/****************************************************************************** * * Copyright (C) 2019 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * ***************************************************************************** * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore */ #include #include #include #include #include #include #include #include "ih264_typedefs.h" #include "ih264d.h" #include "iv.h" #include "ivd.h" #define NELEMENTS(x) (sizeof(x) / sizeof(x[0])) #define ivd_api_function ih264d_api_function const IV_COLOR_FORMAT_T supportedColorFormats[] = { IV_YUV_420P, IV_YUV_420SP_UV, IV_YUV_420SP_VU, IV_YUV_422ILE, IV_RGB_565, IV_RGBA_8888}; /* Decoder ignores invalid arch, i.e. for arm build, if SSSE3 is requested, * decoder defaults to a supported configuration. So same set of supported * architectures can be used in arm/arm64/x86 builds */ const IVD_ARCH_T supportedArchitectures[] = { ARCH_ARM_NONEON, ARCH_ARM_A9Q, ARCH_ARM_NEONINTR, ARCH_ARMV8_GENERIC, ARCH_X86_GENERIC, ARCH_X86_SSSE3, ARCH_X86_SSE42}; enum { OFFSET_COLOR_FORMAT = 6, OFFSET_NUM_CORES, OFFSET_ARCH, /* Should be the last entry */ OFFSET_MAX, }; const static int kMaxNumDecodeCalls = 100; const static int kSupportedColorFormats = NELEMENTS(supportedColorFormats); const static int kSupportedArchitectures = NELEMENTS(supportedArchitectures); const static int kMaxCores = 4; void *iv_aligned_malloc(void *ctxt, WORD32 alignment, WORD32 size) { void *buf = NULL; (void)ctxt; if (0 != posix_memalign(&buf, alignment, size)) { return NULL; } return buf; } void iv_aligned_free(void *ctxt, void *buf) { (void)ctxt; free(buf); } class Codec { public: Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores); ~Codec(); void createCodec(); void deleteCodec(); void resetCodec(); void setCores(); void allocFrame(); void freeFrame(); void decodeHeader(const uint8_t *data, size_t size); IV_API_CALL_STATUS_T decodeFrame(const uint8_t *data, size_t size, size_t *bytesConsumed); void setParams(IVD_VIDEO_DECODE_MODE_T mode); void setArchitecture(IVD_ARCH_T arch); private: IV_COLOR_FORMAT_T mColorFormat; size_t mNumCores; iv_obj_t *mCodec; ivd_out_bufdesc_t mOutBufHandle; uint32_t mWidth; uint32_t mHeight; }; Codec::Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores) { mColorFormat = colorFormat; mNumCores = numCores; mCodec = nullptr; mWidth = 0; mHeight = 0; memset(&mOutBufHandle, 0, sizeof(mOutBufHandle)); } Codec::~Codec() {} void Codec::createCodec() { IV_API_CALL_STATUS_T ret; ih264d_create_ip_t create_ip; ih264d_create_op_t create_op; void *fxns = (void *)&ivd_api_function; create_ip.s_ivd_create_ip_t.e_cmd = IVD_CMD_CREATE; create_ip.s_ivd_create_ip_t.u4_share_disp_buf = 0; create_ip.s_ivd_create_ip_t.e_output_format = mColorFormat; create_ip.s_ivd_create_ip_t.pf_aligned_alloc = iv_aligned_malloc; create_ip.s_ivd_create_ip_t.pf_aligned_free = iv_aligned_free; create_ip.s_ivd_create_ip_t.pv_mem_ctxt = NULL; create_ip.s_ivd_create_ip_t.u4_size = sizeof(ih264d_create_ip_t); create_op.s_ivd_create_op_t.u4_size = sizeof(ih264d_create_op_t); ret = ivd_api_function(NULL, (void *)&create_ip, (void *)&create_op); if (ret != IV_SUCCESS) { return; } mCodec = (iv_obj_t *)create_op.s_ivd_create_op_t.pv_handle; mCodec->pv_fxns = fxns; mCodec->u4_size = sizeof(iv_obj_t); } void Codec::deleteCodec() { ivd_delete_ip_t