From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 3A05D43303 for ; Tue, 31 May 2022 20:42:34 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id E60CB68B6C3; Tue, 31 May 2022 23:42:31 +0300 (EEST) Received: from mail-oa1-f51.google.com (mail-oa1-f51.google.com [209.85.160.51]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4660768B680 for ; Tue, 31 May 2022 23:42:25 +0300 (EEST) Received: by mail-oa1-f51.google.com with SMTP id 586e51a60fabf-e93bbb54f9so19909376fac.12 for ; Tue, 31 May 2022 13:42:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=LP5Lb5xsOm2I6hB7gyITXtpMfJ0AklB2fBmEVqvGtKM=; b=EChK+WSTEQt4redu5WMKmyfuyxskCy0nS1ELFdGmyVIldwpMOLXxznadgfGJcRowni CUqzd+tVXTGS6+MdMLKi4PFAs7PQvP6aB8hDzsZKvRJSr0yTGEViYMQFGkW4CL84IjqL 29IMLiYb5b/mZBtqnhsMhGe9gBk/C3ScxaHl1Ihx89I49PmK2ibY7sgoO5K5i14UHOD6 ZLakQGThZNcef1UjlXN6dhhQ4HQRMrN2pJketTPZMMmZw7tewzJFyDZKTZex2Qo9fgnX u68xqpNndFbsO1c86ZDSq7GUAJIWCZ42i4+7XauVT3HttMA1ZFIIM2ZCi3uPn7ZXX5Xt 59og== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LP5Lb5xsOm2I6hB7gyITXtpMfJ0AklB2fBmEVqvGtKM=; b=YrBPJiddiqq18mTM/F4nl7qekmTwf4f4KPS1obEYWRSWiF3q5o/QbcVdFQRSHl5kq3 A/+FD1P9CTy4ZNNuWXRt5bn9KYRpPb8OSlmrYZKtyjg/PV11c8gGEs2+hJOAz0TYZX5v UEV1B4AbTCW9ot5688OmLFB4DxG8fZZVRWyGCXETyXXC2KzXtE5Vj2fi07AVlySRWirQ XqnKv11aBucGtUO5wB67fR1jwNWsGGLKx+/5eRRIOOmFPT2lgkt+sAkwPiOHa+KnWHBX Tkr+l5mUJ9f8S+Qf5pl54q0liQDiy8gt6lybVOKmDDyXre7yzMAEVyB4+LQiZ80COaiD eAWA== X-Gm-Message-State: AOAM5313z9KfOZCVmDbTzJ86gRT1nse1GxtcbkUch7kiW17aYUbNptG4 vU6xvnUC5me3lZo5rQ0/apxeuebSCZQ= X-Google-Smtp-Source: ABdhPJyeRi0cKCKlS3pPZ0tkLQu2VB/3m22tiisT/r/7ENoVVMZnObB+hGmHMyw0P6aFPIRVRlHiWg== X-Received: by 2002:a05:6870:4620:b0:f2:5d2b:996e with SMTP id z32-20020a056870462000b000f25d2b996emr15075538oao.68.1654029743357; Tue, 31 May 2022 13:42:23 -0700 (PDT) Received: from localhost.localdomain ([186.136.131.204]) by smtp.gmail.com with ESMTPSA id h16-20020a056830035000b0060b2972b503sm6676423ote.64.2022.05.31.13.42.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 31 May 2022 13:42:22 -0700 (PDT) From: James Almer To: ffmpeg-devel@ffmpeg.org Date: Tue, 31 May 2022 17:42:10 -0300 Message-Id: <20220531204210.454-1-jamrial@gmail.com> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220531201223.422-1-jamrial@gmail.com> References: <20220531201223.422-1-jamrial@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2] tools/target_dec_fuzzer: add a custom get_buffer2() implementation X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Unlike avcodec_default_get_buffer2(), this version does not allocate more than what the normal image helper functions consider should be allocated for a given frame. Since the get_buffer2() documentation does not require any kind of buffer overallocation for any of the planes, this should help detect bugs in our DR1 decoders if they overread beyond the end of the buffer, simulating what some library users might experience when they use their own custom get_buffer2() implementations. Signed-off-by: James Almer --- Now making sure to not allocate more plane buffers than needed. tools/target_dec_fuzzer.c | 52 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 288aa63313..2e43ed3d88 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -104,6 +104,57 @@ const uint32_t maxiteration = 8096; static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL; +static int fuzz_video_get_buffer(AVCodecContext *ctx, AVFrame *frame) +{ + ptrdiff_t linesize1[4]; + size_t size[4]; + int linesize_align[AV_NUM_DATA_POINTERS]; + int ret, w = frame->width, h = frame->height; + + avcodec_align_dimensions2(ctx, &w, &h, linesize_align); + ret = av_image_fill_linesizes(frame->linesize, ctx->pix_fmt, w); + if (ret < 0) + return ret; + + for (int i = 0; i < 4; i++) + linesize1[i] = frame->linesize[i] = + FFALIGN(frame->linesize[i], linesize_align[i]); + + ret = av_image_fill_plane_sizes(size, ctx->pix_fmt, h, linesize1); + if (ret < 0) + goto fail; + + for (int i = 0; i < 4; i++) { + if (!size[i]) + break; + frame->buf[i] = av_buffer_alloc(size[i]); + if (!frame->buf[i]) { + ret = AVERROR(ENOMEM); + goto fail; + } + frame->data[i] = frame->buf[i]->data; + } + +fail: + if (ret < 0) + av_frame_unref(frame); + return ret; +} + +static int fuzz_get_buffer2(AVCodecContext *ctx, AVFrame *frame, int flags) +{ + switch (ctx->codec_type) { + case AVMEDIA_TYPE_VIDEO: + return (ctx->codec->capabilities & AV_CODEC_CAP_DR1) + ? fuzz_video_get_buffer(ctx, frame) + : avcodec_default_get_buffer2(ctx, frame, flags); + case AVMEDIA_TYPE_AUDIO: + return avcodec_default_get_buffer2(ctx, frame, flags); + default: + return AVERROR(EINVAL); + } +} + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { uint64_t maxpixels_per_frame = 4096 * 4096; uint64_t maxpixels; @@ -241,6 +292,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ctx->max_pixels = maxpixels_per_frame; //To reduce false positive OOM and hangs ctx->max_samples = maxsamples_per_frame; + ctx->get_buffer2 = fuzz_get_buffer2; if (size > 1024) { GetByteContext gbc; -- 2.36.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".