/src/libmpeg2/fuzzer/mpeg2_dec_fuzzer.cpp

Source
/******************************************************************************
 *
 * Copyright (C) 2019 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 *****************************************************************************
 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
 */

#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <algorithm>
#include <memory>

#include "iv_datatypedef.h"
#include "iv.h"
#include "ivd.h"
#include "impeg2d.h"

#define ALIGN2(x) ((((x) + 1) >> 1) << 1)
#define MAX_FRAME_WIDTH 3840
#define MAX_FRAME_HEIGHT 2160
#define NELEMENTS(x) (sizeof(x) / sizeof(x[0]))
#define ivd_api_function impeg2d_api_function
const IV_COLOR_FORMAT_T supportedColorFormats[] = {IV_YUV_420P, IV_YUV_420SP_UV,
                                                   IV_YUV_420SP_VU};

/* Decoder ignores invalid arch, i.e. for arm build, if SSSE3 is requested,
 * decoder defaults to a supported configuration. So same set of supported
 * architectures can be used in arm/arm64/x86 builds */
const IVD_ARCH_T supportedArchitectures[] = {
    ARCH_ARM_NONEON,  ARCH_ARM_A9Q,   ARCH_ARM_NEONINTR, ARCH_ARMV8_GENERIC,
    ARCH_X86_GENERIC, ARCH_X86_SSSE3, ARCH_X86_SSE42};

enum {
  OFFSET_COLOR_FORMAT = 6,
  OFFSET_NUM_CORES,
  OFFSET_ARCH,
  /* Should be the last entry */
  OFFSET_MAX,
};

const static int kMaxNumDecodeCalls = 100;
const static int kSupportedColorFormats = NELEMENTS(supportedColorFormats);
const static int kSupportedArchitectures = NELEMENTS(supportedArchitectures);
const static int kMaxCores = 4;

class Codec {
 public:
  Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores);
  ~Codec();

  void createCodec();
  void deleteCodec();
  void resetCodec();
  void setCores();
  void allocFrame();
  void freeFrame();
  void decodeHeader(const uint8_t *data, size_t size);
  IV_API_CALL_STATUS_T decodeFrame(const uint8_t *data, size_t size,
                                   size_t *bytesConsumed);
  void setParams(IVD_VIDEO_DECODE_MODE_T mode);
  void setArchitecture(IVD_ARCH_T arch);

 private:
  IV_COLOR_FORMAT_T mColorFormat;
  size_t mNumCores;
  iv_obj_t *mCodec;
  ivd_out_bufdesc_t mOutBufHandle;
  uint32_t mWidth;
  uint32_t mHeight;
  uint32_t mDeinterlace;
  uint32_t mKeepThreadsActive;
  iv_mem_rec_t *mMemRecords;
};

Codec::Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores) {
  mColorFormat = colorFormat;
  mNumCores = numCores;
  mCodec = nullptr;
  mWidth = 0;
  mHeight = 0;
  mDeinterlace = 1;
  mKeepThreadsActive = 1;
  memset(&mOutBufHandle, 0, sizeof(mOutBufHandle));
}

Codec::~Codec() {}

void Codec::createCodec() {
  IV_API_CALL_STATUS_T ret;
  UWORD32 numMemRecords;
  size_t i;
  void *fxns = (void *)&ivd_api_function;

  iv_num_mem_rec_ip_t get_mem_ip;
  iv_num_mem_rec_op_t get_mem_op;

  get_mem_ip.u4_size = sizeof(get_mem_ip);
  get_mem_op.u4_size = sizeof(get_mem_op);
  get_mem_ip.e_cmd = IV_CMD_GET_NUM_MEM_REC;

  ret = ivd_api_function(NULL, (void *)&get_mem_ip, (void *)&get_mem_op);
  if (ret != IV_SUCCESS) {
    return;
  }

  numMemRecords = get_mem_op.u4_num_mem_rec;

  mMemRecords = (iv_mem_rec_t *)malloc(numMemRecords * sizeof(iv_mem_rec_t));
  if (mMemRecords == NULL) {
    return;
  }

  impeg2d_fill_mem_rec_ip_t fill_mem_ip;
  impeg2d_fill_mem_rec_op_t fill_mem_op;

  fill_mem_ip.s_ivd_fill_mem_rec_ip_t.e_cmd = IV_CMD_FILL_NUM_MEM_REC;
  fill_mem_ip.s_ivd_fill_mem_rec_ip_t.pv_mem_rec_location =
      (iv_mem_rec_t *)mMemRecords;
  fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_max_frm_wd = MAX_FRAME_WIDTH;
  fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht = MAX_FRAME_HEIGHT;
  fill_mem_ip.u4_share_disp_buf = 0;
  fill_mem_ip.u4_deinterlace = mDeinterlace;
  fill_mem_ip.u4_keep_threads_active = mKeepThreadsActive;
  fill_mem_ip.e_output_format = mColorFormat;

  fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_size =
      sizeof(impeg2d_fill_mem_rec_ip_t);
  fill_mem_op.s_ivd_fill_mem_rec_op_t.u4_size =
      sizeof(impeg2d_fill_mem_rec_op_t);

  for (i = 0; i < numMemRecords; i++)
    mMemRecords[i].u4_size = sizeof(iv_mem_rec_t);

  ret = ivd_api_function(NULL, (void *)&fill_mem_ip, (void *)&fill_mem_op);

  if (ret != IV_SUCCESS) {
    return;
  }
  numMemRecords = fill_mem_op.s_ivd_fill_mem_rec_op_t.u4_num_mem_rec_filled;

  iv_mem_rec_t *ps_mem_rec = (iv_mem_rec_t *)mMemRecords;

  for (i = 0; i < numMemRecords; i++) {
    if (0 != posix_memalign(&ps_mem_rec->pv_base, ps_mem_rec->u4_mem_alignment,
                            ps_mem_rec->u4_mem_size)) {
      return;
    }

    if (ps_mem_rec->pv_base == NULL) {
      return;
    }

    ps_mem_rec++;
  }

  mCodec = (iv_obj_t *)(iv_obj_t *)mMemRecords[0].pv_base;
  mCodec->pv_fxns = fxns;
  mCodec->u4_size = sizeof(iv_obj_t);

  impeg2d_init_ip_t init_ip;
  impeg2d_init_op_t init_op;

  init_ip.s_ivd_init_ip_t.e_cmd = (IVD_API_COMMAND_TYPE_T)IV_CMD_INIT;
  init_ip.s_ivd_init_ip_t.pv_mem_rec_location = mMemRecords;
  init_ip.s_ivd_init_ip_t.u4_frm_max_wd = MAX_FRAME_WIDTH;
  init_ip.s_ivd_init_ip_t.u4_frm_max_ht = MAX_FRAME_HEIGHT;

  init_ip.u4_share_disp_buf = 0;
  init_ip.u4_deinterlace = mDeinterlace;
  init_ip.u4_keep_threads_active = mKeepThreadsActive;
  init_ip.s_ivd_init_ip_t.u4_num_mem_rec = numMemRecords;
  init_ip.s_ivd_init_ip_t.e_output_format = mColorFormat;
  init_ip.s_ivd_init_ip_t.u4_size = sizeof(impeg2d_init_ip_t);
  init_op.s_ivd_init_op_t.u4_size = sizeof(impeg2d_init_op_t);

  ret = ivd_api_function(mCodec, (void *)&init_ip, (void *)&init_op);
  if (ret != IV_SUCCESS) {
    return;
  }
}

void Codec::deleteCodec() {
  IV_API_CALL_STATUS_T ret;
  iv_retrieve_mem_rec_ip_t retrieve_ip;
  iv_retrieve_mem_rec_op_t retrieve_op;
  retrieve_ip.pv_mem_rec_location = (iv_mem_rec_t *)mMemRecords;

  retrieve_ip.e_cmd = IV_CMD_RETRIEVE_MEMREC;
  retrieve_ip.u4_size = sizeof(iv_retrieve_mem_rec_ip_t);
  retrieve_op.u4_size = sizeof(iv_retrieve_mem_rec_op_t);

  ret = ivd_api_function(mCodec, (void *)&retrieve_ip, (void *)&retrieve_op);

  if (ret != IV_SUCCESS) {
    return;
  }

  iv_mem_rec_t *ps_mem_rec = retrieve_ip.pv_mem_rec_location;
  for (size_t i = 0; i < retrieve_op.u4_num_mem_rec_filled; i++) {
    free(ps_mem_rec->pv_base);
    ps_mem_rec++;
  }
  free(retrieve_ip.pv_mem_rec_location);
}

void Codec::resetCodec() {
  ivd_ctl_reset_ip_t s_ctl_ip;
  ivd_ctl_reset_op_t s_ctl_op;

  s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
  s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_RESET;
  s_ctl_ip.u4_size = sizeof(ivd_ctl_reset_ip_t);
  s_ctl_op.u4_size = sizeof(ivd_ctl_reset_op_t);

  ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
}

void Codec::setCores() {
  impeg2d_ctl_set_num_cores_ip_t s_ctl_ip;
  impeg2d_ctl_set_num_cores_op_t s_ctl_op;

  s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
  s_ctl_ip.e_sub_cmd =
      (IVD_CONTROL_API_COMMAND_TYPE_T)IMPEG2D_CMD_CTL_SET_NUM_CORES;
  s_ctl_ip.u4_num_cores = mNumCores;
  s_ctl_ip.u4_size = sizeof(impeg2d_ctl_set_num_cores_ip_t);
  s_ctl_op.u4_size = sizeof(impeg2d_ctl_set_num_cores_op_t);

  ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
}

void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) {
  ivd_ctl_set_config_ip_t s_ctl_ip;
  ivd_ctl_set_config_op_t s_ctl_op;

  s_ctl_ip.u4_disp_wd = 0;
  s_ctl_ip.e_frm_skip_mode = IVD_SKIP_NONE;
  s_ctl_ip.e_frm_out_mode = IVD_DISPLAY_FRAME_OUT;
  s_ctl_ip.e_vid_dec_mode = mode;
  s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
  s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_SETPARAMS;
  s_ctl_ip.u4_size = sizeof(ivd_ctl_set_config_ip_t);
  s_ctl_op.u4_size = sizeof(ivd_ctl_set_config_op_t);

  ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
}

void Codec::setArchitecture(IVD_ARCH_T arch) {
  impeg2d_ctl_set_processor_ip_t s_ctl_ip;
  impeg2d_ctl_set_processor_op_t s_ctl_op;

  s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
  s_ctl_ip.e_sub_cmd =
      (IVD_CONTROL_API_COMMAND_TYPE_T)IMPEG2D_CMD_CTL_SET_PROCESSOR;
  s_ctl_ip.u4_arch = arch;
  s_ctl_ip.u4_soc = SOC_GENERIC;
  s_ctl_ip.u4_size = sizeof(impeg2d_ctl_set_processor_ip_t);
  s_ctl_op.u4_size = sizeof(impeg2d_ctl_set_processor_op_t);

  ivd_api_function(mCodec, (void *)&s_ctl_ip, (void *)&s_ctl_op);
}
void Codec::freeFrame() {
  for (int i = 0; i < mOutBufHandle.u4_num_bufs; i++) {
    if (mOutBufHandle.pu1_bufs[i]) {
      free(mOutBufHandle.pu1_bufs[i]);
      mOutBufHandle.pu1_bufs[i] = nullptr;
    }
  }
}

void Codec::allocFrame() {
  size_t sizes[4] = {0};
  size_t num_bufs = 0;

  freeFrame();

  memset(&mOutBufHandle, 0, sizeof(mOutBufHandle));

  switch (mColorFormat) {
    case IV_YUV_420SP_UV:
      [[fallthrough]];
    case IV_YUV_420SP_VU:
      sizes[0] = mWidth * mHeight;
      sizes[1] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 1;
      num_bufs = 2;
      break;
    case IV_YUV_422ILE:
      sizes[0] = mWidth * mHeight * 2;
      num_bufs = 1;
      break;
    case IV_RGB_565:
      sizes[0] = mWidth * mHeight * 2;
      num_bufs = 1;
      break;
    case IV_RGBA_8888:
      sizes[0] = mWidth * mHeight * 4;
      num_bufs = 1;
      break;
    case IV_YUV_420P:
      [[fallthrough]];
    default:
      sizes[0] = mWidth * mHeight;
      sizes[1] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 2;
      sizes[2] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 2;
      num_bufs = 3;
      break;
  }
  mOutBufHandle.u4_num_bufs = num_bufs;
  for (int i = 0; i < num_bufs; i++) {
    mOutBufHandle.u4_min_out_buf_size[i] = sizes[i];
    void *buf = NULL;
    if (0 != posix_memalign(&buf, 16, sizes[i])) {
      return;
    }
    mOutBufHandle.pu1_bufs[i] = (UWORD8 *)buf;
  }
}

void Codec::decodeHeader(const uint8_t *data, size_t size) {
  setParams(IVD_DECODE_HEADER);

  size_t numDecodeCalls = 0;

  while (size > 0 && numDecodeCalls < kMaxNumDecodeCalls) {
    IV_API_CALL_STATUS_T ret;
    ivd_video_decode_ip_t dec_ip;
    ivd_video_decode_op_t dec_op;
    size_t bytes_consumed;

    memset(&dec_ip, 0, sizeof(dec_ip));
    memset(&dec_op, 0, sizeof(dec_op));

    dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
    dec_ip.u4_ts = 0;
    dec_ip.pv_stream_buffer = (void *)data;
    dec_ip.u4_num_Bytes = size;
    dec_ip.u4_size = sizeof(ivd_video_decode_ip_t);
    dec_op.u4_size = sizeof(ivd_video_decode_op_t);

    ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op);

    bytes_consumed = dec_op.u4_num_bytes_consumed;
    /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds
     * to feed next data */
    if (!bytes_consumed) bytes_consumed = 4;

    bytes_consumed = std::min(size, bytes_consumed);

    data += bytes_consumed;
    size -= bytes_consumed;
    numDecodeCalls++;

    mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240);
    mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240);

    /* Break after successful header decode */
    if (mWidth && mHeight) {
      break;
    }
  }
  /* if width / height are invalid, set them to defaults */
  if (!mWidth) mWidth = 1920;
  if (!mHeight) mHeight = 1088;
}

IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size,
                                        size_t *bytesConsumed) {
  IV_API_CALL_STATUS_T ret;
  ivd_video_decode_ip_t dec_ip;
  ivd_video_decode_op_t dec_op;

  memset(&dec_ip, 0, sizeof(dec_ip));
  memset(&dec_op, 0, sizeof(dec_op));

  dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
  dec_ip.u4_ts = 0;
  dec_ip.pv_stream_buffer = (void *)data;
  dec_ip.u4_num_Bytes = size;
  dec_ip.u4_size = sizeof(ivd_video_decode_ip_t);
  dec_ip.s_out_buffer = mOutBufHandle;

  dec_op.u4_size = sizeof(ivd_video_decode_op_t);

  ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op);
  if (IMPEG2D_UNSUPPORTED_DIMENSIONS == dec_op.u4_error_code) {
    /* In case of unsupported resolution, reset codec */
    resetCodec();
  } else if (IVD_RES_CHANGED == (dec_op.u4_error_code & 0xFF)) {
    /* In case of change in resolution, reset codec and feed the same data
     * again */
    resetCodec();
    ret = ivd_api_function(mCodec, (void *)&dec_ip, (void *)&dec_op);
  }
  *bytesConsumed = dec_op.u4_num_bytes_consumed;

