1 /******************************************************************************
2 *
3 * Copyright (C) 2019 The Android Open Source Project
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 *****************************************************************************
18 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
19 */
20
21 #include <stddef.h>
22 #include <stdint.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <algorithm>
27 #include <memory>
28
29 #include "iv_datatypedef.h"
30 #include "iv.h"
31 #include "ivd.h"
32 #include "impeg2d.h"
33
34 #define ALIGN2(x) ((((x) + 1) >> 1) << 1)
35 #define MAX_FRAME_WIDTH 3840
36 #define MAX_FRAME_HEIGHT 2160
37 #define NELEMENTS(x) (sizeof(x) / sizeof(x[0]))
38 #define ivd_api_function impeg2d_api_function
39 const IV_COLOR_FORMAT_T supportedColorFormats[] = {IV_YUV_420P, IV_YUV_420SP_UV,
40 IV_YUV_420SP_VU};
41
42 /* Decoder ignores invalid arch, i.e. for arm build, if SSSE3 is requested,
43 * decoder defaults to a supported configuration. So same set of supported
44 * architectures can be used in arm/arm64/x86 builds */
45 const IVD_ARCH_T supportedArchitectures[] = {
46 ARCH_ARM_NONEON, ARCH_ARM_A9Q, ARCH_ARM_NEONINTR, ARCH_ARMV8_GENERIC,
47 ARCH_X86_GENERIC, ARCH_X86_SSSE3, ARCH_X86_SSE42};
48
49 enum {
50 OFFSET_COLOR_FORMAT = 6,
51 OFFSET_NUM_CORES,
52 OFFSET_ARCH,
53 /* Should be the last entry */
54 OFFSET_MAX,
55 };
56
57 const static int kMaxNumDecodeCalls = 100;
58 const static int kSupportedColorFormats = NELEMENTS(supportedColorFormats);
59 const static int kSupportedArchitectures = NELEMENTS(supportedArchitectures);
60 const static int kMaxCores = 4;
61
62 class Codec {
63 public:
64 Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores);
65 ~Codec();
66
67 void createCodec();
68 void deleteCodec();
69 void resetCodec();
70 void setCores();
71 void allocFrame();
72 void freeFrame();
73 void decodeHeader(const uint8_t *data, size_t size);
74 IV_API_CALL_STATUS_T decodeFrame(const uint8_t *data, size_t size,
75 size_t *bytesConsumed);
76 void setParams(IVD_VIDEO_DECODE_MODE_T mode);
77 void setArchitecture(IVD_ARCH_T arch);
78
79 private:
80 IV_COLOR_FORMAT_T mColorFormat;
81 size_t mNumCores;
82 iv_obj_t *mCodec;
83 ivd_out_bufdesc_t mOutBufHandle;
84 uint32_t mWidth;
85 uint32_t mHeight;
86 uint32_t mDeinterlace;
87 iv_mem_rec_t *mMemRecords;
88 };
89
Codec(IV_COLOR_FORMAT_T colorFormat,size_t numCores)90 Codec::Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores) {
91 mColorFormat = colorFormat;
92 mNumCores = numCores;
93 mCodec = nullptr;
94 mWidth = 0;
95 mHeight = 0;
96 mDeinterlace = 1;
97 memset(&mOutBufHandle, 0, sizeof(mOutBufHandle));
98 }
99
~Codec()100 Codec::~Codec() {}
101
createCodec()102 void Codec::createCodec() {
103 IV_API_CALL_STATUS_T ret;
104 UWORD32 numMemRecords;
105 size_t i;
106 void *fxns = (void *)&ivd_api_function;
107
108 iv_num_mem_rec_ip_t get_mem_ip;
109 iv_num_mem_rec_op_t get_mem_op;
110
111 get_mem_ip.u4_size = sizeof(get_mem_ip);
112 get_mem_op.u4_size = sizeof(get_mem_op);
113 get_mem_ip.e_cmd = IV_CMD_GET_NUM_MEM_REC;
114
115 ret = ivd_api_function(NULL, (void *)&get_mem_ip, (void *)&get_mem_op);
116 if (ret != IV_SUCCESS) {
117 return;
118 }
119
120 numMemRecords = get_mem_op.u4_num_mem_rec;
121
122 mMemRecords = (iv_mem_rec_t *)malloc(numMemRecords * sizeof(iv_mem_rec_t));
123 if (mMemRecords == NULL) {
124 return;
125 }
126
127 impeg2d_fill_mem_rec_ip_t fill_mem_ip;
128 impeg2d_fill_mem_rec_op_t fill_mem_op;
129
130 fill_mem_ip.s_ivd_fill_mem_rec_ip_t.e_cmd = IV_CMD_FILL_NUM_MEM_REC;
131 fill_mem_ip.s_ivd_fill_mem_rec_ip_t.pv_mem_rec_location =
