1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
|
/*
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/* Targeted fuzzer that targets specific codecs depending on two
compile-time flags.
INSTRUCTIONS:
* Get the very fresh clang, e.g. see http://libfuzzer.info#versions
* Get and build libFuzzer:
svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
./Fuzzer/build.sh
* build ffmpeg for fuzzing:
FLAGS="-fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp -g" CC="clang $FLAGS" CXX="clang++ $FLAGS" ./configure --disable-yasm
make clean && make -j
* build the fuzz target.
Choose the value of FFMPEG_CODEC (e.g. AV_CODEC_ID_DVD_SUBTITLE) and
choose one of FUZZ_FFMPEG_VIDEO, FUZZ_FFMPEG_AUDIO, FUZZ_FFMPEG_SUBTITLE.
clang -fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp tools/target_dec_fuzzer.c -o target_dec_fuzzer -I. -DFFMPEG_CODEC=AV_CODEC_ID_MPEG1VIDEO -DFUZZ_FFMPEG_VIDEO ../../libfuzzer/libFuzzer.a -Llibavcodec -Llibavdevice -Llibavfilter -Llibavformat -Llibavresample -Llibavutil -Llibpostproc -Llibswscale -Llibswresample -Wl,--as-needed -Wl,-z,noexecstack -Wl,--warn-common -Wl,-rpath-link=libpostproc:libswresample:libswscale:libavfilter:libavdevice:libavformat:libavcodec:libavutil:libavresample -lavdevice -lavfilter -lavformat -lavcodec -lswresample -lswscale -lavutil -ldl -lxcb -lxcb-shm -lxcb -lxcb-xfixes -lxcb -lxcb-shape -lxcb -lX11 -lasound -lm -lbz2 -lz -pthread
* create a corpus directory and put some samples there (empty dir is ok too):
mkdir CORPUS && cp some-files CORPUS
* Run fuzzing:
./target_dec_fuzzer -max_len=100000 CORPUS
More info:
http://libfuzzer.info
http://tutorial.libfuzzer.info
https://github.com/google/oss-fuzz
http://lcamtuf.coredump.cx/afl/
https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html
*/
#include "config.h"
#include "libavutil/avassert.h"
#include "libavutil/imgutils.h"
#include "libavutil/intreadwrite.h"
#include "libavcodec/avcodec.h"
#include "libavcodec/bytestream.h"
#include "libavformat/avformat.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
static void error(const char *err)
{
fprintf(stderr, "%s", err);
exit(1);
}
static AVCodec *c = NULL;
static AVCodec *AVCodecInitialize(enum AVCodecID codec_id)
{
AVCodec *res;
avcodec_register_all();
av_log_set_level(AV_LOG_PANIC);
res = avcodec_find_decoder(codec_id);
if (!res)
error("Failed to find decoder");
return res;
}
static int subtitle_handler(AVCodecContext *avctx, void *frame,
int *got_sub_ptr, AVPacket *avpkt)
{
AVSubtitle sub;
int ret = avcodec_decode_subtitle2(avctx, &sub, got_sub_ptr, avpkt);
if (ret >= 0 && *got_sub_ptr)
avsubtitle_free(&sub);
return ret;
}
// Class to handle buffer allocation and resize for each frame
typedef struct FuzzDataBuffer {
size_t size_;
uint8_t *data_;
} FuzzDataBuffer;
static void FDBCreate(FuzzDataBuffer *FDB) {
FDB->size_ = 0x1000;
FDB->data_ = av_malloc(FDB->size_);
if (!FDB->data_)
error("Failed memory allocation");
}
static void FDBDesroy(FuzzDataBuffer *FDB) { av_free(FDB->data_); }
static void FDBRealloc(FuzzDataBuffer *FDB, size_t size) {
size_t needed = size + FF_INPUT_BUFFER_PADDING_SIZE;
av_assert0(needed > size);
if (needed > FDB->size_) {
av_free(FDB->data_);
FDB->size_ = needed;
FDB->data_ = av_malloc(FDB->size_);
if (!FDB->data_)
error("Failed memory allocation");
}
}
static void FDBPrepare(FuzzDataBuffer *FDB, AVPacket *dst, const uint8_t *data,
size_t size)
{
FDBRealloc(FDB, size);
memcpy(FDB->data_, data, size);
size_t padd = FDB->size_ - size;
if (padd > FF_INPUT_BUFFER_PADDING_SIZE)
padd = FF_INPUT_BUFFER_PADDING_SIZE;
memset(FDB->data_ + size, 0, padd);
av_init_packet(dst);
dst->data = FDB->data_;
dst->size = size;
}
// Ensure we don't loop forever
const uint32_t maxiteration = 8096;
static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
const uint64_t fuzz_tag = FUZZ_TAG;
FuzzDataBuffer buffer;
const uint8_t *last = data;
const uint8_t *end = data + size;
uint32_t it = 0;
int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture,
int *got_picture_ptr,
const AVPacket *avpkt) = NULL;
if (!c)
c = AVCodecInitialize(FFMPEG_CODEC); // Done once.
switch (c->type) {
case AVMEDIA_TYPE_AUDIO : decode_handler = avcodec_decode_audio4; break;
case AVMEDIA_TYPE_VIDEO : decode_handler = avcodec_decode_video2; break;
case AVMEDIA_TYPE_SUBTITLE: decode_handler = subtitle_handler ; break;
}
AVCodecContext* ctx = avcodec_alloc_context3(NULL);
if (!ctx)
error("Failed memory allocation");
ctx->max_pixels = 4096 * 4096; //To reduce false positive OOM and hangs
if (size > 1024) {
GetByteContext gbc;
bytestream2_init(&gbc, data + size - 1024, 1024);
ctx->width = bytestream2_get_le32(&gbc);
ctx->height = bytestream2_get_le32(&gbc);
ctx->bit_rate = bytestream2_get_le64(&gbc);
ctx->bits_per_coded_sample = bytestream2_get_le32(&gbc);
if (av_image_check_size(ctx->width, ctx->height, 0, ctx))
ctx->width = ctx->height = 0;
size -= 1024;
}
int res = avcodec_open2(ctx, c, NULL);
if (res < 0)
return 0; // Failure of avcodec_open2() does not imply that a issue was found
FDBCreate(&buffer);
int got_frame;
AVFrame *frame = av_frame_alloc();
if (!frame)
error("Failed memory allocation");
// Read very simple container
AVPacket avpkt;
while (data < end && it < maxiteration) {
// Search for the TAG
while (data + sizeof(fuzz_tag) < end) {
if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
break;
data++;
}
if (data + sizeof(fuzz_tag) > end)
data = end;
FDBPrepare(&buffer, &avpkt, last, data - last);
data += sizeof(fuzz_tag);
last = data;
// Iterate through all data
while (avpkt.size > 0 && it++ < maxiteration) {
av_frame_unref(frame);
int ret = decode_handler(ctx, frame, &got_frame, &avpkt);
if (it > 20)
ctx->error_concealment = 0;
if (ret <= 0 || ret > avpkt.size)
break;
if (ctx->codec_type != AVMEDIA_TYPE_AUDIO)
ret = avpkt.size;
avpkt.data += ret;
avpkt.size -= ret;
}
}
av_init_packet(&avpkt);
avpkt.data = NULL;
avpkt.size = 0;
do {
got_frame = 0;
decode_handler(ctx, frame, &got_frame, &avpkt);
} while (got_frame == 1 && it++ < maxiteration);
av_frame_free(&frame);
avcodec_free_context(&ctx);
av_freep(&ctx);
FDBDesroy(&buffer);
return 0;
}
|
