1 /*
2 * This file is part of FFmpeg.
3 *
4 * FFmpeg is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * FFmpeg is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with FFmpeg; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17 */
18
19 #include "config.h"
20 #include "libavutil/avassert.h"
21
22 #include "libavcodec/avcodec.h"
23 #include "libavcodec/bytestream.h"
24 #include "libavformat/avformat.h"
25
26
27 typedef struct IOContext {
28 int64_t pos;
29 int64_t filesize;
30 uint8_t *fuzz;
31 int fuzz_size;
32 } IOContext;
33
34 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
35
error(const char * err)36 static void error(const char *err)
37 {
38 fprintf(stderr, "%s", err);
39 exit(1);
40 }
41
io_read(void * opaque,uint8_t * buf,int buf_size)42 static int io_read(void *opaque, uint8_t *buf, int buf_size)
43 {
44 IOContext *c = opaque;
45 int size = FFMIN(buf_size, c->fuzz_size);
46
47 if (!c->fuzz_size) {
48 c->filesize = FFMIN(c->pos, c->filesize);
49 return AVERROR_EOF;
50 }
51
52 memcpy(buf, c->fuzz, size);
53 c->fuzz += size;
54 c->fuzz_size -= size;
55 c->pos += size;
56 c->filesize = FFMAX(c->filesize, c->pos);
57
58 return size;
59 }
60
io_seek(void * opaque,int64_t offset,int whence)61 static int64_t io_seek(void *opaque, int64_t offset, int whence)
62 {
63 IOContext *c = opaque;
64
65 if (whence == SEEK_CUR) {
66 if (offset > INT64_MAX - c->pos)
67 return -1;
68 offset += c->pos;
69 } else if (whence == SEEK_END) {
70 if (offset > INT64_MAX - c->filesize)
71 return -1;
72 offset += c->filesize;
73 } else if (whence == AVSEEK_SIZE) {
74 return c->filesize;
75 }
76 if (offset < 0 || offset > c->filesize)
77 return -1;
78 c->pos = offset;
79 return 0;
80 }
81
82 // Ensure we don't loop forever
83 const uint32_t maxiteration = 8096;
84
85 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
86
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)87 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
88 const uint64_t fuzz_tag = FUZZ_TAG;
89 uint32_t it = 0;
90 AVFormatContext *avfmt = avformat_alloc_context();
91 AVPacket pkt;
92 char filename[1025] = {0};
93 AVIOContext *fuzzed_pb = NULL;
94 uint8_t *io_buffer;
95 int io_buffer_size = 32768;
96 int64_t filesize = size;
97 IOContext opaque;
98 static int c;
99 int seekable = 0;
100 int ret;
101
102 if (!c) {
103 av_register_all();
104 avcodec_register_all();
105 av_log_set_level(AV_LOG_PANIC);
106 c=1;
107 }
108
109 if (!avfmt)
110 error("Failed avformat_alloc_context()");
111
112 if (size > 2048) {
113 GetByteContext gbc;
114 memcpy (filename, data + size - 1024, 1024);
115 bytestream2_init(&gbc, data + size - 2048, 1024);
116 size -= 2048;
117
118 io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF;
119 seekable = bytestream2_get_byte(&gbc) & 1;
120 filesize = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF;
121 }
122 io_buffer = av_malloc(io_buffer_size);
123 if (!io_buffer)
124 error("Failed to allocate io_buffer");
125
126 opaque.filesize = filesize;
127 opaque.pos = 0;
128 opaque.fuzz = data;
129 opaque.fuzz_size= size;
130 fuzzed_pb = avio_alloc_context(io_buffer, io_buffer_size, 0, &opaque,
131 io_read, NULL, seekable ? io_seek : NULL);
132 if (!fuzzed_pb)
133 error("avio_alloc_context failed");
134
135 avfmt->pb = fuzzed_pb;
136
137 ret = avformat_open_input(&avfmt, filename, NULL, NULL);
138 if (ret < 0) {
139 av_freep(&fuzzed_pb->buffer);
140 av_freep(&fuzzed_pb);
141 avformat_free_context(avfmt);
142 return 0;
143 }
144
145 ret = avformat_find_stream_info(avfmt, NULL);
146
147 av_init_packet(&pkt);
148
149 //TODO, test seeking
150
151 for(it = 0; it < maxiteration; it++) {
152 ret = av_read_frame(avfmt, &pkt);
153 if (ret < 0)
154 break;
155 av_packet_unref(&pkt);
156 }
157 end:
158 av_freep(&fuzzed_pb->buffer);
159 av_freep(&fuzzed_pb);
160 avformat_close_input(&avfmt);
161
162 return 0;
163 }
164