summaryrefslogtreecommitdiffstats
path: root/third_party/libwebrtc/test/fuzzers
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 17:32:43 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 17:32:43 +0000
commit6bf0a5cb5034a7e684dcc3500e841785237ce2dd (patch)
treea68f146d7fa01f0134297619fbe7e33db084e0aa /third_party/libwebrtc/test/fuzzers
parentInitial commit. (diff)
downloadthunderbird-upstream.tar.xz
thunderbird-upstream.zip
Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--third_party/libwebrtc/test/fuzzers/BUILD.gn689
-rw-r--r--third_party/libwebrtc/test/fuzzers/DEPS5
-rw-r--r--third_party/libwebrtc/test/fuzzers/OWNERS3
-rw-r--r--third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc30
-rw-r--r--third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc79
-rw-r--r--third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc124
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc77
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h36
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc39
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc26
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc61
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc24
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc24
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc56
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc45
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc53
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h26
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc27
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc147
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc143
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h25
-rw-r--r--third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc162
-rw-r--r--third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc59
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json151
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json66
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json66
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json29
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json73
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json29
-rw-r--r--third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json79
-rw-r--r--third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc52
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/README37
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json1
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1bin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2bin0 -> 801699 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3bin0 -> 801699 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4bin0 -> 799275 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0bin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1bin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2bin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3bin0 -> 5341 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0bin0 -> 136 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1bin0 -> 118 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10bin0 -> 51 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-111
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12bin0 -> 48 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13bin0 -> 349 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14bin0 -> 1872 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15bin0 -> 48 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16bin0 -> 349 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2bin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3bin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4bin0 -> 2958 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5bin0 -> 25 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6bin0 -> 109 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7bin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-82
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9bin0 -> 13 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-01
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-21
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0bin0 -> 10 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1bin0 -> 127 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdnsbin0 -> 62 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdnsbin0 -> 17 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdnsbin0 -> 129 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdnsbin0 -> 17 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdnsbin0 -> 72 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdnsbin0 -> 650 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdnsbin0 -> 30 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdnsbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdnsbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdnsbin0 -> 57 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdnsbin0 -> 144 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdnsbin0 -> 132 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdnsbin0 -> 51 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdnsbin0 -> 106 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdnsbin0 -> 103 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdnsbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdnsbin0 -> 14 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdnsbin0 -> 252 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdnsbin0 -> 72 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdnsbin0 -> 27 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511bin0 -> 24 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcpbin0 -> 72 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcpbin0 -> 24 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcpbin0 -> 76 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcpbin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcpbin0 -> 28 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcpbin0 -> 56 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcpbin0 -> 28 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcpbin0 -> 28 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcpbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcpbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcpbin0 -> 52 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcpbin0 -> 24 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcpbin0 -> 11 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcpbin0 -> 36 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcpbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcpbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcpbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp1
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcpbin0 -> 24 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcpbin0 -> 4 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcpbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcpbin0 -> 4 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcpbin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp0
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcpbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcpbin0 -> 4 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcpbin0 -> 28 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcpbin0 -> 44 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcpbin0 -> 4 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcpbin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcpbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcpbin0 -> 4 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcpbin0 -> 4 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcpbin0 -> 16 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0bin0 -> 12 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1bin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2bin0 -> 24 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3bin0 -> 43 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4bin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5bin0 -> 261774 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6bin0 -> 261774 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7bin0 -> 58 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8bin0 -> 24 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-01
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdumpbin0 -> 167509 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdumpbin0 -> 192742 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.binbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.binbin0 -> 396 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.binbin0 -> 288 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.binbin0 -> 288 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.binbin0 -> 1212 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.binbin0 -> 20 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.binbin0 -> 56 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.binbin0 -> 56 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.binbin0 -> 364 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.binbin0 -> 104 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.binbin0 -> 34 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.binbin0 -> 672 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.binbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp12
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp12
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp8
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp8
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp8
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp12
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp5
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp5
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp10
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp7
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp8
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp12
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp9
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp58
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp43
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp85
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp73
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp41
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp41
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp52
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp40
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp13
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp5
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp12
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp12
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp64
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp66
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens56
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/01
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/11
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/21
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/31
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/41
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/51
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stunbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stunbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stunbin0 -> 44 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stunbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stunbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stunbin0 -> 28 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stunbin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stunbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stunbin0 -> 40 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stunbin0 -> 44 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stunbin0 -> 44 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stunbin0 -> 44 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stunbin0 -> 44 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stunbin0 -> 108 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stunbin0 -> 80 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stunbin0 -> 92 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stunbin0 -> 116 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stunbin0 -> 32 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stunbin0 -> 80 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/stun.tokens2
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-01
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2bin0 -> 11 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682bin0 -> 7 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029fbin0 -> 8 bytes
-rw-r--r--third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc29
-rw-r--r--third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc28
-rw-r--r--third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc26
-rw-r--r--third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc36
-rw-r--r--third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc71
-rw-r--r--third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc67
-rw-r--r--third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc119
-rw-r--r--third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc116
-rw-r--r--third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc87
-rw-r--r--third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc20
-rw-r--r--third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h105
-rw-r--r--third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc21
-rw-r--r--third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc19
-rw-r--r--third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc184
-rw-r--r--third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc201
-rw-r--r--third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc47
-rw-r--r--third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc66
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc52
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc39
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc94
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc154
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc182
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc71
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc44
-rw-r--r--third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc64
-rw-r--r--third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc31
-rw-r--r--third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc66
-rw-r--r--third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc28
-rw-r--r--third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc49
-rw-r--r--third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc35
-rw-r--r--third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc29
-rw-r--r--third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc23
-rw-r--r--third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc22
-rw-r--r--third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc70
-rw-r--r--third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc36
-rw-r--r--third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc71
-rw-r--r--third_party/libwebrtc/test/fuzzers/utils/BUILD.gn47
-rw-r--r--third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc200
-rw-r--r--third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h92
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc20
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc17
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc42
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc20
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc624
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc17
-rw-r--r--third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc41
-rw-r--r--third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc41
323 files changed, 7273 insertions, 0 deletions
diff --git a/third_party/libwebrtc/test/fuzzers/BUILD.gn b/third_party/libwebrtc/test/fuzzers/BUILD.gn
new file mode 100644
index 0000000000..c3576713ab
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/BUILD.gn
@@ -0,0 +1,689 @@
+# Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+#
+# Use of this source code is governed by a BSD-style license
+# that can be found in the LICENSE file in the root of the source
+# tree. An additional intellectual property rights grant can be found
+# in the file PATENTS. All contributing project authors may
+# be found in the AUTHORS file in the root of the source tree.
+
+import("//build/config/features.gni")
+import("//testing/libfuzzer/fuzzer_test.gni")
+import("../../webrtc.gni")
+
+rtc_library("webrtc_fuzzer_main") {
+ sources = [ "webrtc_fuzzer_main.cc" ]
+ deps = [
+ "../../rtc_base:logging",
+ "//testing/libfuzzer:libfuzzer_main",
+ ]
+
+ # When WebRTC fuzzer tests are built on Chromium bots they need to link
+ # with Chromium's implementation of metrics, field trial, and system time.
+ if (build_with_chromium) {
+ deps += [
+ "../../../webrtc_overrides:field_trial",
+ "../../../webrtc_overrides:metrics",
+ "../../../webrtc_overrides:system_time",
+ ]
+ }
+}
+
+rtc_library("fuzz_data_helper") {
+ testonly = true
+ sources = [
+ "fuzz_data_helper.cc",
+ "fuzz_data_helper.h",
+ ]
+ deps = [
+ "../../api:array_view",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+ visibility = [ ":*" ] # Only targets in this file can depend on this.
+}
+
+set_defaults("webrtc_fuzzer_test") {
+ configs = rtc_add_configs
+ absl_deps = []
+}
+
+template("webrtc_fuzzer_test") {
+ fuzzer_test(target_name) {
+ forward_variables_from(invoker, "*")
+ deps += [
+ ":fuzz_data_helper",
+ ":webrtc_fuzzer_main",
+ ]
+ additional_configs = configs
+
+ # If absl_deps is [], no action is needed. If not [], then it needs to be
+ # converted to //third_party/abseil-cpp:absl when build_with_chromium=true
+ # otherwise it just needs to be added to deps.
