[FFmpeg-devel] [PATCH] tools: add a fuzzer tool for bitstream filters

[Michael Niedermayer]

On Tue, Dec 03, 2019 at 04:59:26PM -0300, James Almer wrote:
> On 12/3/2019 4:31 PM, Andriy Gelman wrote:
> > On Mon, 02. Dec 13:15, James Almer wrote:
> >> Signed-off-by: James Almer <jamrial at gmail.com>
> >> ---
> >> Untested.
> >>
> >> The BSF can be set the same way a decoder can in target_dec_fuzzer. The
> >> codec_id will be randomly chosen from the supported list, if any.
> >>
> >>  tools/Makefile            |   3 +
> >>  tools/target_bsf_fuzzer.c | 166 ++++++++++++++++++++++++++++++++++++++
> >>  2 files changed, 169 insertions(+)
> >>  create mode 100644 tools/target_bsf_fuzzer.c
[...]
> > 
> > 
> >> +    while (data < end) {
> > 
> >> +        // Search for the TAG
> >> +        while (data + sizeof(fuzz_tag) < end) {
> >> +            if (data[0] == (fuzz_tag & 0xFF) && AV_RN64(data) == fuzz_tag)
> >> +                break;
> >> +            data++;
> >> +        }
> > 
> > Is the idea here to add "FUZZ_TAG" via the -dict option when running the
> > fuzzer? 
> 
> I don't know, but Michael might.

I dont know how or if FUZZ_TAG "connects" back into the fuzzer.

But the same issue also exist for every chunk, slice, packet header
the fuzzer has to generate valid data 

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

When the tyrant has disposed of foreign enemies by conquest or treaty, and
there is nothing more to fear from them, then he is always stirring up
some war or other, in order that the people may require a leader. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20191203/f110d005/attachment.sig>