FFmpeg  4.4.5
target_bsf_fuzzer.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 #include "config.h"
20 #include "libavutil/imgutils.h"
21 #include "libavutil/opt.h"
22 
23 #include "libavcodec/avcodec.h"
25 #include "libavcodec/bytestream.h"
26 #include "libavcodec/internal.h"
27 
28 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
29 
30 static void error(const char *err)
31 {
32  fprintf(stderr, "%s", err);
33  exit(1);
34 }
35 
37 
38 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
39 
40 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
41  const uint64_t fuzz_tag = FUZZ_TAG;
42  const uint8_t *last = data;
43  const uint8_t *end = data + size;
44  AVBSFContext *bsf = NULL;
45  AVPacket *in, *out;
46  uint64_t keyframes = 0;
47  uint64_t flushpattern = -1;
48  int res;
49 
50  if (!f) {
51 #ifdef FFMPEG_BSF
52 #define BSF_SYMBOL0(BSF) ff_##BSF##_bsf
53 #define BSF_SYMBOL(BSF) BSF_SYMBOL0(BSF)
54  extern AVBitStreamFilter BSF_SYMBOL(FFMPEG_BSF);
55  f = &BSF_SYMBOL(FFMPEG_BSF);
56 #else
58  f = &ff_null_bsf;
59 #endif
61  }
62 
63  res = av_bsf_alloc(f, &bsf);
64  if (res < 0)
65  error("Failed memory allocation");
66 
67  if (size > 1024) {
68  GetByteContext gbc;
69  int extradata_size;
70  int flags;
71  size -= 1024;
72  bytestream2_init(&gbc, data + size, 1024);
73  bsf->par_in->width = bytestream2_get_le32(&gbc);
74  bsf->par_in->height = bytestream2_get_le32(&gbc);
75  bsf->par_in->bit_rate = bytestream2_get_le64(&gbc);
76  bsf->par_in->bits_per_coded_sample = bytestream2_get_le32(&gbc);
77 
78  if (f->codec_ids) {
79  int i, id;
80  for (i = 0; f->codec_ids[i] != AV_CODEC_ID_NONE; i++);
81  id = f->codec_ids[bytestream2_get_byte(&gbc) % i];
82  bsf->par_in->codec_id = id;
83  bsf->par_in->codec_tag = bytestream2_get_le32(&gbc);
84  }
85 
86  extradata_size = bytestream2_get_le32(&gbc);
87 
88  bsf->par_in->sample_rate = bytestream2_get_le32(&gbc);
89  bsf->par_in->channels = (unsigned)bytestream2_get_le32(&gbc) % FF_SANE_NB_CHANNELS;
90  bsf->par_in->block_align = bytestream2_get_le32(&gbc);
91  keyframes = bytestream2_get_le64(&gbc);
92  flushpattern = bytestream2_get_le64(&gbc);
93  flags = bytestream2_get_byte(&gbc);
94 
95  if (flags & 0x20) {
96  if (!strcmp(f->name, "av1_metadata"))
97  av_opt_set_int(bsf->priv_data, "td", bytestream2_get_byte(&gbc) % 3, 0);
98  else if (!strcmp(f->name, "h264_metadata") || !strcmp(f->name, "h265_metadata"))
99  av_opt_set_int(bsf->priv_data, "aud", bytestream2_get_byte(&gbc) % 3, 0);
100  else if (!strcmp(f->name, "extract_extradata"))
101  av_opt_set_int(bsf->priv_data, "remove", bytestream2_get_byte(&gbc) & 1, 0);
102  }
103 
104  if (extradata_size < size) {
105  bsf->par_in->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
106  if (bsf->par_in->extradata) {
107  bsf->par_in->extradata_size = extradata_size;
108  size -= bsf->par_in->extradata_size;
109  memcpy(bsf->par_in->extradata, data + size, bsf->par_in->extradata_size);
110  }
111  }
112  if (av_image_check_size(bsf->par_in->width, bsf->par_in->height, 0, bsf))
113  bsf->par_in->width = bsf->par_in->height = 0;
114  }
115 
116  res = av_bsf_init(bsf);
117  if (res < 0) {
118  av_bsf_free(&bsf);
119  return 0; // Failure of av_bsf_init() does not imply that a issue was found
120  }
121 
122  in = av_packet_alloc();
123  out = av_packet_alloc();
124  if (!in || !out)
125  error("Failed memory allocation");
126 
127  while (data < end) {
128  // Search for the TAG
129  while (data + sizeof(fuzz_tag) < end) {
130  if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
131  break;
132  data++;
133  }
134  if (data + sizeof(fuzz_tag) > end)
135  data = end;
136 
137  res = av_new_packet(in, data - last);
138  if (res < 0)
139  error("Failed memory allocation");
140  memcpy(in->data, last, data - last);
141  in->flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY;
142  keyframes = (keyframes >> 2) + (keyframes<<62);
143  data += sizeof(fuzz_tag);
144  last = data;
145 
146  if (!(flushpattern & 7))
147  av_bsf_flush(bsf);
148  flushpattern = (flushpattern >> 3) + (flushpattern << 61);
