mirror of https://git.ffmpeg.org/ffmpeg.git
tools/target_dec_fuzzer: use refcounted packets
Should reduce allocations and data copying. Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
parent
48b86dd8a6
commit
92c32b0f0c
|
@ -85,47 +85,6 @@ static int subtitle_handler(AVCodecContext *avctx, void *frame,
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Class to handle buffer allocation and resize for each frame
|
|
||||||
typedef struct FuzzDataBuffer {
|
|
||||||
size_t size_;
|
|
||||||
uint8_t *data_;
|
|
||||||
} FuzzDataBuffer;
|
|
||||||
|
|
||||||
static void FDBCreate(FuzzDataBuffer *FDB) {
|
|
||||||
FDB->size_ = 0x1000;
|
|
||||||
FDB->data_ = av_malloc(FDB->size_);
|
|
||||||
if (!FDB->data_)
|
|
||||||
error("Failed memory allocation");
|
|
||||||
}
|
|
||||||
|
|
||||||
static void FDBDesroy(FuzzDataBuffer *FDB) { av_free(FDB->data_); }
|
|
||||||
|
|
||||||
static void FDBRealloc(FuzzDataBuffer *FDB, size_t size) {
|
|
||||||
size_t needed = size + AV_INPUT_BUFFER_PADDING_SIZE;
|
|
||||||
av_assert0(needed > size);
|
|
||||||
if (needed > FDB->size_) {
|
|
||||||
av_free(FDB->data_);
|
|
||||||
FDB->size_ = needed;
|
|
||||||
FDB->data_ = av_malloc(FDB->size_);
|
|
||||||
if (!FDB->data_)
|
|
||||||
error("Failed memory allocation");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data,
|
|
||||||
size_t size)
|
|
||||||
{
|
|
||||||
FDBRealloc(FDB, size);
|
|
||||||
memcpy(FDB->data_, data, size);
|
|
||||||
size_t padd = FDB->size_ - size;
|
|
||||||
if (padd > AV_INPUT_BUFFER_PADDING_SIZE)
|
|
||||||
padd = AV_INPUT_BUFFER_PADDING_SIZE;
|
|
||||||
memset(FDB->data_ + size, 0, padd);
|
|
||||||
av_init_packet(dst);
|
|
||||||
dst->data = FDB->data_;
|
|
||||||
dst->size = size;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ensure we don't loop forever
|
// Ensure we don't loop forever
|
||||||
const uint32_t maxiteration = 8096;
|
const uint32_t maxiteration = 8096;
|
||||||
const uint64_t maxpixels_per_frame = 4096 * 4096;
|
const uint64_t maxpixels_per_frame = 4096 * 4096;
|
||||||
|
@ -135,7 +94,6 @@ static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
|
||||||
|
|
||||||
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
const uint64_t fuzz_tag = FUZZ_TAG;
|
const uint64_t fuzz_tag = FUZZ_TAG;
|
||||||
FuzzDataBuffer buffer;
|
|
||||||
const uint8_t *last = data;
|
const uint8_t *last = data;
|
||||||
const uint8_t *end = data + size;
|
const uint8_t *end = data + size;
|
||||||
uint32_t it = 0;
|
uint32_t it = 0;
|
||||||
|
@ -187,6 +145,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
|
|
||||||
if (ctx->max_pixels == 0 || ctx->max_pixels > maxpixels_per_frame)
|
if (ctx->max_pixels == 0 || ctx->max_pixels > maxpixels_per_frame)
|
||||||
ctx->max_pixels = maxpixels_per_frame; //To reduce false positive OOM and hangs
|
ctx->max_pixels = maxpixels_per_frame; //To reduce false positive OOM and hangs
|
||||||
|
ctx->refcounted_frames = 1; //To reduce false positive timeouts and focus testing on the refcounted API
|
||||||
|
|
||||||
if (size > 1024) {
|
if (size > 1024) {
|
||||||
GetByteContext gbc;
|
GetByteContext gbc;
|
||||||
|
@ -223,7 +182,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
}
|
}
|
||||||
parser_avctx->codec_id = ctx->codec_id;
|
parser_avctx->codec_id = ctx->codec_id;
|
||||||
|
|
||||||
FDBCreate(&buffer);
|
|
||||||
int got_frame;
|
int got_frame;
|
||||||
AVFrame *frame = av_frame_alloc();
|
AVFrame *frame = av_frame_alloc();
|
||||||
if (!frame)
|
if (!frame)
|
||||||
|
