FFmpeg: tools/target_sws_fuzzer.c Source File

FFmpeg

tools

target_sws_fuzzer.c

Go to the documentation of this file.

1 /*

2 * Copyright (c) 2024 Michael Niedermayer <michael-ffmpeg@niedermayer.cc>

3 *

4 * This file is part of FFmpeg.

5 *

6 * FFmpeg is free software; you can redistribute it and/or

7 * modify it under the terms of the GNU Lesser General Public

8 * License as published by the Free Software Foundation; either

9 * version 2.1 of the License, or (at your option) any later version.

10 *

11 * FFmpeg is distributed in the hope that it will be useful,

12 * but WITHOUT ANY WARRANTY; without even the implied warranty of

13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

14 * Lesser General Public License for more details.

15 *

16 * You should have received a copy of the GNU Lesser General Public

17 * License along with FFmpeg; if not, write to the Free Software

18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

19 */

20

21 #include "config.h"

22 #include "libavutil/avassert.h"

23 #include "libavutil/avstring.h"

24 #include "libavutil/cpu.h"

25 #include "libavutil/imgutils.h"

26 #include "libavutil/intreadwrite.h"

27 #include "libavutil/mem.h"

28 #include "libavutil/opt.h"

29

30 #include "libavcodec/bytestream.h"

31

32 #include "libswscale/swscale.h"

33

34

35 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

36

37 static void error(const char *err)

38 {

39 fprintf(stderr, "%s", err);

40 exit(1);

41 }

42

43 static int alloc_plane(uint8_t *data[AV_VIDEO_MAX_PLANES], int stride[AV_VIDEO_MAX_PLANES], int w, int h, int format, int *hshift, int *vshift)

44 {

45 size_t size[AV_VIDEO_MAX_PLANES];

46 ptrdiff_t ptrdiff_stride[AV_VIDEO_MAX_PLANES];

47 int ret = av_image_fill_linesizes(stride, format, w);

48 if (ret < 0)

49 return -1;

50

51 av_assert0(AV_VIDEO_MAX_PLANES == 4); // Some of the libavutil API has 4 hardcoded so this has undefined behaviour if its not 4

52

53 av_pix_fmt_get_chroma_sub_sample(format, hshift, vshift);

54

55 for(int p=0; p<AV_VIDEO_MAX_PLANES; p++) {

56 stride[p] =

57 ptrdiff_stride[p] = FFALIGN(stride[p], 32);

58 }

59 ret = av_image_fill_plane_sizes(size, format, h, ptrdiff_stride);

60 if (ret < 0)

61 return ret;

62

63 for(int p=0; p<AV_VIDEO_MAX_PLANES; p++) {

64 if (size[p]) {

65 data[p] = av_mallocz(size[p] + 32);

66 if (!data[p])

67 return -1;

68 } else

69 data[p] = NULL;

70 }

71 return 0;

72 }

73

74 static void free_plane(uint8_t *data[AV_VIDEO_MAX_PLANES])

75 {

76 for(int p=0; p<AV_VIDEO_MAX_PLANES; p++)

77 av_freep(&data[p]);

78 }

79

80 static void mapres(unsigned *r0, unsigned *r1) {

81 double d = (double)(*r0*10ll - 9ll*UINT32_MAX) / UINT32_MAX;

82 double a = exp(d) * 16384 / exp(1) ;

83 int ai = (int)round(a);

84 uint64_t maxb = 16384 / ai;

85 *r0 = ai;

86 *r1 = 1 + (*r1 * maxb) / UINT32_MAX;

87 }

88

89 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

90 int srcW= 48, srcH = 48;

91 int dstW= 48, dstH = 48;

92 int srcHShift, srcVShift;

93 int dstHShift, dstVShift;

94 unsigned flags = 1;

95 int srcStride[AV_VIDEO_MAX_PLANES] = {0};

96 int dstStride[AV_VIDEO_MAX_PLANES] = {0};

97 int ret;

