[FFmpeg-cvslog] tools/target_dec_fuzzer: use refcounted packets
James Almer
git at videolan.org
Fri Aug 23 17:10:19 EEST 2019
ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Tue Aug 20 18:58:03 2019 -0300| [92c32b0f0c3e70d809e56be6c56cf1697cc259f9] | committer: James Almer
tools/target_dec_fuzzer: use refcounted packets
Should reduce allocations and data copying.
Signed-off-by: James Almer <jamrial at gmail.com>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=92c32b0f0c3e70d809e56be6c56cf1697cc259f9
---
tools/target_dec_fuzzer.c | 71 ++++++++++++++---------------------------------
1 file changed, 21 insertions(+), 50 deletions(-)
diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 5119a7c5da..7bf25608ba 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -85,47 +85,6 @@ static int subtitle_handler(AVCodecContext *avctx, void *frame,
return ret;
}
-// Class to handle buffer allocation and resize for each frame
-typedef struct FuzzDataBuffer {
- size_t size_;
- uint8_t *data_;
-} FuzzDataBuffer;
-
-static void FDBCreate(FuzzDataBuffer *FDB) {
- FDB->size_ = 0x1000;
- FDB->data_ = av_malloc(FDB->size_);
- if (!FDB->data_)
- error("Failed memory allocation");
-}
-
-static void FDBDesroy(FuzzDataBuffer *FDB) { av_free(FDB->data_); }
-
-static void FDBRealloc(FuzzDataBuffer *FDB, size_t size) {
- size_t needed = size + AV_INPUT_BUFFER_PADDING_SIZE;
- av_assert0(needed > size);
- if (needed > FDB->size_) {
- av_free(FDB->data_);
- FDB->size_ = needed;
- FDB->data_ = av_malloc(FDB->size_);
- if (!FDB->data_)
- error("Failed memory allocation");
- }
-}
-
-static void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data,
- size_t size)
-{
- FDBRealloc(FDB, size);
- memcpy(FDB->data_, data, size);
- size_t padd = FDB->size_ - size;
- if (padd > AV_INPUT_BUFFER_PADDING_SIZE)
- padd = AV_INPUT_BUFFER_PADDING_SIZE;
- memset(FDB->data_ + size, 0, padd);
- av_init_packet(dst);
- dst->data = FDB->data_;
- dst->size = size;
-}
-
// Ensure we don't loop forever
const uint32_t maxiteration = 8096;
const uint64_t maxpixels_per_frame = 4096 * 4096;
@@ -135,7 +94,6 @@ static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
const uint64_t fuzz_tag = FUZZ_TAG;
- FuzzDataBuffer buffer;
const uint8_t *last = data;
const uint8_t *end = data + size;
uint32_t it = 0;
@@ -187,6 +145,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (ctx->max_pixels == 0 || ctx->max_pixels > maxpixels_per_frame)
ctx->max_pixels = maxpixels_per_frame; //To reduce false positive OOM and hangs
+ ctx->refcounted_frames = 1; //To reduce false positive timeouts and focus testing on the refcounted API
if (size > 1024) {
GetByteContext gbc;
@@ -223,7 +182,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
}
parser_avctx->codec_id = ctx->codec_id;
- FDBCreate(&buffer);
int got_frame;
AVFrame *frame = av_frame_alloc();
if (!frame)
@@ -231,6 +189,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
// Read very simple container
AVPacket avpkt, parsepkt;
+ av_init_packet(&avpkt);
while (data < end && it < maxiteration) {
// Search for the TAG
while (data + sizeof(fuzz_tag) < end) {
@@ -241,7 +200,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (data + sizeof(fuzz_tag) > end)
data = end;
- FDBPrepare(&buffer, &parsepkt, last, data - last);
+ res = av_new_packet(&parsepkt, data - last);
+ if (res < 0)
+ error("Failed memory allocation");
+ memcpy(parsepkt.data, last, data - last);
data += sizeof(fuzz_tag);
last = data;
@@ -252,6 +214,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
int ret = av_parser_parse2(parser, parser_avctx, &avpkt.data, &avpkt.size,
parsepkt.data, parsepkt.size,
parsepkt.pts, parsepkt.dts, parsepkt.pos);
+ if (avpkt.data == parsepkt.data) {
+ avpkt.buf = av_buffer_ref(parsepkt.buf);
+ if (!avpkt.buf)
+ error("Failed memory allocation");
+ } else {
+ ret = av_packet_make_refcounted(&avpkt);
+ if (ret < 0)
+ error("Failed memory allocation");
+ }
parsepkt.data += ret;
parsepkt.size -= ret;
parsepkt.pos += ret;
@@ -263,8 +234,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
avpkt.flags |= AV_PKT_FLAG_KEY;
avpkt.flags |= parsepkt.flags & AV_PKT_FLAG_DISCARD;
} else {
- avpkt = parsepkt;
- parsepkt.size = 0;
+ av_packet_move_ref(&avpkt, &parsepkt);
}
// Iterate through all data
@@ -285,16 +255,17 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
avpkt.data += ret;
avpkt.size -= ret;
}
+ av_packet_unref(&avpkt);
}
+ av_packet_unref(&parsepkt);
}
maximums_reached:
- av_init_packet(&avpkt);
- avpkt.data = NULL;
- avpkt.size = 0;
+ av_packet_unref(&avpkt);
do {
got_frame = 0;
+ av_frame_unref(frame);
decode_handler(ctx, frame, &got_frame, &avpkt);
} while (got_frame == 1 && it++ < maxiteration);
@@ -304,6 +275,6 @@ maximums_reached:
avcodec_free_context(&ctx);
avcodec_free_context(&parser_avctx);
av_parser_close(parser);
- FDBDesroy(&buffer);
+ av_packet_unref(&parsepkt);
return 0;
}
More information about the ffmpeg-cvslog
mailing list