@ -231,6 +189,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
|
|
||||||
// Read very simple container
|
// Read very simple container
|
||||||
AVPacket avpkt, parsepkt;
|
AVPacket avpkt, parsepkt;
|
||||||
|
av_init_packet(&avpkt);
|
||||||
while (data < end && it < maxiteration) {
|
while (data < end && it < maxiteration) {
|
||||||
// Search for the TAG
|
// Search for the TAG
|
||||||
while (data + sizeof(fuzz_tag) < end) {
|
while (data + sizeof(fuzz_tag) < end) {
|
||||||
|
@ -241,7 +200,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
if (data + sizeof(fuzz_tag) > end)
|
if (data + sizeof(fuzz_tag) > end)
|
||||||
data = end;
|
data = end;
|
||||||
|
|
||||||
FDBPrepare(&buffer, &parsepkt, last, data - last);
|
res = av_new_packet(&parsepkt, data - last);
|
||||||
|
if (res < 0)
|
||||||
|
error("Failed memory allocation");
|
||||||
|
memcpy(parsepkt.data, last, data - last);
|
||||||
data += sizeof(fuzz_tag);
|
data += sizeof(fuzz_tag);
|
||||||
last = data;
|
last = data;
|
||||||
|
|
||||||
|
@ -252,6 +214,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
int ret = av_parser_parse2(parser, parser_avctx, &avpkt.data, &avpkt.size,
|
int ret = av_parser_parse2(parser, parser_avctx, &avpkt.data, &avpkt.size,
|
||||||
parsepkt.data, parsepkt.size,
|
parsepkt.data, parsepkt.size,
|
||||||
parsepkt.pts, parsepkt.dts, parsepkt.pos);
|
parsepkt.pts, parsepkt.dts, parsepkt.pos);
|
||||||
|
if (avpkt.data == parsepkt.data) {
|
||||||
|
avpkt.buf = av_buffer_ref(parsepkt.buf);
|
||||||
|
if (!avpkt.buf)
|
||||||
|
error("Failed memory allocation");
|
||||||
|
} else {
|
||||||
|
ret = av_packet_make_refcounted(&avpkt);
|
||||||
|
if (ret < 0)
|
||||||
|
error("Failed memory allocation");
|
||||||
|
}
|
||||||
parsepkt.data += ret;
|
parsepkt.data += ret;
|
||||||
parsepkt.size -= ret;
|
parsepkt.size -= ret;
|
||||||
parsepkt.pos += ret;
|
parsepkt.pos += ret;
|
||||||
|
@ -263,8 +234,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
avpkt.flags |= AV_PKT_FLAG_KEY;
|
avpkt.flags |= AV_PKT_FLAG_KEY;
|
||||||
avpkt.flags |= parsepkt.flags & AV_PKT_FLAG_DISCARD;
|
avpkt.flags |= parsepkt.flags & AV_PKT_FLAG_DISCARD;
|
||||||
} else {
|
} else {
|
||||||
avpkt = parsepkt;
|
av_packet_move_ref(&avpkt, &parsepkt);
|
||||||
parsepkt.size = 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Iterate through all data
|
// Iterate through all data
|
||||||
|
@ -285,16 +255,17 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||||
avpkt.data += ret;
|
avpkt.data += ret;
|
||||||
avpkt.size -= ret;
|
avpkt.size -= ret;
|
||||||
}
|
}
|
||||||
|
av_packet_unref(&avpkt);
|
||||||
}
|
}
|
||||||
|
av_packet_unref(&parsepkt);
|
||||||
}
|
}
|
||||||
maximums_reached:
|
maximums_reached:
|
||||||
|
|
||||||
av_init_packet(&avpkt);
|
av_packet_unref(&avpkt);
|
||||||
avpkt.data = NULL;
|
|
||||||
avpkt.size = 0;
|
|
||||||
|
|
||||||
do {
|
do {
|
||||||
got_frame = 0;
|
got_frame = 0;
|
||||||
|
av_frame_unref(frame);
|
||||||
decode_handler(ctx, frame, &got_frame, &avpkt);
|
decode_handler(ctx, frame, &got_frame, &avpkt);
|
||||||
} while (got_frame == 1 && it++ < maxiteration);
|
} while (got_frame == 1 && it++ < maxiteration);
|
||||||
|
|
||||||
|
@ -304,6 +275,6 @@ maximums_reached:
|
||||||
avcodec_free_context(&ctx);
|
avcodec_free_context(&ctx);
|
||||||
avcodec_free_context(&parser_avctx);
|
avcodec_free_context(&parser_avctx);
|
||||||
av_parser_close(parser);
|
av_parser_close(parser);
|
||||||
FDBDesroy(&buffer);
|
av_packet_unref(&parsepkt);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue