FFmpeg
target_dec_fuzzer.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 /* Targeted fuzzer that targets specific codecs depending on two
20  compile-time flags.
21  INSTRUCTIONS:
22 
23  * Get clang > 6.0 (https://llvm.org/docs/LibFuzzer.html)
24  * Build ffmpeg for fuzzing:
25  ./configure --enable-debug --toolchain=clang-asan-ubsan-fuzz --enable-ossfuzz
26  make clean && make -j
27  * build the fuzz target.
28  make tools/target_dec_<codec>_fuzzer # e.g. tools/target_dec_jpeg2000_fuzzer
29  * Run fuzzing with a corpus directory:
30  mkdir CORPUS && cp some-files CORPUS # (empty corpus dir is ok too)
31  ./tools/target_dec_<codec>_fuzzer -max_len=100000 CORPUS
32  * Run a test case:
33  ./tools/target_dec_<codec>_fuzzer <testcase>
34 
35  More info:
36  http://libfuzzer.info
37  http://tutorial.libfuzzer.info
38  https://github.com/google/oss-fuzz
39  http://lcamtuf.coredump.cx/afl/
40  https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html
41 */
42 
43 #include "config.h"
44 #include "libavutil/avassert.h"
45 #include "libavutil/avstring.h"
46 #include "libavutil/cpu.h"
47 #include "libavutil/imgutils.h"
48 #include "libavutil/intreadwrite.h"
49 #include "libavutil/mem.h"
50 
51 #include "libavcodec/avcodec.h"
52 #include "libavcodec/bytestream.h"
53 #include "libavcodec/codec_internal.h"
54 #include "libavformat/avformat.h"
55 
56 //For FF_SANE_NB_CHANNELS, so we dont waste energy testing things that will get instantly rejected
57 #include "libavcodec/internal.h"
58 
59 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
60 
61 extern const FFCodec * codec_list[];
62 
63 static void error(const char *err)
64 {
65  fprintf(stderr, "%s", err);
66  exit(1);
67 }
68 
69 static const FFCodec *c = NULL;
70 
71 #ifndef FFMPEG_DECODER
72 static const FFCodec *AVCodecInitialize(enum AVCodecID codec_id)
73 {
74  const AVCodec *res;
75 
76  res = avcodec_find_decoder(codec_id);
77  if (!res)
78  error("Failed to find decoder");
79  return ffcodec(res);
80 }
81 #endif
82 
83 static int subtitle_handler(AVCodecContext *avctx, AVFrame *unused,
84  int *got_sub_ptr, const AVPacket *avpkt)
85 {
86  AVSubtitle sub;
87  int ret = avcodec_decode_subtitle2(avctx, &sub, got_sub_ptr, avpkt);
88  av_assert0(ret != AVERROR_BUG);
89  if (ret >= 0 && *got_sub_ptr)
90  avsubtitle_free(&sub);
91  return ret;
92 }
93 
94 static int audio_video_handler(AVCodecContext *avctx, AVFrame *frame,
95  int *got_frame, const AVPacket *dummy)
96 {
97  int ret = avcodec_receive_frame(avctx, frame);
98  av_assert0(ret != AVERROR_BUG);
99  *got_frame = ret >= 0;
100  return ret;
101 }
102 
103 // Ensure we don't loop forever
104 const uint32_t maxiteration = 8096;
105 
106 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
107 
108 static uint64_t alloc_pixels;
109 static uint64_t max_alloc_pixels;
110 
111 static int fuzz_video_get_buffer(AVCodecContext *ctx, AVFrame *frame)
112 {
113  ptrdiff_t linesize1[4];
114  size_t size[4];
115  int linesize_align[AV_NUM_DATA_POINTERS];
116  int i, ret, w = frame->width, h = frame->height;
117 
118  avcodec_align_dimensions2(ctx, &w, &h, linesize_align);
119 
120  alloc_pixels += (uint64_t)w * h;
121  if (alloc_pixels > max_alloc_pixels)
122  return AVERROR(ENOMEM);
123 
124  ret = av_image_fill_linesizes(frame->linesize, ctx->pix_fmt, w);
125  if (ret < 0)
126  return ret;
127 
128  for (i = 0; i < 4 && frame->linesize[i]; i++)
129  linesize1[i] = frame->linesize[i] =
130  FFALIGN(frame->linesize[i], linesize_align[i]);
131  for (; i < 4; i++)
132  linesize1[i] = 0;
133 
134  ret = av_image_fill_plane_sizes(size, ctx->pix_fmt, h, linesize1);
135  if (ret < 0)
136  return ret;
137 
138  frame->extended_data = frame->data;
139  for (i = 0; i < 4 && size[i]; i++) {
140  switch(ctx->codec_id) {
141  case AV_CODEC_ID_FFV1:
142  frame->buf[i] = av_buffer_alloc(size[i]);
143  break;
144  default:
145  frame->buf[i] = av_buffer_allocz(size[i]);
146  }
147 
148  if (!frame->buf[i])
149  goto fail;
150  frame->data[i] = frame->buf[i]->data;
151  }
152  for (; i < AV_NUM_DATA_POINTERS; i++) {
153  frame->data[i] = NULL;
154  frame->linesize[i] = 0;
155  }
156 
157  return 0;
158 fail:
159  av_frame_unref(frame);
160  return AVERROR(ENOMEM);
161 }
162 
163 static int fuzz_get_buffer2(AVCodecContext *ctx, AVFrame *frame, int flags)
164 {
165  switch (ctx->codec_type) {
166  case AVMEDIA_TYPE_VIDEO:
167  return (ctx->codec->capabilities & AV_CODEC_CAP_DR1)
168  ? fuzz_video_get_buffer(ctx, frame)
169  : avcodec_default_get_buffer2(ctx, frame, flags);
170  case AVMEDIA_TYPE_AUDIO:
171  return avcodec_default_get_buffer2(ctx, frame, flags);
172  default:
173  return AVERROR(EINVAL);
174  }
175 }
176 
177 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
178  uint64_t maxpixels_per_frame = 4096 * 4096;
179  uint64_t maxpixels;
180 
181  uint64_t maxsamples_per_frame = 256*1024*32;
182  uint64_t maxsamples;
183  const uint64_t fuzz_tag = FUZZ_TAG;
184  const uint8_t *last = data;
185  const uint8_t *end = data + size;
186  uint32_t it = 0;
187  uint64_t ec_pixels = 0;
188  uint64_t nb_samples = 0;
189  int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture,
190  int *got_picture_ptr,
191  const AVPacket *avpkt) = NULL;
192  AVCodecParserContext *parser = NULL;
193  uint64_t keyframes = 0;
194  uint64_t flushpattern = -1;
195  AVDictionary *opts = NULL;
196 
197  if (!c) {
198 #ifdef FFMPEG_DECODER
199 #define DECODER_SYMBOL0(CODEC) ff_##CODEC##_decoder
200 #define DECODER_SYMBOL(CODEC) DECODER_SYMBOL0(CODEC)
201  extern FFCodec DECODER_SYMBOL(FFMPEG_DECODER);
202  codec_list[0] = &DECODER_SYMBOL(FFMPEG_DECODER);
203 
204  c = &DECODER_SYMBOL(FFMPEG_DECODER);
205 #else
206  c = AVCodecInitialize(FFMPEG_CODEC); // Done once.
