FFmpeg
target_bsf_fuzzer.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 #include "config.h"
20 #include "libavutil/imgutils.h"
21 #include "libavutil/opt.h"
22 
23 #include "libavcodec/avcodec.h"
25 #include "libavcodec/bytestream.h"
26 #include "libavcodec/internal.h"
27 
28 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
29 
30 static void error(const char *err)
31 {
32  fprintf(stderr, "%s", err);
33  exit(1);
34 }
35 
37 
38 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
39 
40 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
41  const uint64_t fuzz_tag = FUZZ_TAG;
42  const uint8_t *last = data;
43  const uint8_t *end = data + size;
44  AVBSFContext *bsf = NULL;
45  AVPacket *in, *out;
46  uint64_t keyframes = 0;
47  uint64_t flushpattern = -1;
48  int res;
49 
50  if (!f) {
51 #ifdef FFMPEG_BSF
52 #define BSF_SYMBOL0(BSF) ff_##BSF##_bsf
53 #define BSF_SYMBOL(BSF) BSF_SYMBOL0(BSF)
54  extern AVBitStreamFilter BSF_SYMBOL(FFMPEG_BSF);
55  f = &BSF_SYMBOL(FFMPEG_BSF);
56 #else
58  f = &ff_null_bsf;
59 #endif
61  }
62 
63  res = av_bsf_alloc(f, &bsf);
64  if (res < 0)
65  error("Failed memory allocation");
66 
67  if (size > 1024) {
68  GetByteContext gbc;
69  int extradata_size;
70  int flags;
71  size -= 1024;
72  bytestream2_init(&gbc, data + size, 1024);
73  bsf->par_in->width = bytestream2_get_le32(&gbc);
74  bsf->par_in->height = bytestream2_get_le32(&gbc);
75  bsf->par_in->bit_rate = bytestream2_get_le64(&gbc);
76  bsf->par_in->bits_per_coded_sample = bytestream2_get_le32(&gbc);
77 
78  if (f->codec_ids) {
79  int i, id;
80  for (i = 0; f->codec_ids[i] != AV_CODEC_ID_NONE; i++);
81  id = f->codec_ids[bytestream2_get_byte(&gbc) % i];
82  bsf->par_in->codec_id = id;
83  bsf->par_in->codec_tag = bytestream2_get_le32(&gbc);
84  }
85 
86  extradata_size = bytestream2_get_le32(&gbc);
87 
88  bsf->par_in->sample_rate = bytestream2_get_le32(&gbc);
89  bsf->par_in->channels = (unsigned)bytestream2_get_le32(&gbc) % FF_SANE_NB_CHANNELS;
90  bsf->par_in->block_align = bytestream2_get_le32(&gbc);
91  keyframes = bytestream2_get_le64(&gbc);
92  flushpattern = bytestream2_get_le64(&gbc);
93  flags = bytestream2_get_byte(&gbc);
94 
95  if (flags & 0x20) {
96  if (!strcmp(f->name, "av1_metadata"))
97  av_opt_set_int(bsf->priv_data, "td", bytestream2_get_byte(&gbc) % 3, 0);
98  else if (!strcmp(f->name, "h264_metadata") || !strcmp(f->name, "h265_metadata"))
99  av_opt_set_int(bsf->priv_data, "aud", bytestream2_get_byte(&gbc) % 3, 0);
100  else if (!strcmp(f->name, "extract_extradata"))
101  av_opt_set_int(bsf->priv_data, "remove", bytestream2_get_byte(&gbc) & 1, 0);
102  }
103 
104  if (extradata_size < size) {
105  bsf->par_in->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
106  if (bsf->par_in->extradata) {
107  bsf->par_in->extradata_size = extradata_size;
108  size -= bsf->par_in->extradata_size;
109  memcpy(bsf->par_in->extradata, data + size, bsf->par_in->extradata_size);
110  }
111  }
112  if (av_image_check_size(bsf->par_in->width, bsf->par_in->height, 0, bsf))
113  bsf->par_in->width = bsf->par_in->height = 0;
114  }
115 
116  res = av_bsf_init(bsf);
117  if (res < 0) {
118  av_bsf_free(&bsf);
119  return 0; // Failure of av_bsf_init() does not imply that a issue was found
120  }
121 
122  in = av_packet_alloc();
123  out = av_packet_alloc();
124  if (!in || !out)
125  error("Failed memory allocation");
126 
127  while (data < end) {
128  // Search for the TAG
129  while (data + sizeof(fuzz_tag) < end) {
130  if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
131  break;
132  data++;
133  }
