virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

tools/target_dem_fuzzer: Use file extensions listed in input formats

Browse Source 
This should make it easier for the fuzzer to fuzz formats being detected only by
file extension and thus increase coverage

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-06-08 11:26:45 +02:00
parent bc8ab084fb
commit d3747f4431
1 changed files with 26 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
tools/target_dem_fuzzer.c
View File

@ -18,6 +18,7 @@
#include "config.h"
#include "libavutil/avassert.h"
#include "libavutil/avstring.h"
#include "libavcodec/avcodec.h"
#include "libavcodec/bytestream.h"
@ -110,14 +111,38 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
error("Failed avformat_alloc_context()");
if (size > 2048) {
int flags;
char extension[64];
GetByteContext gbc;
memcpy (filename, data + size - 1024, 1024);
bytestream2_init(&gbc, data + size - 2048, 1024);
size -= 2048;
io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF;
seekable = bytestream2_get_byte(&gbc) & 1;
flags = bytestream2_get_byte(&gbc);
seekable = flags & 1;
filesize = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF;
if ((flags & 2) && strlen(filename) < sizeof(filename) / 2) {
AVInputFormat *avif = NULL;
int avif_count = 0;
while ((avif = av_iformat_next(avif))) {
if (avif->extensions)
avif_count ++;
}
avif_count = bytestream2_get_le32(&gbc) % avif_count;
while ((avif = av_iformat_next(avif))) {
if (avif->extensions)
if (!avif_count--)
break;
}
av_strlcpy(extension, avif->extensions, sizeof(extension));
if (strchr(extension, ','))
*strchr(extension, ',') = 0;
av_strlcatf(filename, sizeof(filename), ".%s", extension);
}
}
io_buffer = av_malloc(io_buffer_size);
if (!io_buffer)