[FFmpeg-devel] [PATCH 1/3] tools: Add target_sws_fuzzer.c

[Michael Niedermayer]

On Tue, Feb 20, 2024 at 12:41:57AM -0300, James Almer wrote:
> On 2/19/2024 11:49 PM, Michael Niedermayer wrote:
> > +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
> > +    int srcW= 48, srcH = 48;
> > +    int dstW= 48, dstH = 48;
> > +    int srcHShift, srcVShift;
> > +    int dstHShift, dstVShift;
> > +    unsigned flags = 1;
> > +    int srcStride[AV_VIDEO_MAX_PLANES] = {0};
> > +    int dstStride[AV_VIDEO_MAX_PLANES] = {0};
> > +    int ret;
> > +    const uint8_t *end = data + size;
> > +    enum AVPixelFormat srcFormat = AV_PIX_FMT_YUV420P;
> > +    enum AVPixelFormat dstFormat = AV_PIX_FMT_YUV420P;
> > +    uint8_t *src[AV_VIDEO_MAX_PLANES] = { 0 };
> > +    uint8_t *dst[AV_VIDEO_MAX_PLANES] = { 0 };
> > +    struct SwsContext *sws = NULL;
> > +    const AVPixFmtDescriptor *desc_src, *desc_dst;
> > +
> > +    if (size > 128) {
> > +        GetByteContext gbc;
> > +        int64_t flags64;
> > +
> > +        size -= 128;
> > +        bytestream2_init(&gbc, data + size, 128);
> > +        srcW = bytestream2_get_le32(&gbc) % 16384;
> > +        srcH = bytestream2_get_le32(&gbc) % 16384;
> > +        dstW = bytestream2_get_le32(&gbc) % 16384;
> > +        dstH = bytestream2_get_le32(&gbc) % 16384;
> 
> Might as well use bytestream2_get_le16 to save bytes from the input buffer.
> 
> > +
> > +        if (srcW * (uint64_t)srcH > 16384 || dstW * (uint64_t)dstH > 16384)
> > +            return 0; // we avoid high res as its very slow
> 
> This will abort in a lot of cases. Would reading only xW then setting xH to
> 16384 / xW make sense? You can remove these checks if so.

no that would reduce the number of tested resolutions to one for each width

What we are trying to do here, is to map some flat random data into
a resolution constraint to
X > 0
Y > 0
X*Y <= 16484
and at the same time have each pair occur approximately as frequent as any other

that can be achieved in a few ways, ill use the following

static void mapres(unsigned *r0, unsigned *r1) {
    double d = (double)(*r0*10ll - 9ll*UINT32_MAX) / UINT32_MAX;
    double a = exp(d) * 16384 / exp(1) ;
    int ai = (int)round(a);
    uint64_t maxb = 16384 / ai;
    *r0 = ai;
    *r1 = 1 + (*r1 * maxb) / UINT32_MAX;
}

this avoids all the aborts and is flat enough statically for this purpose

will apply with that, but if you prefer the previous simpler code, dont hesitate
to replace it. Iam not sure this helps the fuzzer at all

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

While the State exists there can be no freedom; when there is freedom there
will be no State. -- Vladimir Lenin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240221/3b02a3ce/attachment.sig>