134  if (data + sizeof(fuzz_tag) > end)
135  data = end;
136 
137  res = av_new_packet(in, data - last);
138  if (res < 0)
139  error("Failed memory allocation");
140  memcpy(in->data, last, data - last);
141  in->flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY;
142  keyframes = (keyframes >> 2) + (keyframes<<62);
143  data += sizeof(fuzz_tag);
144  last = data;
145 
146  if (!(flushpattern & 7))
147  av_bsf_flush(bsf);
148  flushpattern = (flushpattern >> 3) + (flushpattern << 61);
149 
150  while (in->size) {
151  res = av_bsf_send_packet(bsf, in);
152  if (res < 0 && res != AVERROR(EAGAIN))
153  break;
154  res = av_bsf_receive_packet(bsf, out);
155  if (res < 0)
156  break;
158  }
160  }
161 
162  res = av_bsf_send_packet(bsf, NULL);
163  while (!res) {
164  res = av_bsf_receive_packet(bsf, out);
165  if (res < 0)
166  break;
168  }
169 
170  av_packet_free(&in);
172  av_bsf_free(&bsf);
173  return 0;
174 }
error
static void error(const char *err)
Definition: target_bsf_fuzzer.c:30
av_packet_unref
void av_packet_unref(AVPacket *pkt)
Wipe the packet.
Definition: avpacket.c:634
AVBSFContext::par_in
AVCodecParameters * par_in
Parameters of the input stream.
Definition: bsf.h:77
AVCodecParameters::extradata
uint8_t * extradata
Extra binary data needed for initializing the decoder, codec-dependent.
Definition: codec_par.h:74
AVERROR
Filter the word “frame” indicates either a video frame or a group of audio as stored in an AVFrame structure Format for each input and each output the list of supported formats For video that means pixel format For audio that means channel sample they are references to shared objects When the negotiation mechanism computes the intersection of the formats supported at each end of a all references to both lists are replaced with a reference to the intersection And when a single format is eventually chosen for a link amongst the remaining all references to the list are updated That means that if a filter requires that its input and output have the same format amongst a supported all it has to do is use a reference to the same list of formats query_formats can leave some formats unset and return AVERROR(EAGAIN) to cause the negotiation mechanism toagain later. That can be used by filters with complex requirements to use the format negotiated on one link to set the formats supported on another. Frame references ownership and permissions
bsf_internal.h
opt.h
out
FILE * out
Definition: movenc.c:54
GetByteContext
Definition: bytestream.h:33
AV_LOG_PANIC
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:181
AV_PKT_FLAG_DISCARD
#define AV_PKT_FLAG_DISCARD
Flag is used to discard packets which are required to maintain valid decoder state but are not requir...
Definition: packet.h:417
AVBitStreamFilter::name
const char * name
Definition: bsf.h:99
av_bsf_init
int av_bsf_init(AVBSFContext *ctx)
Prepare the filter for use, after all the parameters and options have been set.
Definition: bsf.c:148
AV_RN64
#define AV_RN64(p)
Definition: intreadwrite.h:368
internal.h
data
const char data[16]
Definition: mxf.c:142
AVCodecParameters::codec_tag
uint32_t codec_tag
Additional information about the codec (corresponds to the AVI FOURCC).
Definition: codec_par.h:64
AV_PKT_FLAG_KEY
#define AV_PKT_FLAG_KEY
The packet contains a keyframe.
Definition: packet.h:410
av_packet_free
void av_packet_free(AVPacket **pkt)
Free the packet, if the packet is reference counted, it will be unreferenced first.
Definition: avpacket.c:75
AVBSFContext
The bitstream filter state.
Definition: bsf.h:49
AVCodecParameters::channels
int channels
Audio only.
