avcodec/flacenc: Remove always-true check

[ffmpeg] / tools / target_dem_fuzzer.c

diff --git a/tools/target_dem_fuzzer.c b/tools/target_dem_fuzzer.c
index b51c7668781cf358057dbe31181ffa2572eab73d..3c03c8d17c05ffab6673a76b1503e2df9f6d43df 100644 (file)
--- a/tools/target_dem_fuzzer.c
+++ b/tools/target_dem_fuzzer.c
@@ -18,6 +18,7 @@
 
 #include "config.h"
 #include "libavutil/avassert.h"
+#include "libavutil/avstring.h"
 
 #include "libavcodec/avcodec.h"
 #include "libavcodec/bytestream.h"
@@ -48,6 +49,8 @@ static int io_read(void *opaque, uint8_t *buf, int buf_size)
         c->filesize = FFMIN(c->pos, c->filesize);
         return AVERROR_EOF;
     }
+    if (c->pos > INT64_MAX - size)
+        return AVERROR(EIO);
 
     memcpy(buf, c->fuzz, size);
     c->fuzz      += size;
@@ -70,15 +73,22 @@ static int64_t io_seek(void *opaque, int64_t offset, int whence)
         if (offset > INT64_MAX - c->filesize)
             return -1;
         offset += c->filesize;
+    } else if (whence == AVSEEK_SIZE) {
+        return c->filesize;
     }
     if (offset < 0 || offset > c->filesize)
         return -1;
+    if (IO_FLAT) {
+        c->fuzz      += offset - c->pos;
+        c->fuzz_size -= offset - c->pos;
+    }
     c->pos = offset;
     return 0;
 }
 
 // Ensure we don't loop forever
 const uint32_t maxiteration = 8096;
+const int maxblocks= 50000;
 
 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
 
@@ -86,7 +96,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     const uint64_t fuzz_tag = FUZZ_TAG;
     uint32_t it = 0;
     AVFormatContext *avfmt = avformat_alloc_context();
-    AVPacket pkt;
+    AVPacket *pkt;
     char filename[1025] = {0};
     AVIOContext *fuzzed_pb = NULL;
     uint8_t *io_buffer;
@@ -96,10 +106,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     static int c;
     int seekable = 0;
     int ret;
+    AVInputFormat *fmt = NULL;
+#ifdef FFMPEG_DEMUXER
+#define DEMUXER_SYMBOL0(DEMUXER) ff_##DEMUXER##_demuxer
+#define DEMUXER_SYMBOL(DEMUXER) DEMUXER_SYMBOL0(DEMUXER)
+    extern AVInputFormat DEMUXER_SYMBOL(FFMPEG_DEMUXER);
+    fmt = &DEMUXER_SYMBOL(FFMPEG_DEMUXER);
+#endif
 
     if (!c) {
-        av_register_all();
-        avcodec_register_all();
         av_log_set_level(AV_LOG_PANIC);
         c=1;
     }
@@ -107,16 +122,53 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     if (!avfmt)
         error("Failed avformat_alloc_context()");
 
-    if (size > 2048) {
+    if (IO_FLAT) {
+        seekable = 1;
+        io_buffer_size = size;
+    } else if (size > 2048) {
+        int flags;
+        char extension[64];
+
         GetByteContext gbc;
         memcpy (filename, data + size - 1024, 1024);
         bytestream2_init(&gbc, data + size - 2048, 1024);
         size -= 2048;
 
         io_buffer_size = bytestream2_get_le32(&gbc) & 0xFFFFFFF;
-        seekable       = bytestream2_get_byte(&gbc) & 1;
+        flags          = bytestream2_get_byte(&gbc);
+        seekable       = flags & 1;
         filesize       = bytestream2_get_le64(&gbc) & 0x7FFFFFFFFFFFFFFF;
+
+        if ((flags & 2) && strlen(filename) < sizeof(filename) / 2) {
+            const AVInputFormat *avif = NULL;
+            void *avif_iter = NULL;
+            int avif_count = 0;
+            while ((avif = av_demuxer_iterate(&avif_iter))) {
+                if (avif->extensions)
+                    avif_count ++;
+            }
+            avif_count =  bytestream2_get_le32(&gbc) % avif_count;
+
+            avif_iter = NULL;
+            while ((avif = av_demuxer_iterate(&avif_iter))) {
+                if (avif->extensions)
+                    if (!avif_count--)
+                        break;
+            }
+            av_strlcpy(extension, avif->extensions, sizeof(extension));
+            if (strchr(extension, ','))
+                *strchr(extension, ',') = 0;
+            av_strlcatf(filename, sizeof(filename), ".%s", extension);
+        }
     }
+
+    if (!io_buffer_size || size / io_buffer_size > maxblocks)
+        io_buffer_size = size;
+
+    pkt = av_packet_alloc();
+    if (!pkt)
+        error("Failed to allocate pkt");
+
     io_buffer = av_malloc(io_buffer_size);
     if (!io_buffer)
         error("Failed to allocate io_buffer");
@@ -132,32 +184,28 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
     avfmt->pb = fuzzed_pb;
 
-    ret = avformat_open_input(&avfmt, filename, NULL, NULL);
+    ret = avformat_open_input(&avfmt, filename, fmt, NULL);
     if (ret < 0) {
-        av_freep(&fuzzed_pb->buffer);
-        av_freep(&fuzzed_pb);
-        avformat_free_context(avfmt);
-        return 0;
+        goto fail;
     }
 
     ret = avformat_find_stream_info(avfmt, NULL);
-    if (ret < 0)
-        goto end;
-
-    av_init_packet(&pkt);
 
     //TODO, test seeking
 
     for(it = 0; it < maxiteration; it++) {
-        ret = av_read_frame(avfmt, &pkt);
+        ret = av_read_frame(avfmt, pkt);
         if (ret < 0)
             break;
-        av_packet_unref(&pkt);
+        av_packet_unref(pkt);
     }
-end:
+
+fail:
+    av_packet_free(&pkt);
     av_freep(&fuzzed_pb->buffer);
-    av_freep(&fuzzed_pb);
+    avio_context_free(&fuzzed_pb);
     avformat_close_input(&avfmt);
 
     return 0;
+
 }