FFmpeg: tools/target_dem_fuzzer.c Source File

FFmpeg

[フレーム]

tools

target_dem_fuzzer.c

Go to the documentation of this file.

1 /*

2 * This file is part of FFmpeg.

3 *

4 * FFmpeg is free software; you can redistribute it and/or

5 * modify it under the terms of the GNU Lesser General Public

6 * License as published by the Free Software Foundation; either

7 * version 2.1 of the License, or (at your option) any later version.

8 *

9 * FFmpeg is distributed in the hope that it will be useful,

10 * but WITHOUT ANY WARRANTY; without even the implied warranty of

11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

12 * Lesser General Public License for more details.

13 *

14 * You should have received a copy of the GNU Lesser General Public

15 * License along with FFmpeg; if not, write to the Free Software

16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

17 */

19 #include "config.h"

20 #include "libavutil/avassert.h"

21 #include "libavutil/avstring.h"

22 #include "libavutil/mem.h"

24 #include "libavcodec/avcodec.h"

25 #include "libavcodec/bytestream.h"

26 #include "libavformat/avformat.h"

27 #include "libavformat/demux.h"

29 typedef struct IOContext {

30 int64_t pos;

31 int64_t filesize;

32 const uint8_t *fuzz;

33 int fuzz_size;

34 } IOContext;

36 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

38 int64_t interrupt_counter;

39 static int interrupt_cb(void *ctx)

40 {

41 interrupt_counter --;

42 return interrupt_counter < 0;

43 }

45 static void error(const char *err)

46 {

47 fprintf(stderr, "%s", err);

48 exit(1);

49 }

51 static int io_read(void *opaque, uint8_t *buf, int buf_size)

52 {

53 IOContext *c = opaque;

54 int size = FFMIN(buf_size, c->fuzz_size);

56 if (!c->fuzz_size) {

57 c->filesize = FFMIN(c->pos, c->filesize);

58 return AVERROR_EOF;

59 }

60 if (c->pos > INT64_MAX - size)

61 return AVERROR(EIO);

63 memcpy(buf, c->fuzz, size);

64 c->fuzz += size;

65 c->fuzz_size -= size;

66 c->pos += size;

67 c->filesize = FFMAX(c->filesize, c->pos);

69 return size;

70 }

72 static int64_t io_seek(void *opaque, int64_t offset, int whence)

73 {

74 IOContext *c = opaque;

76 if (whence == SEEK_CUR) {

77 if (offset > INT64_MAX - c->pos)

78 return -1;

79 offset += c->pos;

80 } else if (whence == SEEK_END) {

81 if (offset > INT64_MAX - c->filesize)

82 return -1;

83 offset += c->filesize;

84 } else if (whence == AVSEEK_SIZE) {

85 return c->filesize;

86 }

87 if (offset < 0 || offset > c->filesize)

88 return -1;

89 if (IO_FLAT) {

90 c->fuzz += offset - c->pos;

91 c->fuzz_size -= offset - c->pos;

92 }

93 c->pos = offset;

94 return 0;

95 }

97 // Ensure we don't loop forever

98 const uint32_t maxiteration = 8096;

99 const int maxblocks= 50000;

100

101 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

102 uint32_t it = 0;

103 AVFormatContext *avfmt = avformat_alloc_context();

104 AVPacket *pkt;

105 char filename[1025] = {0};

106 AVIOContext *fuzzed_pb = NULL;

107 uint8_t *io_buffer;

108 int io_buffer_size = 32768;

109 int64_t filesize = size;

110 IOContext opaque;

111 static int c;

112 int seekable = 0;

113 int ret;

114 const AVInputFormat *fmt = NULL;

115 #ifdef FFMPEG_DEMUXER

116 #define DEMUXER_SYMBOL0(DEMUXER) ff_##DEMUXER##_demuxer

117 #define DEMUXER_SYMBOL(DEMUXER) DEMUXER_SYMBOL0(DEMUXER)

118 extern const FFInputFormat DEMUXER_SYMBOL(FFMPEG_DEMUXER);

119 fmt = &DEMUXER_SYMBOL(FFMPEG_DEMUXER).p;

120 #endif

121

122 if (!c) {

123 av_log_set_level(AV_LOG_PANIC);

124 c=1;

125 }

126

127 if (!avfmt)

128 error("Failed avformat_alloc_context()");

129

130 if (IO_FLAT) {

131 seekable = 1;

132 io_buffer_size = size;

133 } else if (size > 2048) {

134 int flags;

135 char extension[64];

136

137 GetByteContext gbc;

138 memcpy (filename, data + size - 1024, 1024);

139 bytestream2_init(&gbc, data + size - 2048, 1024);

140 size -= 2048;

141

142 io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF;

143 flags = bytestream2_get_byte(&gbc);

144 seekable = flags & 1;

145 filesize = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF;

146

147 if ((flags & 2) && strlen(filename) < sizeof(filename) / 2) {

148 const AVInputFormat *avif = NULL;

149 void *avif_iter = NULL;