delete_ip; ivd_delete_op_t delete_op; delete_ip.e_cmd = IVD_CMD_DELETE; delete_ip.u4_size = sizeof(ivd_delete_ip_t); delete_op.u4_size = sizeof(ivd_delete_op_t); ivd_api_function(mCodec, (void *)&delete_ip, (void *)&delete_op); } void Codec::resetCodec() { ivd_ctl_reset_ip_t s_ctl_ip; ivd_ctl_reset_op_t s_ctl_op; s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_RESET; s_ctl_ip.u4_size = sizeof(ivd_ctl_reset_ip_t); s_ctl_op.u4_size = sizeof(ivd_ctl_reset_op_t); ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op); } void Codec::setCores() { ih264d_ctl_set_num_cores_ip_t s_ctl_ip; ih264d_ctl_set_num_cores_op_t s_ctl_op; s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; s_ctl_ip.e_sub_cmd = (IVD_CONTROL_API_COMMAND_TYPE_T)IH264D_CMD_CTL_SET_NUM_CORES; s_ctl_ip.u4_num_cores = mNumCores; s_ctl_ip.u4_size = sizeof(ih264d_ctl_set_num_cores_ip_t); s_ctl_op.u4_size = sizeof(ih264d_ctl_set_num_cores_op_t); ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op); } void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) { ivd_ctl_set_config_ip_t s_ctl_ip; ivd_ctl_set_config_op_t s_ctl_op; s_ctl_ip.u4_disp_wd = 0; s_ctl_ip.e_frm_skip_mode = IVD_SKIP_NONE; s_ctl_ip.e_frm_out_mode = IVD_DISPLAY_FRAME_OUT; s_ctl_ip.e_vid_dec_mode = mode; s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_SETPARAMS; s_ctl_ip.u4_size = sizeof(ivd_ctl_set_config_ip_t); s_ctl_op.u4_size = sizeof(ivd_ctl_set_config_op_t); ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op); } void Codec::setArchitecture(IVD_ARCH_T arch) { ih264d_ctl_set_processor_ip_t s_ctl_ip; ih264d_ctl_set_processor_op_t s_ctl_op; s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; s_ctl_ip.e_sub_cmd = (IVD_CONTROL_API_COMMAND_TYPE_T)IH264D_CMD_CTL_SET_PROCESSOR; s_ctl_ip.u4_arch = arch; s_ctl_ip.u4_soc = SOC_GENERIC; s_ctl_ip.u4_size = sizeof(ih264d_ctl_set_processor_ip_t); s_ctl_op.u4_size = sizeof(ih264d_ctl_set_processor_op_t); ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op); } void Codec::freeFrame() { for (int i = 0; i < mOutBufHandle.u4_num_bufs; i++) { if (mOutBufHandle.pu1_bufs[i]) { free(mOutBufHandle.pu1_bufs[i]); mOutBufHandle.pu1_bufs[i] = nullptr; } } } void Codec::allocFrame() { size_t sizes[4] = {0}; size_t num_bufs = 0; freeFrame(); memset(&mOutBufHandle, 0, sizeof(mOutBufHandle)); switch (mColorFormat) { case IV_YUV_420SP_UV: [[fallthrough]]; case IV_YUV_420SP_VU: sizes[0] = mWidth * mHeight; sizes[1] = mWidth * mHeight >> 1; num_bufs = 2; break; case IV_YUV_422ILE: sizes[0] = mWidth * mHeight * 2; num_bufs = 1; break; case IV_RGB_565: sizes[0] = mWidth * mHeight * 2; num_bufs = 1; break; case IV_RGBA_8888: sizes[0] = mWidth * mHeight * 4; num_bufs = 1; break; case IV_YUV_420P: [[fallthrough]]; default: sizes[0] = mWidth * mHeight; sizes[1] = mWidth * mHeight >> 2; sizes[2] = mWidth * mHeight >> 2; num_bufs = 3; break; } mOutBufHandle.u4_num_bufs = num_bufs; for (int i = 0; i < num_bufs; i++) { mOutBufHandle.u4_min_out_buf_size[i] = sizes[i]; mOutBufHandle.pu1_bufs[i] = (UWORD8 *)iv_aligned_malloc(NULL, 16, sizes[i]); } } void Codec::decodeHeader(const uint8_t *data, size_t size) { setParams(IVD_DECODE_HEADER); while (size > 0) { IV_API_CALL_STATUS_T ret; ivd_video_decode_ip_t dec_ip; ivd_video_decode_op_t dec_op; size_t bytes_consumed; memset(&dec_ip, 0, sizeof(dec_ip)); memset(&dec_op, 