207 #endif
208  av_log_set_level(AV_LOG_PANIC);
209  }
210 
211  switch (c->p.type) {
212  case AVMEDIA_TYPE_AUDIO :
213  case AVMEDIA_TYPE_VIDEO : decode_handler = audio_video_handler ; break;
214  case AVMEDIA_TYPE_SUBTITLE: decode_handler = subtitle_handler ; break;
215  }
216  switch (c->p.id) {
217  case AV_CODEC_ID_APE: maxsamples_per_frame /= 256; break;
218  }
219  maxpixels = maxpixels_per_frame * maxiteration;
220  maxsamples = maxsamples_per_frame * maxiteration;
221  switch (c->p.id) {
222  case AV_CODEC_ID_4XM: maxpixels /= 64; break;
223  case AV_CODEC_ID_AASC: maxpixels /= 1024; break;
224  case AV_CODEC_ID_AGM: maxpixels /= 1024; break;
225  case AV_CODEC_ID_ANM: maxpixels /= 1024; break;
226  case AV_CODEC_ID_APE: maxsamples /= 16384; break;
227  case AV_CODEC_ID_ARBC: maxpixels /= 1024; break;
228  case AV_CODEC_ID_ARGO: maxpixels /= 1024; break;
229  case AV_CODEC_ID_BETHSOFTVID: maxpixels /= 8192; break;
230  case AV_CODEC_ID_BFI: maxpixels /= 8192; break;
231  case AV_CODEC_ID_BINKVIDEO: maxpixels /= 32; break;
232  case AV_CODEC_ID_BMP: maxpixels /= 16; break;
233  case AV_CODEC_ID_BONK: maxsamples /= 1<<20; break;
234  case AV_CODEC_ID_CAVS: maxpixels /= 1024; break;
235  case AV_CODEC_ID_CDTOONS: maxpixels /= 1024; break;
236  case AV_CODEC_ID_CFHD: maxpixels /= 16384; break;
237  case AV_CODEC_ID_CINEPAK: maxpixels /= 128; break;
238  case AV_CODEC_ID_COOK: maxsamples /= 1<<20; break;
239  case AV_CODEC_ID_CPIA: maxpixels /= 256; break;
240  case AV_CODEC_ID_CRI: maxpixels /= 1024; break;
241  case AV_CODEC_ID_CSCD: maxpixels /= 1024; break;
242  case AV_CODEC_ID_DFA: maxpixels /= 1024; break;
243  case AV_CODEC_ID_DIRAC: maxpixels /= 8192; break;
244  case AV_CODEC_ID_DSICINVIDEO: maxpixels /= 1024; break;
245  case AV_CODEC_ID_DST: maxsamples /= 1<<20; break;
246  case AV_CODEC_ID_DVB_SUBTITLE: av_dict_set_int(&opts, "compute_clut", -2, 0); break;
247  case AV_CODEC_ID_DXA: maxpixels /= 32; break;
248  case AV_CODEC_ID_DXV: maxpixels /= 32; break;
249  case AV_CODEC_ID_CMV: maxpixels /= 256; break;
250  case AV_CODEC_ID_EXR: maxpixels /= 1024; break;
251  case AV_CODEC_ID_FFV1: maxpixels /= 32; break;
252  case AV_CODEC_ID_FFWAVESYNTH: maxsamples /= 16384; break;
253  case AV_CODEC_ID_FLAC: maxsamples /= 1024; break;
254  case AV_CODEC_ID_FLIC: maxpixels /= 1024; break;
255  case AV_CODEC_ID_FLV1: maxpixels /= 1024; break;
256  case AV_CODEC_ID_FMVC: maxpixels /= 1024; break;
257  case AV_CODEC_ID_G2M: maxpixels /= 16384; break;
258  case AV_CODEC_ID_GEM: maxpixels /= 512; break;
259  case AV_CODEC_ID_GDV: maxpixels /= 512; break;
260  case AV_CODEC_ID_GIF: maxpixels /= 16; break;
261  case AV_CODEC_ID_H264: maxpixels /= 256; break;
262  case AV_CODEC_ID_HAP: maxpixels /= 128; break;
263  case AV_CODEC_ID_HEVC: maxpixels /= 16384; break;
264  case AV_CODEC_ID_HNM4_VIDEO: maxpixels /= 128; break;
265  case AV_CODEC_ID_HQ_HQA: maxpixels /= 128; break;
266  case AV_CODEC_ID_IFF_ILBM: maxpixels /= 4096; break;
267  case AV_CODEC_ID_INDEO4: maxpixels /= 128; break;
268  case AV_CODEC_ID_INDEO5: maxpixels /= 1024; break;
269  case AV_CODEC_ID_INTERPLAY_ACM: maxsamples /= 16384; break;
270  case AV_CODEC_ID_INTERPLAY_VIDEO: maxpixels /= 256; break;
271  case AV_CODEC_ID_JPEG2000: maxpixels /= 16384; break;
272  case AV_CODEC_ID_JV: maxpixels /= 16384; break;
273  case AV_CODEC_ID_LAGARITH: maxpixels /= 1024; break;
274  case AV_CODEC_ID_LOCO: maxpixels /= 1024; break;
275  case AV_CODEC_ID_VORBIS: maxsamples /= 1024; break;
276  case AV_CODEC_ID_LSCR: maxpixels /= 16; break;
277  case AV_CODEC_ID_MAGICYUV: maxpixels /= 256; break;
278  case AV_CODEC_ID_MMVIDEO: maxpixels /= 256; break;
279  case AV_CODEC_ID_MOTIONPIXELS:maxpixels /= 256; break;
280  case AV_CODEC_ID_MP4ALS: maxsamples /= 65536;
281  av_dict_set_int(&opts, "max_order", 15, 0);
282  break;
283  case AV_CODEC_ID_MUSEPACK8: maxsamples /= 16384; break;
284  case AV_CODEC_ID_MSA1: maxpixels /= 16384; break;
285  case AV_CODEC_ID_MSCC: maxpixels /= 4096; break;
286  case AV_CODEC_ID_MSRLE: maxpixels /= 16; break;
287  case AV_CODEC_ID_MSS2: maxpixels /= 16384; break;
288  case AV_CODEC_ID_MSZH: maxpixels /= 128; break;
289  case AV_CODEC_ID_MTS2: maxpixels /= 4096; break;
290  case AV_CODEC_ID_MV30: maxpixels /= 128; break;
291  case AV_CODEC_ID_MVC1: maxpixels /= 1024; break;
292  case AV_CODEC_ID_MVC2: maxpixels /= 128; break;
293  case AV_CODEC_ID_MVHA: maxpixels /= 16384; break;
294  case AV_CODEC_ID_MVDV: maxpixels /= 1024; break;
295  case AV_CODEC_ID_MWSC: maxpixels /= 256; break;
296  case AV_CODEC_ID_MXPEG: maxpixels /= 128; break;
297  case AV_CODEC_ID_NUV: maxpixels /= 128; break;
298  case AV_CODEC_ID_OPUS: maxsamples /= 16384; break;
299  case AV_CODEC_ID_PIXLET: maxpixels /= 1024; break;
300  case AV_CODEC_ID_PNG: maxpixels /= 128; break;
301  case AV_CODEC_ID_APNG: maxpixels /= 128; break;
302  case AV_CODEC_ID_QTRLE: maxpixels /= 16; break;
303  case AV_CODEC_ID_PAF_VIDEO: maxpixels /= 16; break;
304  case AV_CODEC_ID_PRORES: maxpixels /= 256; break;
305  case AV_CODEC_ID_QDRAW: maxpixels /= 256; break;
306  case AV_CODEC_ID_QOI: maxpixels /= 256; break;
307  case AV_CODEC_ID_QPEG: maxpixels /= 256; break;
308  case AV_CODEC_ID_RKA: maxsamples /= 1<<20; break;
309  case AV_CODEC_ID_RSCC: maxpixels /= 256; break;
310  case AV_CODEC_ID_RASC: maxpixels /= 256; break;
311  case AV_CODEC_ID_RTV1: maxpixels /= 16; break;
312  case AV_CODEC_ID_RV30: maxpixels /= 256; break;
313  case AV_CODEC_ID_RV60: maxpixels /= 256; break;
314  case AV_CODEC_ID_SANM: maxpixels /= 16; break;
315  case AV_CODEC_ID_SCPR: maxpixels /= 32; break;
316  case AV_CODEC_ID_SCREENPRESSO:maxpixels /= 64; break;
317  case AV_CODEC_ID_SGA_VIDEO: maxpixels /= 256; break;