150 int avif_count = 0;

151 while ((avif = av_demuxer_iterate(&avif_iter))) {

152 if (avif->extensions)

153 avif_count ++;

154 }

155 avif_count = bytestream2_get_le32(&gbc) % avif_count;

156

157 avif_iter = NULL;

158 while ((avif = av_demuxer_iterate(&avif_iter))) {

159 if (avif->extensions)

160 if (!avif_count--)

161 break;

162 }

163 av_strlcpy(extension, avif->extensions, sizeof(extension));

164 if (strchr(extension, ','))

165 *strchr(extension, ',') = 0;

166 av_strlcatf(filename, sizeof(filename), ".%s", extension);

167 }

168

169 interrupt_counter = bytestream2_get_le32(&gbc);

170 avfmt->interrupt_callback.callback = interrupt_cb;

171 }

172

173 // HLS uses a loop with sleep, we thus must breakout or we timeout

174 if (fmt && !strcmp(fmt->name, "hls"))

175 interrupt_counter &= 31;

176

177 if (!io_buffer_size || size / io_buffer_size > maxblocks)

178 io_buffer_size = size;

179

180 pkt = av_packet_alloc();

181 if (!pkt)

182 error("Failed to allocate pkt");

183

184 io_buffer = av_malloc(io_buffer_size);

185 if (!io_buffer)

186 error("Failed to allocate io_buffer");

187

188 opaque.filesize = filesize;

189 opaque.pos = 0;

190 opaque.fuzz = data;

191 opaque.fuzz_size= size;

192 fuzzed_pb = avio_alloc_context(io_buffer, io_buffer_size, 0, &opaque,

193 io_read, NULL, seekable ? io_seek : NULL);

194 if (!fuzzed_pb)

195 error("avio_alloc_context failed");

196

197 avfmt->pb = fuzzed_pb;

198

199 ret = avformat_open_input(&avfmt, filename, fmt, NULL);

200 if (ret < 0) {

201 goto fail;

202 }

203

204 ret = avformat_find_stream_info(avfmt, NULL);

205

206 //TODO, test seeking

207

208 for(it = 0; it < maxiteration; it++) {

209 ret = av_read_frame(avfmt, pkt);

210 if (ret < 0)

211 break;

212 av_packet_unref(pkt);

213 }

214

215 fail:

216 av_packet_free(&pkt);

217 av_freep(&fuzzed_pb->buffer);

218 avio_context_free(&fuzzed_pb);

219 avformat_close_input(&avfmt);

220

221 return 0;

222

223 }

flags

const SwsFlags flags[]

Definition: swscale.c:61

av_packet_unref

void av_packet_unref(AVPacket *pkt)

Wipe the packet.

Definition: packet.c:432

IOContext::filesize

int64_t filesize

Definition: target_dem_fuzzer.c:31

AVERROR

Filter the word "frame" indicates either a video frame or a group of audio as stored in an AVFrame structure Format for each input and each output the list of supported formats For video that means pixel format For audio that means channel sample they are references to shared objects When the negotiation mechanism computes the intersection of the formats supported at each end of a all references to both lists are replaced with a reference to the intersection And when a single format is eventually chosen for a link amongst the remaining all references to the list are updated That means that if a filter requires that its input and output have the same format amongst a supported all it has to do is use a reference to the same list of formats query_formats can leave some formats unset and return AVERROR(EAGAIN) to cause the negotiation mechanism toagain later. That can be used by filters with complex requirements to use the format negotiated on one link to set the formats supported on another. Frame references ownership and permissions

GetByteContext

Definition: bytestream.h:33

AVERROR_EOF

#define AVERROR_EOF

End of file.

Definition: error.h:57

AV_LOG_PANIC

#define AV_LOG_PANIC

Something went really wrong and we will crash now.

Definition: log.h:197

avio_context_free

void avio_context_free(AVIOContext **s)

Free the supplied IO context and everything associated with it.

Definition: aviobuf.c:126

int64_t

long long int64_t

Definition: coverity.c:34

avio_alloc_context

AVIOContext * avio_alloc_context(unsigned char *buffer, int buffer_size, int write_flag, void *opaque, int(*read_packet)(void *opaque, uint8_t *buf, int buf_size), int(*write_packet)(void *opaque, const uint8_t *buf, int buf_size), int64_t(*seek)(void *opaque, int64_t offset, int whence))

Allocate and initialize an AVIOContext for buffered I/O.

Definition: aviobuf.c:109

AVSEEK_SIZE

#define AVSEEK_SIZE

Passing this as the "whence" parameter to a seek function causes it to return the filesize without se...

Definition: avio.h:468

data

const char data[16]

Definition: mxf.c:149

io_seek

static int64_t io_seek(void *opaque, int64_t offset, int whence)

Definition: target_dem_fuzzer.c:72

FFMAX

#define FFMAX(a, b)

Definition: macros.h:47

av_read_frame

int av_read_frame(AVFormatContext *s, AVPacket *pkt)

Return the next frame of a stream.