  /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds
   * to feed next data */
  if (!*bytesConsumed) *bytesConsumed = 4;

  if (dec_op.u4_pic_wd && dec_op.u4_pic_ht &&
      (mWidth != dec_op.u4_pic_wd || mHeight != dec_op.u4_pic_ht)) {
    mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240);
    mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240);
    allocFrame();
  }

  return ret;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  if (size < 1) {
    return 0;
  }
  size_t colorFormatOfst = std::min((size_t)OFFSET_COLOR_FORMAT, size - 1);
  size_t numCoresOfst = std::min((size_t)OFFSET_NUM_CORES, size - 1);
  size_t architectureOfst = std::min((size_t)OFFSET_ARCH, size - 1);
  size_t architectureIdx = data[architectureOfst] % kSupportedArchitectures;
  IVD_ARCH_T arch = (IVD_ARCH_T)supportedArchitectures[architectureIdx];
  size_t colorFormatIdx = data[colorFormatOfst] % kSupportedColorFormats;
  IV_COLOR_FORMAT_T colorFormat =
      (IV_COLOR_FORMAT_T)(supportedColorFormats[colorFormatIdx]);
  uint32_t numCores = (data[numCoresOfst] % kMaxCores) + 1;
  size_t numDecodeCalls = 0;
  Codec *codec = new Codec(colorFormat, numCores);
  codec->createCodec();
  codec->setArchitecture(arch);
  codec->setCores();
  codec->decodeHeader(data, size);
  codec->setParams(IVD_DECODE_FRAME);
  codec->allocFrame();

  while (size > 0 && numDecodeCalls < kMaxNumDecodeCalls) {
    IV_API_CALL_STATUS_T ret;
    size_t bytesConsumed;
    ret = codec->decodeFrame(data, size, &bytesConsumed);

    bytesConsumed = std::min(size, bytesConsumed);
    data += bytesConsumed;
    size -= bytesConsumed;
    numDecodeCalls++;
  }