+ if (absl_deps != []) {
+ if (!defined(deps)) {
+ deps = []
+ }
+ if (build_with_chromium) {
+ deps += [ "//third_party/abseil-cpp:absl" ]
+ } else {
+ deps += absl_deps
+ }
+ }
+
+ if (!build_with_chromium && is_clang) {
+ suppressed_configs = [ "//build/config/clang:find_bad_constructs" ]
+ }
+ }
+}
+
+webrtc_fuzzer_test("h264_depacketizer_fuzzer") {
+ sources = [ "h264_depacketizer_fuzzer.cc" ]
+ deps = [ "../../modules/rtp_rtcp" ]
+ seed_corpus = "corpora/h264-depacketizer-fuzzer-corpus"
+}
+
+webrtc_fuzzer_test("vp8_depacketizer_fuzzer") {
+ sources = [ "vp8_depacketizer_fuzzer.cc" ]
+ deps = [
+ "../../api:array_view",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_video_header",
+ ]
+}
+
+webrtc_fuzzer_test("vp9_depacketizer_fuzzer") {
+ sources = [ "vp9_depacketizer_fuzzer.cc" ]
+ deps = [
+ "../../api:array_view",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_video_header",
+ ]
+}
+
+webrtc_fuzzer_test("vp8_qp_parser_fuzzer") {
+ sources = [ "vp8_qp_parser_fuzzer.cc" ]
+ deps = [
+ "../../modules/video_coding:video_coding_utility",
+ "../../modules/video_coding/",
+ ]
+}
+
+webrtc_fuzzer_test("vp9_qp_parser_fuzzer") {
+ sources = [ "vp9_qp_parser_fuzzer.cc" ]
+ deps = [
+ "../../modules/video_coding:video_coding_utility",
+ "../../modules/video_coding/",
+ ]
+}
+
+webrtc_fuzzer_test("h264_bitstream_parser_fuzzer") {
+ sources = [ "h264_bitstream_parser_fuzzer.cc" ]
+ deps = [
+ "../../common_video",
+ "../../modules/video_coding/",
+ ]
+}
+
+webrtc_fuzzer_test("forward_error_correction_fuzzer") {
+ sources = [ "forward_error_correction_fuzzer.cc" ]
+ deps = [
+ "../../api:scoped_refptr",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:byte_buffer",
+ ]
+}
+
+webrtc_fuzzer_test("flexfec_header_reader_fuzzer") {
+ sources = [ "flexfec_header_reader_fuzzer.cc" ]
+ deps = [
+ "../../api:scoped_refptr",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+}
+
+webrtc_fuzzer_test("flexfec_sender_fuzzer") {
+ sources = [ "flexfec_sender_fuzzer.cc" ]
+ deps = [
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../system_wrappers",
+ ]
+}
+
+webrtc_fuzzer_test("ulpfec_header_reader_fuzzer") {
+ sources = [ "ulpfec_header_reader_fuzzer.cc" ]
+ deps = [
+ "../../api:scoped_refptr",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:fec_test_helper",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+}
+
+webrtc_fuzzer_test("ulpfec_generator_fuzzer") {
+ sources = [ "ulpfec_generator_fuzzer.cc" ]
+ deps = [
+ "../../modules:module_api_public",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:fec_test_helper",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:checks",
+ "../../rtc_base:copy_on_write_buffer",
+ "../../system_wrappers",
+ ]
+}
+
+webrtc_fuzzer_test("ulpfec_receiver_fuzzer") {
+ sources = [ "ulpfec_receiver_fuzzer.cc" ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+}
+
+webrtc_fuzzer_test("flexfec_receiver_fuzzer") {
+ sources = [ "flexfec_receiver_fuzzer.cc" ]
+ deps = [
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+}
+
+webrtc_fuzzer_test("rtp_video_frame_assembler_fuzzer") {
+ sources = [ "rtp_video_frame_assembler_fuzzer.cc" ]
+ deps = [
+ "../../api/video:rtp_video_frame_assembler",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+}
+
+webrtc_fuzzer_test("rtcp_receiver_fuzzer") {
+ sources = [ "rtcp_receiver_fuzzer.cc" ]
+ deps = [
+ "../../modules/rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:checks",
+ "../../system_wrappers",
+ ]
+ seed_corpus = "corpora/rtcp-corpus"
+}
+
+webrtc_fuzzer_test("rtp_packet_fuzzer") {
+ sources = [ "rtp_packet_fuzzer.cc" ]
+ deps = [ "../../modules/rtp_rtcp:rtp_rtcp_format" ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+ seed_corpus = "corpora/rtp-corpus"
+}
+
+webrtc_fuzzer_test("rtp_packetizer_av1_fuzzer") {
+ sources = [ "rtp_packetizer_av1_fuzzer.cc" ]
+ deps = [
+ "../../api/video:video_frame_type",
+ "../../modules/rtp_rtcp:rtp_rtcp",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:checks",
+ ]
+}
+
+webrtc_fuzzer_test("congestion_controller_feedback_fuzzer") {
+ sources = [ "congestion_controller_feedback_fuzzer.cc" ]
+ deps = [
+ "../../modules/congestion_controller",
+ "../../modules/pacing",
+ "../../modules/remote_bitrate_estimator",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/functional:bind_front" ]
+}
+
+rtc_library("audio_decoder_fuzzer") {
+ testonly = true
+ sources = [
+ "audio_decoder_fuzzer.cc",
+ "audio_decoder_fuzzer.h",
+ ]
+ deps = [
+ "../../api/audio_codecs:audio_codecs_api",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:checks",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+}
+
+webrtc_fuzzer_test("audio_decoder_g722_fuzzer") {
+ sources = [ "audio_decoder_g722_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../modules/audio_coding:g722",
+ ]
+}
+
+webrtc_fuzzer_test("audio_decoder_ilbc_fuzzer") {
+ sources = [ "audio_decoder_ilbc_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../modules/audio_coding:ilbc",
+ ]
+}
+
+webrtc_fuzzer_test("audio_decoder_opus_fuzzer") {
+ sources = [ "audio_decoder_opus_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../modules/audio_coding:webrtc_opus",
+ ]
+}
+
+webrtc_fuzzer_test("audio_decoder_opus_redundant_fuzzer") {
+ sources = [ "audio_decoder_opus_redundant_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../modules/audio_coding:webrtc_opus",
+ ]
+}
+
+webrtc_fuzzer_test("audio_decoder_multiopus_fuzzer") {
+ sources = [ "audio_decoder_multistream_opus_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../api/audio_codecs/opus:audio_decoder_multiopus",
+ "../../api/audio_codecs/opus:audio_decoder_opus_config",
+ ]
+}
+
+webrtc_fuzzer_test("audio_decoder_pcm_fuzzer") {
+ sources = [ "audio_decoder_pcm_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../modules/audio_coding:g711",
+ ]
+}
+
+webrtc_fuzzer_test("audio_decoder_pcm16b_fuzzer") {
+ sources = [ "audio_decoder_pcm16b_fuzzer.cc" ]
+ deps = [
+ ":audio_decoder_fuzzer",
+ "../../modules/audio_coding:pcm16b",
+ ]
+}
+
+rtc_library("audio_encoder_fuzzer") {
+ testonly = true
+ sources = [
+ "audio_encoder_fuzzer.cc",
+ "audio_encoder_fuzzer.h",
+ ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../api:array_view",
+ "../../api/audio_codecs:audio_codecs_api",
+ "../../rtc_base:buffer",
+ "../../rtc_base:checks",
+ ]
+}
+
+webrtc_fuzzer_test("audio_encoder_opus_fuzzer") {
+ sources = [ "audio_encoder_opus_fuzzer.cc" ]
+ deps = [
+ ":audio_encoder_fuzzer",
+ "../../api/audio_codecs/opus:audio_encoder_opus",
+ "../../rtc_base:checks",
+ ]
+}
+
+webrtc_fuzzer_test("turn_unwrap_fuzzer") {
+ sources = [ "turn_unwrap_fuzzer.cc" ]
+ deps = [
+ "../../media",
+ "../../media:rtc_media_base",
+ "../../media:turn_utils",
+ ]
+}
+
+webrtc_fuzzer_test("neteq_rtp_fuzzer") {
+ sources = [ "neteq_rtp_fuzzer.cc" ]
+ deps = [
+ "../../api:array_view",
+ "../../api/audio_codecs:builtin_audio_decoder_factory",
+ "../../modules/audio_coding:neteq",
+ "../../modules/audio_coding:neteq_test_tools",
+ "../../modules/audio_coding:neteq_tools_minimal",
+ "../../modules/audio_coding:pcm16b",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ ]
+}
+
+webrtc_fuzzer_test("neteq_signal_fuzzer") {
+ sources = [ "neteq_signal_fuzzer.cc" ]
+ deps = [
+ "../../api:array_view",
+ "../../api/audio_codecs:builtin_audio_decoder_factory",
+ "../../modules/audio_coding:neteq",
+ "../../modules/audio_coding:neteq_test_tools",
+ "../../modules/audio_coding:neteq_tools_minimal",
+ "../../modules/audio_coding:pcm16b",
+ "../../rtc_base:random",
+ "../../rtc_base:safe_conversions",
+ ]
+}
+
+webrtc_fuzzer_test("residual_echo_detector_fuzzer") {
+ sources = [ "residual_echo_detector_fuzzer.cc" ]
+ deps = [
+ "../../api/audio:echo_detector_creator",
+ "../../rtc_base:checks",
+ "../../rtc_base:refcount",
+ ]
+}
+
+webrtc_fuzzer_test("sdp_parser_fuzzer") {
+ sources = [ "sdp_parser_fuzzer.cc" ]
+ deps = [
+ "../../api:libjingle_peerconnection_api",
+ "../../pc:libjingle_peerconnection",
+ ]
+ seed_corpus = "corpora/sdp-corpus"
+}
+
+if (!build_with_chromium) {
+ # This target depends on test infrastructure that can't be built
+ # with Chromium at the moment.
+ # TODO(bugs.chromium.org/12534): Make this fuzzer build in Chromium.