318  case AV_CODEC_ID_SIMBIOSIS_IMX:maxpixels /= 16384; break;
319  case AV_CODEC_ID_SPEEX: maxsamples /= 128; break;
320  case AV_CODEC_ID_SMACKAUDIO: maxsamples /= 4096; break;
321  case AV_CODEC_ID_SMACKVIDEO: maxpixels /= 64; break;
322  case AV_CODEC_ID_SNOW: maxpixels /= 128; break;
323  case AV_CODEC_ID_SRGC: maxpixels /= 128; break;
324  case AV_CODEC_ID_TARGA: maxpixels /= 128; break;
325  case AV_CODEC_ID_TAK: maxsamples /= 1024; break;
326  case AV_CODEC_ID_TDSC: maxpixels /= 128; break;
327  case AV_CODEC_ID_TGV: maxpixels /= 32; break;
328  case AV_CODEC_ID_THEORA: maxpixels /= 16384; break;
329  case AV_CODEC_ID_TQI: maxpixels /= 1024; break;
330  case AV_CODEC_ID_TRUEMOTION2: maxpixels /= 1024; break;
331  case AV_CODEC_ID_TSCC: maxpixels /= 1024; break;
332  case AV_CODEC_ID_UTVIDEO: maxpixels /= 1024; break;
333  case AV_CODEC_ID_VB: maxpixels /= 1024; break;
334  case AV_CODEC_ID_VC1: maxpixels /= 8192; break;
335  case AV_CODEC_ID_VC1IMAGE: maxpixels /= 8192; break;
336  case AV_CODEC_ID_VMNC: maxpixels /= 8192; break;
337  case AV_CODEC_ID_VMDVIDEO: maxpixels /= 1024; break;
338  case AV_CODEC_ID_VMIX: maxpixels /= 8192; break;
339  case AV_CODEC_ID_VP3: maxpixels /= 4096; break;
340  case AV_CODEC_ID_VP4: maxpixels /= 4096; break;
341  case AV_CODEC_ID_VP5: maxpixels /= 256; break;
342  case AV_CODEC_ID_VP6: maxpixels /= 4096; break;
343  case AV_CODEC_ID_VP6F: maxpixels /= 4096; break;
344  case AV_CODEC_ID_VP6A: maxpixels /= 4096; break;
345  case AV_CODEC_ID_VP7: maxpixels /= 256; break;
346  case AV_CODEC_ID_VP8: maxpixels /= 256; break;
347  case AV_CODEC_ID_VP9: maxpixels /= 4096; break;
348  case AV_CODEC_ID_WAVPACK: maxsamples /= 1024; break;
349  case AV_CODEC_ID_WCMV: maxpixels /= 1024; break;
350  case AV_CODEC_ID_WEBP: maxpixels /= 1024; break;
351  case AV_CODEC_ID_WMV3IMAGE: maxpixels /= 8192; break;
352  case AV_CODEC_ID_WMV2: maxpixels /= 1024; break;
353  case AV_CODEC_ID_WMV3: maxpixels /= 1024; break;
354  case AV_CODEC_ID_WS_VQA: maxpixels /= 16384; break;
355  case AV_CODEC_ID_WMALOSSLESS: maxsamples /= 1024; break;
356  case AV_CODEC_ID_WMAPRO: maxsamples /= 16384; break;
357  case AV_CODEC_ID_XAN_WC3: maxpixels /= 1024; break;
358  case AV_CODEC_ID_YLC: maxpixels /= 1024; break;
359  case AV_CODEC_ID_ZEROCODEC: maxpixels /= 128; break;
360  case AV_CODEC_ID_ZLIB: maxpixels /= 4096; break;
361  case AV_CODEC_ID_ZMBV: maxpixels /= 4096; break;
362  }
363 
364  maxsamples_per_frame = FFMIN(maxsamples_per_frame, maxsamples);
365  maxpixels_per_frame = FFMIN(maxpixels_per_frame , maxpixels);
366 
367  alloc_pixels = 0;
368  max_alloc_pixels = maxpixels;
369 
370  AVCodecContext* ctx = avcodec_alloc_context3(&c->p);
371  AVCodecContext* parser_avctx = avcodec_alloc_context3(NULL);
372  if (!ctx || !parser_avctx)
373  error("Failed memory allocation");
374 
375  if (ctx->max_pixels == 0 || ctx->max_pixels > maxpixels_per_frame)
376  ctx->max_pixels = maxpixels_per_frame; //To reduce false positive OOM and hangs
377 
378  ctx->max_samples = maxsamples_per_frame;
379  ctx->get_buffer2 = fuzz_get_buffer2;
380  if (c->p.capabilities & AV_CODEC_CAP_EXPERIMENTAL)
381  ctx->strict_std_compliance = FF_COMPLIANCE_EXPERIMENTAL;
382 
383  if (size > 1024) {
384  GetByteContext gbc;
385  int extradata_size;
386  int flags;
387  uint64_t request_channel_layout;
388  int64_t flags64;
389 
390  size -= 1024;
391  bytestream2_init(&gbc, data + size, 1024);
392  ctx->width = bytestream2_get_le32(&gbc);
393  ctx->height = bytestream2_get_le32(&gbc);
394  ctx->bit_rate = bytestream2_get_le64(&gbc);
395  ctx->bits_per_coded_sample = bytestream2_get_le32(&gbc);
396  // Try to initialize a parser for this codec, note, this may fail which just means we test without one
397  flags = bytestream2_get_byte(&gbc);
398  if (flags & 1)
399  parser = av_parser_init(c->p.id);
400  if (flags & 2)
401  ctx->strict_std_compliance = FF_COMPLIANCE_EXPERIMENTAL;
402  if (flags & 4) {
403  ctx->err_recognition = AV_EF_AGGRESSIVE | AV_EF_COMPLIANT | AV_EF_CAREFUL;
404  if (flags & 8)
405  ctx->err_recognition |= AV_EF_EXPLODE;
406  }
407  if ((flags & 0x10) && c->p.id != AV_CODEC_ID_H264)
408  ctx->flags2 |= AV_CODEC_FLAG2_FAST;
409  if (flags & 0x80)
410  ctx->export_side_data |= AV_CODEC_EXPORT_DATA_MVS;
411 
412  if (flags & 0x40)
413  av_force_cpu_flags(0);
414 
415  extradata_size = bytestream2_get_le32(&gbc);
416 
417  ctx->sample_rate = bytestream2_get_le32(&gbc) & 0x7FFFFFFF;
418  ctx->ch_layout.nb_channels = (unsigned)bytestream2_get_le32(&gbc) % FF_SANE_NB_CHANNELS;
419  ctx->block_align = bytestream2_get_le32(&gbc) & 0x7FFFFFFF;
420  ctx->codec_tag = bytestream2_get_le32(&gbc);
421  if (c->codec_tags) {
422  int n;
423  for (n = 0; c->codec_tags[n] != FF_CODEC_TAGS_END; n++);
424  ctx->codec_tag = c->codec_tags[ctx->codec_tag % n];
425  }
426  keyframes = bytestream2_get_le64(&gbc);
427  request_channel_layout = bytestream2_get_le64(&gbc);
428 
429  ctx->idct_algo = bytestream2_get_byte(&gbc) % 25;
430  flushpattern = bytestream2_get_le64(&gbc);
431  ctx->skip_frame = bytestream2_get_byte(&gbc) - 254 + AVDISCARD_ALL;
432 
433 
434  if (flags & 0x20) {
435  switch (ctx->codec_id) {
436  case AV_CODEC_ID_AC3:
437  case AV_CODEC_ID_EAC3:
438  av_dict_set_int(&opts, "cons_noisegen", bytestream2_get_byte(&gbc) & 1, 0);
439  av_dict_set_int(&opts, "heavy_compr", bytestream2_get_byte(&gbc) & 1, 0);
440  av_dict_set_int(&opts, "target_level", (int)(bytestream2_get_byte(&gbc) % 32) - 31, 0);
441  av_dict_set_int(&opts, "dmix_mode", (int)(bytestream2_get_byte(&gbc) % 4) - 1, 0);
442  break;
443  }
444  }
445 
446  // Keep the deprecated request_channel_layout behavior to ensure old fuzzing failures
447  // remain reproducible.