98 const uint8_t *end = data + size;

99 enum AVPixelFormat srcFormat = AV_PIX_FMT_YUV420P;

100 enum AVPixelFormat dstFormat = AV_PIX_FMT_YUV420P;

101 uint8_t *src[AV_VIDEO_MAX_PLANES] = { 0 };

102 uint8_t *dst[AV_VIDEO_MAX_PLANES] = { 0 };

103 struct SwsContext *sws = NULL;

104 const AVPixFmtDescriptor *desc_src, *desc_dst;

105

106 if (size > 128) {

107 GetByteContext gbc;

108 int64_t flags64;

109

110 size -= 128;

111 bytestream2_init(&gbc, data + size, 128);

112 srcW = bytestream2_get_le32(&gbc);

113 srcH = bytestream2_get_le32(&gbc);

114 dstW = bytestream2_get_le32(&gbc);

115 dstH = bytestream2_get_le32(&gbc);

116

117 mapres(&srcW, &srcH);

118 mapres(&dstW, &dstH);

119

120 flags = bytestream2_get_le32(&gbc);

121

122 unsigned mask = flags & (SWS_POINT |

123 SWS_AREA |

124 SWS_BILINEAR |

125 SWS_FAST_BILINEAR |

126 SWS_BICUBIC |

127 SWS_X |

128 SWS_GAUSS |

129 SWS_LANCZOS |

130 SWS_SINC |

131 SWS_SPLINE |

132 SWS_BICUBLIN);

133 mask &= flags;

134 if (mask && (mask & (mask -1)))

135 return 0; // multiple scalers are set, not possible

136

137 srcFormat = bytestream2_get_le32(&gbc) % AV_PIX_FMT_NB;

138 dstFormat = bytestream2_get_le32(&gbc) % AV_PIX_FMT_NB;

139

140 flags64 = bytestream2_get_le64(&gbc);

141 if (flags64 & 0x10)

142 av_force_cpu_flags(0);

143

144 if (av_image_check_size(srcW, srcH, srcFormat, NULL) < 0)

145 srcW = srcH = 23;

146 if (av_image_check_size(dstW, dstH, dstFormat, NULL) < 0)

147 dstW = dstH = 23;

148 //TODO alphablend

149 }

150

151 desc_src = av_pix_fmt_desc_get(srcFormat);

152 desc_dst = av_pix_fmt_desc_get(dstFormat);

153

154 // fprintf(stderr, "%d x %d %s -> %d x %d %s\n", srcW, srcH, desc_src->name, dstW, dstH, desc_dst->name);

155

156 ret = alloc_plane(src, srcStride, srcW, srcH, srcFormat, &srcHShift, &srcVShift);

157 if (ret < 0)

158 goto end;

159

160 ret = alloc_plane(dst, dstStride, dstW, dstH, dstFormat, &dstHShift, &dstVShift);

161 if (ret < 0)

162 goto end;

163

164

165 for(int p=0; p<AV_VIDEO_MAX_PLANES; p++) {

166 int psize = srcStride[p] * AV_CEIL_RSHIFT(srcH, (p == 1 || p == 2) ? srcVShift : 0);

167 if (psize > size)

168 psize = size;

169 if (psize) {

170 memcpy(src[p], data, psize);

171 data += psize;

172 size -= psize;

173 }

174 }

175

176 sws = sws_alloc_context();

177 if (!sws)

178 error("Failed sws allocation");

179

180 av_opt_set_int(sws, "sws_flags", flags, 0);

181 av_opt_set_int(sws, "srcw", srcW, 0);

182 av_opt_set_int(sws, "srch", srcH, 0);

183 av_opt_set_int(sws, "dstw", dstW, 0);

184 av_opt_set_int(sws, "dsth", dstH, 0);

185 av_opt_set_int(sws, "src_format", srcFormat, 0);

186 av_opt_set_int(sws, "dst_format", dstFormat, 0);

187 av_opt_set(sws, "alphablend", "none", 0);