Definition: codec_par.h:166
LLVMFuzzerTestOneInput
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
Definition: target_bsf_fuzzer.c:40
av_new_packet
int av_new_packet(AVPacket *pkt, int size)
Allocate the payload of a packet and initialize its fields with default values.
Definition: avpacket.c:99
AVCodecParameters::width
int width
Video only.
Definition: codec_par.h:126
FUZZ_TAG
static const uint64_t FUZZ_TAG
Definition: target_bsf_fuzzer.c:38
AVBitStreamFilter::codec_ids
enum AVCodecID * codec_ids
A list of codec ids supported by the filter, terminated by AV_CODEC_ID_NONE.
Definition: bsf.h:106
NULL
#define NULL
Definition: coverity.c:32
f
static AVBitStreamFilter * f
Definition: target_bsf_fuzzer.c:36
AVCodecParameters::sample_rate
int sample_rate
Audio only.
Definition: codec_par.h:170
av_opt_set_int
int av_opt_set_int(void *obj, const char *name, int64_t val, int search_flags)
Definition: opt.c:586
AVCodecParameters::extradata_size
int extradata_size
Size of the extradata content in bytes.
Definition: codec_par.h:78
ff_null_bsf
const AVBitStreamFilter ff_null_bsf
Definition: null_bsf.c:27
id
enum AVCodecID id
Definition: extract_extradata_bsf.c:325
size
int size
Definition: twinvq_data.h:10344
av_packet_alloc
AVPacket * av_packet_alloc(void)
Allocate an AVPacket and set its fields to default values.
Definition: avpacket.c:64
in
uint8_t pi<< 24) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_U8, uint8_t,(*(const uint8_t *) pi - 0x80) *(1.0f/(1<< 7))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_U8, uint8_t,(*(const uint8_t *) pi - 0x80) *(1.0/(1<< 7))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_S16, int16_t,(*(const int16_t *) pi >> 8)+0x80) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_S16, int16_t, *(const int16_t *) pi *(1.0f/(1<< 15))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_S16, int16_t, *(const int16_t *) pi *(1.0/(1<< 15))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_S32, int32_t,(*(const int32_t *) pi >> 24)+0x80) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_S32, int32_t, *(const int32_t *) pi *(1.0f/(1U<< 31))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_S32, int32_t, *(const int32_t *) pi *(1.0/(1U<< 31))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_FLT, float, av_clip_uint8(lrintf(*(const float *) pi *(1<< 7))+0x80)) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S16, int16_t, AV_SAMPLE_FMT_FLT, float, av_clip_int16(lrintf(*(const float *) pi *(1<< 15)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S32, int32_t, AV_SAMPLE_FMT_FLT, float, av_clipl_int32(llrintf(*(const float *) pi *(1U<< 31)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_DBL, double, av_clip_uint8(lrint(*(const double *) pi *(1<< 7))+0x80)) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S16, int16_t, AV_SAMPLE_FMT_DBL, double, av_clip_int16(lrint(*(const double *) pi *(1<< 15)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S32, int32_t, AV_SAMPLE_FMT_DBL, double, av_clipl_int32(llrint(*(const double *) pi *(1U<< 31)))) #define SET_CONV_FUNC_GROUP(ofmt, ifmt) static void set_generic_function(AudioConvert *ac) { } void ff_audio_convert_free(AudioConvert **ac) { if(! *ac) return;ff_dither_free(&(*ac) ->dc);av_freep(ac);} AudioConvert *ff_audio_convert_alloc(AVAudioResampleContext *avr, enum AVSampleFormat out_fmt, enum AVSampleFormat in_fmt, int channels, int sample_rate, int apply_map) { AudioConvert *ac;int in_planar, out_planar;ac=av_mallocz(sizeof(*ac));if(!ac) return NULL;ac->avr=avr;ac->out_fmt=out_fmt;ac->in_fmt=in_fmt;ac->channels=channels;ac->apply_map=apply_map;if(avr->dither_method !