• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 //This program fuzzes Metadata.cpp
2 
3 #include <stddef.h>
4 #include <stdint.h>
5 #include <fuzzer/FuzzedDataProvider.h>
6 #include <media/Metadata.h>
7 #include <binder/Parcel.h>
8 
9 using namespace android;
10 using namespace media;
11 
12 static const float want_prob = 0.5;
13 
14 bool bytesRemain(FuzzedDataProvider *fdp);
15 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)16 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
17     FuzzedDataProvider fdp(data, size);
18     Parcel p;
19     Metadata md = Metadata(&p);
20 
21     md.appendHeader();
22     while (bytesRemain(&fdp)) {
23 
24         float got_prob = fdp.ConsumeProbability<float>();
25         if (!bytesRemain(&fdp)) {
26             break;
27         }
28 
29         if (got_prob < want_prob) {
30             int32_t key_bool = fdp.ConsumeIntegral<int32_t>();
31             if (!bytesRemain(&fdp)) {
32                 break;
33             }
34             bool val_bool = fdp.ConsumeBool();
35             md.appendBool(key_bool, val_bool);
36         } else {
37             int32_t key_int32 = fdp.ConsumeIntegral<int32_t>();
38             if (!bytesRemain(&fdp)) {
39                 break;
40             }
41             bool val_int32 = fdp.ConsumeIntegral<int32_t>();
42             md.appendInt32(key_int32, val_int32);
43         }
44         md.updateLength();
45     }
46     md.resetParcel();
47     return 0;
48 }
49 
bytesRemain(FuzzedDataProvider * fdp)50 bool bytesRemain(FuzzedDataProvider *fdp){
51     return fdp -> remaining_bytes() > 0;
52 }