0, sizeof(dec_op)); dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE; dec_ip.u4_ts = 0; dec_ip.pv_stream_buffer = (void *)data; dec_ip.u4_num_Bytes = size; dec_ip.u4_size = sizeof(ivd_video_decode_ip_t); dec_op.u4_size = sizeof(ivd_video_decode_op_t); ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op); bytes_consumed = dec_op.u4_num_bytes_consumed; /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds * to feed next data */ if (!bytes_consumed) bytes_consumed = 4; bytes_consumed = std::min(size, bytes_consumed); data += bytes_consumed; size -= bytes_consumed; mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240); mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240); /* Break after successful header decode */ if (mWidth && mHeight) { break; } } /* if width / height are invalid, set them to defaults */ if (!mWidth) mWidth = 1920; if (!mHeight) mHeight = 1088; } IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size, size_t *bytesConsumed) { IV_API_CALL_STATUS_T ret; ivd_video_decode_ip_t dec_ip; ivd_video_decode_op_t dec_op; memset(&dec_ip, 0, sizeof(dec_ip)); memset(&dec_op, 0, sizeof(dec_op)); dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE; dec_ip.u4_ts = 0; dec_ip.pv_stream_buffer = (void *)data; dec_ip.u4_num_Bytes = size; dec_ip.u4_size = sizeof(ivd_video_decode_ip_t); dec_ip.s_out_buffer = mOutBufHandle; dec_op.u4_size = sizeof(ivd_video_decode_op_t); ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op); /* In case of change in resolution, reset codec and feed the same data again */ if (IVD_RES_CHANGED == (dec_op.u4_error_code & 0xFF)) { resetCodec(); ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op); } *bytesConsumed = dec_op.u4_num_bytes_consumed; /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds * to feed next data */ if (!*bytesConsumed) *bytesConsumed = 4; if (dec_op.u4_pic_wd && dec_op.u4_pic_ht && (mWidth != dec_op.u4_pic_wd || mHeight != dec_op.u4_pic_ht)) { mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240); mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240); allocFrame(); } return ret; } extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size < 1) { return 0; } size_t colorFormatOfst = std::min((size_t)OFFSET_COLOR_FORMAT, size - 1); size_t numCoresOfst = std::min((size_t)OFFSET_NUM_CORES, size - 1); size_t architectureOfst = std::min((size_t)OFFSET_ARCH, size - 1); size_t architectureIdx = data[architectureOfst] % kSupportedArchitectures; IVD_ARCH_T arch = (IVD_ARCH_T)supportedArchitectures[architectureIdx]; size_t colorFormatIdx = data[colorFormatOfst] % kSupportedColorFormats; IV_COLOR_FORMAT_T colorFormat = (IV_COLOR_FORMAT_T)(supportedColorFormats[colorFormatIdx]); uint32_t numCores = (data[numCoresOfst] % kMaxCores) + 1; size_t numDecodeCalls = 0; Codec *codec = new Codec(colorFormat, numCores); codec->createCodec(); codec->setArchitecture(arch); codec->setCores(); codec->decodeHeader(data, size); codec->setParams(IVD_DECODE_FRAME); codec->allocFrame(); while (size > 0 && numDecodeCalls < kMaxNumDecodeCalls) { IV_API_CALL_STATUS_T ret; size_t bytesConsumed; ret = codec->decodeFrame(data, size, &bytesConsumed); bytesConsumed = std::min(size, bytesConsumed); data += bytesConsumed; size -= bytesConsumed; numDecodeCalls++; } codec->freeFrame(); codec->deleteCodec(); delete codec; return 0; }