RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-12 02:19:35 +00:00
Code Issues Projects Releases Wiki Activity

tools/target_dec_fuzzer: Also fuzz keyframe & disposal flags

Browse Source 
This should improve coverage

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-10-12 22:34:03 +02:00
parent e71c241bea
commit ec9d48da19
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/target_dec_fuzzer.c
View File

@ -109,6 +109,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
int *got_picture_ptr, int *got_picture_ptr,
const AVPacket *avpkt) = NULL; const AVPacket *avpkt) = NULL;
AVCodecParserContext *parser = NULL; AVCodecParserContext *parser = NULL;
uint64_t keyframes = 0;
if (!c) { if (!c) {
@ -191,6 +192,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
ctx->channels = (unsigned)bytestream2_get_le32(&gbc) % FF_SANE_NB_CHANNELS; ctx->channels = (unsigned)bytestream2_get_le32(&gbc) % FF_SANE_NB_CHANNELS;
ctx->block_align = bytestream2_get_le32(&gbc); ctx->block_align = bytestream2_get_le32(&gbc);
ctx->codec_tag = bytestream2_get_le32(&gbc); ctx->codec_tag = bytestream2_get_le32(&gbc);
keyframes = bytestream2_get_le64(&gbc);
if (extradata_size < size) { if (extradata_size < size) {
ctx->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE); ctx->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
@ -236,6 +238,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (res < 0) if (res < 0)
error("Failed memory allocation"); error("Failed memory allocation");
memcpy(parsepkt.data, last, data - last); memcpy(parsepkt.data, last, data - last);
parsepkt.flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY;
keyframes = (keyframes >> 2) + (keyframes<<62);
data += sizeof(fuzz_tag); data += sizeof(fuzz_tag);
last = data; last = data;