448  if (request_channel_layout) {
449  switch (ctx->codec_id) {
450  case AV_CODEC_ID_AC3:
451  case AV_CODEC_ID_EAC3:
452  case AV_CODEC_ID_MLP:
453  case AV_CODEC_ID_TRUEHD:
454  case AV_CODEC_ID_DTS:
455  if (request_channel_layout & ~INT64_MIN) {
456  char *downmix_layout = av_mallocz(19);
457  if (!downmix_layout)
458  error("Failed memory allocation");
459  av_strlcatf(downmix_layout, 19, "0x%"PRIx64, request_channel_layout & ~INT64_MIN);
460  av_dict_set(&opts, "downmix", downmix_layout, AV_DICT_DONT_STRDUP_VAL);
461  }
462  if (ctx->codec_id != AV_CODEC_ID_DTS)
463  break;
464  // fall-through
465  case AV_CODEC_ID_DOLBY_E:
466  av_dict_set_int(&opts, "channel_order", !!(request_channel_layout & INT64_MIN), 0);
467  break;
468  }
469  }
470 
471  flags64 = bytestream2_get_le64(&gbc);
472  if (flags64 &1)
473  ctx->debug |= FF_DEBUG_SKIP;
474  if (flags64 &2)
475  ctx->debug |= FF_DEBUG_QP;
476  if (flags64 &4)
477  ctx->debug |= FF_DEBUG_MB_TYPE;
478  if (flags64 & 8)
479  ctx->export_side_data |= AV_CODEC_EXPORT_DATA_VIDEO_ENC_PARAMS;
480  if (flags64 & 0x10)
481  ctx->err_recognition |= AV_EF_CRCCHECK;
482 
483  ctx->workaround_bugs = bytestream2_get_le32(&gbc);
484 
485  if (c->p.max_lowres) {
486  ctx->lowres = bytestream2_get_byte(&gbc) % (c->p.max_lowres+1);
487  }
488 
489  if (extradata_size < size) {
490  ctx->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
491  if (ctx->extradata) {
492  ctx->extradata_size = extradata_size;
493  size -= ctx->extradata_size;
494  memcpy(ctx->extradata, data + size, ctx->extradata_size);
495  }
496  }
497  if (av_image_check_size(ctx->width, ctx->height, 0, ctx))
498  ctx->width = ctx->height = 0;
499  }
500 
501  int res = avcodec_open2(ctx, &c->p, &opts);
502  if (res < 0) {
503  av_assert0(res != AVERROR_BUG);
504  avcodec_free_context(&ctx);
505  av_free(parser_avctx);
506  av_parser_close(parser);
507  av_dict_free(&opts);
508  return 0; // Failure of avcodec_open2() does not imply that a issue was found
509  }
510  parser_avctx->codec_id = ctx->codec_id;
511  parser_avctx->extradata_size = ctx->extradata_size;
512  parser_avctx->extradata = ctx->extradata ? av_memdup(ctx->extradata, ctx->extradata_size + AV_INPUT_BUFFER_PADDING_SIZE) : NULL;
513 
514 
515  int got_frame;
516  AVFrame *frame = av_frame_alloc();
517  AVPacket *avpkt = av_packet_alloc();
518  AVPacket *parsepkt = av_packet_alloc();
519  if (!frame || !avpkt || !parsepkt)
520  error("Failed memory allocation");
521 
522  // Read very simple container
523  while (data < end && it < maxiteration) {
524  // Search for the TAG
525  while (data + sizeof(fuzz_tag) < end) {
526  if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
527  break;
528  data++;
529  }
530  if (data + sizeof(fuzz_tag) > end)
531  data = end;
532 
533  res = av_new_packet(parsepkt, data - last);
534  if (res < 0)
535  error("Failed memory allocation");
536  memcpy(parsepkt->data, last, data - last);
537  parsepkt->flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY;
538  keyframes = (keyframes >> 2) + (keyframes<<62);
539  data += sizeof(fuzz_tag);
540  last = data;
541 
542  while (parsepkt->size > 0) {
543  int decode_more;
544 
545  if (parser) {
546  int ret = av_parser_parse2(parser, parser_avctx, &avpkt->data, &avpkt->size,
547  parsepkt->data, parsepkt->size,
548  parsepkt->pts, parsepkt->dts, parsepkt->pos);
549  if (avpkt->data == parsepkt->data) {
550  avpkt->buf = av_buffer_ref(parsepkt->buf);
551  if (!avpkt->buf)
552  error("Failed memory allocation");
553  } else {
554  if (av_packet_make_refcounted(avpkt) < 0)
555  error("Failed memory allocation");
556  }
557  parsepkt->data += ret;
558  parsepkt->size -= ret;
559  parsepkt->pos += ret;
560  avpkt->pts = parser->pts;
561  avpkt->dts = parser->dts;
562  avpkt->pos = parser->pos;
563  if ( parser->key_frame == 1 ||
564  (parser->key_frame == -1 && parser->pict_type == AV_PICTURE_TYPE_I))
565  avpkt->flags |= AV_PKT_FLAG_KEY;
566  avpkt->flags |= parsepkt->flags & AV_PKT_FLAG_DISCARD;
567  } else {
568  av_packet_move_ref(avpkt, parsepkt);
569  }
570 
571  if (!(flushpattern & 7))
572  avcodec_flush_buffers(ctx);
573  flushpattern = (flushpattern >> 3) + (flushpattern << 61);
574 
575  if (ctx->codec_type != AVMEDIA_TYPE_SUBTITLE) {
576  int ret = avcodec_send_packet(ctx, avpkt);
577  av_assert0(ret != AVERROR_BUG);
578  decode_more = ret >= 0;
579  if(!decode_more) {
580  ec_pixels += (ctx->width + 32LL) * (ctx->height + 32LL);
581  if (it > 20 || ec_pixels > 4 * ctx->max_pixels) {
582  ctx->error_concealment = 0;
583  ctx->debug &= ~(FF_DEBUG_SKIP | FF_DEBUG_QP | FF_DEBUG_MB_TYPE);
584  }
585  if (ec_pixels > maxpixels)
586  goto maximums_reached;
587  }
588  } else
589  decode_more = 1;
590 
591  // Iterate through all data
592  while (decode_more && it++ < maxiteration) {
593  av_frame_unref(frame);
594  int ret = decode_handler(ctx, frame, &got_frame, avpkt);
595 
596  ec_pixels += (ctx->width + 32LL) * (ctx->height + 32LL);
597  if (it > 20 || ec_pixels > 4 * ctx->max_pixels) {
598  ctx->error_concealment = 0;
599  ctx->debug &= ~(FF_DEBUG_SKIP | FF_DEBUG_QP | FF_DEBUG_MB_TYPE);
600  }
601  if (ec_pixels > maxpixels)
602  goto maximums_reached;
603 
604  if (ctx->codec_type == AVMEDIA_TYPE_AUDIO &&
605  frame->nb_samples == 0 && !got_frame &&
606  (avpkt->flags & AV_PKT_FLAG_DISCARD))
607  nb_samples += ctx->max_samples;
608 
609  nb_samples += frame->nb_samples;
610  if (nb_samples > maxsamples)
611  goto maximums_reached;
612 
613  if (ret <= 0 || ret > avpkt->size)
614  break;
615 
616  if (ctx->codec_type == AVMEDIA_TYPE_SUBTITLE) {
617  avpkt->data += ret;
618  avpkt->size -= ret;
619  decode_more = avpkt->size > 0;
620  } else
621  decode_more = ret >= 0;
622  }
623  av_packet_unref(avpkt);
624  }
625  av_packet_unref(parsepkt);
626  }
627 maximums_reached:
628 
629  av_packet_unref(avpkt);
630 
631  if (ctx->codec_type != AVMEDIA_TYPE_SUBTITLE) {
632  int ret = avcodec_send_packet(ctx, NULL);
633  av_assert0(ret != AVERROR_BUG);
634  }
635 
636  do {
637  got_frame = 0;
638  av_frame_unref(frame);
639  decode_handler(ctx, frame, &got_frame, avpkt);
640 
641  nb_samples += frame->nb_samples;
642  if (nb_samples > maxsamples)
643  break;
644  } while (got_frame == 1 && it++ < maxiteration);
645 
646  // fprintf(stderr, "pixels decoded: %"PRId64", samples decoded: %"PRId64", iterations: %d\n", ec_pixels, nb_samples, it);
647 
648  av_frame_free(&frame);
649  avcodec_free_context(&ctx);
650  avcodec_free_context(&parser_avctx);
651  av_parser_close(parser);
652  av_packet_free(&avpkt);
653  av_packet_free(&parsepkt);
654  av_dict_free(&opts);
655  return 0;
656 }
flags
const SwsFlags flags[]
Definition: swscale.c:85
AV_CODEC_ID_TRUEMOTION2
@ AV_CODEC_ID_TRUEMOTION2
Definition: codec_id.h:129
AVSubtitle
Definition: avcodec.h:2100
av_packet_unref
void av_packet_unref(AVPacket *pkt)
Wipe the packet.
Definition: packet.c:434
AVCodec
AVCodec.
Definition: codec.h:172
AVMEDIA_TYPE_SUBTITLE
@ AVMEDIA_TYPE_SUBTITLE
Definition: avutil.h:203
AV_CODEC_ID_VP6F
@ AV_CODEC_ID_VP6F
Definition: codec_id.h:144
AV_CODEC_ID_MSCC
@ AV_CODEC_ID_MSCC
Definition: codec_id.h:286
AV_CODEC_ID_SANM
@ AV_CODEC_ID_SANM
Definition: codec_id.h:236
AV_CODEC_ID_LAGARITH
@ AV_CODEC_ID_LAGARITH
Definition: codec_id.h:199
AVCodecParserContext::pts
int64_t pts
Definition: avcodec.h:2623
AV_EF_EXPLODE
#define AV_EF_EXPLODE
abort decoding on minor error detection
Definition: defs.h:51
AV_CODEC_ID_INDEO5
@ AV_CODEC_ID_INDEO5
Definition: codec_id.h:164
AV_CODEC_ID_AC3
@ AV_CODEC_ID_AC3
Definition: codec_id.h:464
AV_EF_CAREFUL
#define AV_EF_CAREFUL
consider things that violate the spec, are fast to calculate and have not been seen in the wild as er...
