From patchwork Wed Aug 21 00:05:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Almer X-Patchwork-Id: 14632 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 1DE7A447D8C for ; Wed, 21 Aug 2019 03:06:22 +0300 (EEST) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id F147268A848; Wed, 21 Aug 2019 03:06:21 +0300 (EEST) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-qt1-f193.google.com (mail-qt1-f193.google.com [209.85.160.193]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 9543D689B51 for ; Wed, 21 Aug 2019 03:06:15 +0300 (EEST) Received: by mail-qt1-f193.google.com with SMTP id j15so851575qtl.13 for ; Tue, 20 Aug 2019 17:06:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=4ToamxMqEUPr1rOAEMUlVBzHkSHLd0rxCrBpCT7WgrI=; b=HQNGIbb0CHe7RgSWih0aaReEN2PoScNxKF9hylMUvAvm0hLzcfiHm7sw119a+v8NIK CVSeJ4ghjMbYg+Y2G1Miq6lDKM8yLxtIxN1mrrUYiauQ6MUWrPZt802Ev8Ss1AbdlK+E q0QX/vxeJZtr6OaLGn7J82VJ8f3Cv1nE1ZghUEFSzRmeOw3yIw3Bon7mRZJIdaGnQYy7 OPbpAfo48K+u0tBjHGBvGwDHA/dxWB8oozNfzudCPT+b8r2TnrARlA+xfAUjKoxS+wJJ w+cnDPic5eVPjcde3yrG5eSaRxR/0j6G7QfKx5OijGCLlP4IbFNHMFNtSviNDDDpZGqC kdhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=4ToamxMqEUPr1rOAEMUlVBzHkSHLd0rxCrBpCT7WgrI=; b=mi5UJoSGCe0LGrNHWsK1NvIOA9NUssPYg4vZEZE+98RJOoqxqh+zeCWx4wSB1djnKr B/UaM6Zvqn/km23CZFR5wvNwvhY/ZoR4DRYgGf80QdKe0Nw94Gg+cVsJ8yWpqsu4UZtP M9LimaKggomwW8EBCH8MTghl45RUYz4AtEMmvg1fPMCzurd5Qz6nTqbCFXdC9gk9co16 mx8QDeOSvpbIRbkfvIrYuQRaG/ChZfajUpDoaJ1TmYeBnrbzYtHOIiZH2eevN6+oEa6n h8gmoB7Lf8Cwvkuo5USHKpokwKOqRgS5Ja5uRrZXKw6lo4VAp/gjz+FHG2p5SiEDTH+8 KXog== X-Gm-Message-State: APjAAAVv3Tp/03HR+5RYmvwM3F/pJzD943bg5wRnUW57Lzouc5w0MVNt 6ewVPtCR+WJZJCrs/9YhQSn0znYm X-Google-Smtp-Source: APXvYqyYxBb8r2PNTsqXC9zdG16cZRTiIHeL/fIQHRMmoR6SXTkp2t0ddJLkFeIMQCwBbWq15wkSGw== X-Received: by 2002:a05:6214:13a1:: with SMTP id h1mr15765279qvz.190.1566345973982; Tue, 20 Aug 2019 17:06:13 -0700 (PDT) Received: from localhost.localdomain ([181.23.95.42]) by smtp.gmail.com with ESMTPSA id u23sm9238327qkj.98.2019.08.20.17.06.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Aug 2019 17:06:13 -0700 (PDT) From: James Almer To: ffmpeg-devel@ffmpeg.org Date: Tue, 20 Aug 2019 21:05:58 -0300 Message-Id: <20190821000558.1952-1-jamrial@gmail.com> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190820225222.1889-1-jamrial@gmail.com> References: <20190820225222.1889-1-jamrial@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2] tools/target_dec_fuzzer: use refcounted packets X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Should reduce date copying considerably. Signed-off-by: James Almer --- Fixed a stupid mistake when checking the return value for av_new_packet(). Still untested. tools/target_dec_fuzzer.c | 71 ++++++++++++--------------------------- 1 file changed, 21 insertions(+), 50 deletions(-) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index d83039417c..0d10503cfb 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -85,47 +85,6 @@ static int subtitle_handler(AVCodecContext *avctx, void *frame, return ret; } -// Class to handle buffer allocation and resize for each frame -typedef struct FuzzDataBuffer { - size_t size_; - uint8_t *data_; -} FuzzDataBuffer; - -static void FDBCreate(FuzzDataBuffer *FDB) { - FDB->size_ = 0x1000; - FDB->data_ = av_malloc(FDB->size_); - if (!FDB->data_) - error("Failed memory allocation"); -} - -static void FDBDesroy(FuzzDataBuffer *FDB) { av_free(FDB->data_); } - -static void