+
+ webrtc_fuzzer_test("sdp_integration_fuzzer") {
+ sources = [ "sdp_integration_fuzzer.cc" ]
+ deps = [
+ "../../api:libjingle_peerconnection_api",
+ "../../pc:integration_test_helpers",
+ "../../pc:libjingle_peerconnection",
+ "../../test:test_support",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/strings" ]
+ seed_corpus = "corpora/sdp-corpus"
+ }
+}
+
+webrtc_fuzzer_test("stun_parser_fuzzer") {
+ sources = [ "stun_parser_fuzzer.cc" ]
+ deps = [
+ "../../api/transport:stun_types",
+ "../../p2p:rtc_p2p",
+ ]
+ seed_corpus = "corpora/stun-corpus"
+ dict = "corpora/stun.tokens"
+}
+
+webrtc_fuzzer_test("stun_validator_fuzzer") {
+ sources = [ "stun_validator_fuzzer.cc" ]
+ deps = [
+ "../../api/transport:stun_types",
+ "../../p2p:rtc_p2p",
+ ]
+ seed_corpus = "corpora/stun-corpus"
+ dict = "corpora/stun.tokens"
+}
+
+webrtc_fuzzer_test("pseudotcp_parser_fuzzer") {
+ sources = [ "pseudotcp_parser_fuzzer.cc" ]
+ deps = [
+ "../../p2p:rtc_p2p",
+ "../../rtc_base:threading",
+ ]
+}
+
+rtc_library("audio_processing_fuzzer_helper") {
+ testonly = true
+ sources = [
+ "audio_processing_fuzzer_helper.cc",
+ "audio_processing_fuzzer_helper.h",
+ ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../api/audio:audio_frame_api",
+ "../../modules/audio_processing",
+ "../../modules/audio_processing:api",
+ "../../modules/audio_processing:audio_frame_proxies",
+ "../../rtc_base:checks",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+}
+
+webrtc_fuzzer_test("audio_processing_fuzzer") {
+ sources = [ "audio_processing_configs_fuzzer.cc" ]
+ deps = [
+ ":audio_processing_fuzzer_helper",
+ "../../api:scoped_refptr",
+ "../../api/audio:aec3_factory",
+ "../../api/audio:echo_detector_creator",
+ "../../api/task_queue:default_task_queue_factory",
+ "../../modules/audio_processing",
+ "../../modules/audio_processing:api",
+ "../../modules/audio_processing:audio_buffer",
+ "../../modules/audio_processing:audioproc_test_utils",
+ "../../modules/audio_processing/aec3",
+ "../../modules/audio_processing/aec_dump",
+ "../../modules/audio_processing/aec_dump:aec_dump_impl",
+ "../../rtc_base:macromagic",
+ "../../rtc_base:rtc_task_queue",
+ "../../rtc_base:safe_minmax",
+ "../../system_wrappers:field_trial",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/memory" ]
+ seed_corpus = "corpora/audio_processing-corpus"
+}
+
+webrtc_fuzzer_test("audio_processing_sample_rate_fuzzer") {
+ sources = [ "audio_processing_sample_rate_fuzzer.cc" ]
+ deps = [
+ "../../api:scoped_refptr",
+ "../../api/audio:audio_frame_api",
+ "../../modules/audio_processing",
+ "../../modules/audio_processing:api",
+ "../../modules/audio_processing:audio_frame_proxies",
+ "../../modules/audio_processing:audioproc_test_utils",
+ "../../rtc_base:checks",
+ "../../rtc_base:macromagic",
+ "../../rtc_base:safe_minmax",
+ ]
+}
+
+webrtc_fuzzer_test("agc_fuzzer") {
+ sources = [ "agc_fuzzer.cc" ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../modules/audio_processing",
+ "../../modules/audio_processing:api",
+ "../../modules/audio_processing:audio_buffer",
+ "../../rtc_base:macromagic",
+ "../../rtc_base:safe_minmax",
+ ]
+
+ seed_corpus = "corpora/agc-corpus"
+}
+
+webrtc_fuzzer_test("aec3_config_json_fuzzer") {
+ sources = [ "aec3_config_json_fuzzer.cc" ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../api/audio:aec3_config",
+ "../../api/audio:aec3_config_json",
+ ]
+ dict = "//testing/libfuzzer/fuzzers/dicts/json.dict"
+ seed_corpus = "corpora/aec3-config-json-corpus"
+}
+
+webrtc_fuzzer_test("aec3_fuzzer") {
+ defines = []
+ if (apm_debug_dump) {
+ defines += [ "WEBRTC_APM_DEBUG_DUMP=1" ]
+ } else {
+ defines += [ "WEBRTC_APM_DEBUG_DUMP=0" ]
+ }
+ sources = [ "aec3_fuzzer.cc" ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../modules/audio_processing:api",
+ "../../modules/audio_processing:audio_buffer",
+ "../../modules/audio_processing/aec3",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+}
+
+webrtc_fuzzer_test("comfort_noise_decoder_fuzzer") {
+ sources = [ "comfort_noise_decoder_fuzzer.cc" ]
+ deps = [
+ "../../api:array_view",
+ "../../modules/audio_coding:webrtc_cng",
+ "../../rtc_base:buffer",
+ ]
+}
+
+webrtc_fuzzer_test("rtp_depacketizer_av1_assemble_frame_fuzzer") {
+ sources = [ "rtp_depacketizer_av1_assemble_frame_fuzzer.cc" ]
+ seed_corpus = "corpora/rtp-depacketizer-av1-assemble-frame-corpus"
+ deps = [
+ ":fuzz_data_helper",
+ "../../api:array_view",
+ "../../modules/rtp_rtcp",
+ ]
+}
+
+webrtc_fuzzer_test("rtp_dependency_descriptor_fuzzer") {
+ sources = [ "rtp_dependency_descriptor_fuzzer.cc" ]
+ seed_corpus = "corpora/dependency_descriptor-corpus"
+ deps = [
+ "../../api:array_view",
+ "../../common_video/generic_frame_descriptor",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:checks",
+ ]
+}
+
+webrtc_fuzzer_test("rtp_video_layers_allocation_fuzzer") {
+ sources = [ "rtp_video_layers_allocation_fuzzer.cc" ]
+ seed_corpus = "corpora/video_layers_allocation-corpus"
+ deps = [
+ "../../api:array_view",
+ "../../api/video:video_layers_allocation",
+ "../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../rtc_base:checks",
+ ]
+
+ # video_layers_allocation is an rtp header extension and thus can't be longer
+ # than 255 bytes on the wire.
+ libfuzzer_options = [ "max_len=255" ]
+}
+
+webrtc_fuzzer_test("rtp_frame_reference_finder_fuzzer") {
+ sources = [ "rtp_frame_reference_finder_fuzzer.cc" ]
+ deps = [
+ "../../api:rtp_packet_info",
+ "../../api:scoped_refptr",
+ "../../modules/video_coding/",
+ "../../system_wrappers",
+ ]
+}
+
+webrtc_fuzzer_test("frame_buffer2_fuzzer") {
+ sources = [ "frame_buffer2_fuzzer.cc" ]
+ deps = [
+ "../../api/task_queue",
+ "../../modules/video_coding:frame_buffer2",
+ "../../modules/video_coding/timing:timing_module",
+ "../../test:scoped_key_value_config",
+ "../time_controller:time_controller",
+ ]
+}
+
+webrtc_fuzzer_test("frame_buffer_fuzzer") {
+ sources = [ "frame_buffer_fuzzer.cc" ]
+ deps = [
+ ":fuzz_data_helper",
+ "../../api:array_view",
+ "../../api/video:encoded_frame",
+ "../../api/video:frame_buffer",
+ "../../rtc_base:rtc_numerics",
+ "../../test:scoped_key_value_config",
+ ]
+}
+
+webrtc_fuzzer_test("field_trial_fuzzer") {
+ sources = [ "field_trial_fuzzer.cc" ]
+ deps = [ "../../system_wrappers:field_trial" ]
+ seed_corpus = "corpora/field_trial-corpus"
+}
+
+webrtc_fuzzer_test("string_to_number_fuzzer") {
+ sources = [ "string_to_number_fuzzer.cc" ]
+ deps = [ "../../rtc_base:stringutils" ]
+ seed_corpus = "corpora/string_to_number-corpus"
+}
+
+webrtc_fuzzer_test("sctp_utils_fuzzer") {
+ sources = [ "sctp_utils_fuzzer.cc" ]
+ deps = [
+ "../../api:libjingle_peerconnection_api",
+ "../../pc:libjingle_peerconnection",
+ "../../pc:sctp_utils",
+ "../../rtc_base:copy_on_write_buffer",
+ ]
+}
+
+webrtc_fuzzer_test("dcsctp_socket_fuzzer") {
+ sources = [ "dcsctp_socket_fuzzer.cc" ]
+ deps = [
+ "../../net/dcsctp/fuzzers:dcsctp_fuzzers",
+ "../../net/dcsctp/public:socket",
+ "../../net/dcsctp/public:types",
+ "../../net/dcsctp/socket:dcsctp_socket",
+ "../../rtc_base:logging",
+ ]
+}
+
+webrtc_fuzzer_test("ssl_certificate_fuzzer") {
+ sources = [ "ssl_certificate_fuzzer.cc" ]
+ deps = [
+ "../:rtp_test_utils",
+ "../../rtc_base:ssl",
+ "../../rtc_base:stringutils",
+ ]
+}
+
+webrtc_fuzzer_test("vp8_replay_fuzzer") {
+ sources = [ "vp8_replay_fuzzer.cc" ]
+ deps = [ "utils:rtp_replayer" ]
+ seed_corpus = "corpora/rtpdump-corpus/vp8"
+}
+
+if (rtc_build_libvpx) {
+ webrtc_fuzzer_test("vp9_encoder_references_fuzzer") {
+ sources = [ "vp9_encoder_references_fuzzer.cc" ]
+ deps = [
+ "..:test_support",
+ "../../api:array_view",
+ "../../api:field_trials_view",
+ "../../api/video:video_frame",
+ "../../api/video_codecs:video_codecs_api",
+ "../../modules/video_coding:frame_dependencies_calculator",
+ "../../modules/video_coding:webrtc_libvpx_interface",
+ "../../modules/video_coding:webrtc_vp9",
+ "../../rtc_base:safe_compare",
+ rtc_libvpx_dir,
+ ]
+ absl_deps = [
+ "//third_party/abseil-cpp/absl/algorithm:container",
+ "//third_party/abseil-cpp/absl/base:core_headers",
+ "//third_party/abseil-cpp/absl/container:inlined_vector",
+ ]
+ seed_corpus = "corpora/vp9-encoder-references-corpus"
+ defines = [ "RTC_ENABLE_VP9" ]
+ }
+}
+
+webrtc_fuzzer_test("vp9_replay_fuzzer") {
+ sources = [ "vp9_replay_fuzzer.cc" ]
+ deps = [ "utils:rtp_replayer" ]
+ seed_corpus = "corpora/rtpdump-corpus/vp9"
+}
diff --git a/third_party/libwebrtc/test/fuzzers/DEPS b/third_party/libwebrtc/test/fuzzers/DEPS
new file mode 100644
index 0000000000..50b1c8adce
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/DEPS
@@ -0,0 +1,5 @@
+include_rules = [
+ "+audio",
+ "+pc",
+ "+net/dcsctp",
+]
diff --git a/third_party/libwebrtc/test/fuzzers/OWNERS b/third_party/libwebrtc/test/fuzzers/OWNERS
new file mode 100644
index 0000000000..3d97816b3b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/OWNERS
@@ -0,0 +1,3 @@
+danilchap@webrtc.org
+henrik.lundin@webrtc.org
+saza@webrtc.org
diff --git a/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc
new file mode 100644
index 0000000000..626350c52c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <string>
+
+#include "api/audio/echo_canceller3_config.h"
+#include "api/audio/echo_canceller3_config_json.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000) {
+ return;
+ }
+ std::string config_json(reinterpret_cast<const char*>(data), size);
+
+ EchoCanceller3Config config;
+ bool success;
+ Aec3ConfigFromJsonString(config_json, &config, &success);
+ EchoCanceller3Config::Validate(&config);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc
new file mode 100644
index 0000000000..a12ca30f63
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "absl/types/optional.h"
+#include "modules/audio_processing/aec3/echo_canceller3.h"
+#include "modules/audio_processing/audio_buffer.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+using SampleRate = ::webrtc::AudioProcessing::NativeRate;
+
+void PrepareAudioBuffer(int sample_rate_hz,
+ test::FuzzDataHelper* fuzz_data,
+ AudioBuffer* buffer) {
+ float* const* channels = buffer->channels_f();
+ for (size_t i = 0; i < buffer->num_channels(); ++i) {
+ for (size_t j = 0; j < buffer->num_frames(); ++j) {
+ channels[i][j] =
+ static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0));
+ }
+ }
+ if (sample_rate_hz == 32000 || sample_rate_hz == 48000) {
+ buffer->SplitIntoFrequencyBands();
+ }
+}
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 200000) {
+ return;
+ }
+
+ test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+
+ constexpr int kSampleRates[] = {16000, 32000, 48000};
+ const int sample_rate_hz =
+ static_cast<size_t>(fuzz_data.SelectOneOf(kSampleRates));
+
+ constexpr int kMaxNumChannels = 9;
+ const size_t num_render_channels =
+ 1 + fuzz_data.ReadOrDefaultValue<uint8_t>(0) % (kMaxNumChannels - 1);
+ const size_t num_capture_channels =
+ 1 + fuzz_data.ReadOrDefaultValue<uint8_t>(0) % (kMaxNumChannels - 1);
+
+ EchoCanceller3 aec3(EchoCanceller3Config(),
+ /*multichannel_config=*/absl::nullopt, sample_rate_hz,
+ num_render_channels, num_capture_channels);
+
+ AudioBuffer capture_audio(sample_rate_hz, num_capture_channels,
+ sample_rate_hz, num_capture_channels,
+ sample_rate_hz, num_capture_channels);
+ AudioBuffer render_audio(sample_rate_hz, num_render_channels, sample_rate_hz,
+ num_render_channels, sample_rate_hz,
+ num_render_channels);
+
+ // Fuzz frames while there is still fuzzer data.