188

189 ret = sws_init_context(sws, NULL, NULL);

190 if (ret < 0)

191 goto end;

192

193 //TODO Slices

194 sws_scale(sws, (const uint8_t * const*)src, srcStride, 0, srcH, dst, dstStride);

195

196 end:

197 sws_freeContext(sws);

198

199 free_plane(src);

200 free_plane(dst);

201

202 return 0;

203 }

const SwsFlags flags[]

Definition: swscale.c:61

av_force_cpu_flags

void av_force_cpu_flags(int arg)

Disables cpu detection and forces the specified flags.

Definition: cpu.c:81

AVPixelFormat

Pixel format.

Definition: pixfmt.h:71

Definition: bytestream.h:33

av_pix_fmt_desc_get

const AVPixFmtDescriptor * av_pix_fmt_desc_get(enum AVPixelFormat pix_fmt)

Definition: pixdesc.c:3456

long long int64_t

Definition: coverity.c:34

AV_VIDEO_MAX_PLANES

#define AV_VIDEO_MAX_PLANES

Maximum number of planes in any pixel format.

Definition: pixfmt.h:40

sws_freeContext

void sws_freeContext(SwsContext *swsContext)

Free the swscaler context swsContext.

Definition: utils.c:2244

int mask

Definition: mediacodecdec_common.c:154

static void free_plane(uint8_t *data[AV_VIDEO_MAX_PLANES])

Definition: target_sws_fuzzer.c:74

w

uint8_t w

Definition: llviddspenc.c:38

@ SWS_BILINEAR

bilinear filtering

Definition: swscale.h:99

const char data[16]

Definition: mxf.c:149

@ SWS_BICUBLIN

bicubic luma, bilinear chroma

Definition: swscale.h:104

@ AV_PIX_FMT_NB

hardware decoding through openharmony

Definition: pixfmt.h:502

SWS_FAST_BILINEAR

@ SWS_FAST_BILINEAR

Scaler selection options.

Definition: swscale.h:98

sws_init_context

av_warn_unused_result int sws_init_context(SwsContext *sws_context, SwsFilter *srcFilter, SwsFilter *dstFilter)

Initialize the swscaler context sws_context.

Definition: utils.c:1879

av_pix_fmt_get_chroma_sub_sample

int av_pix_fmt_get_chroma_sub_sample(enum AVPixelFormat pix_fmt, int *h_shift, int *v_shift)

Utility function to access log2_chroma_w log2_chroma_h from the pixel format AVPixFmtDescriptor.

Definition: pixdesc.c:3484

int av_opt_set(void *obj, const char *name, const char *val, int search_flags)

Definition: opt.c:835

@ SWS_AREA

area averaging

Definition: swscale.h:103

av_image_fill_linesizes

int av_image_fill_linesizes(int linesizes[4], enum AVPixelFormat pix_fmt, int width)

Fill plane linesizes for an image with pixel format pix_fmt and width width.

Definition: imgutils.c:89

#define AV_CEIL_RSHIFT(a, b)

Definition: common.h:60

#define av_assert0(cond)

assert() equivalent, that is always enabled.

Definition: avassert.h:41

AV_PIX_FMT_YUV420P

@ AV_PIX_FMT_YUV420P

planar YUV 4:2:0, 12bpp, (1 Cr & Cb sample per 2x2 Y samples)

Definition: pixfmt.h:73

static int alloc_plane(uint8_t *data[AV_VIDEO_MAX_PLANES], int stride[AV_VIDEO_MAX_PLANES], int w, int h, int format, int *hshift, int *vshift)

Definition: target_sws_fuzzer.c:43

#define NULL

Definition: coverity.c:32

New swscale design to change SwsGraph is what coordinates multiple passes These can include cascaded scaling error diffusion and so on Or we could have separate passes for the vertical and horizontal scaling In between each SwsPass lies a fully allocated image buffer Graph passes may have different levels of e g we can have a single threaded error diffusion pass following a multi threaded scaling pass SwsGraph is internally recreated whenever the image format

Definition: swscale-v2.txt:14

@ SWS_BICUBIC

2-tap cubic B-spline

Definition: swscale.h:100

av_image_fill_plane_sizes

int av_image_fill_plane_sizes(size_t sizes[4], enum AVPixelFormat pix_fmt, int height, const ptrdiff_t linesizes[4])

Fill plane sizes for an image with pixel format pix_fmt and height height.

