diff mbox series

[FFmpeg-devel,PATCHv5] fate/integer.c: Connect test to fuzzer

Message ID 20210517175749.517010-1-vedaa@riseup.net
State Superseded
Headers show
Series [FFmpeg-devel,PATCHv5] fate/integer.c: Connect test to fuzzer | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Vedaa May 17, 2021, 5:57 p.m. UTC
Hi,
I have removed the tests for overflow & reduced the number of bits read
to 32-bit to avoid overflow.

Best regards
---
 Makefile                  |  2 ++
 libavutil/tests/integer.c | 21 ++----------------
 libavutil/tests/integer.h | 45 +++++++++++++++++++++++++++++++++++++++
 tools/Makefile            |  3 +++
 tools/target_int_fuzzer.c | 35 ++++++++++++++++++++++++++++++
 5 files changed, 87 insertions(+), 19 deletions(-)
 create mode 100644 libavutil/tests/integer.h
 create mode 100644 tools/target_int_fuzzer.c

Comments

Michael Niedermayer May 18, 2021, 9:38 p.m. UTC | #1
On Mon, May 17, 2021 at 11:27:49PM +0530, Vedaa wrote:
> Hi,
> I have removed the tests for overflow & reduced the number of bits read
> to 32-bit to avoid overflow.
> 
> Best regards
> ---
>  Makefile                  |  2 ++
>  libavutil/tests/integer.c | 21 ++----------------
>  libavutil/tests/integer.h | 45 +++++++++++++++++++++++++++++++++++++++
>  tools/Makefile            |  3 +++
>  tools/target_int_fuzzer.c | 35 ++++++++++++++++++++++++++++++
>  5 files changed, 87 insertions(+), 19 deletions(-)
>  create mode 100644 libavutil/tests/integer.h
>  create mode 100644 tools/target_int_fuzzer.c

The return code is wrong

target_int_fuzzer: ../FuzzerLoop.cpp:499: void fuzzer::Fuzzer::ExecuteCallback(const uint8_t *, size_t): Assertion `Res == 0' failed.

after fixing the return code:

#0	READ units: 1
#2	INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 27Mb
libavutil/integer.c:163:19: runtime error: left shift of negative value -1
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavutil/integer.c:163:19 in 
libavutil/integer.c:104:53: runtime error: left shift of 65535 by 16 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavutil/integer.c:104:53 in 
#4	NEW    cov: 85 ft: 85 corp: 2/93b exec/s: 0 rss: 28Mb L: 92/92 MS: 2 ChangeBit-InsertRepeatedBytes-
Assertion av_log2_i(ai) == (31 - __builtin_clz((a)|1)) failed at ./libavutil/tests/integer.h:42


[...]
diff mbox series

Patch

diff --git a/Makefile b/Makefile
index 7e9d8b08c3..92fe8cac65 100644
--- a/Makefile
+++ b/Makefile
@@ -62,6 +62,8 @@  tools/target_dem_fuzzer$(EXESUF): tools/target_dem_fuzzer.o $(FF_DEP_LIBS)
 tools/target_io_dem_fuzzer$(EXESUF): tools/target_io_dem_fuzzer.o $(FF_DEP_LIBS)
 	$(LD) $(LDFLAGS) $(LDEXEFLAGS) $(LD_O) $^ $(ELIBS) $(FF_EXTRALIBS) $(LIBFUZZER_PATH)
 
+tools/target_int_fuzzer$(EXESUF): tools/target_int_fuzzer.o $(FF_DEP_LIBS)
+	$(LD) $(LDFLAGS) $(LDEXEFLAGS) $(LD_O) $^ $(ELIBS) $(FF_EXTRALIBS) $(LIBFUZZER_PATH)
 
 tools/enum_options$(EXESUF): ELIBS = $(FF_EXTRALIBS)
 tools/enum_options$(EXESUF): $(FF_DEP_LIBS)
diff --git a/libavutil/tests/integer.c b/libavutil/tests/integer.c
index d2c8f2a903..02e1d9219c 100644
--- a/libavutil/tests/integer.c
+++ b/libavutil/tests/integer.c
@@ -18,31 +18,14 @@ 
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
-#include <stdint.h>
-
-#include "libavutil/avassert.h"
-#include "libavutil/integer.h"
-#include "libavutil/intmath.h"
+#include "libavutil/tests/integer.h"
 