+ while (fuzz_data.BytesLeft() > 0) {
+ bool is_capture = fuzz_data.ReadOrDefaultValue(true);
+ bool level_changed = fuzz_data.ReadOrDefaultValue(true);
+ if (is_capture) {
+ PrepareAudioBuffer(sample_rate_hz, &fuzz_data, &capture_audio);
+ aec3.ProcessCapture(&capture_audio, level_changed);
+ } else {
+ PrepareAudioBuffer(sample_rate_hz, &fuzz_data, &render_audio);
+ aec3.AnalyzeRender(&render_audio);
+ }
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc
new file mode 100644
index 0000000000..597103993e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/audio_processing/audio_buffer.h"
+#include "modules/audio_processing/gain_control_impl.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "rtc_base/numerics/safe_minmax.h"
+#include "rtc_base/thread_annotations.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+
+void FillAudioBuffer(size_t sample_rate_hz,
+ test::FuzzDataHelper* fuzz_data,
+ AudioBuffer* buffer) {
+ float* const* channels = buffer->channels_f();
+ for (size_t i = 0; i < buffer->num_channels(); ++i) {
+ for (size_t j = 0; j < buffer->num_frames(); ++j) {
+ channels[i][j] =
+ static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0));
+ }
+ }
+
+ if (sample_rate_hz != 16000) {
+ buffer->SplitIntoFrequencyBands();
+ }
+}
+
+// This function calls the GainControl functions that are overriden as private
+// in GainControlInterface.
+void FuzzGainControllerConfig(test::FuzzDataHelper* fuzz_data,
+ GainControl* gc) {
+ GainControl::Mode modes[] = {GainControl::Mode::kAdaptiveAnalog,
+ GainControl::Mode::kAdaptiveDigital,
+ GainControl::Mode::kFixedDigital};
+ GainControl::Mode mode = fuzz_data->SelectOneOf(modes);
+ const bool enable_limiter = fuzz_data->ReadOrDefaultValue(true);
+ // The values are capped to comply with the API of webrtc::GainControl.
+ const int analog_level_min =
+ rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(0), 0, 65534);
+ const int analog_level_max =
+ rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(65535),
+ analog_level_min + 1, 65535);
+ const int stream_analog_level =
+ rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(30000),
+ analog_level_min, analog_level_max);
+ const int gain =
+ rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(30), -1, 100);
+ const int target_level_dbfs =
+ rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(15), -1, 35);
+
+ gc->set_mode(mode);
+ gc->enable_limiter(enable_limiter);
+ if (mode == GainControl::Mode::kAdaptiveAnalog) {
+ gc->set_analog_level_limits(analog_level_min, analog_level_max);
+ gc->set_stream_analog_level(stream_analog_level);
+ }
+ gc->set_compression_gain_db(gain);
+ gc->set_target_level_dbfs(target_level_dbfs);
+
+ static_cast<void>(gc->mode());
+ static_cast<void>(gc->analog_level_minimum());
+ static_cast<void>(gc->analog_level_maximum());
+ static_cast<void>(gc->stream_analog_level());
+ static_cast<void>(gc->compression_gain_db());
+ static_cast<void>(gc->stream_is_saturated());
+ static_cast<void>(gc->target_level_dbfs());
+ static_cast<void>(gc->is_limiter_enabled());
+}
+
+void FuzzGainController(test::FuzzDataHelper* fuzz_data, GainControlImpl* gci) {
+ using Rate = ::webrtc::AudioProcessing::NativeRate;
+ const Rate rate_kinds[] = {Rate::kSampleRate16kHz, Rate::kSampleRate32kHz,
+ Rate::kSampleRate48kHz};
+
+ const auto sample_rate_hz =
+ static_cast<size_t>(fuzz_data->SelectOneOf(rate_kinds));
+ const size_t samples_per_frame = sample_rate_hz / 100;
+ const size_t num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1;
+
+ gci->Initialize(num_channels, sample_rate_hz);
+ FuzzGainControllerConfig(fuzz_data, gci);
+
+ // The audio buffer is used for both capture and render.
+ AudioBuffer audio(sample_rate_hz, num_channels, sample_rate_hz,
+ num_channels, sample_rate_hz, num_channels);
+
+ std::vector<int16_t> packed_render_audio(samples_per_frame);
+
+ while (fuzz_data->CanReadBytes(1)) {
+ FillAudioBuffer(sample_rate_hz, fuzz_data, &audio);
+
+ const bool stream_has_echo = fuzz_data->ReadOrDefaultValue(true);
+ gci->AnalyzeCaptureAudio(audio);
+ gci->ProcessCaptureAudio(&audio, stream_has_echo);
+
+ FillAudioBuffer(sample_rate_hz, fuzz_data, &audio);
+
+ gci->PackRenderAudioBuffer(audio, &packed_render_audio);
+ gci->ProcessRenderAudio(packed_render_audio);
+ }
+}
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 200000) {
+ return;
+ }
+ test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+ auto gci = std::make_unique<GainControlImpl>();
+ FuzzGainController(&fuzz_data, gci.get());
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc
new file mode 100644
index 0000000000..1db332eeb5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+#include <limits>
+
+#include "absl/types/optional.h"
+#include "api/audio_codecs/audio_decoder.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+namespace {
+template <typename T, unsigned int B = sizeof(T)>
+bool ParseInt(const uint8_t** data, size_t* remaining_size, T* value) {
+ static_assert(std::numeric_limits<T>::is_integer, "Type must be an integer.");
+ static_assert(sizeof(T) <= sizeof(uint64_t),
+ "Cannot read wider than uint64_t.");
+ static_assert(B <= sizeof(T), "T must be at least B bytes wide.");
+ if (B > *remaining_size)
+ return false;
+ uint64_t val = ByteReader<uint64_t, B>::ReadBigEndian(*data);
+ *data += B;
+ *remaining_size -= B;
+ *value = static_cast<T>(val);
+ return true;
+}
+} // namespace
+
+// This function reads two bytes from the beginning of `data`, interprets them
+// as the first packet length, and reads this many bytes if available. The
+// payload is inserted into the decoder, and the process continues until no more
+// data is available. Either AudioDecoder::Decode or
+// AudioDecoder::DecodeRedundant is used, depending on the value of
+// `decode_type`.
+void FuzzAudioDecoder(DecoderFunctionType decode_type,
+ const uint8_t* data,
+ size_t size,
+ AudioDecoder* decoder,
+ int sample_rate_hz,
+ size_t max_decoded_bytes,
+ int16_t* decoded) {
+ const uint8_t* data_ptr = data;
+ size_t remaining_size = size;
+ size_t packet_len;
+ constexpr size_t kMaxNumFuzzedPackets = 200;
+ for (size_t num_packets = 0; num_packets < kMaxNumFuzzedPackets;
+ ++num_packets) {
+ if (!(ParseInt<size_t, 2>(&data_ptr, &remaining_size, &packet_len) &&
+ packet_len <= remaining_size)) {
+ break;
+ }
+ AudioDecoder::SpeechType speech_type;
+ switch (decode_type) {
+ case DecoderFunctionType::kNormalDecode:
+ decoder->Decode(data_ptr, packet_len, sample_rate_hz, max_decoded_bytes,
+ decoded, &speech_type);
+ break;
+ case DecoderFunctionType::kRedundantDecode:
+ decoder->DecodeRedundant(data_ptr, packet_len, sample_rate_hz,
+ max_decoded_bytes, decoded, &speech_type);
+ break;
+ }
+ data_ptr += packet_len;
+ remaining_size -= packet_len;
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h
new file mode 100644
index 0000000000..8c5246bb5e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_
+#define TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+namespace webrtc {
+
+class AudioDecoder;
+
+enum class DecoderFunctionType {
+ kNormalDecode,
+ kRedundantDecode,
+};
+
+void FuzzAudioDecoder(DecoderFunctionType decode_type,
+ const uint8_t* data,
+ size_t size,
+ AudioDecoder* decoder,
+ int sample_rate_hz,
+ size_t max_decoded_bytes,
+ int16_t* decoded);
+
+} // namespace webrtc
+
+#endif // TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc
new file mode 100644
index 0000000000..08599aa333
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/g722/audio_decoder_g722.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000 || size < 1) {
+ return;
+ }
+
+ std::unique_ptr<AudioDecoder> dec;
+ size_t num_channels;
+ if (data[0] % 2) {
+ dec = std::make_unique<AudioDecoderG722Impl>();
+ num_channels = 1;
+ } else {
+ dec = std::make_unique<AudioDecoderG722StereoImpl>();
+ num_channels = 2;
+ }
+ // Allocate a maximum output size of 100 ms.
+ const int sample_rate_hz = dec->SampleRateHz();
+ const size_t allocated_ouput_size_samples =
+ sample_rate_hz / 10 * num_channels;
+ std::unique_ptr<int16_t[]> output =
+ std::make_unique<int16_t[]>(allocated_ouput_size_samples);
+ FuzzAudioDecoder(
+ DecoderFunctionType::kNormalDecode, data, size, dec.get(), sample_rate_hz,
+ allocated_ouput_size_samples * sizeof(int16_t), output.get());
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc
new file mode 100644
index 0000000000..8548645c63
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/ilbc/audio_decoder_ilbc.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000) {
+ return;
+ }
+ AudioDecoderIlbcImpl dec;
+ static const int kSampleRateHz = 8000;
+ static const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10;
+ int16_t output[kAllocatedOuputSizeSamples];
+ FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, &dec,
+ kSampleRateHz, sizeof(output), output);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
new file mode 100644
index 0000000000..474a1cdc43
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "api/audio_codecs/opus/audio_decoder_multi_channel_opus.h"
+#include "api/audio_codecs/opus/audio_decoder_multi_channel_opus_config.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+
+AudioDecoderMultiChannelOpusConfig MakeDecoderConfig(
+ int num_channels,
+ int num_streams,
+ int coupled_streams,
+ std::vector<unsigned char> channel_mapping) {
+ AudioDecoderMultiChannelOpusConfig config;
+ config.num_channels = num_channels;
+ config.num_streams = num_streams;
+ config.coupled_streams = coupled_streams;
+ config.channel_mapping = channel_mapping;
+ return config;
+}
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ const std::vector<AudioDecoderMultiChannelOpusConfig> surround_configs = {
+ MakeDecoderConfig(1, 1, 0, {0}), // Mono
+
+ MakeDecoderConfig(2, 2, 0, {0, 0}), // Copy the first (of
+ // 2) decoded streams
+ // into both output
+ // channel 0 and output
+ // channel 1. Ignore
+ // the 2nd decoded
+ // stream.
