[FFmpeg-devel] [PATCH 1/3] tools: Add target_sws_fuzzer.c

[James Almer]

On 2/20/2024 10:17 PM, Michael Niedermayer wrote:
> On Tue, Feb 20, 2024 at 12:41:57AM -0300, James Almer wrote:
>> On 2/19/2024 11:49 PM, Michael Niedermayer wrote:
>>> +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
>>> +    int srcW= 48, srcH = 48;
>>> +    int dstW= 48, dstH = 48;
>>> +    int srcHShift, srcVShift;
>>> +    int dstHShift, dstVShift;
>>> +    unsigned flags = 1;
>>> +    int srcStride[AV_VIDEO_MAX_PLANES] = {0};
>>> +    int dstStride[AV_VIDEO_MAX_PLANES] = {0};
>>> +    int ret;
>>> +    const uint8_t *end = data + size;
>>> +    enum AVPixelFormat srcFormat = AV_PIX_FMT_YUV420P;
>>> +    enum AVPixelFormat dstFormat = AV_PIX_FMT_YUV420P;
>>> +    uint8_t *src[AV_VIDEO_MAX_PLANES] = { 0 };
>>> +    uint8_t *dst[AV_VIDEO_MAX_PLANES] = { 0 };
>>> +    struct SwsContext *sws = NULL;
>>> +    const AVPixFmtDescriptor *desc_src, *desc_dst;
>>> +
>>> +    if (size > 128) {
>>> +        GetByteContext gbc;
>>> +        int64_t flags64;
>>> +
>>> +        size -= 128;
>>> +        bytestream2_init(&gbc, data + size, 128);
>>> +        srcW = bytestream2_get_le32(&gbc) % 16384;
>>> +        srcH = bytestream2_get_le32(&gbc) % 16384;
>>> +        dstW = bytestream2_get_le32(&gbc) % 16384;
>>> +        dstH = bytestream2_get_le32(&gbc) % 16384;
>>
>> Might as well use bytestream2_get_le16 to save bytes from the input buffer.
>>
>>> +
>>> +        if (srcW * (uint64_t)srcH > 16384 || dstW * (uint64_t)dstH > 16384)
>>> +            return 0; // we avoid high res as its very slow
>>
>> This will abort in a lot of cases. Would reading only xW then setting xH to
>> 16384 / xW make sense? You can remove these checks if so.
> 
> no that would reduce the number of tested resolutions to one for each width
> 
> What we are trying to do here, is to map some flat random data into
> a resolution constraint to
> X > 0
> Y > 0
> X*Y <= 16484
> and at the same time have each pair occur approximately as frequent as any other
> 
> that can be achieved in a few ways, ill use the following
> 
> static void mapres(unsigned *r0, unsigned *r1) {
>      double d = (double)(*r0*10ll - 9ll*UINT32_MAX) / UINT32_MAX;
>      double a = exp(d) * 16384 / exp(1) ;
>      int ai = (int)round(a);
>      uint64_t maxb = 16384 / ai;
>      *r0 = ai;
>      *r1 = 1 + (*r1 * maxb) / UINT32_MAX;
> }
> 
> this avoids all the aborts and is flat enough statically for this purpose
> 
> will apply with that, but if you prefer the previous simpler code, dont hesitate
> to replace it. Iam not sure this helps the fuzzer at all

No, you know this better than i do.