132 (iv_mem_rec_t *)mMemRecords;
133 fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_max_frm_wd = MAX_FRAME_WIDTH;
134 fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht = MAX_FRAME_HEIGHT;
135 fill_mem_ip.u4_share_disp_buf = 0;
136 fill_mem_ip.u4_deinterlace = mDeinterlace;
137 fill_mem_ip.e_output_format = mColorFormat;
138
139 fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_size =
140 sizeof(impeg2d_fill_mem_rec_ip_t);
141 fill_mem_op.s_ivd_fill_mem_rec_op_t.u4_size =
142 sizeof(impeg2d_fill_mem_rec_op_t);
143
144 for (i = 0; i < numMemRecords; i++)
145 mMemRecords[i].u4_size = sizeof(iv_mem_rec_t);
146
147 ret = ivd_api_function(NULL, (void *)&fill_mem_ip, (void *)&fill_mem_op);
148
149 if (ret != IV_SUCCESS) {
150 return;
151 }
152 numMemRecords = fill_mem_op.s_ivd_fill_mem_rec_op_t.u4_num_mem_rec_filled;
153
154 iv_mem_rec_t *ps_mem_rec = (iv_mem_rec_t *)mMemRecords;
155
156 for (i = 0; i < numMemRecords; i++) {
157 if (0 != posix_memalign(&ps_mem_rec->pv_base, ps_mem_rec->u4_mem_alignment,
158 ps_mem_rec->u4_mem_size)) {
159 return;
160 }
161
162 if (ps_mem_rec->pv_base == NULL) {
163 return;
164 }
165
166 ps_mem_rec++;
167 }
168
169 mCodec = (iv_obj_t *)(iv_obj_t *)mMemRecords[0].pv_base;
170 mCodec->pv_fxns = fxns;
171 mCodec->u4_size = sizeof(iv_obj_t);
172
173 impeg2d_init_ip_t init_ip;
174 impeg2d_init_op_t init_op;
175
176 init_ip.s_ivd_init_ip_t.e_cmd = (IVD_API_COMMAND_TYPE_T)IV_CMD_INIT;
177 init_ip.s_ivd_init_ip_t.pv_mem_rec_location = mMemRecords;
178 init_ip.s_ivd_init_ip_t.u4_frm_max_wd = MAX_FRAME_WIDTH;
179 init_ip.s_ivd_init_ip_t.u4_frm_max_ht = MAX_FRAME_HEIGHT;
180
181 init_ip.u4_share_disp_buf = 0;
182 init_ip.u4_deinterlace = mDeinterlace;
183 init_ip.s_ivd_init_ip_t.u4_num_mem_rec = numMemRecords;
184 init_ip.s_ivd_init_ip_t.e_output_format = mColorFormat;
185 init_ip.s_ivd_init_ip_t.u4_size = sizeof(impeg2d_init_ip_t);
186 init_op.s_ivd_init_op_t.u4_size = sizeof(impeg2d_init_op_t);
187
188 ret = ivd_api_function(mCodec, (void *)&init_ip, (void *)&init_op);
189 if (ret != IV_SUCCESS) {
190 return;
191 }
192 }
193
deleteCodec()194 void Codec::deleteCodec() {
195 IV_API_CALL_STATUS_T ret;
196 iv_retrieve_mem_rec_ip_t retrieve_ip;
197 iv_retrieve_mem_rec_op_t retrieve_op;
198 retrieve_ip.pv_mem_rec_location = (iv_mem_rec_t *)mMemRecords;
199
200 retrieve_ip.e_cmd = IV_CMD_RETRIEVE_MEMREC;
201 retrieve_ip.u4_size = sizeof(iv_retrieve_mem_rec_ip_t);
202 retrieve_op.u4_size = sizeof(iv_retrieve_mem_rec_op_t);
203
204 ret = ivd_api_function(mCodec, (void *)&retrieve_ip, (void *)&retrieve_op);
205
206 if (ret != IV_SUCCESS) {
207 return;
208 }
209
210 iv_mem_rec_t *ps_mem_rec = retrieve_ip.pv_mem_rec_location;
211 for (size_t i = 0; i < retrieve_op.u4_num_mem_rec_filled; i++) {
212 free(ps_mem_rec->pv_base);
213 ps_mem_rec++;
214 }
215 free(retrieve_ip.pv_mem_rec_location);
216 }
217
resetCodec()218 void Codec::resetCodec() {
219 ivd_ctl_reset_ip_t s_ctl_ip;
220 ivd_ctl_reset_op_t s_ctl_op;
221
222 s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
223 s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_RESET;
224 s_ctl_ip.u4_size = sizeof(ivd_ctl_reset_ip_t);
225 s_ctl_op.u4_size = sizeof(ivd_ctl_reset_op_t);
226
227 ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
228 }
229
setCores()230 void Codec::setCores() {
231 impeg2d_ctl_set_num_cores_ip_t s_ctl_ip;
232 impeg2d_ctl_set_num_cores_op_t s_ctl_op;
233
234 s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
235 s_ctl_ip.e_sub_cmd =
236 (IVD_CONTROL_API_COMMAND_TYPE_T)IMPEG2D_CMD_CTL_SET_NUM_CORES;
237 s_ctl_ip.u4_num_cores = mNumCores;
238 s_ctl_ip.u4_size = sizeof(impeg2d_ctl_set_num_cores_ip_t);