+
+ MakeDecoderConfig(4, 2, 2, {0, 1, 2, 3}), // Quad.
+ MakeDecoderConfig(6, 4, 2, {0, 4, 1, 2, 3, 5}), // 5.1
+ MakeDecoderConfig(8, 5, 3, {0, 6, 1, 2, 3, 4, 5, 7}) // 7.1
+ };
+
+ const auto config = surround_configs[data[0] % surround_configs.size()];
+ RTC_CHECK(config.IsOk());
+ std::unique_ptr<AudioDecoder> dec =
+ AudioDecoderMultiChannelOpus::MakeAudioDecoder(config);
+ RTC_CHECK(dec);
+ const int kSampleRateHz = 48000;
+ const size_t kAllocatedOuputSizeSamples =
+ 4 * kSampleRateHz / 10; // 4x100 ms, 4 times the size of the output array
+ // for the stereo Opus codec. It should be enough
+ // for 8 channels.
+ int16_t output[kAllocatedOuputSizeSamples];
+ FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, dec.get(),
+ kSampleRateHz, sizeof(output), output);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc
new file mode 100644
index 0000000000..a015f98b5b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/opus/audio_decoder_opus.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ const size_t channels = (size % 2) + 1; // 1 or 2 channels.
+ AudioDecoderOpusImpl dec(channels);
+ const int kSampleRateHz = 48000;
+ const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; // 100 ms.
+ int16_t output[kAllocatedOuputSizeSamples];
+ FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, &dec,
+ kSampleRateHz, sizeof(output), output);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc
new file mode 100644
index 0000000000..efcba0f35d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/opus/audio_decoder_opus.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ const size_t channels = (size % 2) + 1; // 1 or 2 channels.
+ AudioDecoderOpusImpl dec(channels);
+ const int kSampleRateHz = 48000;
+ const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; // 100 ms.
+ int16_t output[kAllocatedOuputSizeSamples];
+ FuzzAudioDecoder(DecoderFunctionType::kRedundantDecode, data, size, &dec,
+ kSampleRateHz, sizeof(output), output);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc
new file mode 100644
index 0000000000..6e5d6e2190
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc
@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/audio_coding/codecs/pcm16b/audio_decoder_pcm16b.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000 || size < 2) {
+ return;
+ }
+
+ int sample_rate_hz;
+ switch (data[0] % 4) {
+ case 0:
+ sample_rate_hz = 8000;
+ break;
+ case 1:
+ sample_rate_hz = 16000;
+ break;
+ case 2:
+ sample_rate_hz = 32000;
+ break;
+ case 3:
+ sample_rate_hz = 48000;
+ break;
+ default:
+ RTC_DCHECK_NOTREACHED();
+ return;
+ }
+ const size_t num_channels = data[1] % 16 + 1;
+
+ // Two first bytes of the data are used. Move forward.
+ data += 2;
+ size -= 2;
+
+ AudioDecoderPcm16B dec(sample_rate_hz, num_channels);
+ // Allocate a maximum output size of 100 ms.
+ const size_t allocated_ouput_size_samples =
+ sample_rate_hz * num_channels / 10;
+ std::unique_ptr<int16_t[]> output =
+ std::make_unique<int16_t[]>(allocated_ouput_size_samples);
+ FuzzAudioDecoder(
+ DecoderFunctionType::kNormalDecode, data, size, &dec, sample_rate_hz,
+ allocated_ouput_size_samples * sizeof(int16_t), output.get());
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc
new file mode 100644
index 0000000000..dbfcaf9976
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/audio_coding/codecs/g711/audio_decoder_pcm.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000 || size < 2) {
+ return;
+ }
+
+ const size_t num_channels = data[0] % 16 + 1;
+
+ std::unique_ptr<AudioDecoder> dec;
+ if (data[1] % 2) {
+ dec = std::make_unique<AudioDecoderPcmU>(num_channels);
+ } else {
+ dec = std::make_unique<AudioDecoderPcmA>(num_channels);
+ }
+
+ // Two first bytes of the data are used. Move forward.
+ data += 2;
+ size -= 2;
+
+ // Allocate a maximum output size of 100 ms.
+ const size_t allocated_ouput_size_samples =
+ dec->SampleRateHz() * num_channels / 10;
+ std::unique_ptr<int16_t[]> output =
+ std::make_unique<int16_t[]>(allocated_ouput_size_samples);
+ FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, dec.get(),
+ dec->SampleRateHz(),
+ allocated_ouput_size_samples * sizeof(int16_t),
+ output.get());
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc
new file mode 100644
index 0000000000..837c26df56
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2020 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/audio_encoder_fuzzer.h"
+
+#include <cstring>
+
+#include "rtc_base/buffer.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+
+// This function reads bytes from `data_view`, interprets them as RTP timestamp
+// and input samples, and sends them for encoding. The process continues until
+// no more data is available.
+void FuzzAudioEncoder(rtc::ArrayView<const uint8_t> data_view,
+ std::unique_ptr<AudioEncoder> encoder) {
+ test::FuzzDataHelper data(data_view);
+ const size_t block_size_samples =
+ encoder->SampleRateHz() / 100 * encoder->NumChannels();
+ const size_t block_size_bytes = block_size_samples * sizeof(int16_t);
+ if (data_view.size() / block_size_bytes > 1000) {
+ // If the size of the fuzzer data is more than 1000 input blocks (i.e., more
+ // than 10 seconds), then don't fuzz at all for the fear of timing out.
+ return;
+ }
+
+ rtc::BufferT<int16_t> input_aligned(block_size_samples);
+ rtc::Buffer encoded;
+
+ // Each round in the loop below will need one block of samples + a 32-bit
+ // timestamp from the fuzzer input.
+ const size_t bytes_to_read = block_size_bytes + sizeof(uint32_t);
+ while (data.CanReadBytes(bytes_to_read)) {
+ const uint32_t timestamp = data.Read<uint32_t>();
+ auto byte_array = data.ReadByteArray(block_size_bytes);
+ // Align the data by copying to another array.
+ RTC_DCHECK_EQ(input_aligned.size() * sizeof(int16_t),
+ byte_array.size() * sizeof(uint8_t));
+ memcpy(input_aligned.data(), byte_array.data(), byte_array.size());
+ auto info = encoder->Encode(timestamp, input_aligned, &encoded);
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h
new file mode 100644
index 0000000000..0c879df4d3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2020 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_
+#define TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_
+
+#include <memory>
+
+#include "api/array_view.h"
+#include "api/audio_codecs/audio_encoder.h"
+
+namespace webrtc {
+
+void FuzzAudioEncoder(rtc::ArrayView<const uint8_t> data_view,
+ std::unique_ptr<AudioEncoder> encoder);
+
+} // namespace webrtc
+
+#endif // TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc
new file mode 100644
index 0000000000..d67e6d6067
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "api/audio_codecs/opus/audio_encoder_opus.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/audio_encoder_fuzzer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ AudioEncoderOpus::Config config;
+ config.frame_size_ms = 20;
+ RTC_CHECK(config.IsOk());
+ constexpr int kPayloadType = 100;
+ FuzzAudioEncoder(
+ /*data_view=*/{data, size},
+ /*encoder=*/AudioEncoderOpus::MakeAudioEncoder(config, kPayloadType));
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc
new file mode 100644
index 0000000000..afcb4318f9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <bitset>
+#include <string>
+
+#include "absl/memory/memory.h"
+#include "api/audio/echo_canceller3_factory.h"
+#include "api/audio/echo_detector_creator.h"
+#include "api/task_queue/default_task_queue_factory.h"
+#include "modules/audio_processing/aec_dump/aec_dump_factory.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "modules/audio_processing/test/audio_processing_builder_for_testing.h"
+#include "rtc_base/arraysize.h"
+#include "rtc_base/numerics/safe_minmax.h"
+#include "rtc_base/task_queue.h"
+#include "system_wrappers/include/field_trial.h"
+#include "test/fuzzers/audio_processing_fuzzer_helper.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+
+const std::string kFieldTrialNames[] = {
+ "WebRTC-Audio-Agc2ForceExtraSaturationMargin",
+ "WebRTC-Audio-Agc2ForceInitialSaturationMargin",
+ "WebRTC-Aec3MinErleDuringOnsetsKillSwitch",
+ "WebRTC-Aec3ShortHeadroomKillSwitch",
+};
+
+rtc::scoped_refptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data,
+ std::string* field_trial_string,
+ rtc::TaskQueue* worker_queue) {
+ // Parse boolean values for optionally enabling different
+ // configurable public components of APM.
+ bool use_ts = fuzz_data->ReadOrDefaultValue(true);
+ bool use_red = fuzz_data->ReadOrDefaultValue(true);
+ bool use_hpf = fuzz_data->ReadOrDefaultValue(true);
+ bool use_aec3 = fuzz_data->ReadOrDefaultValue(true);
+ bool use_aec = fuzz_data->ReadOrDefaultValue(true);
+ bool use_aecm = fuzz_data->ReadOrDefaultValue(true);
+ bool use_agc = fuzz_data->ReadOrDefaultValue(true);
+ bool use_ns = fuzz_data->ReadOrDefaultValue(true);
+ bool use_agc_limiter = fuzz_data->ReadOrDefaultValue(true);
+ bool use_agc2 = fuzz_data->ReadOrDefaultValue(true);
+ bool use_agc2_adaptive_digital = fuzz_data->ReadOrDefaultValue(true);
+
+ // Read a gain value supported by GainController2::Validate().
+ const float gain_controller2_gain_db =
+ fuzz_data->ReadOrDefaultValue<uint8_t>(0) % 50;
+
+ constexpr size_t kNumFieldTrials = arraysize(kFieldTrialNames);
+ // Verify that the read data type has enough bits to fuzz the field trials.
+ using FieldTrialBitmaskType = uint64_t;
+ static_assert(kNumFieldTrials <= sizeof(FieldTrialBitmaskType) * 8,
+ "FieldTrialBitmaskType is not large enough.");
+ std::bitset<kNumFieldTrials> field_trial_bitmask(
+ fuzz_data->ReadOrDefaultValue<FieldTrialBitmaskType>(0));
+ for (size_t i = 0; i < kNumFieldTrials; ++i) {
+ if (field_trial_bitmask[i]) {
+ *field_trial_string += kFieldTrialNames[i] + "/Enabled/";
+ }
+ }
+ field_trial::InitFieldTrialsFromString(field_trial_string->c_str());
+
+ // Ignore a few bytes. Bytes from this segment will be used for
+ // future config flag changes. We assume 40 bytes is enough for
+ // configuring the APM.