149 
150  while (in->size) {
151  res = av_bsf_send_packet(bsf, in);
152  if (res < 0 && res != AVERROR(EAGAIN))
153  break;
154  res = av_bsf_receive_packet(bsf, out);
155  if (res < 0)
156  break;
158  }
160  }
161 
162  res = av_bsf_send_packet(bsf, NULL);
163  while (!res) {
164  res = av_bsf_receive_packet(bsf, out);
165  if (res < 0)
166  break;
168  }
169 
170  av_packet_free(&in);
172  av_bsf_free(&bsf);
173  return 0;
174 }
uint8_t pi<< 24) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_U8, uint8_t,(*(const uint8_t *) pi - 0x80) *(1.0f/(1<< 7))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_U8, uint8_t,(*(const uint8_t *) pi - 0x80) *(1.0/(1<< 7))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_S16, int16_t,(*(const int16_t *) pi >> 8)+0x80) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_S16, int16_t, *(const int16_t *) pi *(1.0f/(1<< 15))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_S16, int16_t, *(const int16_t *) pi *(1.0/(1<< 15))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_S32, int32_t,(*(const int32_t *) pi >> 24)+0x80) CONV_FUNC_GROUP(AV_SAMPLE_FMT_FLT, float, AV_SAMPLE_FMT_S32, int32_t, *(const int32_t *) pi *(1.0f/(1U<< 31))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_DBL, double, AV_SAMPLE_FMT_S32, int32_t, *(const int32_t *) pi *(1.0/(1U<< 31))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_FLT, float, av_clip_uint8(lrintf(*(const float *) pi *(1<< 7))+0x80)) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S16, int16_t, AV_SAMPLE_FMT_FLT, float, av_clip_int16(lrintf(*(const float *) pi *(1<< 15)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S32, int32_t, AV_SAMPLE_FMT_FLT, float, av_clipl_int32(llrintf(*(const float *) pi *(1U<< 31)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_U8, uint8_t, AV_SAMPLE_FMT_DBL, double, av_clip_uint8(lrint(*(const double *) pi *(1<< 7))+0x80)) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S16, int16_t, AV_SAMPLE_FMT_DBL, double, av_clip_int16(lrint(*(const double *) pi *(1<< 15)))) CONV_FUNC_GROUP(AV_SAMPLE_FMT_S32, int32_t, AV_SAMPLE_FMT_DBL, double, av_clipl_int32(llrint(*(const double *) pi *(1U<< 31)))) #define SET_CONV_FUNC_GROUP(ofmt, ifmt) static void set_generic_function(AudioConvert *ac) { } void ff_audio_convert_free(AudioConvert **ac) { if(! *ac) return;ff_dither_free(&(*ac) ->dc);av_freep(ac);} AudioConvert *ff_audio_convert_alloc(AVAudioResampleContext *avr, enum AVSampleFormat out_fmt, enum AVSampleFormat in_fmt, int channels, int sample_rate, int apply_map) { AudioConvert *ac;int in_planar, out_planar;ac=av_mallocz(sizeof(*ac));if(!ac) return NULL;ac->avr=avr;ac->out_fmt=out_fmt;ac->in_fmt=in_fmt;ac->channels=channels;ac->apply_map=apply_map;if(avr->dither_method !=AV_RESAMPLE_DITHER_NONE &&av_get_packed_sample_fmt(out_fmt)==AV_SAMPLE_FMT_S16 &&av_get_bytes_per_sample(in_fmt) > 2) { ac->dc=ff_dither_alloc(avr, out_fmt, in_fmt, channels, sample_rate, apply_map);if(!ac->dc) { av_free(ac);return NULL;} return ac;} in_planar=ff_sample_fmt_is_planar(in_fmt, channels);out_planar=ff_sample_fmt_is_planar(out_fmt, channels);if(in_planar==out_planar) { ac->func_type=CONV_FUNC_TYPE_FLAT;ac->planes=in_planar ? ac->channels :1;} else if(in_planar) ac->func_type=CONV_FUNC_TYPE_INTERLEAVE;else ac->func_type=CONV_FUNC_TYPE_DEINTERLEAVE;set_generic_function(ac);if(ARCH_AARCH64) ff_audio_convert_init_aarch64(ac);if(ARCH_ARM) ff_audio_convert_init_arm(ac);if(ARCH_X86) ff_audio_convert_init_x86(ac);return ac;} int ff_audio_convert(AudioConvert *ac, AudioData *out, AudioData *in) { int use_generic=1;int len=in->nb_samples;int p;if(ac->dc) { av_log(ac->avr, AV_LOG_TRACE, "%d samples - audio_convert: %s to %s (dithered)\n", len, av_get_sample_fmt_name(ac->in_fmt), av_get_sample_fmt_name(ac->out_fmt));return ff_convert_dither(ac-> in
uint8_t
Libavcodec external API header.
const AVBitStreamFilter ff_null_bsf
Definition: null_bsf.c:27
static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)
Definition: bytestream.h:137
#define flags(name, subs,...)
