libavfilter vf_foobar c edit libavfilter and add an entry for foobar following the pattern of the other filters edit libavfilter allfilters and add an entry for foobar following the pattern of the other filters configure make j< whatever > ffmpeg ffmpeg i you should get a foobar png with Lena edge detected That s it
#define AVERROR_EOF
End of file.
Definition: error.h:55
ptrdiff_t size
Definition: opengl_enc.c:100
void avcodec_register_all(void)
Register all the codecs, parsers and bitstream filters which were enabled at configuration time...
Definition: allcodecs.c:856
AVIOContext * avio_alloc_context(unsigned char *buffer, int buffer_size, int write_flag, void *opaque, int(*read_packet)(void *opaque, uint8_t *buf, int buf_size), int(*write_packet)(void *opaque, uint8_t *buf, int buf_size), int64_t(*seek)(void *opaque, int64_t offset, int whence))
Allocate and initialize an AVIOContext for buffered I/O.
Definition: aviobuf.c:131
simple assert() macros that are a bit more flexible than ISO C assert().
#define FFMAX(a, b)
Definition: common.h:94
#define FFMIN(a, b)
Definition: common.h:96
int64_t filesize
uint8_t * fuzz
Libavcodec external API header.
AVIOContext * pb
I/O context.
Definition: avformat.h:1400
void av_packet_unref(AVPacket *pkt)
Wipe the packet.
Definition: avpacket.c:599
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
void * buf
Definition: avisynth_c.h:766
void avformat_free_context(AVFormatContext *s)
Free an AVFormatContext and all its streams.
Definition: utils.c:4433
int av_read_frame(AVFormatContext *s, AVPacket *pkt)
Return the next frame of a stream.
Definition: utils.c:1777
Main libavformat public API header.
int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options)
Read packets of a media file to get stream information.
Definition: utils.c:3600
void av_init_packet(AVPacket *pkt)
Initialize optional fields of a packet with default values.
Definition: avpacket.c:33
void avformat_close_input(AVFormatContext **s)
Close an opened input AVFormatContext.
Definition: utils.c:4474
static void error(const char *err)
#define av_freep(p)
This structure stores compressed data.
Definition: avcodec.h:1459
static int64_t io_seek(void *opaque, int64_t offset, int whence)