eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-16 20:10:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

tools/target_dem_fuzzer: Use file extensions listed in input formats

Browse Source 
This should make it easier for the fuzzer to fuzz formats being detected only by
file extension and thus increase coverage

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2020-06-08 11:26:45 +02:00
parent bc8ab084fb
commit d3747f4431
1 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
tools/target_dem_fuzzer.c
View File

@@ -18,6 +18,7 @@
#include "config.h" #include "config.h"
#include "libavutil/avassert.h" #include "libavutil/avassert.h"
#include "libavutil/avstring.h"
#include "libavcodec/avcodec.h" #include "libavcodec/avcodec.h"
#include "libavcodec/bytestream.h" #include "libavcodec/bytestream.h"
@@ -110,14 +111,38 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
error("Failed avformat_alloc_context()"); error("Failed avformat_alloc_context()");
if (size > 2048) { if (size > 2048) {
int flags;
char extension[64];
GetByteContext gbc; GetByteContext gbc;
memcpy (filename, data + size - 1024, 1024); memcpy (filename, data + size - 1024, 1024);
bytestream2_init(&gbc, data + size - 2048, 1024); bytestream2_init(&gbc, data + size - 2048, 1024);
size -= 2048; size -= 2048;
io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF; io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF;
seekable = bytestream2_get_byte(&gbc) & 1; flags = bytestream2_get_byte(&gbc);
seekable = flags & 1;
filesize = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF; filesize = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF;
if ((flags & 2) && strlen(filename) < sizeof(filename) / 2) {
AVInputFormat *avif = NULL;
int avif_count = 0;
while ((avif = av_iformat_next(avif))) {
if (avif->extensions)
avif_count ++;
}
avif_count = bytestream2_get_le32(&gbc) % avif_count;
while ((avif = av_iformat_next(avif))) {
if (avif->extensions)
if (!avif_count--)
break;
}
av_strlcpy(extension, avif->extensions, sizeof(extension));
if (strchr(extension, ','))
*strchr(extension, ',') = 0;
av_strlcatf(filename, sizeof(filename), ".%s", extension);
}
} }
io_buffer = av_malloc(io_buffer_size); io_buffer = av_malloc(io_buffer_size);
if (!io_buffer) if (!io_buffer)