FDBRealloc(FuzzDataBuffer *FDB, size_t size) { - size_t needed = size + AV_INPUT_BUFFER_PADDING_SIZE; - av_assert0(needed > size); - if (needed > FDB->size_) { - av_free(FDB->data_); - FDB->size_ = needed; - FDB->data_ = av_malloc(FDB->size_); - if (!FDB->data_) - error("Failed memory allocation"); - } -} - -static void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data, - size_t size) -{ - FDBRealloc(FDB, size); - memcpy(FDB->data_, data, size); - size_t padd = FDB->size_ - size; - if (padd > AV_INPUT_BUFFER_PADDING_SIZE) - padd = AV_INPUT_BUFFER_PADDING_SIZE; - memset(FDB->data_ + size, 0, padd); - av_init_packet(dst); - dst->data = FDB->data_; - dst->size = size; -} - // Ensure we don't loop forever const uint32_t maxiteration = 8096; const uint64_t maxpixels_per_frame = 4096 * 4096; @@ -135,7 +94,6 @@ static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL; int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const uint64_t fuzz_tag = FUZZ_TAG; - FuzzDataBuffer buffer; const uint8_t *last = data; const uint8_t *end = data + size; uint32_t it = 0; @@ -186,6 +144,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { error("Failed memory allocation"); ctx->max_pixels = maxpixels_per_frame; //To reduce false positive OOM and hangs + ctx->refcounted_frames = 1; if (size > 1024) { GetByteContext gbc; @@ -222,7 +181,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { } parser_avctx->codec_id = ctx->codec_id; - FDBCreate(&buffer); int got_frame; AVFrame *frame = av_frame_alloc(); if (!frame) @@ -230,6 +188,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { // Read very simple container AVPacket avpkt, parsepkt; + av_init_packet(&avpkt); while (data < end && it < maxiteration) { // Search for the TAG while (data + sizeof(fuzz_tag) < end) { @@ -240,7 +199,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (data + sizeof(fuzz_tag) > end) data = end; - FDBPrepare(&buffer, &parsepkt, last, data - last); + res = av_new_packet(&parsepkt, data - last); + if (res < 0) + error("Failed memory allocation"); + memcpy(parsepkt.data, last, data - last); data += sizeof(fuzz_tag); last = data; @@ -257,13 +219,21 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { avpkt.pts = parser->pts; avpkt.dts = parser->dts; avpkt.pos = parser->pos; + if (avpkt.data == parsepkt.data) { + avpkt.buf = av_buffer_ref(parsepkt.buf); + if (!avpkt.buf) + error("Failed memory allocation"); + } else { + ret = av_packet_make_refcounted(&avpkt); + if (ret < 0) + error("Failed memory allocation"); + } if ( parser->key_frame == 1 || (parser->key_frame == -1 && parser->pict_type == AV_PICTURE_TYPE_I)) avpkt.flags |= AV_PKT_FLAG_KEY; avpkt.flags |= parsepkt.flags & AV_PKT_FLAG_DISCARD; } else { - avpkt = parsepkt; - parsepkt.size = 0; + av_packet_move_ref(&avpkt, &parsepkt); } // Iterate through all data @@ -284,16 +254,17 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { avpkt.data += ret; avpkt.size -= ret; } + av_packet_unref(&avpkt); } + av_packet_unref(&parsepkt); } maximums_reached: - av_init_packet(&avpkt); - avpkt.data = NULL; - avpkt.size = 0; + av_packet_unref(&avpkt); do { got_frame = 0; + av_frame_unref(frame); decode_handler(ctx, frame, &got_frame, &avpkt); } while (got_frame == 1 && it++ < maxiteration); @@ -303,6 +274,6 @@ maximums_reached: avcodec_free_context(&ctx); avcodec_free_context(&parser_avctx); av_parser_close(parser); - FDBDesroy(&buffer); + av_packet_unref(&parsepkt); return 0; }