FFmpeg: tools/target_dec_fuzzer.c Source File

FFmpeg
target_dec_fuzzer.c
Go to the documentation of this file.
1 /*
2  * This file is part of FFmpeg.
3  *
4  * FFmpeg is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * FFmpeg is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with FFmpeg; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17  */
18 
19 /* Targeted fuzzer that targets specific codecs depending on two
20  compile-time flags.
21  INSTRUCTIONS:
22 
23  * Get the very fresh clang, e.g. see http://libfuzzer.info#versions
24  * Get and build libFuzzer:
25  svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
26  ./Fuzzer/build.sh
27  * build ffmpeg for fuzzing:
28  FLAGS="-fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp -g" CC="clang $FLAGS" CXX="clang++ $FLAGS" ./configure --disable-x86asm
29  make clean && make -j
30  * build the fuzz target.
31  Choose the value of FFMPEG_CODEC (e.g. AV_CODEC_ID_DVD_SUBTITLE) and
32  choose one of FUZZ_FFMPEG_VIDEO, FUZZ_FFMPEG_AUDIO, FUZZ_FFMPEG_SUBTITLE.
33  clang -fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp tools/target_dec_fuzzer.c -o target_dec_fuzzer -I. -DFFMPEG_CODEC=AV_CODEC_ID_MPEG1VIDEO -DFUZZ_FFMPEG_VIDEO ../../libfuzzer/libFuzzer.a -Llibavcodec -Llibavdevice -Llibavfilter -Llibavformat -Llibavresample -Llibavutil -Llibpostproc -Llibswscale -Llibswresample -Wl,--as-needed -Wl,-z,noexecstack -Wl,--warn-common -Wl,-rpath-link=libpostproc:libswresample:libswscale:libavfilter:libavdevice:libavformat:libavcodec:libavutil:libavresample -lavdevice -lavfilter -lavformat -lavcodec -lswresample -lswscale -lavutil -ldl -lxcb -lxcb-shm -lxcb -lxcb-xfixes -lxcb -lxcb-shape -lxcb -lX11 -lasound -lm -lbz2 -lz -pthread
34  * create a corpus directory and put some samples there (empty dir is ok too):
35  mkdir CORPUS && cp some-files CORPUS
36 
37  * Run fuzzing:
38  ./target_dec_fuzzer -max_len=100000 CORPUS
39 
40  More info:
41  http://libfuzzer.info
42  http://tutorial.libfuzzer.info
43  https://github.com/google/oss-fuzz
44  http://lcamtuf.coredump.cx/afl/
45  https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html
46 */
47 
48 #include "config.h"
49 #include "libavutil/avassert.h"
50 #include "libavutil/imgutils.h"
51 #include "libavutil/intreadwrite.h"
52 
53 #include "libavcodec/avcodec.h"
54 #include "libavcodec/bytestream.h"
55 #include "libavformat/avformat.h"
56 
57 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
58 
59  static void error(const char *err)
60 {
61  fprintf(stderr, "%s", err);
62  exit(1);
63 }
64 
65  static AVCodec *c = NULL;
66  static AVCodec *AVCodecInitialize(enum AVCodecID codec_id)
67 {
68  AVCodec *res;
69 
70  res = avcodec_find_decoder(codec_id);
71  if (!res)
72  error("Failed to find decoder");
73  return res;
74 }
75 
76  static int subtitle_handler(AVCodecContext *avctx, void *frame,
77  int *got_sub_ptr, AVPacket *avpkt)
78 {
79  AVSubtitle sub;
80  int ret = avcodec_decode_subtitle2(avctx, &sub, got_sub_ptr, avpkt);
81  if (ret >= 0 && *got_sub_ptr)
82  avsubtitle_free(&sub);
83  return ret;
84 }
85 
86 // Class to handle buffer allocation and resize for each frame
87  typedef struct FuzzDataBuffer {
88   size_t size_;
89   uint8_t *data_;
90 } FuzzDataBuffer;
91 
92  static void FDBCreate(FuzzDataBuffer *FDB) {
93  FDB->size_ = 0x1000;
94  FDB->data_ = av_malloc(FDB->size_);
95  if (!FDB->data_)
96  error("Failed memory allocation");
97 }
98 
99  static void FDBDesroy(FuzzDataBuffer *FDB) { av_free(FDB->data_); }
100 
101  static void FDBRealloc(FuzzDataBuffer *FDB, size_t size) {
102  size_t needed = size + AV_INPUT_BUFFER_PADDING_SIZE;
103  av_assert0(needed > size);
104  if (needed > FDB->size_) {
105  av_free(FDB->data_);
106  FDB->size_ = needed;
107  FDB->data_ = av_malloc(FDB->size_);
108  if (!FDB->data_)
109  error("Failed memory allocation");
110  }
111 }
112 
113  static void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data,
