[FFmpeg-cvslog] tools/target_dec_fuzzer: Check number of all samples decoded too, like max pixels

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Wed Sep 25 20:40:55 2019 +0200| [db614008bc8a0c92897b927ad07fec04af3a4c18] | committer: Michael Niedermayer

tools/target_dec_fuzzer: Check number of all samples decoded too, like max pixels

Reviewed-by: Paul B Mahol <onemda at gmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=db614008bc8a0c92897b927ad07fec04af3a4c18
---

 tools/target_dec_fuzzer.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c
index 0dc1854738..6c670d8eb9 100644
--- a/tools/target_dec_fuzzer.c
+++ b/tools/target_dec_fuzzer.c
@@ -94,6 +94,7 @@ const uint64_t maxpixels_per_frame = 4096 * 4096;
 uint64_t maxpixels;
 
 const uint64_t maxsamples_per_frame = 256*1024*32;
+uint64_t maxsamples;
 
 static const uint64_t FUZZ_TAG = 0x4741542D5A5A5546ULL;
 
@@ -103,6 +104,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     const uint8_t *end = data + size;
     uint32_t it = 0;
     uint64_t ec_pixels = 0;
+    uint64_t nb_samples = 0;
     int (*decode_handler)(AVCodecContext *avctx, AVFrame *picture,
                           int *got_picture_ptr,
                           const AVPacket *avpkt) = NULL;
@@ -131,6 +133,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     case AVMEDIA_TYPE_SUBTITLE: decode_handler = subtitle_handler     ; break;
     }
     maxpixels = maxpixels_per_frame * maxiteration;
+    maxsamples = maxsamples_per_frame * maxiteration;
     switch (c->id) {
         // Allows a small input to generate gigantic output
     case AV_CODEC_ID_BINKVIDEO: maxpixels /= 32; break;
@@ -269,6 +272,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
             if (ec_pixels > maxpixels)
                 goto maximums_reached;
 
+            nb_samples += frame->nb_samples;
+            if (nb_samples > maxsamples)
+                goto maximums_reached;
+
             if (ret <= 0 || ret > avpkt.size)
                break;
             if (ctx->codec_type != AVMEDIA_TYPE_AUDIO)