1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
/*
* Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
*
* Use of this source code is governed by a BSD-style license
* that can be found in the LICENSE file in the root of the source
* tree. An additional intellectual property rights grant can be found
* in the file PATENTS. All contributing project authors may
* be found in the AUTHORS file in the root of the source tree.
*/
#include <bitset>
#include <string>
#include "absl/base/nullability.h"
#include "absl/memory/memory.h"
#include "api/audio/echo_canceller3_factory.h"
#include "api/audio/echo_detector_creator.h"
#include "api/task_queue/default_task_queue_factory.h"
#include "api/task_queue/task_queue_base.h"
#include "modules/audio_processing/aec_dump/aec_dump_factory.h"
#include "modules/audio_processing/include/audio_processing.h"
#include "modules/audio_processing/test/audio_processing_builder_for_testing.h"
#include "rtc_base/arraysize.h"
#include "rtc_base/numerics/safe_minmax.h"
#include "system_wrappers/include/field_trial.h"
#include "test/fuzzers/audio_processing_fuzzer_helper.h"
#include "test/fuzzers/fuzz_data_helper.h"
namespace webrtc {
namespace {
const std::string kFieldTrialNames[] = {
"WebRTC-Aec3MinErleDuringOnsetsKillSwitch",
"WebRTC-Aec3ShortHeadroomKillSwitch",
};
rtc::scoped_refptr<AudioProcessing> CreateApm(
test::FuzzDataHelper* fuzz_data,
std::string* field_trial_string,
absl::Nonnull<TaskQueueBase*> worker_queue) {
// Parse boolean values for optionally enabling different
// configurable public components of APM.
bool use_ts = fuzz_data->ReadOrDefaultValue(true);
bool use_red = fuzz_data->ReadOrDefaultValue(true);
bool use_hpf = fuzz_data->ReadOrDefaultValue(true);
bool use_aec3 = fuzz_data->ReadOrDefaultValue(true);
bool use_aec = fuzz_data->ReadOrDefaultValue(true);
bool use_aecm = fuzz_data->ReadOrDefaultValue(true);
bool use_agc = fuzz_data->ReadOrDefaultValue(true);
bool use_ns = fuzz_data->ReadOrDefaultValue(true);
bool use_agc_limiter = fuzz_data->ReadOrDefaultValue(true);
bool use_agc2 = fuzz_data->ReadOrDefaultValue(true);
bool use_agc2_adaptive_digital = fuzz_data->ReadOrDefaultValue(true);
// Read a gain value supported by GainController2::Validate().
const float gain_controller2_gain_db =
fuzz_data->ReadOrDefaultValue<uint8_t>(0) % 50;
constexpr size_t kNumFieldTrials = arraysize(kFieldTrialNames);
// Verify that the read data type has enough bits to fuzz the field trials.
using FieldTrialBitmaskType = uint64_t;
static_assert(kNumFieldTrials <= sizeof(FieldTrialBitmaskType) * 8,
"FieldTrialBitmaskType is not large enough.");
std::bitset<kNumFieldTrials> field_trial_bitmask(
fuzz_data->ReadOrDefaultValue<FieldTrialBitmaskType>(0));
for (size_t i = 0; i < kNumFieldTrials; ++i) {
if (field_trial_bitmask[i]) {
*field_trial_string += kFieldTrialNames[i] + "/Enabled/";
}
}
field_trial::InitFieldTrialsFromString(field_trial_string->c_str());
// Ignore a few bytes. Bytes from this segment will be used for
// future config flag changes. We assume 40 bytes is enough for
// configuring the APM.
constexpr size_t kSizeOfConfigSegment = 40;
RTC_DCHECK(kSizeOfConfigSegment >= fuzz_data->BytesRead());
static_cast<void>(
fuzz_data->ReadByteArray(kSizeOfConfigSegment - fuzz_data->BytesRead()));
// Filter out incompatible settings that lead to CHECK failures.
if ((use_aecm && use_aec) || // These settings cause CHECK failure.
(use_aecm && use_aec3 && use_ns) // These settings trigger webrtc:9489.
) {
return nullptr;
}
std::unique_ptr<EchoControlFactory> echo_control_factory;
if (use_aec3) {
echo_control_factory.reset(new EchoCanceller3Factory());
}
webrtc::AudioProcessing::Config apm_config;
apm_config.pipeline.multi_channel_render = true;
apm_config.pipeline.multi_channel_capture = true;
apm_config.echo_canceller.enabled = use_aec || use_aecm;
apm_config.echo_canceller.mobile_mode = use_aecm;
apm_config.high_pass_filter.enabled = use_hpf;
apm_config.gain_controller1.enabled = use_agc;
apm_config.gain_controller1.enable_limiter = use_agc_limiter;
apm_config.gain_controller2.enabled = use_agc2;
apm_config.gain_controller2.fixed_digital.gain_db = gain_controller2_gain_db;
apm_config.gain_controller2.adaptive_digital.enabled =
use_agc2_adaptive_digital;
apm_config.noise_suppression.enabled = use_ns;
apm_config.transient_suppression.enabled = use_ts;
rtc::scoped_refptr<AudioProcessing> apm =
AudioProcessingBuilderForTesting()
.SetEchoControlFactory(std::move(echo_control_factory))
.SetEchoDetector(use_red ? CreateEchoDetector() : nullptr)
.SetConfig(apm_config)
.Create();
#ifdef WEBRTC_LINUX
apm->AttachAecDump(AecDumpFactory::Create("/dev/null", -1, worker_queue));
#endif
return apm;
}
TaskQueueFactory* GetTaskQueueFactory() {
static TaskQueueFactory* const factory =
CreateDefaultTaskQueueFactory().release();
return factory;
}
} // namespace
void FuzzOneInput(const uint8_t* data, size_t size) {
if (size > 400000) {
return;
}
test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
// This string must be in scope during execution, according to documentation
// for field_trial.h. Hence it's created here and not in CreateApm.
std::string field_trial_string = "";
std::unique_ptr<TaskQueueBase, TaskQueueDeleter> worker_queue =
GetTaskQueueFactory()->CreateTaskQueue("rtc-low-prio",
TaskQueueFactory::Priority::LOW);
auto apm = CreateApm(&fuzz_data, &field_trial_string, worker_queue.get());
if (apm) {
FuzzAudioProcessing(&fuzz_data, std::move(apm));
}
}
} // namespace webrtc
|