114  size_t size)
115 {
116  FDBRealloc(FDB, size);
117  memcpy(FDB->data_, data, size);
118  size_t padd = FDB->size_ - size;
119  if (padd > AV_INPUT_BUFFER_PADDING_SIZE)
120  padd = AV_INPUT_BUFFER_PADDING_SIZE;
121  memset(FDB->data_ + size, 0, padd);
122  av_init_packet(dst);
123  dst->data = FDB->data_;
124  dst->size = size;
125 }
126 
127 // Ensure we don't loop forever
128  const uint32_t maxiteration = 8096;
129 
130  static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
131 
132  int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
133  const uint64_t fuzz_tag = FUZZ_TAG;
134  FuzzDataBuffer buffer;
135  const uint8_t *last = data;
136  const uint8_t *end = data + size;
137  uint32_t it = 0;
138  int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture,
139  int *got_picture_ptr,
140  const AVPacket *avpkt) = NULL;
141 
142  if (!c) {
143 #ifdef FFMPEG_DECODER
144 #define DECODER_SYMBOL0(CODEC) ff_##CODEC##_decoder
145 #define DECODER_SYMBOL(CODEC) DECODER_SYMBOL0(CODEC)
146  extern AVCodec DECODER_SYMBOL(FFMPEG_DECODER);
147  avcodec_register(&DECODER_SYMBOL(FFMPEG_DECODER));
148 
149  c = &DECODER_SYMBOL(FFMPEG_DECODER);
150 #else
151  avcodec_register_all();
152  c = AVCodecInitialize(FFMPEG_CODEC); // Done once.
153 #endif
154  av_log_set_level(AV_LOG_PANIC);
155  }
156 
157  switch (c->type) {
158  case AVMEDIA_TYPE_AUDIO : decode_handler = avcodec_decode_audio4; break;
159  case AVMEDIA_TYPE_VIDEO : decode_handler = avcodec_decode_video2; break;
160  case AVMEDIA_TYPE_SUBTITLE: decode_handler = subtitle_handler ; break;
161  }
162 
163  AVCodecContext* ctx = avcodec_alloc_context3(NULL);
164  if (!ctx)
165  error("Failed memory allocation");
166 
167  ctx->max_pixels = 4096 * 4096; //To reduce false positive OOM and hangs
168 
169  if (size > 1024) {
170  GetByteContext gbc;
171  bytestream2_init(&gbc, data + size - 1024, 1024);
172  ctx->width = bytestream2_get_le32(&gbc);
173  ctx->height = bytestream2_get_le32(&gbc);
174  ctx->bit_rate = bytestream2_get_le64(&gbc);
175  ctx->bits_per_coded_sample = bytestream2_get_le32(&gbc);
176  if (av_image_check_size(ctx->width, ctx->height, 0, ctx))
177  ctx->width = ctx->height = 0;
178  size -= 1024;
179  }
180 
181  int res = avcodec_open2(ctx, c, NULL);
182  if (res < 0) {
183  av_free(ctx);
184  return 0; // Failure of avcodec_open2() does not imply that a issue was found
185  }
186 
187  FDBCreate(&buffer);
188  int got_frame;
189  AVFrame *frame = av_frame_alloc();
190  if (!frame)
191  error("Failed memory allocation");
192 
193  // Read very simple container
194  AVPacket avpkt;
195  while (data < end && it < maxiteration) {
196  // Search for the TAG
197  while (data + sizeof(fuzz_tag) < end) {
198  if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
199  break;
200  data++;
201  }
202  if (data + sizeof(fuzz_tag) > end)
203  data = end;
204 
205  FDBPrepare(&buffer, &avpkt, last, data - last);
206  data += sizeof(fuzz_tag);
207  last = data;
208 
209  // Iterate through all data
210  while (avpkt.size > 0 && it++ < maxiteration) {
211  av_frame_unref(frame);
212  int ret = decode_handler(ctx, frame, &got_frame, &avpkt);
213 
214  if (it > 20)
215  ctx->error_concealment = 0;
216 
217  if (ret <= 0 || ret > avpkt.size)
218  break;
219  if (ctx->codec_type != AVMEDIA_TYPE_AUDIO)
220  ret = avpkt.size;
221  avpkt.data += ret;
222  avpkt.size -= ret;
223  }
224  }
225 
226  av_init_packet(&avpkt);
227  avpkt.data = NULL;
228  avpkt.size = 0;
229 
230  do {
231  got_frame = 0;
232  decode_handler(ctx, frame, &got_frame, &avpkt);
233  } while (got_frame == 1 && it++ < maxiteration);
234 
235  av_frame_free(&frame);
236  avcodec_free_context(&ctx);
237  av_freep(&ctx);
238  FDBDesroy(&buffer);
239  return 0;
240 }
maxiteration
const uint32_t maxiteration
Definition: target_dec_fuzzer.c:128
NULL
#define NULL
Definition: coverity.c:32
AVFrame
This structure describes decoded (raw) audio or video data.