Definition: cbs_av1.c:572
#define NULL
Definition: coverity.c:32
enum AVCodecID id
void av_bsf_free(AVBSFContext **pctx)
Free a bitstream filter context and everything associated with it; write NULL into the supplied point...
Definition: bsf.c:40
int av_bsf_init(AVBSFContext *ctx)
Prepare the filter for use, after all the parameters and options have been set.
Definition: bsf.c:148
void av_bsf_flush(AVBSFContext *ctx)
Reset the internal bitstream filter state.
Definition: bsf.c:189
int av_bsf_alloc(const AVBitStreamFilter *filter, AVBSFContext **pctx)
Allocate a context for a given bitstream filter.
Definition: bsf.c:95
int av_bsf_receive_packet(AVBSFContext *ctx, AVPacket *pkt)
Retrieve a filtered packet.
Definition: bsf.c:227
int av_bsf_send_packet(AVBSFContext *ctx, AVPacket *pkt)
Submit a packet for filtering.
Definition: bsf.c:201
@ AV_CODEC_ID_NONE
Definition: codec_id.h:47
#define AV_INPUT_BUFFER_PADDING_SIZE
Required number of additionally allocated bytes at the end of the input bitstream for decoding.
Definition: avcodec.h:215
void av_packet_free(AVPacket **pkt)
Free the packet, if the packet is reference counted, it will be unreferenced first.
Definition: avpacket.c:75
#define AV_PKT_FLAG_DISCARD
Flag is used to discard packets which are required to maintain valid decoder state but are not requir...
Definition: packet.h:417
void av_packet_unref(AVPacket *pkt)
Wipe the packet.
Definition: avpacket.c:634
#define AV_PKT_FLAG_KEY
The packet contains a keyframe.
Definition: packet.h:410
AVPacket * av_packet_alloc(void)
Allocate an AVPacket and set its fields to default values.
Definition: avpacket.c:64
int av_new_packet(AVPacket *pkt, int size)
Allocate the payload of a packet and initialize its fields with default values.
Definition: avpacket.c:99
#define AVERROR(e)
Definition: error.h:43
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:181
void av_log_set_level(int level)
Set the log level.
Definition: log.c:440
void * av_mallocz(size_t size)
Allocate a memory block with alignment suitable for all memory accesses (including vectors if availab...
Definition: mem.c:237
int av_image_check_size(unsigned int w, unsigned int h, int log_offset, void *log_ctx)
Check if the given dimension of an image is valid, meaning that all bytes of the image can be address...
Definition: imgutils.c:317
int av_opt_set_int(void *obj, const char *name, int64_t val, int search_flags)
Definition: opt.c:586
misc image utilities
int i
Definition: input.c:407
#define AV_RN64(p)
Definition: intreadwrite.h:368
common internal api header.
#define FF_SANE_NB_CHANNELS
Definition: internal.h:107
const char data[16]
Definition: mxf.c:142
AVOptions.
The bitstream filter state.
Definition: bsf.h:49
void * priv_data
Opaque filter-specific private data.
Definition: bsf.h:70
AVCodecParameters * par_in
Parameters of the input stream.
Definition: bsf.h:77
const char * name
Definition: bsf.h:99
enum AVCodecID * codec_ids
A list of codec ids supported by the filter, terminated by AV_CODEC_ID_NONE.
Definition: bsf.h:106
int extradata_size
Size of the extradata content in bytes.
Definition: codec_par.h:78
int bits_per_coded_sample
The number of bits per sample in the codedwords.
Definition: codec_par.h:102
int channels
Audio only.
Definition: codec_par.h:166
int width
Video only.
Definition: codec_par.h:126
int64_t bit_rate
The average bitrate of the encoded data (in bits per second).
Definition: codec_par.h:89
int block_align
Audio only.
Definition: codec_par.h:177
uint32_t codec_tag
Additional information about the codec (corresponds to the AVI FOURCC).
Definition: codec_par.h:64
uint8_t * extradata
Extra binary data needed for initializing the decoder, codec-dependent.
Definition: codec_par.h:74
enum AVCodecID codec_id
Specific type of the encoded data (the codec used).
Definition: codec_par.h:60
int sample_rate
Audio only.
Definition: codec_par.h:170
This structure stores compressed data.
Definition: packet.h:346
static const uint64_t FUZZ_TAG
static AVBitStreamFilter * f
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
static void error(const char *err)
FILE * out
Definition: movenc.c:54
int size