vlc: add new bpg codec target (google#15820)

Signed-off-by: David Korczynski <david@adalogics.com>

Author: DavidKorczynski

projects/vlc/build.sh

@@ -95,6 +95,29 @@ make V=1 -j$(nproc) \
     .ass \
     .kate
 
+# libbpg ships a hand-written Makefile that hardcodes CC=gcc, but the OSS-Fuzz
+# CFLAGS are clang-only (-gline-tables-only, -fsanitize=fuzzer-no-link), which
+# gcc rejects. Build it in its own make so a command-line CC/CXX override (which
+# beats the Makefile's CC=gcc and propagates to the inner libbpg sub-make)
+# forces clang, keeping libbpg instrumented.
+make V=1 -j$(nproc) CC="$CC" CXX="$CXX" .bpg
+
+# libbpg bundles a forked libavcodec/libavutil. VLC normally builds each plugin
+# as a separate .so, so those symbols never clash with the ffmpeg contrib; but
+# the OSS-Fuzz static build links every plugin into one binary, where libbpg's
+# av_*/ff_*/avcodec_* duplicate ffmpeg's ("multiple definition" link errors).
+# Merge libbpg.a into a single relocatable object and localize every symbol
+# except the public bpg_* API: libbpg then resolves its own libav internally
+# while ffmpeg's symbols stay global for the avcodec plugin.
+for bpg_a in ../*/lib/libbpg.a; do
+    [ -f "$bpg_a" ] || continue
+    ld -r --whole-archive "$bpg_a" -o "${bpg_a}.merged.o"
+    objcopy --wildcard --keep-global-symbol='bpg_*' "${bpg_a}.merged.o" "${bpg_a}.local.o"
+    rm -f "$bpg_a" "${bpg_a}.merged.o"
+    ar crs "$bpg_a" "${bpg_a}.local.o"
+    rm -f "${bpg_a}.local.o"
+done
+
 # libgme's CMake compiles with -fno-rtti, which is incompatible with the
 # -fsanitize=vptr check implied by SANITIZER=undefined ("invalid argument
 # '-fsanitize=vptr' not allowed with '-fno-rtti'"). Build it with that single
@@ -153,6 +176,7 @@ sed -i "s/${RULE}/${FUZZ_LDFLAGS}\n${RULE}/g" ./test/Makefile.am
             --disable-xcb \
             --disable-alsa \
             --disable-libva \
+            --enable-bpg \
             --with-libfuzzer
 make V=1 -j$(nproc)
 

projects/vlc/fuzzing-modules.patch

@@ -23,7 +23,7 @@ index 613cfab..e977d39 100644
  	../modules/libfilesystem_plugin.la \
  	../modules/libxml_plugin.la \
  	../modules/libogg_plugin.la \
-@@ -537,13 +549,34 @@ libvlc_demux_dec_run_la_LIBADD += \
+@@ -537,13 +549,35 @@ libvlc_demux_dec_run_la_LIBADD += \
  	../modules/libsubsusf_plugin.la \
  	../modules/libsvcdsub_plugin.la \
  	../modules/libtextst_plugin.la \
@@ -45,7 +45,8 @@ index 613cfab..e977d39 100644
 +	../modules/libpng_plugin.la \
 +	../modules/liblibass_plugin.la \
 +	../modules/libkate_plugin.la \
-+	../modules/libtelx_plugin.la
++	../modules/libtelx_plugin.la \
++	../modules/libbpg_plugin.la
  if HAVE_ZVBI
  libvlc_demux_dec_run_la_LIBADD += ../modules/libzvbi_plugin.la
  endif
@@ -63,7 +64,7 @@ diff --git a/test/src/input/demux-run.c b/test/src/input/demux-run.c
 index 92a5d92..1486f79 100644
 --- a/test/src/input/demux-run.c
 +++ b/test/src/input/demux-run.c
-@@ -417,7 +417,24 @@ int vlc_demux_process_memory(const struct vlc_run_args *args,
+@@ -417,7 +417,25 @@ int vlc_demux_process_memory(const struct vlc_run_args *args,
      f(codec_subsusf) \
      f(codec_svcdsub) \
      f(codec_textst) \
@@ -85,7 +86,8 @@ index 92a5d92..1486f79 100644
 +    f(codec_png) \
 +    f(codec_ass) \
 +    f(codec_kate) \
-+    f(codec_telx)
++    f(codec_telx) \
++    f(codec_bpg)
  #else
  #define DECODER_PLUGINS(f)
  #endif

projects/vlc/generate_seeds.py

@@ -4784,6 +4784,29 @@ def gen_image(root):
     JPEG (baseline/progressive/subsampling/grey/CMYK) for libpng / libjpeg."""
     O = os.path.join(root, 'seeds', 'image')
     os.makedirs(O, exist_ok=True)
+
+    # BPG (Better Portable Graphics) -> codec/bpg.c + bundled libbpg, reached
+    # via the image demux, which detects the 4-byte 'BPG\xFB' marker. bpg.c was
+    # never registered in the harness (absent from coverage). A structurally
+    # valid BPG header gets past detection and the libbpg header parse (the
+    # front door); libFuzzer mutates from there into the HEVC-based decoder.
+    def _ue7(v: int) -> bytes:
+        out = bytearray([v & 0x7F])
+        v >>= 7
+        while v:
+            out.insert(0, 0x80 | (v & 0x7F))
+            v >>= 7
+        return bytes(out)
+
+    bpg = (b'BPG\xfb'                 # magic
+           + bytes([0x20])            # pixel_format=4:2:0(1), bit_depth_minus8=0
+           + bytes([0x00])            # color_space=YCbCr, no extension/alpha
+           + _ue7(16) + _ue7(16)      # picture_width, picture_height
+           + _ue7(0))                 # picture_data_length (0 = to end of file)
+    bpg += bytes([0x00, 0x00, 0x01, 0x26, 0x01] + [0x00] * 32)   # HEVC payload
+    with open(os.path.join(O, 'minimal.bpg'), 'wb') as f:
+        f.write(bpg)
+
     SIG = b'\x89PNG\r\n\x1a\n'
 
     def png(name, w, h, bd, ct, rows, before=b'', after=b'',