+ constexpr size_t kSizeOfConfigSegment = 40;
+ RTC_DCHECK(kSizeOfConfigSegment >= fuzz_data->BytesRead());
+ static_cast<void>(
+ fuzz_data->ReadByteArray(kSizeOfConfigSegment - fuzz_data->BytesRead()));
+
+ // Filter out incompatible settings that lead to CHECK failures.
+ if ((use_aecm && use_aec) || // These settings cause CHECK failure.
+ (use_aecm && use_aec3 && use_ns) // These settings trigger webrtc:9489.
+ ) {
+ return nullptr;
+ }
+
+ std::unique_ptr<EchoControlFactory> echo_control_factory;
+ if (use_aec3) {
+ echo_control_factory.reset(new EchoCanceller3Factory());
+ }
+
+ webrtc::AudioProcessing::Config apm_config;
+ apm_config.pipeline.multi_channel_render = true;
+ apm_config.pipeline.multi_channel_capture = true;
+ apm_config.echo_canceller.enabled = use_aec || use_aecm;
+ apm_config.echo_canceller.mobile_mode = use_aecm;
+ apm_config.high_pass_filter.enabled = use_hpf;
+ apm_config.gain_controller1.enabled = use_agc;
+ apm_config.gain_controller1.enable_limiter = use_agc_limiter;
+ apm_config.gain_controller2.enabled = use_agc2;
+ apm_config.gain_controller2.fixed_digital.gain_db = gain_controller2_gain_db;
+ apm_config.gain_controller2.adaptive_digital.enabled =
+ use_agc2_adaptive_digital;
+ apm_config.noise_suppression.enabled = use_ns;
+ apm_config.transient_suppression.enabled = use_ts;
+
+ rtc::scoped_refptr<AudioProcessing> apm =
+ AudioProcessingBuilderForTesting()
+ .SetEchoControlFactory(std::move(echo_control_factory))
+ .SetEchoDetector(use_red ? CreateEchoDetector() : nullptr)
+ .SetConfig(apm_config)
+ .Create();
+
+#ifdef WEBRTC_LINUX
+ apm->AttachAecDump(AecDumpFactory::Create("/dev/null", -1, worker_queue));
+#endif
+
+ return apm;
+}
+
+TaskQueueFactory* GetTaskQueueFactory() {
+ static TaskQueueFactory* const factory =
+ CreateDefaultTaskQueueFactory().release();
+ return factory;
+}
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 400000) {
+ return;
+ }
+ test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+ // This string must be in scope during execution, according to documentation
+ // for field_trial.h. Hence it's created here and not in CreateApm.
+ std::string field_trial_string = "";
+
+ rtc::TaskQueue worker_queue(GetTaskQueueFactory()->CreateTaskQueue(
+ "rtc-low-prio", rtc::TaskQueue::Priority::LOW));
+ auto apm = CreateApm(&fuzz_data, &field_trial_string, &worker_queue);
+
+ if (apm) {
+ FuzzAudioProcessing(&fuzz_data, std::move(apm));
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc
new file mode 100644
index 0000000000..5252918d77
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc
@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/audio_processing_fuzzer_helper.h"
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <limits>
+
+#include "api/audio/audio_frame.h"
+#include "modules/audio_processing/include/audio_frame_proxies.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+namespace {
+bool ValidForApm(float x) {
+ return std::isfinite(x) && -1.0f <= x && x <= 1.0f;
+}
+
+void GenerateFloatFrame(test::FuzzDataHelper* fuzz_data,
+ int input_rate,
+ int num_channels,
+ float* const* float_frames) {
+ const int samples_per_input_channel =
+ AudioProcessing::GetFrameSize(input_rate);
+ RTC_DCHECK_LE(samples_per_input_channel, 480);
+ for (int i = 0; i < num_channels; ++i) {
+ std::fill(float_frames[i], float_frames[i] + samples_per_input_channel, 0);
+ const size_t read_bytes = sizeof(float) * samples_per_input_channel;
+ if (fuzz_data->CanReadBytes(read_bytes)) {
+ rtc::ArrayView<const uint8_t> byte_array =
+ fuzz_data->ReadByteArray(read_bytes);
+ memmove(float_frames[i], byte_array.begin(), read_bytes);
+ }
+
+ // Sanitize input.
+ for (int j = 0; j < samples_per_input_channel; ++j) {
+ if (!ValidForApm(float_frames[i][j])) {
+ float_frames[i][j] = 0.f;
+ }
+ }
+ }
+}
+
+void GenerateFixedFrame(test::FuzzDataHelper* fuzz_data,
+ int input_rate,
+ int num_channels,
+ AudioFrame* fixed_frame) {
+ const int samples_per_input_channel =
+ AudioProcessing::GetFrameSize(input_rate);
+
+ fixed_frame->samples_per_channel_ = samples_per_input_channel;
+ fixed_frame->sample_rate_hz_ = input_rate;
+ fixed_frame->num_channels_ = num_channels;
+
+ RTC_DCHECK_LE(samples_per_input_channel * num_channels,
+ AudioFrame::kMaxDataSizeSamples);
+ for (int i = 0; i < samples_per_input_channel * num_channels; ++i) {
+ fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue<int16_t>(0);
+ }
+}
+} // namespace
+
+void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data,
+ rtc::scoped_refptr<AudioProcessing> apm) {
+ AudioFrame fixed_frame;
+ // Normal usage is up to 8 channels. Allowing to fuzz one beyond this allows
+ // us to catch implicit assumptions about normal usage.
+ constexpr int kMaxNumChannels = 9;
+ std::array<std::array<float, 480>, kMaxNumChannels> float_frames;
+ std::array<float*, kMaxNumChannels> float_frame_ptrs;
+ for (int i = 0; i < kMaxNumChannels; ++i) {
+ float_frame_ptrs[i] = float_frames[i].data();
+ }
+ float* const* ptr_to_float_frames = &float_frame_ptrs[0];
+
+ constexpr int kSampleRatesHz[] = {8000, 11025, 16000, 22050,
+ 32000, 44100, 48000};
+
+ // We may run out of fuzz data in the middle of a loop iteration. In
+ // that case, default values will be used for the rest of that
+ // iteration.
+ while (fuzz_data->CanReadBytes(1)) {
+ const bool is_float = fuzz_data->ReadOrDefaultValue(true);
+ // Decide input/output rate for this iteration.
+ const int input_rate = fuzz_data->SelectOneOf(kSampleRatesHz);
+ const int output_rate = fuzz_data->SelectOneOf(kSampleRatesHz);
+
+ const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue<uint8_t>(0);
+ // API call needed for AECM to run.
+ apm->set_stream_delay_ms(stream_delay);
+
+ const bool key_pressed = fuzz_data->ReadOrDefaultValue(true);
+ apm->set_stream_key_pressed(key_pressed);
+
+ // Make the APM call depending on capture/render mode and float /
+ // fix interface.
+ const bool is_capture = fuzz_data->ReadOrDefaultValue(true);
+
+ // Fill the arrays with audio samples from the data.
+ int apm_return_code = AudioProcessing::Error::kNoError;
+ if (is_float) {
+ const int num_channels =
+ fuzz_data->ReadOrDefaultValue<uint8_t>(1) % kMaxNumChannels;
+
+ GenerateFloatFrame(fuzz_data, input_rate, num_channels,
+ ptr_to_float_frames);
+ if (is_capture) {
+ apm_return_code = apm->ProcessStream(
+ ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+ StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+ } else {
+ apm_return_code = apm->ProcessReverseStream(
+ ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+ StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+ }
+ } else {
+ const int num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1;
+ GenerateFixedFrame(fuzz_data, input_rate, num_channels, &fixed_frame);
+
+ if (is_capture) {
+ apm_return_code = ProcessAudioFrame(apm.get(), &fixed_frame);
+ } else {
+ apm_return_code = ProcessReverseAudioFrame(apm.get(), &fixed_frame);
+ }
+ }
+
+ // Cover stats gathering code paths.
+ static_cast<void>(apm->GetStatistics(true /*has_remote_tracks*/));
+
+ RTC_DCHECK_NE(apm_return_code, AudioProcessing::kBadDataLengthError);
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h
new file mode 100644
index 0000000000..a604db8cef
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_
+#define TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_
+
+#include <memory>
+
+#include "modules/audio_processing/include/audio_processing.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+namespace webrtc {
+
+void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data,
+ rtc::scoped_refptr<AudioProcessing> apm);
+
+} // namespace webrtc
+
+#endif // TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc
new file mode 100644
index 0000000000..ca3946988c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc
@@ -0,0 +1,162 @@
+/*
+ * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <limits>
+
+#include "modules/audio_processing/include/audio_processing.h"
+#include "modules/audio_processing/test/audio_processing_builder_for_testing.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+constexpr int kMaxNumChannels = 2;
+// APM supported max rate is 384000 Hz, using a limit slightly above lets the
+// fuzzer exercise the handling of too high rates.
+constexpr int kMaxSampleRateHz = 400000;
+constexpr int kMaxSamplesPerChannel = kMaxSampleRateHz / 100;
+
+void GenerateFloatFrame(test::FuzzDataHelper& fuzz_data,
+ int input_rate,
+ int num_channels,
+ float* const* float_frames) {
+ const int samples_per_input_channel =
+ AudioProcessing::GetFrameSize(input_rate);
+ RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel);
+ for (int i = 0; i < num_channels; ++i) {
+ float channel_value;
+ fuzz_data.CopyTo<float>(&channel_value);
+ std::fill(float_frames[i], float_frames[i] + samples_per_input_channel,
+ channel_value);
+ }
+}
+
+void GenerateFixedFrame(test::FuzzDataHelper& fuzz_data,
+ int input_rate,
+ int num_channels,
+ int16_t* fixed_frames) {
+ const int samples_per_input_channel =
+ AudioProcessing::GetFrameSize(input_rate);
+ RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel);
+ // Write interleaved samples.
+ for (int ch = 0; ch < num_channels; ++ch) {
+ const int16_t channel_value = fuzz_data.ReadOrDefaultValue<int16_t>(0);
+ for (int i = ch; i < samples_per_input_channel * num_channels;
+ i += num_channels) {
+ fixed_frames[i] = channel_value;
+ }
+ }
+}
+
+// No-op processor used to influence APM input/output pipeline decisions based
+// on what submodules are present.