Definition: defs.h:54
AVERROR
Filter the word “frame” indicates either a video frame or a group of audio as stored in an AVFrame structure Format for each input and each output the list of supported formats For video that means pixel format For audio that means channel sample they are references to shared objects When the negotiation mechanism computes the intersection of the formats supported at each end of a all references to both lists are replaced with a reference to the intersection And when a single format is eventually chosen for a link amongst the remaining all references to the list are updated That means that if a filter requires that its input and output have the same format amongst a supported all it has to do is use a reference to the same list of formats query_formats can leave some formats unset and return AVERROR(EAGAIN) to cause the negotiation mechanism toagain later. That can be used by filters with complex requirements to use the format negotiated on one link to set the formats supported on another. Frame references ownership and permissions
AV_CODEC_ID_APE
@ AV_CODEC_ID_APE
Definition: codec_id.h:493
AV_CODEC_ID_TQI
@ AV_CODEC_ID_TQI
Definition: codec_id.h:174
AV_EF_COMPLIANT
#define AV_EF_COMPLIANT
consider all spec non compliances as errors
Definition: defs.h:55
AVCodecParserContext::pict_type
int pict_type
Definition: avcodec.h:2612
AV_CODEC_ID_ZMBV
@ AV_CODEC_ID_ZMBV
Definition: codec_id.h:133
AV_CODEC_ID_RV60
@ AV_CODEC_ID_RV60
Definition: codec_id.h:330
GetByteContext
Definition: bytestream.h:33
AV_CODEC_ID_INTERPLAY_ACM
@ AV_CODEC_ID_INTERPLAY_ACM
Definition: codec_id.h:539
AV_CODEC_ID_SRGC
@ AV_CODEC_ID_SRGC
Definition: codec_id.h:287
AV_CODEC_ID_LOCO
@ AV_CODEC_ID_LOCO
Definition: codec_id.h:124
AV_LOG_PANIC
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:197
AV_PKT_FLAG_DISCARD
#define AV_PKT_FLAG_DISCARD
Flag is used to discard packets which are required to maintain valid decoder state but are not requir...
Definition: packet.h:665
AV_CODEC_ID_DIRAC
@ AV_CODEC_ID_DIRAC
Definition: codec_id.h:168
int64_t
long long int64_t
Definition: coverity.c:34
AV_CODEC_ID_MVC2
@ AV_CODEC_ID_MVC2
Definition: codec_id.h:239
av_frame_free
void av_frame_free(AVFrame **frame)
Free the frame and any dynamically allocated objects in it, e.g.
Definition: frame.c:64
AV_RN64
#define AV_RN64(p)
Definition: intreadwrite.h:364
AVFrame
This structure describes decoded (raw) audio or video data.
Definition: frame.h:466
AVCodec::capabilities
int capabilities
Codec capabilities.
Definition: codec.h:191
AVFormatContext::strict_std_compliance
int strict_std_compliance
Allow non-standard and experimental extension.
Definition: avformat.h:1673
AV_CODEC_ID_MWSC
@ AV_CODEC_ID_MWSC
Definition: codec_id.h:293
internal.h
AVPacket::data
uint8_t * data
Definition: packet.h:603
AV_CODEC_ID_VP6
@ AV_CODEC_ID_VP6
Definition: codec_id.h:143
AV_CODEC_ID_FLIC
@ AV_CODEC_ID_FLIC
Definition: codec_id.h:102
data
const char data[16]
Definition: mxf.c:149
AV_CODEC_ID_CDTOONS
@ AV_CODEC_ID_CDTOONS
Definition: codec_id.h:304
FFCodec
Definition: codec_internal.h:127
c
static const FFCodec * c
Definition: target_dec_fuzzer.c:69
AV_CODEC_ID_GDV
@ AV_CODEC_ID_GDV
Definition: codec_id.h:289
AV_CODEC_ID_ARBC
@ AV_CODEC_ID_ARBC
Definition: codec_id.h:297
AV_CODEC_ID_RTV1
@ AV_CODEC_ID_RTV1
Definition: codec_id.h:326
AV_CODEC_ID_SCREENPRESSO
@ AV_CODEC_ID_SCREENPRESSO
Definition: codec_id.h:246
FF_COMPLIANCE_EXPERIMENTAL
#define FF_COMPLIANCE_EXPERIMENTAL
Allow nonstandardized experimental things.
Definition: defs.h:62
AV_CODEC_ID_VB
@ AV_CODEC_ID_VB
Definition: codec_id.h:160
AVDictionary
Definition: dict.c:32
AV_CODEC_ID_FLAC
@ AV_CODEC_ID_FLAC
Definition: codec_id.h:473
av_buffer_ref
AVBufferRef * av_buffer_ref(const AVBufferRef *buf)
Create a new reference to an AVBuffer.
Definition: buffer.c:103
AV_CODEC_ID_APNG
@ AV_CODEC_ID_APNG
Definition: codec_id.h:269
AV_CODEC_ID_MXPEG
@ AV_CODEC_ID_MXPEG
Definition: codec_id.h:198
av_strlcatf
size_t av_strlcatf(char *dst, size_t size, const char *fmt,...)
Definition: avstring.c:103
AV_CODEC_ID_TRUEHD
@ AV_CODEC_ID_TRUEHD
Definition: codec_id.h:505
cpu.h
AV_PKT_FLAG_KEY
#define AV_PKT_FLAG_KEY
The packet contains a keyframe.
Definition: packet.h:658
dummy
static int dummy
Definition: ffplay.c:3751
av_packet_free
void av_packet_free(AVPacket **pkt)
Free the packet, if the packet is reference counted, it will be unreferenced first.
Definition: packet.c:74
AV_CODEC_ID_DSICINVIDEO
@ AV_CODEC_ID_DSICINVIDEO
Definition: codec_id.h:146
AV_CODEC_ID_RSCC
@ AV_CODEC_ID_RSCC
Definition: codec_id.h:247
av_memdup
void * av_memdup(const void *p, size_t size)
Duplicate a buffer with av_malloc().
Definition: mem.c:304
AVCodec::max_lowres
uint8_t max_lowres
maximum value for lowres supported by the decoder
Definition: codec.h:192
AVCodecParserContext::key_frame
int key_frame
Set by parser to 1 for key frames and 0 for non-key frames.
Definition: avcodec.h:2653
FFCodec::p
AVCodec p
The public AVCodec.
Definition: codec_internal.h:131
AV_CODEC_ID_PIXLET
@ AV_CODEC_ID_PIXLET
Definition: codec_id.h:278
AV_CODEC_ID_IFF_ILBM
@ AV_CODEC_ID_IFF_ILBM
Definition: codec_id.h:188
AV_CODEC_ID_SPEEX
@ AV_CODEC_ID_SPEEX
Definition: codec_id.h:496
AV_CODEC_ID_MV30
@ AV_CODEC_ID_MV30
Definition: codec_id.h:305
AV_CODEC_ID_MSZH
@ AV_CODEC_ID_MSZH
Definition: codec_id.h:105
AV_CODEC_ID_SMACKAUDIO
@ AV_CODEC_ID_SMACKAUDIO
Definition: codec_id.h:484
max_alloc_pixels
static uint64_t max_alloc_pixels
Definition: target_dec_fuzzer.c:109
AV_CODEC_ID_RKA
@ AV_CODEC_ID_RKA
Definition: codec_id.h:563
av_parser_init
AVCodecParserContext * av_parser_init(int codec_id)
Definition: parser.c:36
AV_CODEC_ID_VMIX
@ AV_CODEC_ID_VMIX
Definition: codec_id.h:327
AV_CODEC_ID_FFWAVESYNTH
@ AV_CODEC_ID_FFWAVESYNTH
Definition: codec_id.h:529
AVCodecParserContext::dts
int64_t dts
Definition: avcodec.h:2624
FF_CODEC_TAGS_END
#define FF_CODEC_TAGS_END
FFCodec.codec_tags termination value.
Definition: codec_internal.h:95
avsubtitle_free
void avsubtitle_free(AVSubtitle *sub)
Free all allocated data in the given subtitle struct.
Definition: avcodec.c:421
AV_DICT_DONT_STRDUP_VAL
#define AV_DICT_DONT_STRDUP_VAL
Take ownership of a value that's been allocated with av_malloc() or another memory allocation functio...
Definition: dict.h:79
av_frame_alloc
AVFrame * av_frame_alloc(void)
Allocate an AVFrame and set its fields to default values.
Definition: frame.c:52
AV_CODEC_ID_DVB_SUBTITLE
@ AV_CODEC_ID_DVB_SUBTITLE
Definition: codec_id.h:575
AVFormatContext::bit_rate
int64_t bit_rate
Total stream bitrate in bit/s, 0 if not available.
