This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 6c47bc66a4fe2b8e868e7686dac96877cf62a8de Author: Kacper Michajłow <[email protected]> AuthorDate: Wed Sep 9 00:18:22 2026 +0200 Commit: Kacper Michajłow <[email protected]> CommitDate: Thu Sep 24 08:43:09 2026 +0000 tools/target_{dec,enc,swr,sws}_fuzzer: restore CPU flags on every run The fuzzed input can call av_force_cpu_flags(0), which changes process global state that nothing ever restores. Every later input handled by the same process then runs with the CPU flags cleared, so runs are not independent of each other, which is critical for fuzzing. That also breaks reproduction. A crash found after some earlier input cleared the flags does not happen when the minimized input is replayed on its own, because the replay starts with the flags detected for the host. This might invalidate some already found test vectors, but will find them quickly again given the corpus is primed already. Signed-off-by: Kacper Michajłow <[email protected]> --- tools/target_dec_fuzzer.c | 12 ++++++++++++ tools/target_enc_fuzzer.c | 12 ++++++++++++ tools/target_swr_fuzzer.c | 12 ++++++++++++ tools/target_sws_fuzzer.c | 12 ++++++++++++ 4 files changed, 48 insertions(+) diff --git a/tools/target_dec_fuzzer.c b/tools/target_dec_fuzzer.c index d301b99dfd..4b43a51417 100644 --- a/tools/target_dec_fuzzer.c +++ b/tools/target_dec_fuzzer.c @@ -174,6 +174,16 @@ static int fuzz_get_buffer2(AVCodecContext *ctx, AVFrame *frame, int flags) } } +static void reset_cpu_flags(void) +{ + static int default_cpu_flags = -1; + + if (default_cpu_flags < 0) + default_cpu_flags = av_get_cpu_flags(); + + av_force_cpu_flags(default_cpu_flags); +} + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { uint64_t maxpixels_per_frame = 4096 * 4096; uint64_t maxpixels; @@ -194,6 +204,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { uint64_t flushpattern = -1; AVDictionary *opts = NULL; + reset_cpu_flags(); + if (!c) { #ifdef FFMPEG_DECODER #define DECODER_SYMBOL0(CODEC) ff_##CODEC##_decoder diff --git a/tools/target_enc_fuzzer.c b/tools/target_enc_fuzzer.c index 2e1dfe7dde..bb6fdf0c7f 100644 --- a/tools/target_enc_fuzzer.c +++ b/tools/target_enc_fuzzer.c @@ -70,6 +70,16 @@ static int encode(AVCodecContext *enc_ctx, AVFrame *frame, AVPacket *pkt) av_assert0(0); } +static void reset_cpu_flags(void) +{ + static int default_cpu_flags = -1; + + if (default_cpu_flags < 0) + default_cpu_flags = av_get_cpu_flags(); + + av_force_cpu_flags(default_cpu_flags); +} + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { uint64_t maxpixels_per_frame = 512 * 512; uint64_t maxpixels; @@ -80,6 +90,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { AVDictionary *opts = NULL; uint64_t ec_pixels = 0; + reset_cpu_flags(); + if (!c) { #define ENCODER_SYMBOL0(CODEC) ff_##CODEC##_encoder #define ENCODER_SYMBOL(CODEC) ENCODER_SYMBOL0(CODEC) diff --git a/tools/target_swr_fuzzer.c b/tools/target_swr_fuzzer.c index 8100e99524..f468d988fb 100644 --- a/tools/target_swr_fuzzer.c +++ b/tools/target_swr_fuzzer.c @@ -67,6 +67,16 @@ static const AVChannelLayout layouts[]={ AV_CHANNEL_LAYOUT_5POINT1POINT2_BACK , }; +static void reset_cpu_flags(void) +{ + static int default_cpu_flags = -1; + + if (default_cpu_flags < 0) + default_cpu_flags = av_get_cpu_flags(); + + av_force_cpu_flags(default_cpu_flags); +} + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { struct SwrContext * swr= NULL; AVChannelLayout in_ch_layout = AV_CHANNEL_LAYOUT_MONO, out_ch_layout = AV_CHANNEL_LAYOUT_MONO; @@ -85,6 +95,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { int count; int ret; + reset_cpu_flags(); + if (size > 128) { GetByteContext gbc; int64_t flags64; diff --git a/tools/target_sws_fuzzer.c b/tools/target_sws_fuzzer.c index a0a2ef31bc..11326e2f66 100644 --- a/tools/target_sws_fuzzer.c +++ b/tools/target_sws_fuzzer.c @@ -86,6 +86,16 @@ static void mapres(unsigned *r0, unsigned *r1) { *r1 = 1 + (*r1 * maxb) / UINT32_MAX; } +static void reset_cpu_flags(void) +{ + static int default_cpu_flags = -1; + + if (default_cpu_flags < 0) + default_cpu_flags = av_get_cpu_flags(); + + av_force_cpu_flags(default_cpu_flags); +} + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { int srcW= 48, srcH = 48; int dstW= 48, dstH = 48; @@ -101,6 +111,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { uint8_t *dst[AV_VIDEO_MAX_PLANES] = { 0 }; struct SwsContext *sws = NULL; + reset_cpu_flags(); + if (size > 128) { GetByteContext gbc; int64_t flags64; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