Definition: demux.c:1558

IOContext::pos

int64_t pos

Definition: target_dem_fuzzer.c:30

av_strlcatf

size_t av_strlcatf(char *dst, size_t size, const char *fmt,...)

Definition: avstring.c:103

av_packet_free

void av_packet_free(AVPacket **pkt)

Free the packet, if the packet is reference counted, it will be unreferenced first.

Definition: packet.c:74

av_malloc

#define av_malloc(s)

Definition: tableprint_vlc.h:31

avformat_close_input

void avformat_close_input(AVFormatContext **s)

Close an opened input AVFormatContext.

Definition: demux.c:367

AVFormatContext::interrupt_callback

AVIOInterruptCB interrupt_callback

Custom interrupt callbacks for the I/O layer.

Definition: avformat.h:1534

io_read

static int io_read(void *opaque, uint8_t *buf, int buf_size)

Definition: target_dem_fuzzer.c:51

fail

#define fail()

Definition: checkasm.h:207

avassert.h

pkt

AVPacket * pkt

Definition: movenc.c:60

AVInputFormat

Definition: avformat.h:544

AVInputFormat::extensions

const char * extensions

If extensions are defined, then no probe is done.

Definition: avformat.h:570

avformat_open_input

int avformat_open_input(AVFormatContext **ps, const char *url, const AVInputFormat *fmt, AVDictionary **options)

Open an input stream and read the header.

Definition: demux.c:221

AVInputFormat::name

const char * name

A comma separated list of short names for the format.

Definition: avformat.h:549

ctx

AVFormatContext * ctx

Definition: movenc.c:49

IOContext::fuzz_size

int fuzz_size

Definition: target_dem_fuzzer.c:33

AVFormatContext

Format I/O context.

Definition: avformat.h:1264

NULL

#define NULL

Definition: coverity.c:32

AVFormatContext::pb

AVIOContext * pb

I/O context.

Definition: avformat.h:1306

interrupt_cb

static int interrupt_cb(void *ctx)

Definition: target_dem_fuzzer.c:39

Undefined Behavior In the C some operations are like signed integer dereferencing freed accessing outside allocated Undefined Behavior must not occur in a C it is not safe even if the output of undefined operations is unused The unsafety may seem nit picking but Optimizing compilers have in fact optimized code on the assumption that no undefined Behavior occurs Optimizing code based on wrong assumptions can and has in some cases lead to effects beyond the output of computations The signed integer overflow problem in speed critical code Code which is highly optimized and works with signed integers sometimes has the problem that often the output of the computation does not c

Definition: undefined.txt:32

avformat_find_stream_info

int avformat_find_stream_info(AVFormatContext *ic, AVDictionary **options)

Read packets of a media file to get stream information.

Definition: demux.c:2577

AVIOContext

Bytestream IO Context.

Definition: avio.h:160

avformat_alloc_context

AVFormatContext * avformat_alloc_context(void)

Allocate an AVFormatContext.

Definition: options.c:162

size

int size

Definition: twinvq_data.h:10344

av_demuxer_iterate

const AVInputFormat * av_demuxer_iterate(void **opaque)

Iterate over all registered demuxers.

Definition: allformats.c:613

FFInputFormat::p

AVInputFormat p

The public AVInputFormat.

Definition: demux.h:51

offset

it s the only field you need to keep assuming you have a context There is some magic you don t need to care about around this just let it vf offset

Definition: writing_filters.txt:86

av_packet_alloc

AVPacket * av_packet_alloc(void)

Allocate an AVPacket and set its fields to default values.

Definition: packet.c:63

IOContext::fuzz

const uint8_t * fuzz

Definition: target_dem_fuzzer.c:32

filesize

static int64_t filesize(AVIOContext *pb)

Definition: ffmpeg_mux.c:51

av_log_set_level

void av_log_set_level(int level)

Set the log level.

Definition: log.c:475

FFMIN

#define FFMIN(a, b)

Definition: macros.h:49

demux.h

error

static void error(const char *err)

Definition: target_dem_fuzzer.c:45

avcodec.h

ret

Definition: filter_design.txt:187

avformat.h

LLVMFuzzerTestOneInput

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)

Definition: target_dem_fuzzer.c:101

mem.h

interrupt_counter

int64_t interrupt_counter

Definition: target_dem_fuzzer.c:38

s EdgeDetect Foobar g libavfilter vf_edgedetect c libavfilter vf_foobar c edit libavfilter and add an entry for foobar following the pattern of the other filters edit libavfilter allfilters and add an entry for foobar following the pattern of the other filters configure make j< whatever > ffmpeg ffmpeg i you should get a foobar png with Lena edge detected That s it

Definition: writing_filters.txt:31

IOContext

Definition: target_dem_fuzzer.c:29

AVIOInterruptCB::callback

int(* callback)(void *)

Definition: avio.h:60

AVIOContext::buffer

unsigned char * buffer

Start of the buffer.

Definition: avio.h:225

AVPacket

This structure stores compressed data.