Definition: avformat.h:1456
avcodec_decode_subtitle2
int avcodec_decode_subtitle2(AVCodecContext *avctx, AVSubtitle *sub, int *got_sub_ptr, const AVPacket *avpkt)
Decode a subtitle message.
Definition: decode.c:929
avassert.h
AV_CODEC_CAP_EXPERIMENTAL
#define AV_CODEC_CAP_EXPERIMENTAL
Codec is experimental and is thus avoided in favor of non experimental encoders.
Definition: codec.h:87
LLVMFuzzerTestOneInput
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
Definition: target_dec_fuzzer.c:177
AV_CODEC_ID_CFHD
@ AV_CODEC_ID_CFHD
Definition: codec_id.h:271
AVCodecContext::extradata_size
int extradata_size
Definition: avcodec.h:527
AV_CODEC_ID_4XM
@ AV_CODEC_ID_4XM
Definition: codec_id.h:86
avcodec_alloc_context3
AVCodecContext * avcodec_alloc_context3(const AVCodec *codec)
Allocate an AVCodecContext and set its fields to default values.
Definition: options.c:149
av_image_fill_linesizes
int av_image_fill_linesizes(int linesizes[4], enum AVPixelFormat pix_fmt, int width)
Fill plane linesizes for an image with pixel format pix_fmt and width width.
Definition: imgutils.c:89
intreadwrite.h
av_new_packet
int av_new_packet(AVPacket *pkt, int size)
Allocate the payload of a packet and initialize its fields with default values.
Definition: packet.c:98
AV_CODEC_ID_BMP
@ AV_CODEC_ID_BMP
Definition: codec_id.h:130
AV_CODEC_ID_WMAPRO
@ AV_CODEC_ID_WMAPRO
Definition: codec_id.h:498
AVMEDIA_TYPE_AUDIO
@ AVMEDIA_TYPE_AUDIO
Definition: avutil.h:201
AV_CODEC_ID_VP9
@ AV_CODEC_ID_VP9
Definition: codec_id.h:222
AV_CODEC_ID_NUV
@ AV_CODEC_ID_NUV
Definition: codec_id.h:136
AV_CODEC_ID_SGA_VIDEO
@ AV_CODEC_ID_SGA_VIDEO
Definition: codec_id.h:314
AV_CODEC_ID_WS_VQA
@ AV_CODEC_ID_WS_VQA
Definition: codec_id.h:96
AV_CODEC_ID_ARGO
@ AV_CODEC_ID_ARGO
Definition: codec_id.h:311
AV_CODEC_ID_WMV2
@ AV_CODEC_ID_WMV2
Definition: codec_id.h:70
avcodec_receive_frame
int avcodec_receive_frame(AVCodecContext *avctx, AVFrame *frame)
Alias for avcodec_receive_frame_flags(avctx, frame, 0).
Definition: avcodec.c:731
av_assert0
#define av_assert0(cond)
assert() equivalent, that is always enabled.
Definition: avassert.h:42
AV_CODEC_ID_UTVIDEO
@ AV_CODEC_ID_UTVIDEO
Definition: codec_id.h:205
ctx
static AVFormatContext * ctx
Definition: movenc.c:49
avcodec_align_dimensions2
void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, int linesize_align[AV_NUM_DATA_POINTERS])
Modify width and height values so that they will result in a memory buffer that is acceptable for the...
Definition: utils.c:141
codec_id
enum AVCodecID codec_id
Definition: vaapi_decode.c:410
AV_CODEC_ID_DOLBY_E
@ AV_CODEC_ID_DOLBY_E
Definition: codec_id.h:545
AV_CODEC_ID_VC1IMAGE
@ AV_CODEC_ID_VC1IMAGE
Definition: codec_id.h:204
av_mallocz
#define av_mallocz(s)
Definition: tableprint_vlc.h:31
AV_CODEC_ID_H264
@ AV_CODEC_ID_H264
Definition: codec_id.h:79
AVCodecContext::codec_id
enum AVCodecID codec_id
Definition: avcodec.h:453
AV_CODEC_ID_PNG
@ AV_CODEC_ID_PNG
Definition: codec_id.h:113
if
if(ret)
Definition: filter_design.txt:179
AV_CODEC_ID_TDSC
@ AV_CODEC_ID_TDSC
Definition: codec_id.h:241
AVDISCARD_ALL
@ AVDISCARD_ALL
discard all
Definition: defs.h:232
AV_CODEC_ID_WMV3
@ AV_CODEC_ID_WMV3
Definition: codec_id.h:123
fail
#define fail
Definition: test.h:478
opts
static AVDictionary * opts
Definition: movenc.c:51
FUZZ_TAG
static const uint64_t FUZZ_TAG
Definition: target_dec_fuzzer.c:106
AV_CODEC_ID_EXR
@ AV_CODEC_ID_EXR
Definition: codec_id.h:234
AVPacket::buf
AVBufferRef * buf
A reference to the reference-counted buffer where the packet data is stored.
Definition: packet.h:586
NULL
#define NULL
Definition: coverity.c:32
AV_CODEC_ID_DST
@ AV_CODEC_ID_DST
Definition: codec_id.h:542
AV_CODEC_ID_INTERPLAY_VIDEO
@ AV_CODEC_ID_INTERPLAY_VIDEO
Definition: codec_id.h:91
AV_CODEC_ID_ZEROCODEC
@ AV_CODEC_ID_ZEROCODEC
Definition: codec_id.h:215
AVCodec::type
enum AVMediaType type
Definition: codec.h:185
av_image_fill_plane_sizes
int av_image_fill_plane_sizes(size_t sizes[4], enum AVPixelFormat pix_fmt, int height, const ptrdiff_t linesizes[4])
Fill plane sizes for an image with pixel format pix_fmt and height height.
Definition: imgutils.c:111
avcodec_free_context
void avcodec_free_context(AVCodecContext **avctx)
Free the codec context and everything associated with it and write NULL to the provided pointer.
Definition: options.c:164
FF_DEBUG_MB_TYPE
#define FF_DEBUG_MB_TYPE
Definition: avcodec.h:1396
AV_CODEC_ID_WMALOSSLESS
@ AV_CODEC_ID_WMALOSSLESS
Definition: codec_id.h:499
AV_CODEC_ID_MVDV
@ AV_CODEC_ID_MVDV
Definition: codec_id.h:302
AV_CODEC_ID_CINEPAK
@ AV_CODEC_ID_CINEPAK
Definition: codec_id.h:95
AV_CODEC_ID_MOTIONPIXELS
@ AV_CODEC_ID_MOTIONPIXELS
Definition: codec_id.h:171
AV_CODEC_FLAG2_FAST
#define AV_CODEC_FLAG2_FAST
Allow non spec compliant speedup tricks.
Definition: avcodec.h:337
AV_CODEC_ID_CPIA
@ AV_CODEC_ID_CPIA
Definition: codec_id.h:265
AV_PICTURE_TYPE_I
@ AV_PICTURE_TYPE_I
Intra.
Definition: avutil.h:278
AV_CODEC_ID_ZLIB
@ AV_CODEC_ID_ZLIB
Definition: codec_id.h:106
AV_CODEC_ID_FMVC
@ AV_CODEC_ID_FMVC
Definition: codec_id.h:280
AV_CODEC_ID_ANM
@ AV_CODEC_ID_ANM
Definition: codec_id.h:186
avcodec_open2
int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *codec, AVDictionary **options)
Initialize the AVCodecContext to use the given AVCodec.
Definition: avcodec.c:144
av_packet_move_ref
void av_packet_move_ref(AVPacket *dst, AVPacket *src)
Move every field in src to dst and reset src.
Definition: packet.c:491
AV_EF_CRCCHECK
#define AV_EF_CRCCHECK
Verify checksums embedded in the bitstream (could be of either encoded or decoded data,...
Definition: defs.h:48
AV_CODEC_ID_VMDVIDEO
@ AV_CODEC_ID_VMDVIDEO
Definition: codec_id.h:104
AV_CODEC_ID_VP6A
@ AV_CODEC_ID_VP6A
Definition: codec_id.h:158
AV_CODEC_ID_VP4
@ AV_CODEC_ID_VP4
Definition: codec_id.h:300
AV_CODEC_ID_MAGICYUV
@ AV_CODEC_ID_MAGICYUV
Definition: codec_id.h:274
AV_CODEC_ID_MP4ALS
@ AV_CODEC_ID_MP4ALS
Definition: codec_id.h:506
error
static void error(const char *err)
Definition: target_dec_fuzzer.c:63
AVCodecID
AVCodecID
Identify the syntax and semantics of the bitstream.