Definition: frame.h:218
data
ptrdiff_t const GLvoid * data
Definition: opengl_enc.c:101
imgutils.h
misc image utilities
AVCodecContext::bit_rate
int64_t bit_rate
the average bitrate
Definition: avcodec.h:1568
av_log_set_level
void av_log_set_level(int level)
Set the log level.
Definition: log.c:385
AVPacket::size
int size
Definition: avcodec.h:1431
bytestream2_init
static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)
Definition: bytestream.h:133
avcodec_decode_audio4
attribute_deprecated int avcodec_decode_audio4(AVCodecContext *avctx, AVFrame *frame, int *got_frame_ptr, const AVPacket *avpkt)
Decode the audio frame of size avpkt->size from avpkt->data into frame.
Definition: decode.c:833
AVCodec::type
enum AVMediaType type
Definition: avcodec.h:3421
FDBCreate
static void FDBCreate(FuzzDataBuffer *FDB)
Definition: target_dec_fuzzer.c:92
avcodec_decode_subtitle2
int avcodec_decode_subtitle2(AVCodecContext *avctx, AVSubtitle *sub, int *got_sub_ptr, AVPacket *avpkt)
Decode a subtitle message.
Definition: decode.c:998
AVCodec
AVCodec.
Definition: avcodec.h:3408
av_assert0
#define av_assert0(cond)
assert() equivalent, that is always enabled.
Definition: avassert.h:37
uint8_t
uint8_t
Definition: audio_convert.c:194
av_malloc
#define av_malloc(s)
Definition: tableprint_vlc.h:31
av_frame_alloc
AVFrame * av_frame_alloc(void)
Allocate an AVFrame and set its fields to default values.
Definition: frame.c:189
AV_LOG_PANIC
#define AV_LOG_PANIC
Something went really wrong and we will crash now.
Definition: log.h:163
end
static av_cold int end(AVCodecContext *avctx)
Definition: avrndec.c:90
LLVMFuzzerTestOneInput
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
Definition: target_dec_fuzzer.c:132
frame
static AVFrame * frame
Definition: demuxing_decoding.c:53
AVPacket::data
uint8_t * data
Definition: avcodec.h:1430
avcodec_register
av_cold void avcodec_register(AVCodec *codec)
Register the codec codec and initialize libavcodec.
Definition: allcodecs.c:805
size
ptrdiff_t size
Definition: opengl_enc.c:101
AVCodecContext::bits_per_coded_sample
int bits_per_coded_sample
bits per sample/pixel from the demuxer (needed for huffyuv).
Definition: avcodec.h:2734
avcodec_register_all
void avcodec_register_all(void)
Register all the codecs, parsers and bitstream filters which were enabled at configuration time...
Definition: allcodecs.c:820
c
static AVCodec * c
Definition: target_dec_fuzzer.c:65
FUZZ_TAG
static const uint64_t FUZZ_TAG
Definition: target_dec_fuzzer.c:130
AVCodecID
AVCodecID
Identify the syntax and semantics of the bitstream.
Definition: avcodec.h:215
av_frame_free
void av_frame_free(AVFrame **frame)
Free the frame and any dynamically allocated objects in it, e.g.
Definition: frame.c:202
AVCodecContext::error_concealment
int error_concealment
error concealment flags
Definition: avcodec.h:2588
AVMEDIA_TYPE_AUDIO
Definition: avutil.h:202
avassert.h
simple assert() macros that are a bit more flexible than ISO C assert().
