| Message ID | 20240823114958.70392-1-post@frankplowman.com |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] tools/target_{bsf, dec}_fuzzer: Stop skipping end of input | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Fri, Aug 23, 2024 at 12:49:30PM +0100, Frank Plowman wrote: > For the final input in a file, the while loop above will not break and > as a result > > data + sizeof(fuzz_tag) == end > > when it exits. There is an off-by-one error in the changed line, > which is meant to handle this case. The result is that the final 8 > bytes of all input files are skipped. > > Signed-off-by: Frank Plowman <post@frankplowman.com> > --- > tools/target_bsf_fuzzer.c | 2 +- > tools/target_dec_fuzzer.c | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) this will alter behavior of past testcase not sure if thats good thx [...]
diff --git a/tools/target_bsf_fuzzer.c b/tools/target_bsf_fuzzer.c index 44a4d1467d..c3761bb33e 100644 --- a/tools/target_bsf_fuzzer.c +++ b/tools/target_bsf_fuzzer.c @@ -131,7 +131,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { break; data++; } - if (data + sizeof(fuzz_tag) > end) + if (data + sizeof(fuzz_tag) >= end) data = end; res = av_new_packet(pkt, data - last); diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index 794b5b92cc..550d34fc61 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -485,7 +485,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { break; data++; } - if (data + sizeof(fuzz_tag) > end) + if (data + sizeof(fuzz_tag) >= end) data = end; res = av_new_packet(parsepkt, data - last);
For the final input in a file, the while loop above will not break and as a result data + sizeof(fuzz_tag) == end when it exits. There is an off-by-one error in the changed line, which is meant to handle this case. The result is that the final 8 bytes of all input files are skipped. Signed-off-by: Frank Plowman <post@frankplowman.com> --- tools/target_bsf_fuzzer.c | 2 +- tools/target_dec_fuzzer.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)