Definition: codec_id.h:49
avcodec_find_decoder
const AVCodec * avcodec_find_decoder(enum AVCodecID id)
Find a registered decoder with a matching codec ID.
Definition: allcodecs.c:1045
AV_CODEC_ID_EAC3
@ AV_CODEC_ID_EAC3
Definition: codec_id.h:501
AV_CODEC_ID_LSCR
@ AV_CODEC_ID_LSCR
Definition: codec_id.h:299
AV_CODEC_ID_WCMV
@ AV_CODEC_ID_WCMV
Definition: codec_id.h:294
AV_CODEC_ID_FFV1
@ AV_CODEC_ID_FFV1
Definition: codec_id.h:85
AV_CODEC_CAP_DR1
#define AV_CODEC_CAP_DR1
Codec uses get_buffer() or get_encode_buffer() for allocating buffers and supports custom allocators.
Definition: codec.h:52
AV_CODEC_ID_SCPR
@ AV_CODEC_ID_SCPR
Definition: codec_id.h:281
AVPacket::size
int size
Definition: packet.h:604
codec_internal.h
AV_CODEC_ID_YLC
@ AV_CODEC_ID_YLC
Definition: codec_id.h:276
i
#define i(width, name, range_min, range_max)
Definition: cbs_h264.c:63
AV_CODEC_ID_RASC
@ AV_CODEC_ID_RASC
Definition: codec_id.h:295
codec_list
const FFCodec * codec_list[]
AV_CODEC_ID_DXV
@ AV_CODEC_ID_DXV
Definition: codec_id.h:245
AV_CODEC_ID_DTS
@ AV_CODEC_ID_DTS
Definition: codec_id.h:465
size
int size
Definition: twinvq_data.h:10344
AV_NUM_DATA_POINTERS
#define AV_NUM_DATA_POINTERS
Definition: frame.h:467
ffcodec
static const av_always_inline FFCodec * ffcodec(const AVCodec *codec)
Definition: codec_internal.h:290
AV_CODEC_ID_MSRLE
@ AV_CODEC_ID_MSRLE
Definition: codec_id.h:97
AV_CODEC_ID_OPUS
@ AV_CODEC_ID_OPUS
Definition: codec_id.h:521
AV_CODEC_ID_QOI
@ AV_CODEC_ID_QOI
Definition: codec_id.h:318
AVPacket::dts
int64_t dts
Decompression timestamp in AVStream->time_base units; the time at which the packet is decompressed.
Definition: packet.h:602
AV_CODEC_ID_QPEG
@ AV_CODEC_ID_QPEG
Definition: codec_id.h:112
AV_CODEC_ID_RV30
@ AV_CODEC_ID_RV30
Definition: codec_id.h:120
AV_CODEC_ID_MMVIDEO
@ AV_CODEC_ID_MMVIDEO
Definition: codec_id.h:132
av_packet_make_refcounted
int av_packet_make_refcounted(AVPacket *pkt)
Ensure the data described by a given packet is reference counted.
Definition: packet.c:497
AVPacket::flags
int flags
A combination of AV_PKT_FLAG values.
Definition: packet.h:609
av_packet_alloc
AVPacket * av_packet_alloc(void)
Allocate an AVPacket and set its fields to default values.
Definition: packet.c:63
av_dict_free
void av_dict_free(AVDictionary **pm)
Free all the memory allocated for an AVDictionary struct and all keys and values.
Definition: dict.c:233
AV_CODEC_ID_QDRAW
@ AV_CODEC_ID_QDRAW
Definition: codec_id.h:110
av_buffer_alloc
AVBufferRef * av_buffer_alloc(size_t size)
Allocate an AVBuffer of the given size using av_malloc().
Definition: buffer.c:77
AV_CODEC_ID_DXA
@ AV_CODEC_ID_DXA
Definition: codec_id.h:150
AV_CODEC_ID_INDEO4
@ AV_CODEC_ID_INDEO4
Definition: codec_id.h:163
AV_CODEC_ID_MSS2
@ AV_CODEC_ID_MSS2
Definition: codec_id.h:221
AVCodec::id
enum AVCodecID id
Definition: codec.h:186
AV_CODEC_ID_HQ_HQA
@ AV_CODEC_ID_HQ_HQA
Definition: codec_id.h:242
AV_CODEC_ID_VP5
@ AV_CODEC_ID_VP5
Definition: codec_id.h:142
AV_CODEC_ID_XAN_WC3
@ AV_CODEC_ID_XAN_WC3
Definition: codec_id.h:92
AV_CODEC_ID_VP3
@ AV_CODEC_ID_VP3
Definition: codec_id.h:81
AV_CODEC_ID_GIF
@ AV_CODEC_ID_GIF
Definition: codec_id.h:149
AV_CODEC_ID_TGV
@ AV_CODEC_ID_TGV
Definition: codec_id.h:172
AV_CODEC_ID_VP7
@ AV_CODEC_ID_VP7
Definition: codec_id.h:235
avcodec_default_get_buffer2
int avcodec_default_get_buffer2(AVCodecContext *s, AVFrame *frame, int flags)
The default callback for AVCodecContext.get_buffer2().
Definition: get_buffer.c:253
avcodec_send_packet
int avcodec_send_packet(AVCodecContext *avctx, const AVPacket *avpkt)
Supply raw packet data as input to a decoder.
Definition: decode.c:724
av_log_set_level
void av_log_set_level(int level)
Set the log level.
Definition: log.c:477
AV_CODEC_ID_CRI
@ AV_CODEC_ID_CRI
Definition: codec_id.h:312
AVCodecParserContext::pos
int64_t pos
Byte position of currently parsed frame in stream.
Definition: avcodec.h:2706
AVPacket::pts
int64_t pts
Presentation timestamp in AVStream->time_base units; the time at which the decompressed packet will b...
Definition: packet.h:596
AV_CODEC_ID_MTS2
@ AV_CODEC_ID_MTS2
Definition: codec_id.h:219
AVCodecContext::extradata
uint8_t * extradata
Out-of-band global headers that may be used by some codecs.
Definition: avcodec.h:526
AV_CODEC_ID_THEORA
@ AV_CODEC_ID_THEORA
Definition: codec_id.h:82
AV_CODEC_ID_CAVS
@ AV_CODEC_ID_CAVS
Definition: codec_id.h:139
FF_DEBUG_SKIP
#define FF_DEBUG_SKIP
Definition: avcodec.h:1399
av_force_cpu_flags
void av_force_cpu_flags(int arg)
Disables cpu detection and forces the specified flags.
Definition: cpu.c:81
AV_CODEC_ID_PAF_VIDEO
@ AV_CODEC_ID_PAF_VIDEO
Definition: codec_id.h:233
AV_CODEC_ID_BONK
@ AV_CODEC_ID_BONK
Definition: codec_id.h:558
AV_CODEC_ID_HEVC
@ AV_CODEC_ID_HEVC
Definition: codec_id.h:228
FFMIN
#define FFMIN(a, b)
Definition: macros.h:49
AV_CODEC_ID_HNM4_VIDEO
@ AV_CODEC_ID_HNM4_VIDEO
Definition: codec_id.h:227
av_frame_unref
void av_frame_unref(AVFrame *frame)
Unreference all the buffers referenced by frame and reset the frame fields.
Definition: frame.c:496
AV_CODEC_ID_CMV
@ AV_CODEC_ID_CMV
Definition: codec_id.h:170
AV_CODEC_ID_VC1
@ AV_CODEC_ID_VC1
Definition: codec_id.h:122
AV_CODEC_ID_WEBP
@ AV_CODEC_ID_WEBP
Definition: codec_id.h:226
AV_CODEC_ID_JPEG2000
@ AV_CODEC_ID_JPEG2000
Definition: codec_id.h:140
AV_CODEC_ID_BETHSOFTVID
@ AV_CODEC_ID_BETHSOFTVID
Definition: codec_id.h:155
AV_CODEC_ID_MVHA
@ AV_CODEC_ID_MVHA
Definition: codec_id.h:303
AV_CODEC_ID_MVC1
@ AV_CODEC_ID_MVC1
Definition: codec_id.h:238
avcodec.h
AVCodecParserContext
Definition: avcodec.h:2604
AVCodecInitialize
static const FFCodec * AVCodecInitialize(enum AVCodecID codec_id)
Definition: target_dec_fuzzer.c:72
fuzz_video_get_buffer
static int fuzz_video_get_buffer(AVCodecContext *ctx, AVFrame *frame)
Definition: target_dec_fuzzer.c:111
AV_CODEC_ID_SMACKVIDEO
@ AV_CODEC_ID_SMACKVIDEO
Definition: codec_id.h:135
av_buffer_allocz
AVBufferRef * av_buffer_allocz(size_t size)
Same as av_buffer_alloc(), except the returned buffer will be initialized to zero.