  codec->freeFrame();
  codec->deleteCodec();
  delete codec;
  return 0;
}

Coverage Report

Created: 2025-10-10 06:56

Line	Count	Source
1		/******************************************************************************
2		*
3		* Copyright (C) 2019 The Android Open Source Project
4		*
5		* Licensed under the Apache License, Version 2.0 (the "License");
6		* you may not use this file except in compliance with the License.
7		* You may obtain a copy of the License at:
8		*
9		* http://www.apache.org/licenses/LICENSE-2.0
10		*
11		* Unless required by applicable law or agreed to in writing, software
12		* distributed under the License is distributed on an "AS IS" BASIS,
13		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14		* See the License for the specific language governing permissions and
15		* limitations under the License.
16		*
17		*****************************************************************************
18		* Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
19		*/
20
21		#include <stddef.h>
22		#include <stdint.h>
23		#include <stdio.h>
24		#include <stdlib.h>
25		#include <string.h>
26		#include <algorithm>
27		#include <memory>
28
29		#include "iv_datatypedef.h"
30		#include "iv.h"
31		#include "ivd.h"
32		#include "impeg2d.h"
33
34	36.7k	#define ALIGN2(x) ((((x) + 1) >> 1) << 1)
35	11.5k	#define MAX_FRAME_WIDTH 3840
36	11.5k	#define MAX_FRAME_HEIGHT 2160
37		#define NELEMENTS(x) (sizeof(x) / sizeof(x[0]))
38	126k	#define ivd_api_function impeg2d_api_function
39		const IV_COLOR_FORMAT_T supportedColorFormats[] = {IV_YUV_420P, IV_YUV_420SP_UV,
40		IV_YUV_420SP_VU};
41
42		/* Decoder ignores invalid arch, i.e. for arm build, if SSSE3 is requested,
43		* decoder defaults to a supported configuration. So same set of supported
44		* architectures can be used in arm/arm64/x86 builds */
45		const IVD_ARCH_T supportedArchitectures[] = {
46		ARCH_ARM_NONEON, ARCH_ARM_A9Q, ARCH_ARM_NEONINTR, ARCH_ARMV8_GENERIC,
47		ARCH_X86_GENERIC, ARCH_X86_SSSE3, ARCH_X86_SSE42};
48
49		enum {
50		OFFSET_COLOR_FORMAT = 6,
51		OFFSET_NUM_CORES,
52		OFFSET_ARCH,
53		/* Should be the last entry */
54		OFFSET_MAX,
55		};
56
57		const static int kMaxNumDecodeCalls = 100;
58		const static int kSupportedColorFormats = NELEMENTS(supportedColorFormats);
59		const static int kSupportedArchitectures = NELEMENTS(supportedArchitectures);
60		const static int kMaxCores = 4;
61
62		class Codec {
63		public:
64		Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores);
65		~Codec();
66
67		void createCodec();
68		void deleteCodec();
69		void resetCodec();
70		void setCores();
71		void allocFrame();
72		void freeFrame();
73		void decodeHeader(const uint8_t *data, size_t size);
74		IV_API_CALL_STATUS_T decodeFrame(const uint8_t *data, size_t size,
75		size_t *bytesConsumed);
76		void setParams(IVD_VIDEO_DECODE_MODE_T mode);
77		void setArchitecture(IVD_ARCH_T arch);
78
79		private:
80		IV_COLOR_FORMAT_T mColorFormat;
81		size_t mNumCores;
82		iv_obj_t *mCodec;
83		ivd_out_bufdesc_t mOutBufHandle;
84		uint32_t mWidth;
85		uint32_t mHeight;
86		uint32_t mDeinterlace;
87		uint32_t mKeepThreadsActive;
88		iv_mem_rec_t *mMemRecords;
89		};
90
91	5.79k	Codec::Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores) {
92	5.79k	mColorFormat = colorFormat;
93	5.79k	mNumCores = numCores;
94	5.79k	mCodec = nullptr;
95	5.79k	mWidth = 0;
96	5.79k	mHeight = 0;
97	5.79k	mDeinterlace = 1;
98	5.79k	mKeepThreadsActive = 1;
99	5.79k	memset(&mOutBufHandle, 0, sizeof(mOutBufHandle));
100	5.79k	}
101
102	5.79k	Codec::~Codec() {}
103
104	5.79k	void Codec::createCodec() {
105	5.79k	IV_API_CALL_STATUS_T ret;
106	5.79k	UWORD32 numMemRecords;
107	5.79k	size_t i;
108	5.79k	void fxns = (void )&ivd_api_function;
109
110	5.79k	iv_num_mem_rec_ip_t get_mem_ip;
111	5.79k	iv_num_mem_rec_op_t get_mem_op;
112
113	5.79k	get_mem_ip.u4_size = sizeof(get_mem_ip);
114	5.79k	get_mem_op.u4_size = sizeof(get_mem_op);
115	5.79k	get_mem_ip.e_cmd = IV_CMD_GET_NUM_MEM_REC;
116
117	5.79k	ret = ivd_api_function(NULL, (void )&get_mem_ip, (void )&get_mem_op);
118	5.79k	if (ret != IV_SUCCESS) {
119	0	return;
120	0	}
121
122	5.79k	numMemRecords = get_mem_op.u4_num_mem_rec;
123