+class NoopCustomProcessing : public CustomProcessing {
+ public:
+ NoopCustomProcessing() {}
+ ~NoopCustomProcessing() override {}
+ void Initialize(int sample_rate_hz, int num_channels) override {}
+ void Process(AudioBuffer* audio) override {}
+ std::string ToString() const override { return ""; }
+ void SetRuntimeSetting(AudioProcessing::RuntimeSetting setting) override {}
+};
+} // namespace
+
+// This fuzzer is directed at fuzzing unexpected input and output sample rates
+// of APM. For example, the sample rate 22050 Hz is processed by APM in frames
+// of floor(22050/100) = 220 samples. This is not exactly 10 ms of audio
+// content, and may break assumptions commonly made on the APM frame size.
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 100) {
+ return;
+ }
+ test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+
+ std::unique_ptr<CustomProcessing> capture_processor =
+ fuzz_data.ReadOrDefaultValue(true)
+ ? std::make_unique<NoopCustomProcessing>()
+ : nullptr;
+ std::unique_ptr<CustomProcessing> render_processor =
+ fuzz_data.ReadOrDefaultValue(true)
+ ? std::make_unique<NoopCustomProcessing>()
+ : nullptr;
+ rtc::scoped_refptr<AudioProcessing> apm =
+ AudioProcessingBuilderForTesting()
+ .SetConfig({.pipeline = {.multi_channel_render = true,
+ .multi_channel_capture = true}})
+ .SetCapturePostProcessing(std::move(capture_processor))
+ .SetRenderPreProcessing(std::move(render_processor))
+ .Create();
+ RTC_DCHECK(apm);
+
+ std::array<int16_t, kMaxSamplesPerChannel * kMaxNumChannels> fixed_frame;
+ std::array<std::array<float, kMaxSamplesPerChannel>, kMaxNumChannels>
+ float_frames;
+ std::array<float*, kMaxNumChannels> float_frame_ptrs;
+ for (int i = 0; i < kMaxNumChannels; ++i) {
+ float_frame_ptrs[i] = float_frames[i].data();
+ }
+ float* const* ptr_to_float_frames = &float_frame_ptrs[0];
+
+ // Choose whether to fuzz the float or int16_t interfaces of APM.
+ const bool is_float = fuzz_data.ReadOrDefaultValue(true);
+
+ // We may run out of fuzz data in the middle of a loop iteration. In
+ // that case, default values will be used for the rest of that
+ // iteration.
+ while (fuzz_data.CanReadBytes(1)) {
+ // Decide input/output rate for this iteration.
+ const int input_rate = static_cast<int>(
+ fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz);
+ const int output_rate = static_cast<int>(
+ fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz);
+ const int num_channels = fuzz_data.ReadOrDefaultValue(true) ? 2 : 1;
+
+ // Since render and capture calls have slightly different reinitialization
+ // procedures, we let the fuzzer choose the order.
+ const bool is_capture = fuzz_data.ReadOrDefaultValue(true);
+
+ int apm_return_code = AudioProcessing::Error::kNoError;
+ if (is_float) {
+ GenerateFloatFrame(fuzz_data, input_rate, num_channels,
+ ptr_to_float_frames);
+
+ if (is_capture) {
+ apm_return_code = apm->ProcessStream(
+ ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+ StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+ } else {
+ apm_return_code = apm->ProcessReverseStream(
+ ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+ StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+ }
+ } else {
+ GenerateFixedFrame(fuzz_data, input_rate, num_channels,
+ fixed_frame.data());
+
+ if (is_capture) {
+ apm_return_code = apm->ProcessStream(
+ fixed_frame.data(), StreamConfig(input_rate, num_channels),
+ StreamConfig(output_rate, num_channels), fixed_frame.data());
+ } else {
+ apm_return_code = apm->ProcessReverseStream(
+ fixed_frame.data(), StreamConfig(input_rate, num_channels),
+ StreamConfig(output_rate, num_channels), fixed_frame.data());
+ }
+ }
+ // APM may flag an error on unsupported audio formats, but should not crash.
+ RTC_DCHECK(apm_return_code == AudioProcessing::kNoError ||
+ apm_return_code == AudioProcessing::kBadSampleRateError);
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc
new file mode 100644
index 0000000000..7f44af99fb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "api/array_view.h"
+#include "modules/audio_coding/codecs/cng/webrtc_cng.h"
+#include "rtc_base/buffer.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace test {
+namespace {
+
+void FuzzOneInputTest(rtc::ArrayView<const uint8_t> data) {
+ FuzzDataHelper fuzz_data(data);
+ ComfortNoiseDecoder cng_decoder;
+
+ while (1) {
+ if (!fuzz_data.CanReadBytes(1))
+ break;
+ const uint8_t sid_frame_len = fuzz_data.Read<uint8_t>();
+ auto sid_frame = fuzz_data.ReadByteArray(sid_frame_len);
+ if (sid_frame.empty())
+ break;
+ cng_decoder.UpdateSid(sid_frame);
+ if (!fuzz_data.CanReadBytes(3))
+ break;
+ constexpr bool kTrueOrFalse[] = {true, false};
+ const bool new_period = fuzz_data.SelectOneOf(kTrueOrFalse);
+ constexpr size_t kOutputSizes[] = {80, 160, 320, 480};
+ const size_t output_size = fuzz_data.SelectOneOf(kOutputSizes);
+ const size_t num_generate_calls =
+ std::min(fuzz_data.Read<uint8_t>(), static_cast<uint8_t>(17));
+ rtc::BufferT<int16_t> output(output_size);
+ for (size_t i = 0; i < num_generate_calls; ++i) {
+ cng_decoder.Generate(output, new_period);
+ }
+ }
+}
+
+} // namespace
+} // namespace test
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 5000) {
+ return;
+ }
+ test::FuzzOneInputTest(rtc::ArrayView<const uint8_t>(data, size));
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json
new file mode 100644
index 0000000000..59b5db9446
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json
@@ -0,0 +1,151 @@
+[
+ {
+ "decoders" : [
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "1"
+ },
+ {
+ "profile-level-id" : "42001f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 100
+ },
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "0"
+ },
+ {
+ "profile-level-id" : "42001f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 102
+ },
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "1"
+ },
+ {
+ "profile-level-id" : "42e01f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 127
+ },
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "0"
+ },
+ {
+ "profile-level-id" : "42e01f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 125
+ },
+ {
+ "codec_params" : [],
+ "payload_name" : "VP8",
+ "payload_type" : 96
+ },
+ {
+ "codec_params" : [],
+ "payload_name" : "VP9",
+ "payload_type" : 98
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [
+ {
+ "encrypt" : false,
+ "id" : 5,
+ "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+ },
+ {
+ "encrypt" : false,
+ "id" : 3,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time"
+ },
+ {
+ "encrypt" : false,
+ "id" : 6,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay"
+ },
+ {
+ "encrypt" : false,
+ "id" : 7,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type"
+ },
+ {
+ "encrypt" : false,
+ "id" : 8,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing"
+ },
+ {
+ "encrypt" : false,
+ "id" : 4,
+ "uri" : "urn:3gpp:video-orientation"
+ },
+ {
+ "encrypt" : false,
+ "id" : 2,
+ "uri" : "urn:ietf:params:rtp-hdrext:toffset"
+ }
+ ],
+ "local_ssrc" : 1,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : -1,
+ "remb" : true,
+ "remote_ssrc" : 2736493666,
+ "rtcp_mode" : "RtcpMode::kReducedSize",
+ "rtx_payload_types" : [
+ {
+ "97" : 96
+ },
+ {
+ "99" : 98
+ },
+ {
+ "101" : 100
+ },
+ {
+ "107" : 125
+ },
+ {
+ "122" : 127
+ },
+ {
+ "123" : 102
+ }
+ ],
+ "rtx_ssrc" : 885796452,
+ "transport_cc" : true,
+ "ulpfec_payload_type" : -1
+ },
+ "target_delay_ms" : 0
+ }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json
new file mode 100644
index 0000000000..9cb5bd767b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json
@@ -0,0 +1,66 @@
+[
+ {
+ "decoders" : [
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "0"
+ },
+ {
+ "packetization-mode" : "0"
+ },
+ {
+ "profile-level-id" : "42001f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 100
+ },
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "1"
+ },
+ {
+ "profile-level-id" : "42e01f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 102
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [],
+ "local_ssrc" : 1,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : 125,
+ "remb" : true,
+ "remote_ssrc" : 1989790381,
+ "rtcp_mode" : "RtcpMode::kReducedSize",
+ "rtx_payload_types" : [
+ {
+ "101" : 100
+ },
+ {
+ "122" : 125
+ },
+ {
+ "123" : 127
+ }
+ ],
+ "rtx_ssrc" : 1406083315,
+ "transport_cc" : true,
+ "ulpfec_payload_type" : -1
+ },
+ "target_delay_ms" : 0
+ }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json
new file mode 100644
index 0000000000..f3ae6bbafc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json
@@ -0,0 +1,66 @@
+[
+ {
+ "decoders" : [
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "1"
+ },
+ {
+ "profile-level-id" : "42001f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 100
+ },
+ {
+ "codec_params" : [
+ {
+ "level-asymmetry-allowed" : "1"
+ },
+ {
+ "packetization-mode" : "1"
+ },
+ {
+ "profile-level-id" : "42e01f"
+ }
+ ],
+ "payload_name" : "H264",
+ "payload_type" : 102
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [],
+ "local_ssrc" : 1,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : 125,
+ "remb" : true,
+ "remote_ssrc" : 1989790381,
+ "rtcp_mode" : "RtcpMode::kReducedSize",
+ "rtx_payload_types" : [
+ {
+ "101" : 100
+ },
+ {
+ "122" : 125
+ },
+ {
+ "123" : 127
+ }
+ ],
+ "rtx_ssrc" : 1406083315,
+ "transport_cc" : true,
+ "ulpfec_payload_type" : -1
+ },
+ "target_delay_ms" : 0
+ }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json
new file mode 100644
index 0000000000..0a5eef8b09
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json
@@ -0,0 +1,29 @@
+[{
+ "decoders" : [
+ {
+ "codec_params" : [],
+ "payload_name" : "VP8",
+ "payload_type" : 125
