diff options
| -rw-r--r-- | tools/target_bsf_fuzzer.c | 41 |
1 files changed, 16 insertions, 25 deletions
diff --git a/tools/target_bsf_fuzzer.c b/tools/target_bsf_fuzzer.c index d6aaee3bd9..8ef9932690 100644 --- a/tools/target_bsf_fuzzer.c +++ b/tools/target_bsf_fuzzer.c @@ -43,7 +43,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const uint8_t *last = data; const uint8_t *end = data + size; AVBSFContext *bsf = NULL; - AVPacket *in, *out; + AVPacket *pkt; uint64_t keyframes = 0; uint64_t flushpattern = -1; int res; @@ -118,9 +118,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { return 0; // Failure of av_bsf_init() does not imply that a issue was found } - in = av_packet_alloc(); - out = av_packet_alloc(); - if (!in || !out) + pkt = av_packet_alloc(); + if (!pkt) error("Failed memory allocation"); while (data < end) { @@ -133,11 +132,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (data + sizeof(fuzz_tag) > end) data = end; - res = av_new_packet(in, data - last); + res = av_new_packet(pkt, data - last); if (res < 0) error("Failed memory allocation"); - memcpy(in->data, last, data - last); - in->flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY; + memcpy(pkt->data, last, data - last); + pkt->flags = (keyframes & 1) * AV_PKT_FLAG_DISCARD + (!!(keyframes & 2)) * AV_PKT_FLAG_KEY; keyframes = (keyframes >> 2) + (keyframes<<62); data += sizeof(fuzz_tag); last = data; @@ -146,28 +145,20 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { av_bsf_flush(bsf); flushpattern = (flushpattern >> 3) + (flushpattern << 61); - while (in->size) { - res = av_bsf_send_packet(bsf, in); - if (res < 0 && res != AVERROR(EAGAIN)) - break; - res = av_bsf_receive_packet(bsf, out); - if (res < 0) - break; - av_packet_unref(out); + res = av_bsf_send_packet(bsf, pkt); + if (res < 0) { + av_packet_unref(pkt); + continue; } - av_packet_unref(in); + while (av_bsf_receive_packet(bsf, pkt) >= 0) + av_packet_unref(pkt); } - res = av_bsf_send_packet(bsf, NULL); - while (!res) { - res = av_bsf_receive_packet(bsf, out); - if (res < 0) - break; - av_packet_unref(out); - } + av_bsf_send_packet(bsf, NULL); + while (av_bsf_receive_packet(bsf, pkt) >= 0) + av_packet_unref(pkt); - av_packet_free(&in); - av_packet_free(&out); + av_packet_free(&pkt); av_bsf_free(&bsf); return 0; } |