124	5.79k	mMemRecords = (iv_mem_rec_t )malloc(numMemRecords sizeof(iv_mem_rec_t));
125	5.79k	if (mMemRecords == NULL) {
126	0	return;
127	0	}
128
129	5.79k	impeg2d_fill_mem_rec_ip_t fill_mem_ip;
130	5.79k	impeg2d_fill_mem_rec_op_t fill_mem_op;
131
132	5.79k	fill_mem_ip.s_ivd_fill_mem_rec_ip_t.e_cmd = IV_CMD_FILL_NUM_MEM_REC;
133	5.79k	fill_mem_ip.s_ivd_fill_mem_rec_ip_t.pv_mem_rec_location =
134	5.79k	(iv_mem_rec_t *)mMemRecords;
135	5.79k	fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_max_frm_wd = MAX_FRAME_WIDTH;
136	5.79k	fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_max_frm_ht = MAX_FRAME_HEIGHT;
137	5.79k	fill_mem_ip.u4_share_disp_buf = 0;
138	5.79k	fill_mem_ip.u4_deinterlace = mDeinterlace;
139	5.79k	fill_mem_ip.u4_keep_threads_active = mKeepThreadsActive;
140	5.79k	fill_mem_ip.e_output_format = mColorFormat;
141
142	5.79k	fill_mem_ip.s_ivd_fill_mem_rec_ip_t.u4_size =
143	5.79k	sizeof(impeg2d_fill_mem_rec_ip_t);
144	5.79k	fill_mem_op.s_ivd_fill_mem_rec_op_t.u4_size =
145	5.79k	sizeof(impeg2d_fill_mem_rec_op_t);
146
147	220k	for (i = 0; i < numMemRecords; i++)
148	214k	mMemRecords[i].u4_size = sizeof(iv_mem_rec_t);
149
150	5.79k	ret = ivd_api_function(NULL, (void )&fill_mem_ip, (void )&fill_mem_op);
151
152	5.79k	if (ret != IV_SUCCESS) {
153	0	return;
154	0	}
155	5.79k	numMemRecords = fill_mem_op.s_ivd_fill_mem_rec_op_t.u4_num_mem_rec_filled;
156
157	5.79k	iv_mem_rec_t ps_mem_rec = (iv_mem_rec_t )mMemRecords;
158
159	220k	for (i = 0; i < numMemRecords; i++) {
160	214k	if (0 != posix_memalign(&ps_mem_rec->pv_base, ps_mem_rec->u4_mem_alignment,
161	214k	ps_mem_rec->u4_mem_size)) {
162	0	return;
163	0	}
164
165	214k	if (ps_mem_rec->pv_base == NULL) {
166	0	return;
167	0	}
168
169	214k	ps_mem_rec++;
170	214k	}
171
172	5.79k	mCodec = (iv_obj_t )(iv_obj_t )mMemRecords[0].pv_base;
173	5.79k	mCodec->pv_fxns = fxns;
174	5.79k	mCodec->u4_size = sizeof(iv_obj_t);
175
176	5.79k	impeg2d_init_ip_t init_ip;
177	5.79k	impeg2d_init_op_t init_op;
178
179	5.79k	init_ip.s_ivd_init_ip_t.e_cmd = (IVD_API_COMMAND_TYPE_T)IV_CMD_INIT;
180	5.79k	init_ip.s_ivd_init_ip_t.pv_mem_rec_location = mMemRecords;
181	5.79k	init_ip.s_ivd_init_ip_t.u4_frm_max_wd = MAX_FRAME_WIDTH;
182	5.79k	init_ip.s_ivd_init_ip_t.u4_frm_max_ht = MAX_FRAME_HEIGHT;
183
184	5.79k	init_ip.u4_share_disp_buf = 0;
185	5.79k	init_ip.u4_deinterlace = mDeinterlace;
186	5.79k	init_ip.u4_keep_threads_active = mKeepThreadsActive;
187	5.79k	init_ip.s_ivd_init_ip_t.u4_num_mem_rec = numMemRecords;
188	5.79k	init_ip.s_ivd_init_ip_t.e_output_format = mColorFormat;
189	5.79k	init_ip.s_ivd_init_ip_t.u4_size = sizeof(impeg2d_init_ip_t);
190	5.79k	init_op.s_ivd_init_op_t.u4_size = sizeof(impeg2d_init_op_t);
191
192	5.79k	ret = ivd_api_function(mCodec, (void )&init_ip, (void )&init_op);
193	5.79k	if (ret != IV_SUCCESS) {
194	0	return;
195	0	}
196	5.79k	}
197
198	5.79k	void Codec::deleteCodec() {
199	5.79k	IV_API_CALL_STATUS_T ret;
200	5.79k	iv_retrieve_mem_rec_ip_t retrieve_ip;
201	5.79k	iv_retrieve_mem_rec_op_t retrieve_op;
202	5.79k	retrieve_ip.pv_mem_rec_location = (iv_mem_rec_t *)mMemRecords;
203
204	5.79k	retrieve_ip.e_cmd = IV_CMD_RETRIEVE_MEMREC;
205	5.79k	retrieve_ip.u4_size = sizeof(iv_retrieve_mem_rec_ip_t);
206	5.79k	retrieve_op.u4_size = sizeof(iv_retrieve_mem_rec_op_t);
207
208	5.79k	ret = ivd_api_function(mCodec, (void )&retrieve_ip, (void )&retrieve_op);
209
210	5.79k	if (ret != IV_SUCCESS) {
211	0	return;
212	0	}
213
214	5.79k	iv_mem_rec_t *ps_mem_rec = retrieve_ip.pv_mem_rec_location;
215	220k	for (size_t i = 0; i < retrieve_op.u4_num_mem_rec_filled; i++) {
216	214k	free(ps_mem_rec->pv_base);
217	214k	ps_mem_rec++;
218	214k	}
219	5.79k	free(retrieve_ip.pv_mem_rec_location);
220	5.79k	}
221
222	9.80k	void Codec::resetCodec() {
223	9.80k	ivd_ctl_reset_ip_t s_ctl_ip;
224	9.80k	ivd_ctl_reset_op_t s_ctl_op;
225
226	9.80k	s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
227	9.80k	s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_RESET;
228	9.80k	s_ctl_ip.u4_size = sizeof(ivd_ctl_reset_ip_t);
229	9.80k	s_ctl_op.u4_size = sizeof(ivd_ctl_reset_op_t);
230
231	9.80k	ivd_api_function(mCodec, (void )&s_ctl_ip, (void )&s_ctl_op);
232	9.80k	}
233
234	5.79k	void Codec::setCores() {
235	5.79k	impeg2d_ctl_set_num_cores_ip_t s_ctl_ip;