239 s_ctl_op.u4_size = sizeof(impeg2d_ctl_set_num_cores_op_t);
240
241 ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
242 }
243
setParams(IVD_VIDEO_DECODE_MODE_T mode)244 void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) {
245 ivd_ctl_set_config_ip_t s_ctl_ip;
246 ivd_ctl_set_config_op_t s_ctl_op;
247
248 s_ctl_ip.u4_disp_wd = 0;
249 s_ctl_ip.e_frm_skip_mode = IVD_SKIP_NONE;
250 s_ctl_ip.e_frm_out_mode = IVD_DISPLAY_FRAME_OUT;
251 s_ctl_ip.e_vid_dec_mode = mode;
252 s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
253 s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_SETPARAMS;
254 s_ctl_ip.u4_size = sizeof(ivd_ctl_set_config_ip_t);
255 s_ctl_op.u4_size = sizeof(ivd_ctl_set_config_op_t);
256
257 ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
258 }
259
setArchitecture(IVD_ARCH_T arch)260 void Codec::setArchitecture(IVD_ARCH_T arch) {
261 impeg2d_ctl_set_processor_ip_t s_ctl_ip;
262 impeg2d_ctl_set_processor_op_t s_ctl_op;
263
264 s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
265 s_ctl_ip.e_sub_cmd =
266 (IVD_CONTROL_API_COMMAND_TYPE_T)IMPEG2D_CMD_CTL_SET_PROCESSOR;
267 s_ctl_ip.u4_arch = arch;
268 s_ctl_ip.u4_soc = SOC_GENERIC;
269 s_ctl_ip.u4_size = sizeof(impeg2d_ctl_set_processor_ip_t);
270 s_ctl_op.u4_size = sizeof(impeg2d_ctl_set_processor_op_t);
271
272 ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
273 }
freeFrame()274 void Codec::freeFrame() {
275 for (int i = 0; i < mOutBufHandle.u4_num_bufs; i++) {
276 if (mOutBufHandle.pu1_bufs[i]) {
277 free(mOutBufHandle.pu1_bufs[i]);
278 mOutBufHandle.pu1_bufs[i] = nullptr;
279 }
280 }
281 }
282
allocFrame()283 void Codec::allocFrame() {
284 size_t sizes[4] = {0};
285 size_t num_bufs = 0;
286
287 freeFrame();
288
289 memset(&mOutBufHandle, 0, sizeof(mOutBufHandle));
290
291 switch (mColorFormat) {
292 case IV_YUV_420SP_UV:
293 [[fallthrough]];
294 case IV_YUV_420SP_VU:
295 sizes[0] = mWidth * mHeight;
296 sizes[1] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 1;
297 num_bufs = 2;
298 break;
299 case IV_YUV_422ILE:
300 sizes[0] = mWidth * mHeight * 2;
301 num_bufs = 1;
302 break;
303 case IV_RGB_565:
304 sizes[0] = mWidth * mHeight * 2;
305 num_bufs = 1;
306 break;
307 case IV_RGBA_8888:
308 sizes[0] = mWidth * mHeight * 4;
309 num_bufs = 1;
310 break;
311 case IV_YUV_420P:
312 [[fallthrough]];
313 default:
314 sizes[0] = mWidth * mHeight;
315 sizes[1] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 2;
316 sizes[2] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 2;
317 num_bufs = 3;
318 break;
319 }
320 mOutBufHandle.u4_num_bufs = num_bufs;
321 for (int i = 0; i < num_bufs; i++) {
322 mOutBufHandle.u4_min_out_buf_size[i] = sizes[i];
323 void *buf = NULL;
324 if (0 != posix_memalign(&buf, 16, sizes[i])) {
325 return;
326 }
327 mOutBufHandle.pu1_bufs[i] = (UWORD8 *)buf;
328 }
329 }
330
decodeHeader(const uint8_t * data,size_t size)331 void Codec::decodeHeader(const uint8_t *data, size_t size) {
332 setParams(IVD_DECODE_HEADER);
333
334 while (size > 0) {
335 IV_API_CALL_STATUS_T ret;
336 ivd_video_decode_ip_t dec_ip;
337 ivd_video_decode_op_t dec_op;
338 size_t bytes_consumed;
339
340 memset(&dec_ip, 0, sizeof(dec_ip));
341 memset(&dec_op, 0, sizeof(dec_op));
342
343 dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
344 dec_ip.u4_ts = 0;
345 dec_ip.pv_stream_buffer = (void *)data;
346 dec_ip.u4_num_Bytes = size;
347 dec_ip.u4_size = sizeof(ivd_video_decode_ip_t);
348 dec_op.u4_size = sizeof(ivd_video_decode_op_t);
349
350 ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op);
351
352 bytes_consumed = dec_op.u4_num_bytes_consumed;
