av1_decoder_fuzzertest.cc 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stddef.h>
  5. #include <fuzzer/FuzzedDataProvider.h>
  6. #include <tuple>
  7. #include "base/logging.h"
  8. #include "media/base/decoder_buffer.h"
  9. #include "media/base/video_codecs.h"
  10. #include "media/gpu/av1_decoder.h"
  11. #include "media/gpu/av1_picture.h"
  12. namespace {
  13. class FakeAV1Accelerator : public media::AV1Decoder::AV1Accelerator {
  14. public:
  15. FakeAV1Accelerator() = default;
  16. ~FakeAV1Accelerator() override = default;
  17. FakeAV1Accelerator(const FakeAV1Accelerator&) = delete;
  18. FakeAV1Accelerator& operator=(const FakeAV1Accelerator&) = delete;
  19. // media::AV1Decoder::AV1Accelerator implementation.
  20. scoped_refptr<media::AV1Picture> CreateAV1Picture(bool apply_grain) override {
  21. return base::MakeRefCounted<media::AV1Picture>();
  22. }
  23. Status SubmitDecode(const media::AV1Picture& pic,
  24. const libgav1::ObuSequenceHeader& sequence_header,
  25. const media::AV1ReferenceFrameVector& ref_frames,
  26. const libgav1::Vector<libgav1::TileBuffer>& tile_buffers,
  27. base::span<const uint8_t> data) override {
  28. return Status::kOk;
  29. }
  30. bool OutputPicture(const media::AV1Picture& pic) override { return true; }
  31. };
  32. } // namespace
  33. // Entry point for LibFuzzer.
  34. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  35. FuzzedDataProvider fuzzed_data_provider(data, size);
  36. media::AV1Decoder decoder(std::make_unique<FakeAV1Accelerator>(),
  37. media::AV1PROFILE_PROFILE_MAIN);
  38. // Split the input in two: we'll create a DecoderBuffer from each half. This
  39. // allows us to Decode(), Reset(), and Decode() again for more coverage.
  40. for (int i = 0; i < 2; ++i) {
  41. size_t size_to_consume = i == 0 ? size / 2 : (size - size / 2);
  42. std::vector<uint8_t> decoder_buffer_data =
  43. fuzzed_data_provider.ConsumeBytes<uint8_t>(size_to_consume);
  44. if (decoder_buffer_data.empty())
  45. continue;
  46. // The *|decoder_buffer| can be destroyed at the end of each iteration
  47. // because Reset() is expected to ensure that the current DecoderBuffer
  48. // won't be needed after that.
  49. scoped_refptr<media::DecoderBuffer> decoder_buffer =
  50. media::DecoderBuffer::CopyFrom(decoder_buffer_data.data(),
  51. decoder_buffer_data.size());
  52. decoder.SetStream(i, *decoder_buffer);
  53. // Decode should consume all the data unless it returns kConfigChange, and
  54. // in that case it needs to be called again.
  55. while (true) {
  56. if (decoder.Decode() != media::AcceleratedVideoDecoder::kConfigChange)
  57. break;
  58. }
  59. decoder.Reset();
  60. }
  61. std::ignore = decoder.Flush();
  62. return 0;
  63. }