=AV_RESAMPLE_DITHER_NONE &&av_get_packed_sample_fmt(out_fmt)==AV_SAMPLE_FMT_S16 &&av_get_bytes_per_sample(in_fmt) > 2) { ac->dc=ff_dither_alloc(avr, out_fmt, in_fmt, channels, sample_rate, apply_map);if(!ac->dc) { av_free(ac);return NULL;} return ac;} in_planar=ff_sample_fmt_is_planar(in_fmt, channels);out_planar=ff_sample_fmt_is_planar(out_fmt, channels);if(in_planar==out_planar) { ac->func_type=CONV_FUNC_TYPE_FLAT;ac->planes=in_planar ? ac->channels :1;} else if(in_planar) ac->func_type=CONV_FUNC_TYPE_INTERLEAVE;else ac->func_type=CONV_FUNC_TYPE_DEINTERLEAVE;set_generic_function(ac);if(ARCH_AARCH64) ff_audio_convert_init_aarch64(ac);if(ARCH_ARM) ff_audio_convert_init_arm(ac);if(ARCH_X86) ff_audio_convert_init_x86(ac);return ac;} int ff_audio_convert(AudioConvert *ac, AudioData *out, AudioData *in) { int use_generic=1;int len=in->nb_samples;int p;if(ac->dc) { av_log(ac->avr, AV_LOG_TRACE, "%d samples - audio_convert: %s to %s (dithered)\n", len, av_get_sample_fmt_name(ac->in_fmt), av_get_sample_fmt_name(ac->out_fmt));return ff_convert_dither(ac-> in
Definition: audio_convert.c:326
av_log_set_level
void av_log_set_level(int level)
Set the log level.
Definition: log.c:440
i
int i
Definition: input.c:407
AV_CODEC_ID_NONE
@ AV_CODEC_ID_NONE
Definition: codec_id.h:47
av_bsf_receive_packet
int av_bsf_receive_packet(AVBSFContext *ctx, AVPacket *pkt)
Retrieve a filtered packet.
Definition: bsf.c:227
AVCodecParameters::height
int height
Definition: codec_par.h:127
AVCodecParameters::block_align
int block_align
Audio only.
Definition: codec_par.h:177
uint8_t
uint8_t
Definition: audio_convert.c:194
av_mallocz
void * av_mallocz(size_t size)
Allocate a memory block with alignment suitable for all memory accesses (including vectors if availab...
Definition: mem.c:237
avcodec.h
AVBSFContext::priv_data
void * priv_data
Opaque filter-specific private data.
Definition: bsf.h:70
AV_INPUT_BUFFER_PADDING_SIZE
#define AV_INPUT_BUFFER_PADDING_SIZE
Definition: avcodec.h:215
av_bsf_send_packet
int av_bsf_send_packet(AVBSFContext *ctx, AVPacket *pkt)
Submit a packet for filtering.
Definition: bsf.c:201
av_bsf_flush
void av_bsf_flush(AVBSFContext *ctx)
Reset the internal bitstream filter state.
Definition: bsf.c:189
AVBitStreamFilter
Definition: bsf.h:98
AVCodecParameters::bits_per_coded_sample
int bits_per_coded_sample
The number of bits per sample in the codedwords.
Definition: codec_par.h:102
AVCodecParameters::codec_id
enum AVCodecID codec_id
Specific type of the encoded data (the codec used).
Definition: codec_par.h:60
AVPacket
This structure stores compressed data.
Definition: packet.h:346
av_bsf_free
void av_bsf_free(AVBSFContext **pctx)
Free a bitstream filter context and everything associated with it; write NULL into the supplied point...
Definition: bsf.c:40
bytestream.h
imgutils.h
bytestream2_init
static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)
Definition: bytestream.h:137
flags
#define flags(name, subs,...)
Definition: cbs_av1.c:561
AVCodecParameters::bit_rate
int64_t bit_rate
The average bitrate of the encoded data (in bits per second).
Definition: codec_par.h:89
av_image_check_size
int av_image_check_size(unsigned int w, unsigned int h, int log_offset, void *log_ctx)
Check if the given dimension of an image is valid, meaning that all bytes of the image can be address...
Definition: imgutils.c:317
FF_SANE_NB_CHANNELS
#define FF_SANE_NB_CHANNELS
Definition: internal.h:107
av_bsf_alloc
int av_bsf_alloc(const AVBitStreamFilter *filter, AVBSFContext **pctx)
Allocate a context for a given bitstream filter.
Definition: bsf.c:95