353 /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds
354 * to feed next data */
355 if (!bytes_consumed) bytes_consumed = 4;
356
357 bytes_consumed = std::min(size, bytes_consumed);
358
359 data += bytes_consumed;
360 size -= bytes_consumed;
361
362 mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240);
363 mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240);
364
365 /* Break after successful header decode */
366 if (mWidth && mHeight) {
367 break;
368 }
369 }
370 /* if width / height are invalid, set them to defaults */
371 if (!mWidth) mWidth = 1920;
372 if (!mHeight) mHeight = 1088;
373 }
374
decodeFrame(const uint8_t * data,size_t size,size_t * bytesConsumed)375 IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size,
376 size_t *bytesConsumed) {
377 IV_API_CALL_STATUS_T ret;
378 ivd_video_decode_ip_t dec_ip;
379 ivd_video_decode_op_t dec_op;
380
381 memset(&dec_ip, 0, sizeof(dec_ip));
382 memset(&dec_op, 0, sizeof(dec_op));
383
384 dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
385 dec_ip.u4_ts = 0;
386 dec_ip.pv_stream_buffer = (void *)data;
387 dec_ip.u4_num_Bytes = size;
388 dec_ip.u4_size = sizeof(ivd_video_decode_ip_t);
389 dec_ip.s_out_buffer = mOutBufHandle;
390
391 dec_op.u4_size = sizeof(ivd_video_decode_op_t);
392
393 ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op);
394 if (IMPEG2D_UNSUPPORTED_DIMENSIONS == dec_op.u4_error_code) {
395 /* In case of unsupported resolution, reset codec */
396 resetCodec();
397 } else if (IVD_RES_CHANGED == (dec_op.u4_error_code & 0xFF)) {
398 /* In case of change in resolution, reset codec and feed the same data
399 * again */
400 resetCodec();
401 ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op);
402 }
403 *bytesConsumed = dec_op.u4_num_bytes_consumed;
404
405 /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds
406 * to feed next data */
407 if (!*bytesConsumed) *bytesConsumed = 4;
408
409 if (dec_op.u4_pic_wd && dec_op.u4_pic_ht &&
410 (mWidth != dec_op.u4_pic_wd || mHeight != dec_op.u4_pic_ht)) {
411 mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240);
412 mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240);
413 allocFrame();
414 }
415
416 return ret;
417 }
418
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)419 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
420 if (size < 1) {
421 return 0;
422 }
423 size_t colorFormatOfst = std::min((size_t)OFFSET_COLOR_FORMAT, size - 1);
424 size_t numCoresOfst = std::min((size_t)OFFSET_NUM_CORES, size - 1);
425 size_t architectureOfst = std::min((size_t)OFFSET_ARCH, size - 1);
426 size_t architectureIdx = data[architectureOfst] % kSupportedArchitectures;
427 IVD_ARCH_T arch = (IVD_ARCH_T)supportedArchitectures[architectureIdx];
428 size_t colorFormatIdx = data[colorFormatOfst] % kSupportedColorFormats;
429 IV_COLOR_FORMAT_T colorFormat =
430 (IV_COLOR_FORMAT_T)(supportedColorFormats[colorFormatIdx]);
431 uint32_t numCores = (data[numCoresOfst] % kMaxCores) + 1;
432 size_t numDecodeCalls = 0;
433 Codec *codec = new Codec(colorFormat, numCores);
434 codec->createCodec();
435 codec->setArchitecture(arch);
436 codec->setCores();
437 codec->decodeHeader(data, size);
438 codec->setParams(IVD_DECODE_FRAME);
439 codec->allocFrame();
440
441 while (size > 0 && numDecodeCalls < kMaxNumDecodeCalls) {
442 IV_API_CALL_STATUS_T ret;
443 size_t bytesConsumed;
444 ret = codec->decodeFrame(data, size, &bytesConsumed);
445
446 bytesConsumed = std::min(size, bytesConsumed);
447 data += bytesConsumed;
448 size -= bytesConsumed;
449 numDecodeCalls++;
450 }
451
452 codec->freeFrame();
453 codec->deleteCodec();
454 delete codec;
455 return 0;
456 }
457