 int main(void){
     int64_t a,b;
 
     for(a=7; a<256*256*256; a+=13215){
         for(b=3; b<256*256*256; b+=27118){
-            AVInteger ai= av_int2i(a);
-            AVInteger bi= av_int2i(b);
-
-            av_assert0(av_i2int(ai) == a);
-            av_assert0(av_i2int(bi) == b);
-            av_assert0(av_i2int(av_add_i(ai,bi)) == a+b);
-            av_assert0(av_i2int(av_sub_i(ai,bi)) == a-b);
-            av_assert0(av_i2int(av_mul_i(ai,bi)) == a*b);
-            av_assert0(av_i2int(av_shr_i(ai, 9)) == a>>9);
-            av_assert0(av_i2int(av_shr_i(ai,-9)) == a<<9);
-            av_assert0(av_i2int(av_shr_i(ai, 17)) == a>>17);
-            av_assert0(av_i2int(av_shr_i(ai,-17)) == a<<17);
-            av_assert0(av_log2_i(ai) == av_log2(a));
-            av_assert0(av_i2int(av_div_i(ai,bi)) == a/b);
+            TestInteger(a,b);
         }
     }
     return 0;
diff --git a/libavutil/tests/integer.h b/libavutil/tests/integer.h
new file mode 100644
index 0000000000..1e28c29787
--- /dev/null
+++ b/libavutil/tests/integer.h
@@ -0,0 +1,45 @@ 
+/*
+ * Copyright (c) 2004 Michael Niedermayer <michaelni@gmx.at>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+#ifndef AVUTIL_TESTS_INTEGER_H
+#define AVUTIL_TESTS_INTEGER_H
+
+#include <stdint.h>
+#include "libavutil/avassert.h"
+#include "libavutil/integer.h"
+#include "libavutil/intmath.h"
+
+static inline void TestInteger(int64_t a, int64_t b)
+{
+        AVInteger ai= av_int2i(a);
+        AVInteger bi= av_int2i(b);
+
+        av_assert0(av_i2int(ai) == a);
+        av_assert0(av_i2int(bi) == b);
+        av_assert0(av_i2int(av_add_i(ai,bi)) == a+b);
+        av_assert0(av_i2int(av_sub_i(ai,bi)) == a-b);
+        av_assert0(av_i2int(av_mul_i(ai,bi)) == a*b);
+        av_assert0(av_i2int(av_shr_i(ai, 9)) == a>>9);
+        av_assert0(av_i2int(av_shr_i(ai,-9)) == a<<9);
+        av_assert0(av_i2int(av_shr_i(ai, 17)) == a>>17);
+        av_assert0(av_i2int(av_shr_i(ai,-17)) == a<<17);
+        av_assert0(av_log2_i(ai) == av_log2(a));
+        av_assert0(av_i2int(av_div_i(ai,bi)) == a/b);
+}
+#endif /* AVUTIL_TESTS_INTEGER_H */
diff --git a/tools/Makefile b/tools/Makefile
index 82baa8eadb..fde7f08984 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -17,6 +17,9 @@  tools/target_dem_fuzzer.o: tools/target_dem_fuzzer.c
 tools/target_io_dem_fuzzer.o: tools/target_dem_fuzzer.c
 	$(COMPILE_C) -DIO_FLAT=0
 
+tools/target_int_fuzzer.o: tools/target_int_fuzzer.c
+	$(COMPILE_C)
+
 OUTDIRS += tools
 
 clean::
diff --git a/tools/target_int_fuzzer.c b/tools/target_int_fuzzer.c
new file mode 100644
index 0000000000..929ae7fae9
--- /dev/null
+++ b/tools/target_int_fuzzer.c
@@ -0,0 +1,35 @@ 
+/*
+ * Copyright (c) 2021 Vedaa <vedaa@riseup.net>
+ *
+ * This file is part of FFmpeg.
+ *
+ * FFmpeg is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * FFmpeg is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with FFmpeg; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "libavutil/tests/integer.h"
+#include "libavutil/intreadwrite.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < 2 * sizeof(int32_t))
+        return 1;
+
+    int64_t a,b;
+    a = AV_RB32(data);
+    b = AV_RB32(data + sizeof(int32_t));
+    TestInteger(a,b);
+    return 0;
+}