Definition: buffer.c:93
ret
ret
Definition: filter_design.txt:187
AV_EF_AGGRESSIVE
#define AV_EF_AGGRESSIVE
consider things that a sane encoder/muxer should not do as an error
Definition: defs.h:56
avcodec_flush_buffers
void avcodec_flush_buffers(AVCodecContext *avctx)
Reset the internal codec state / flush internal buffers.
Definition: avcodec.c:389
frame
these buffered frames must be flushed immediately if a new input produces new the filter must not call request_frame to get more It must just process the frame or queue it The task of requesting more frames is left to the filter s request_frame method or the application If a filter has several the filter must be ready for frames arriving randomly on any input any filter with several inputs will most likely require some kind of queuing mechanism It is perfectly acceptable to have a limited queue and to drop frames when the inputs are too unbalanced request_frame For filters that do not use the this method is called when a frame is wanted on an output For a it should directly call filter_frame on the corresponding output For a if there are queued frames already one of these frames should be pushed If the filter should request a frame on one of its repeatedly until at least one frame has been pushed Return or at least make progress towards producing a frame
Definition: filter_design.txt:265
AV_CODEC_ID_CSCD
@ AV_CODEC_ID_CSCD
Definition: codec_id.h:131
alloc_pixels
static uint64_t alloc_pixels
Definition: target_dec_fuzzer.c:108
avformat.h
audio_video_handler
static int audio_video_handler(AVCodecContext *avctx, AVFrame *frame, int *got_frame, const AVPacket *dummy)
Definition: target_dec_fuzzer.c:94
FF_DEBUG_QP
#define FF_DEBUG_QP
Definition: avcodec.h:1397
AV_CODEC_ID_JV
@ AV_CODEC_ID_JV
Definition: codec_id.h:201
AV_INPUT_BUFFER_PADDING_SIZE
#define AV_INPUT_BUFFER_PADDING_SIZE
Definition: defs.h:40
AV_CODEC_ID_MUSEPACK8
@ AV_CODEC_ID_MUSEPACK8
Definition: codec_id.h:495
AV_CODEC_EXPORT_DATA_VIDEO_ENC_PARAMS
#define AV_CODEC_EXPORT_DATA_VIDEO_ENC_PARAMS
Decoding only.
Definition: avcodec.h:399
fuzz_get_buffer2
static int fuzz_get_buffer2(AVCodecContext *ctx, AVFrame *frame, int flags)
Definition: target_dec_fuzzer.c:163
AV_CODEC_ID_AGM
@ AV_CODEC_ID_AGM
Definition: codec_id.h:298
AVFormatContext::debug
int debug
Flags to enable debugging.
Definition: avformat.h:1589
AVCodecContext
main external API structure.
Definition: avcodec.h:443
AV_CODEC_ID_SNOW
@ AV_CODEC_ID_SNOW
Definition: codec_id.h:267
AV_CODEC_ID_HAP
@ AV_CODEC_ID_HAP
Definition: codec_id.h:243
AV_CODEC_ID_BINKVIDEO
@ AV_CODEC_ID_BINKVIDEO
Definition: codec_id.h:187
FFCodec::codec_tags
const uint32_t * codec_tags
List of supported codec_tags, terminated by FF_CODEC_TAGS_END.
Definition: codec_internal.h:275
AV_CODEC_ID_BFI
@ AV_CODEC_ID_BFI
Definition: codec_id.h:169
AV_CODEC_ID_SIMBIOSIS_IMX
@ AV_CODEC_ID_SIMBIOSIS_IMX
Definition: codec_id.h:313
AV_CODEC_ID_MSA1
@ AV_CODEC_ID_MSA1
Definition: codec_id.h:217
AV_CODEC_ID_VMNC
@ AV_CODEC_ID_VMNC
Definition: codec_id.h:141
av_dict_set_int
int av_dict_set_int(AVDictionary **pm, const char *key, int64_t value, int flags)
Convenience wrapper for av_dict_set() that converts the value to a string and stores it.
Definition: dict.c:177
AVMEDIA_TYPE_VIDEO
@ AVMEDIA_TYPE_VIDEO
Definition: avutil.h:200
av_parser_parse2
int av_parser_parse2(AVCodecParserContext *s, AVCodecContext *avctx, uint8_t **poutbuf, int *poutbuf_size, const uint8_t *buf, int buf_size, int64_t pts, int64_t dts, int64_t pos)
Parse a packet.
Definition: parser.c:124
mem.h
AV_CODEC_ID_QTRLE
@ AV_CODEC_ID_QTRLE
Definition: codec_id.h:107
AV_CODEC_ID_GEM
@ AV_CODEC_ID_GEM
Definition: codec_id.h:315
AV_CODEC_EXPORT_DATA_MVS
#define AV_CODEC_EXPORT_DATA_MVS
Export motion vectors through frame side data.
Definition: avcodec.h:390
it
s EdgeDetect Foobar g libavfilter vf_edgedetect c libavfilter vf_foobar c edit libavfilter and add an entry for foobar following the pattern of the other filters edit libavfilter allfilters and add an entry for foobar following the pattern of the other filters configure make j< whatever > ffmpeg ffmpeg i you should get a foobar png with Lena edge detected That s it
Definition: writing_filters.txt:31
AV_CODEC_ID_G2M
@ AV_CODEC_ID_G2M
Definition: codec_id.h:225
AV_CODEC_ID_TSCC
@ AV_CODEC_ID_TSCC
Definition: codec_id.h:108
w
uint8_t w
Definition: llvidencdsp.c:39
av_free
#define av_free(p)
Definition: tableprint_vlc.h:34
FFALIGN
#define FFALIGN(x, a)
Definition: macros.h:78
AVPacket
This structure stores compressed data.
Definition: packet.h:580
av_dict_set
int av_dict_set(AVDictionary **pm, const char *key, const char *value, int flags)
Set the given entry in *pm, overwriting an existing entry.
Definition: dict.c:86
AVPacket::pos
int64_t pos
byte position in stream, -1 if unknown
Definition: packet.h:623
AV_CODEC_ID_TAK
@ AV_CODEC_ID_TAK
Definition: codec_id.h:523
bytestream.h
imgutils.h
bytestream2_init
static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)
Definition: bytestream.h:137
AV_CODEC_ID_VP8
@ AV_CODEC_ID_VP8
Definition: codec_id.h:192
AVERROR_BUG
#define AVERROR_BUG
Internal bug, also see AVERROR_BUG2.
Definition: error.h:52
AV_CODEC_ID_WAVPACK
@ AV_CODEC_ID_WAVPACK
Definition: codec_id.h:486
AV_CODEC_ID_COOK
@ AV_CODEC_ID_COOK
Definition: codec_id.h:481
h
h
Definition: vp9dsp_template.c:2070
AV_CODEC_ID_TARGA
@ AV_CODEC_ID_TARGA
Definition: codec_id.h:145
AV_CODEC_ID_VORBIS
@ AV_CODEC_ID_VORBIS
Definition: codec_id.h:466
AV_CODEC_ID_WMV3IMAGE
@ AV_CODEC_ID_WMV3IMAGE
Definition: codec_id.h:203
avstring.h
av_image_check_size
int av_image_check_size(unsigned int w, unsigned int h, int log_offset, void *log_ctx)
Check if the given dimension of an image is valid, meaning that all bytes of the image can be address...
Definition: imgutils.c:318
FF_SANE_NB_CHANNELS
#define FF_SANE_NB_CHANNELS
Definition: internal.h:37
AV_CODEC_ID_FLV1
@ AV_CODEC_ID_FLV1
Definition: codec_id.h:73
AV_CODEC_ID_DFA
@ AV_CODEC_ID_DFA
Definition: codec_id.h:202
AV_CODEC_ID_AASC
@ AV_CODEC_ID_AASC
Definition: codec_id.h:126
subtitle_handler
static int subtitle_handler(AVCodecContext *avctx, AVFrame *unused, int *got_sub_ptr, const AVPacket *avpkt)
Definition: target_dec_fuzzer.c:83
maxiteration
const uint32_t maxiteration
Definition: target_dec_fuzzer.c:104
AV_CODEC_ID_MLP
@ AV_CODEC_ID_MLP
Definition: codec_id.h:490
av_parser_close
void av_parser_close(AVCodecParserContext *s)
Definition: parser.c:207
AV_CODEC_ID_PRORES
@ AV_CODEC_ID_PRORES
Definition: codec_id.h:200
Generated on Tue Jun 16 2026 19:24:46 for FFmpeg by   doxygen 1.8.17