1 /*
2 * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
3 *
4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree.
9 */
10
11 #include "test/fuzzers/audio_decoder_fuzzer.h"
12
13 #include <limits>
14
15 #include "absl/types/optional.h"
16 #include "api/audio_codecs/audio_decoder.h"
17 #include "modules/rtp_rtcp/source/byte_io.h"
18 #include "rtc_base/checks.h"
19
20 namespace webrtc {
21 namespace {
22 template <typename T, unsigned int B = sizeof(T)>
ParseInt(const uint8_t ** data,size_t * remaining_size,T * value)23 bool ParseInt(const uint8_t** data, size_t* remaining_size, T* value) {
24 static_assert(std::numeric_limits<T>::is_integer, "Type must be an integer.");
25 static_assert(sizeof(T) <= sizeof(uint64_t),
26 "Cannot read wider than uint64_t.");
27 static_assert(B <= sizeof(T), "T must be at least B bytes wide.");
28 if (B > *remaining_size)
29 return false;
30 uint64_t val = ByteReader<uint64_t, B>::ReadBigEndian(*data);
31 *data += B;
32 *remaining_size -= B;
33 *value = static_cast<T>(val);
34 return true;
35 }
36 } // namespace
37
38 // This function reads two bytes from the beginning of |data|, interprets them
39 // as the first packet length, and reads this many bytes if available. The
40 // payload is inserted into the decoder, and the process continues until no more
41 // data is available. Either AudioDecoder::Decode or
42 // AudioDecoder::DecodeRedundant is used, depending on the value of
43 // |decode_type|.
FuzzAudioDecoder(DecoderFunctionType decode_type,const uint8_t * data,size_t size,AudioDecoder * decoder,int sample_rate_hz,size_t max_decoded_bytes,int16_t * decoded)44 void FuzzAudioDecoder(DecoderFunctionType decode_type,
45 const uint8_t* data,
46 size_t size,
47 AudioDecoder* decoder,
48 int sample_rate_hz,
49 size_t max_decoded_bytes,
50 int16_t* decoded) {
51 const uint8_t* data_ptr = data;
52 size_t remaining_size = size;
53 size_t packet_len;
54 constexpr size_t kMaxNumFuzzedPackets = 200;
55 for (size_t num_packets = 0; num_packets < kMaxNumFuzzedPackets;
56 ++num_packets) {
57 if (!(ParseInt<size_t, 2>(&data_ptr, &remaining_size, &packet_len) &&
58 packet_len <= remaining_size)) {
59 break;
60 }
61 AudioDecoder::SpeechType speech_type;
62 switch (decode_type) {
63 case DecoderFunctionType::kNormalDecode:
64 decoder->Decode(data_ptr, packet_len, sample_rate_hz, max_decoded_bytes,
65 decoded, &speech_type);
66 break;
67 case DecoderFunctionType::kRedundantDecode:
68 decoder->DecodeRedundant(data_ptr, packet_len, sample_rate_hz,
69 max_decoded_bytes, decoded, &speech_type);
70 break;
71 }
72 data_ptr += packet_len;
73 remaining_size -= packet_len;
74 }
75 }
76
77 } // namespace webrtc
78