236	5.79k	impeg2d_ctl_set_num_cores_op_t s_ctl_op;
237
238	5.79k	s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
239	5.79k	s_ctl_ip.e_sub_cmd =
240	5.79k	(IVD_CONTROL_API_COMMAND_TYPE_T)IMPEG2D_CMD_CTL_SET_NUM_CORES;
241	5.79k	s_ctl_ip.u4_num_cores = mNumCores;
242	5.79k	s_ctl_ip.u4_size = sizeof(impeg2d_ctl_set_num_cores_ip_t);
243	5.79k	s_ctl_op.u4_size = sizeof(impeg2d_ctl_set_num_cores_op_t);
244
245	5.79k	ivd_api_function(mCodec, (void )&s_ctl_ip, (void )&s_ctl_op);
246	5.79k	}
247
248	11.5k	void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) {
249	11.5k	ivd_ctl_set_config_ip_t s_ctl_ip;
250	11.5k	ivd_ctl_set_config_op_t s_ctl_op;
251
252	11.5k	s_ctl_ip.u4_disp_wd = 0;
253	11.5k	s_ctl_ip.e_frm_skip_mode = IVD_SKIP_NONE;
254	11.5k	s_ctl_ip.e_frm_out_mode = IVD_DISPLAY_FRAME_OUT;
255	11.5k	s_ctl_ip.e_vid_dec_mode = mode;
256	11.5k	s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
257	11.5k	s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_SETPARAMS;
258	11.5k	s_ctl_ip.u4_size = sizeof(ivd_ctl_set_config_ip_t);
259	11.5k	s_ctl_op.u4_size = sizeof(ivd_ctl_set_config_op_t);
260
261	11.5k	ivd_api_function(mCodec, (void )&s_ctl_ip, (void )&s_ctl_op);
262	11.5k	}
263
264	5.79k	void Codec::setArchitecture(IVD_ARCH_T arch) {
265	5.79k	impeg2d_ctl_set_processor_ip_t s_ctl_ip;
266	5.79k	impeg2d_ctl_set_processor_op_t s_ctl_op;
267
268	5.79k	s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL;
269	5.79k	s_ctl_ip.e_sub_cmd =
270	5.79k	(IVD_CONTROL_API_COMMAND_TYPE_T)IMPEG2D_CMD_CTL_SET_PROCESSOR;
271	5.79k	s_ctl_ip.u4_arch = arch;
272	5.79k	s_ctl_ip.u4_soc = SOC_GENERIC;
273	5.79k	s_ctl_ip.u4_size = sizeof(impeg2d_ctl_set_processor_ip_t);
274	5.79k	s_ctl_op.u4_size = sizeof(impeg2d_ctl_set_processor_op_t);
275
276	5.79k	ivd_api_function(mCodec, (void )&s_ctl_ip, (void )&s_ctl_op);
277	5.79k	}
278	18.1k	void Codec::freeFrame() {
279	48.8k	for (int i = 0; i < mOutBufHandle.u4_num_bufs; i++) {
280	30.7k	if (mOutBufHandle.pu1_bufs[i]) {
281	30.7k	free(mOutBufHandle.pu1_bufs[i]);
282	30.7k	mOutBufHandle.pu1_bufs[i] = nullptr;
283	30.7k	}
284	30.7k	}
285	18.1k	}
286
287	12.3k	void Codec::allocFrame() {
288	12.3k	size_t sizes[4] = {0};
289	12.3k	size_t num_bufs = 0;
290
291	12.3k	freeFrame();
292
293	12.3k	memset(&mOutBufHandle, 0, sizeof(mOutBufHandle));
294
295	12.3k	switch (mColorFormat) {
296	2.97k	case IV_YUV_420SP_UV:
297	2.97k	[[fallthrough]];
298	6.24k	case IV_YUV_420SP_VU:
299	6.24k	sizes[0] = mWidth * mHeight;
300	6.24k	sizes[1] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 1;
301	6.24k	num_bufs = 2;
302	6.24k	break;
303	0	case IV_YUV_422ILE:
304	0	sizes[0] = mWidth * mHeight * 2;
305	0	num_bufs = 1;
306	0	break;
307	0	case IV_RGB_565:
308	0	sizes[0] = mWidth * mHeight * 2;
309	0	num_bufs = 1;
310	0	break;
311	0	case IV_RGBA_8888:
312	0	sizes[0] = mWidth * mHeight * 4;
313	0	num_bufs = 1;
314	0	break;
315	6.07k	case IV_YUV_420P:
316	6.07k	[[fallthrough]];
317	6.07k	default:
318	6.07k	sizes[0] = mWidth * mHeight;
319	6.07k	sizes[1] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 2;
320	6.07k	sizes[2] = ALIGN2(mWidth) * ALIGN2(mHeight) >> 2;
321	6.07k	num_bufs = 3;
322	6.07k	break;
323	12.3k	}
324	12.3k	mOutBufHandle.u4_num_bufs = num_bufs;
325	43.0k	for (int i = 0; i < num_bufs; i++) {
326	30.7k	mOutBufHandle.u4_min_out_buf_size[i] = sizes[i];
327	30.7k	void *buf = NULL;
328	30.7k	if (0 != posix_memalign(&buf, 16, sizes[i])) {
329	0	return;
330	0	}
331	30.7k	mOutBufHandle.pu1_bufs[i] = (UWORD8 *)buf;
332	30.7k	}
333	12.3k	}
334
335	5.79k	void Codec::decodeHeader(const uint8_t *data, size_t size) {
336	5.79k	setParams(IVD_DECODE_HEADER);
337
338	5.79k	size_t numDecodeCalls = 0;
339
340	10.5k	while (size > 0 && numDecodeCalls < kMaxNumDecodeCalls) {
341	10.2k	IV_API_CALL_STATUS_T ret;
342	10.2k	ivd_video_decode_ip_t dec_ip;
343	10.2k	ivd_video_decode_op_t dec_op;
344	10.2k	size_t bytes_consumed;
345
346	10.2k	memset(&dec_ip, 0, sizeof(dec_ip));
347	10.2k	memset(&dec_op, 0, sizeof(dec_op));
348
349	10.2k	dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
350	10.2k	dec_ip.u4_ts = 0;
351	10.2k	dec_ip.pv_stream_buffer = (void *)data;
352	10.2k	dec_ip.u4_num_Bytes = size;
353	10.2k	dec_ip.u4_size = sizeof(ivd_video_decode_ip_t);