AVCodecContext::max_pixels
int64_t max_pixels
The number of pixels per image to maximally accept.
Definition: avcodec.h:3227
FuzzDataBuffer::data_
uint8_t * data_
Definition: target_dec_fuzzer.c:89
av_image_check_size
int av_image_check_size(unsigned int w, unsigned int h, int log_offset, void *log_ctx)
Check if the given dimension of an image is valid, meaning that all bytes of the image can be address...
Definition: imgutils.c:282
avcodec_alloc_context3
AVCodecContext * avcodec_alloc_context3(const AVCodec *codec)
Allocate an AVCodecContext and set its fields to default values.
Definition: options.c:156
AVCodecInitialize
static AVCodec * AVCodecInitialize(enum AVCodecID codec_id)
Definition: target_dec_fuzzer.c:66
AVCodecContext::width
int width
picture width / height.
Definition: avcodec.h:1690
ctx
AVFormatContext * ctx
Definition: movenc.c:48
codec_id
enum AVCodecID codec_id
Definition: vaapi_decode.c:362
AVCodecContext::height
int height
Definition: avcodec.h:1690
error
static void error(const char *err)
Definition: target_dec_fuzzer.c:59
subtitle_handler
static int subtitle_handler(AVCodecContext *avctx, void *frame, int *got_sub_ptr, AVPacket *avpkt)
Definition: target_dec_fuzzer.c:76
avcodec.h
Libavcodec external API header.
AVCodecContext::codec_type
enum AVMediaType codec_type
Definition: avcodec.h:1526
avcodec_decode_video2
attribute_deprecated int avcodec_decode_video2(AVCodecContext *avctx, AVFrame *picture, int *got_picture_ptr, const AVPacket *avpkt)
Decode the video frame of size avpkt->size from avpkt->data into picture.
Definition: decode.c:826
avcodec_free_context
void avcodec_free_context(AVCodecContext **avctx)
Free the codec context and everything associated with it and write NULL to the provided pointer...
Definition: options.c:171
AVCodecContext
main external API structure.
Definition: avcodec.h:1518
avcodec_find_decoder
AVCodec * avcodec_find_decoder(enum AVCodecID id)
Find a registered decoder with a matching codec ID.
Definition: allcodecs.c:862
avsubtitle_free
void avsubtitle_free(AVSubtitle *sub)
Free all allocated data in the given subtitle struct.
Definition: utils.c:1042
avcodec_open2
int avcodec_open2(AVCodecContext *avctx, const AVCodec *codec, AVDictionary **options)
Initialize the AVCodecContext to use the given AVCodec.
Definition: utils.c:538
FDBPrepare
static void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data, size_t size)
Definition: target_dec_fuzzer.c:113
av_frame_unref
void av_frame_unref(AVFrame *frame)
Unreference all the buffers referenced by frame and reset the frame fields.
Definition: frame.c:551
avformat.h
Main libavformat public API header.
int
int
Definition: ffmpeg_filter.c:190
av_init_packet
void av_init_packet(AVPacket *pkt)
Initialize optional fields of a packet with default values.
Definition: avpacket.c:33
AV_INPUT_BUFFER_PADDING_SIZE
#define AV_INPUT_BUFFER_PADDING_SIZE
Required number of additionally allocated bytes at the end of the input bitstream for decoding...
Definition: avcodec.h:773
av_free
#define av_free(p)
Definition: tableprint_vlc.h:34
AV_RN64
#define AV_RN64(p)
Definition: intreadwrite.h:368
av_freep
#define av_freep(p)
Definition: tableprint_vlc.h:35
AVMEDIA_TYPE_VIDEO
Definition: avutil.h:201
AVMEDIA_TYPE_SUBTITLE
Definition: avutil.h:204
FDBDesroy
static void FDBDesroy(FuzzDataBuffer *FDB)
Definition: target_dec_fuzzer.c:99
FDBRealloc
static void FDBRealloc(FuzzDataBuffer *FDB, size_t size)
Definition: target_dec_fuzzer.c:101
AVPacket
This structure stores compressed data.
Definition: avcodec.h:1407
buffer
GLuint buffer
Definition: opengl_enc.c:102
Generated on Sun May 13 2018 02:04:10 for FFmpeg by   doxygen 1.8.6

AltStyle によって変換されたページ (->オリジナル) /