Definition: imgutils.c:111

double

Definition: af_crystalizer.c:132

int8_t exp

Definition: eval.c:73

int av_opt_set_int(void *obj, const char *name, int64_t val, int search_flags)

Definition: opt.c:880

sws_alloc_context

SwsContext * sws_alloc_context(void)

Allocate an empty SwsContext and set its fields to default values.

Definition: utils.c:1018

uint8_t ptrdiff_t const uint8_t ptrdiff_t int intptr_t intptr_t int int16_t * dst

Definition: dsp.h:87

double d

Definition: swresample_internal.h:179

int size

Definition: twinvq_data.h:10344

@ SWS_POINT

nearest neighbor

Definition: swscale.h:102

@ SWS_SPLINE

cubic Keys spline

Definition: swscale.h:108

a

The reader does not expect b to be semantically here and if the code is changed by maybe adding a a division or other the signedness will almost certainly be mistaken To avoid this confusion a new type was SUINT is the C unsigned type but it holds a signed int to use the same example SUINT a

Definition: undefined.txt:41

static void error(const char *err)

Definition: target_sws_fuzzer.c:37

static SwsContext * sws[3]

Definition: swscale.c:73

static av_always_inline av_const double round(double x)

Definition: libm.h:446

@ SWS_X

experimental

Definition: swscale.h:101

void * av_mallocz(size_t size)

Allocate a memory block with alignment suitable for all memory accesses (including vectors if availab...

Definition: mem.c:256

ret

Definition: filter_design.txt:187

int attribute_align_arg sws_scale(SwsContext *sws, const uint8_t *const srcSlice[], const int srcStride[], int srcSliceY, int srcSliceH, uint8_t *const dst[], const int dstStride[])

swscale wrapper, so we don't need to export the SwsContext.

Definition: swscale.c:1503

@ SWS_GAUSS

gaussian approximation

Definition: swscale.h:105

Windows::Graphics::DirectX::Direct3D11::p

IDirect3DDxgiInterfaceAccess _COM_Outptr_ void ** p

Definition: vsrc_gfxcapture_winrt.hpp:53

static void mapres(unsigned *r0, unsigned *r1)

Definition: target_sws_fuzzer.c:80

AVPixFmtDescriptor

Descriptor that unambiguously describes how the bits of a pixel are stored in the up to 4 data planes...

Definition: pixdesc.h:69

LLVMFuzzerTestOneInput

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)

Definition: target_sws_fuzzer.c:89

#define FFALIGN(x, a)

Definition: macros.h:78

#define av_freep(p)

Definition: tableprint_vlc.h:35

bytestream2_init

static av_always_inline void bytestream2_init(GetByteContext *g, const uint8_t *buf, int buf_size)

Definition: bytestream.h:137

h

h

Definition: vp9dsp_template.c:2070

@ SWS_LANCZOS

3-tap sinc/sinc

Definition: swscale.h:107

#define stride

Definition: h264pred_template.c:536

av_image_check_size

int av_image_check_size(unsigned int w, unsigned int h, int log_offset, void *log_ctx)

Check if the given dimension of an image is valid, meaning that all bytes of the image can be address...

Definition: imgutils.c:318

@ SWS_SINC

unwindowed sinc

Definition: swscale.h:106

Main external API structure.

Definition: swscale.h:189

#define src

Definition: vp8dsp.c:248

Generated on Tue Nov 18 2025 19:23:48 for FFmpeg by doxygen 1.8.17