354	10.2k	dec_op.u4_size = sizeof(ivd_video_decode_op_t);
355
356	10.2k	ret = ivd_api_function(mCodec, (void )&dec_ip, (void )&dec_op);
357
358	10.2k	bytes_consumed = dec_op.u4_num_bytes_consumed;
359		/* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds
360		* to feed next data */
361	10.2k	if (!bytes_consumed) bytes_consumed = 4;
362
363	10.2k	bytes_consumed = std::min(size, bytes_consumed);
364
365	10.2k	data += bytes_consumed;
366	10.2k	size -= bytes_consumed;
367	10.2k	numDecodeCalls++;
368
369	10.2k	mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240);
370	10.2k	mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240);
371
372		/* Break after successful header decode */
373	10.2k	if (mWidth && mHeight) {
374	5.54k	break;
375	5.54k	}
376	10.2k	}
377		/* if width / height are invalid, set them to defaults */
378	5.79k	if (!mWidth) mWidth = 1920;
379	5.79k	if (!mHeight) mHeight = 1088;
380	5.79k	}
381
382		IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size,
383	51.8k	size_t *bytesConsumed) {
384	51.8k	IV_API_CALL_STATUS_T ret;
385	51.8k	ivd_video_decode_ip_t dec_ip;
386	51.8k	ivd_video_decode_op_t dec_op;
387
388	51.8k	memset(&dec_ip, 0, sizeof(dec_ip));
389	51.8k	memset(&dec_op, 0, sizeof(dec_op));
390
391	51.8k	dec_ip.e_cmd = IVD_CMD_VIDEO_DECODE;
392	51.8k	dec_ip.u4_ts = 0;
393	51.8k	dec_ip.pv_stream_buffer = (void *)data;
394	51.8k	dec_ip.u4_num_Bytes = size;
395	51.8k	dec_ip.u4_size = sizeof(ivd_video_decode_ip_t);
396	51.8k	dec_ip.s_out_buffer = mOutBufHandle;
397
398	51.8k	dec_op.u4_size = sizeof(ivd_video_decode_op_t);
399
400	51.8k	ret = ivd_api_function(mCodec, (void )&dec_ip, (void )&dec_op);
401	51.8k	if (IMPEG2D_UNSUPPORTED_DIMENSIONS == dec_op.u4_error_code) {
402		/* In case of unsupported resolution, reset codec */
403	7.88k	resetCodec();
404	44.0k	} else if (IVD_RES_CHANGED == (dec_op.u4_error_code & 0xFF)) {
405		/* In case of change in resolution, reset codec and feed the same data
406		* again */
407	1.92k	resetCodec();
408	1.92k	ret = ivd_api_function(mCodec, (void )&dec_ip, (void )&dec_op);
409	1.92k	}
410	51.8k	*bytesConsumed = dec_op.u4_num_bytes_consumed;
411
412		/* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds
413		* to feed next data */
414	51.8k	if (!bytesConsumed) bytesConsumed = 4;
415
416	51.8k	if (dec_op.u4_pic_wd && dec_op.u4_pic_ht &&
417	36.0k	(mWidth != dec_op.u4_pic_wd \|\| mHeight != dec_op.u4_pic_ht)) {
418	6.51k	mWidth = std::min(dec_op.u4_pic_wd, (UWORD32)10240);
419	6.51k	mHeight = std::min(dec_op.u4_pic_ht, (UWORD32)10240);
420	6.51k	allocFrame();
421	6.51k	}
422
423	51.8k	return ret;
424	51.8k	}
425
426	5.79k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
427	5.79k	if (size < 1) {
428	0	return 0;
429	0	}
430	5.79k	size_t colorFormatOfst = std::min((size_t)OFFSET_COLOR_FORMAT, size - 1);
431	5.79k	size_t numCoresOfst = std::min((size_t)OFFSET_NUM_CORES, size - 1);
432	5.79k	size_t architectureOfst = std::min((size_t)OFFSET_ARCH, size - 1);
433	5.79k	size_t architectureIdx = data[architectureOfst] % kSupportedArchitectures;
434	5.79k	IVD_ARCH_T arch = (IVD_ARCH_T)supportedArchitectures[architectureIdx];
435	5.79k	size_t colorFormatIdx = data[colorFormatOfst] % kSupportedColorFormats;
436	5.79k	IV_COLOR_FORMAT_T colorFormat =
437	5.79k	(IV_COLOR_FORMAT_T)(supportedColorFormats[colorFormatIdx]);
438	5.79k	uint32_t numCores = (data[numCoresOfst] % kMaxCores) + 1;
439	5.79k	size_t numDecodeCalls = 0;
440	5.79k	Codec *codec = new Codec(colorFormat, numCores);
441	5.79k	codec->createCodec();
442	5.79k	codec->setArchitecture(arch);
443	5.79k	codec->setCores();
444	5.79k	codec->decodeHeader(data, size);
445	5.79k	codec->setParams(IVD_DECODE_FRAME);
446	5.79k	codec->allocFrame();
447
448	57.6k	while (size > 0 && numDecodeCalls < kMaxNumDecodeCalls) {
449	51.8k	IV_API_CALL_STATUS_T ret;
450	51.8k	size_t bytesConsumed;
451	51.8k	ret = codec->decodeFrame(data, size, &bytesConsumed);
452
453	51.8k	bytesConsumed = std::min(size, bytesConsumed);
454	51.8k	data += bytesConsumed;
455	51.8k	size -= bytesConsumed;
456	51.8k	numDecodeCalls++;
457	51.8k	}
458
459	5.79k	codec->freeFrame();
460	5.79k	codec->deleteCodec();
461	5.79k	delete codec;
462	5.79k	return 0;
463	5.79k	}