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [],
+ "local_ssrc" : 7331,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : -1,
+ "remb" : true,
+ "remote_ssrc" : 1337,
+ "rtcp_mode" : "RtcpMode::kCompound",
+ "rtx_payload_types" : [],
+ "rtx_ssrc" : 100,
+ "transport_cc" : true,
+ "ulpfec_payload_type" : -1
+ },
+ "target_delay_ms" : 0
+}]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json
new file mode 100644
index 0000000000..3d2b66301d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json
@@ -0,0 +1,73 @@
+[
+ {
+ "decoders" : [
+ {
+ "codec_params" : [],
+ "payload_name" : "VP8",
+ "payload_type" : 96
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [
+ {
+ "encrypt" : false,
+ "id" : 5,
+ "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+ },
+ {
+ "encrypt" : false,
+ "id" : 3,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time"
+ },
+ {
+ "encrypt" : false,
+ "id" : 6,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay"
+ },
+ {
+ "encrypt" : false,
+ "id" : 7,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type"
+ },
+ {
+ "encrypt" : false,
+ "id" : 8,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing"
+ },
+ {
+ "encrypt" : false,
+ "id" : 4,
+ "uri" : "urn:3gpp:video-orientation"
+ },
+ {
+ "encrypt" : false,
+ "id" : 2,
+ "uri" : "urn:ietf:params:rtp-hdrext:toffset"
+ }
+ ],
+ "local_ssrc" : 1,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : -1,
+ "remb" : true,
+ "remote_ssrc" : 2672243158,
+ "rtcp_mode" : "RtcpMode::kReducedSize",
+ "rtx_payload_types" : [
+ {
+ "97" : 96
+ },
+ {
+ "99" : 98
+ }
+ ],
+ "rtx_ssrc" : 1807563126,
+ "transport_cc" : true
+ },
+ "target_delay_ms" : 0
+ }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json
new file mode 100644
index 0000000000..a9c88a2402
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json
@@ -0,0 +1,29 @@
+[{
+ "decoders" : [
+ {
+ "codec_params" : [],
+ "payload_name" : "VP9",
+ "payload_type" : 124
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [],
+ "local_ssrc" : 7331,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : -1,
+ "remb" : true,
+ "remote_ssrc" : 1337,
+ "rtcp_mode" : "RtcpMode::kCompound",
+ "rtx_payload_types" : [],
+ "rtx_ssrc" : 100,
+ "transport_cc" : true,
+ "ulpfec_payload_type" : -1
+ },
+ "target_delay_ms" : 0
+}]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json
new file mode 100644
index 0000000000..d089aa8fec
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json
@@ -0,0 +1,79 @@
+[
+ {
+ "decoders" : [
+ {
+ "codec_params" : [],
+ "payload_name" : "VP9",
+ "payload_type" : 98
+ },
+ {
+ "codec_params" : [],
+ "payload_name" : "VP8",
+ "payload_type" : 96
+ }
+ ],
+ "render_delay_ms" : 10,
+ "rtp" : {
+ "extensions" : [
+ {
+ "encrypt" : false,
+ "id" : 5,
+ "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+ },
+ {
+ "encrypt" : false,
+ "id" : 3,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time"
+ },
+ {
+ "encrypt" : false,
+ "id" : 6,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay"
+ },
+ {
+ "encrypt" : false,
+ "id" : 7,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type"
+ },
+ {
+ "encrypt" : false,
+ "id" : 8,
+ "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing"
+ },
+ {
+ "encrypt" : false,
+ "id" : 4,
+ "uri" : "urn:3gpp:video-orientation"
+ },
+ {
+ "encrypt" : false,
+ "id" : 2,
+ "uri" : "urn:ietf:params:rtp-hdrext:toffset"
+ }
+ ],
+ "local_ssrc" : 1,
+ "lntf" : {
+ "enabled": false,
+ },
+ "nack" : {
+ "rtp_history_ms" : 1000
+ },
+ "red_payload_type" : -1,
+ "remb" : true,
+ "remote_ssrc" : 2678204013,
+ "rtcp_mode" : "RtcpMode::kReducedSize",
+ "rtx_payload_types" : [
+ {
+ "97" : 96
+ },
+ {
+ "99" : 98
+ }
+ ],
+ "rtx_ssrc" : 1110725867,
+ "transport_cc" : true,
+ "ulpfec_payload_type" : -1
+ },
+ "target_delay_ms" : 0
+ }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc
new file mode 100644
index 0000000000..e266b85fa4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "absl/functional/bind_front.h"
+#include "modules/congestion_controller/include/receive_side_congestion_controller.h"
+#include "modules/pacing/packet_router.h"
+#include "modules/remote_bitrate_estimator/include/remote_bitrate_estimator.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ size_t i = 0;
+ if (size < sizeof(int64_t) + sizeof(uint8_t) + sizeof(uint32_t))
+ return;
+ SimulatedClock clock(data[i++]);
+ PacketRouter packet_router;
+ ReceiveSideCongestionController cc(
+ &clock,
+ absl::bind_front(&PacketRouter::SendCombinedRtcpPacket, &packet_router),
+ absl::bind_front(&PacketRouter::SendRemb, &packet_router), nullptr);
+ RTPHeader header;
+ header.ssrc = ByteReader<uint32_t>::ReadBigEndian(&data[i]);
+ i += sizeof(uint32_t);
+ header.extension.hasTransportSequenceNumber = true;
+ int64_t arrival_time_ms = std::min<int64_t>(
+ std::max<int64_t>(ByteReader<int64_t>::ReadBigEndian(&data[i]), 0),
+ std::numeric_limits<int64_t>::max() / 2);
+ i += sizeof(int64_t);
+ const size_t kMinPacketSize =
+ sizeof(size_t) + sizeof(uint16_t) + sizeof(uint8_t);
+ while (i + kMinPacketSize < size) {
+ size_t payload_size = ByteReader<size_t>::ReadBigEndian(&data[i]) % 1500;
+ i += sizeof(size_t);
+ header.extension.transportSequenceNumber =
+ ByteReader<uint16_t>::ReadBigEndian(&data[i]);
+ i += sizeof(uint16_t);
+ cc.OnReceivedPacket(arrival_time_ms, payload_size, header);
+ clock.AdvanceTimeMilliseconds(5);
+ arrival_time_ms += ByteReader<uint8_t>::ReadBigEndian(&data[i]);
+ i += sizeof(uint8_t);
+ cc.MaybeProcess();
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/README b/third_party/libwebrtc/test/fuzzers/corpora/README
new file mode 100644
index 0000000000..cc87025ff6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/README
@@ -0,0 +1,37 @@
+This is a collection of corpora for various WebRTC fuzzers. To use
+them, the gn targets define seed_corpus=$corpus_dir, which causes the
+ClusterFuzz upload bot to bundle $corpus_dir and upload it.
+
+The format is simple: one file per test case. Specific notes are
+included below.
+
+### SDP ###
+This corpus was initially assembled manually from the following
+sources:
+
+ - curl --silent https://www.ietf.org/rfc/rfc4317.txt | grep '^[ a-z]*=[^=]*$' | sed 's/^[[:space:]]*//' | awk -v RS='(^|\n)v=' '/./ {print "v="$0 > NR".sdp"}'
+ - all the SDPs used in the parser unit tests
+ - some manually gathered SDPs from Firefox and Opera
+
+The SDP tokens come from:
+
+ - grep "^static const " webrtc/api/webrtcsdp.cc | cut -d'=' -f2 | cut -d ';' -f1 | tr -d '"' | tr -d "'" | tr -d ' ' | sort -u | grep -v '^(\n|\r|\r\n)$|^$' | sed -e 's/^/"/' -e 's/$/"/' | tail -n +2
+
+### STUN ###
+This corpus was initially assembled from the STUN unit tests, together
+with a crash that it found relatively quickly.
+
+### RT(C)P ###
+This corpus was initially assembled from the unittests. RTCP was
+minimised first.
+
+There is also rt(c?)p-corpus-with-extra-byte, in which each sample is
+prefixed by the byte 0xff. Some of the rtp fuzzers need to decide
+which header extensions to enable, and the first byte of the fuzz data
+is used for this.
+
+### PseudoTCP ###
+Very small corpus minimised from the unit tests.
+
+### SCTP ###
+This corpus was extracted from a few manually recorder wireshark dumps.
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json b/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json
new file mode 100644
index 0000000000..4dcbcee53a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json
@@ -0,0 +1 @@
+{"aec3": {"buffering": {"excess_render_detection_interval_blocks": 250,"max_allowed_excess_render_blocks": 8},"delay": {"default_delay": 5,"down_sampling_factor": 4,"num_filters": 5,"delay_headroom_samples": 32,"hysteresis_limit_blocks": 1,"fixed_capture_delay_samples": 0,"delay_estimate_smoothing": 0.7,"delay_candidate_detection_threshold": 0.2,"delay_selection_thresholds": {"initial": 5,"converged": 20},"use_external_delay_estimator": false,"downmix_before_delay_estimation": true,"log_warning_on_delay_changes": false},"filter": {"main": [13,5e-05,0.05,0.001,2,2.00753e+07],"shadow": [13,0.7,2.00753e+07],"main_initial": [12,0.005,0.5,0.001,2,2.00753e+07],"shadow_initial": [12,0.9,2.00753e+07],"config_change_duration_blocks": 250,"initial_state_seconds": 2.5,"conservative_initial_phase": false,"enable_shadow_filter_output_usage": true},"erle": {"min": 1,"max_l": 4,"max_h": 1.5,"onset_detection": true,"num_sections": 1,"clamp_quality_estimate_to_zero": true,"clamp_quality_estimate_to_one": true},"ep_strength": {"default_gain": 1,"default_len": 0.83,"echo_can_saturate": true,"bounded_erl": false},"echo_audibility": {"low_render_limit": 256,"normal_render_limit": 64,"floor_power": 128,"audibility_threshold_lf": 10,"audibility_threshold_mf": 10,"audibility_threshold_hf": 10,"use_stationarity_properties": false,"use_stationarity_properties_at_init": false},"render_levels": {"active_render_limit": 100,"poor_excitation_render_limit": 150,"poor_excitation_render_limit_ds8": 20},"echo_removal_control": {"has_clock_drift": false,"linear_and_stable_echo_path": false},"echo_model": {"noise_floor_hold": 50,"min_noise_floor_power": 1.6384e+06,"stationary_gate_slope": 10,"noise_gate_power": 27509.4,"noise_gate_slope": 0.3,"render_pre_window_size": 1,"render_post_window_size": 1},"suppressor": {"nearend_average_blocks": 4,"normal_tuning": {"mask_lf": [0.3,0.4,0.3],"mask_hf": [0.07,0.1,0.3],"max_inc_factor": 2,"max_dec_factor_lf": 0.25},"nearend_tuning": {"mask_lf": [1.09,1.1,0.3],"mask_hf": [0.1,0.3,0.3],"max_inc_factor": 2,"max_dec_factor_lf": 0.25},"dominant_nearend_detection": {"enr_threshold": 0.25,"enr_exit_threshold": 10,"snr_threshold": 30,"hold_duration": 50,"trigger_threshold": 12,"use_during_initial_phase": 1},"high_bands_suppression": {"enr_threshold": 1,"max_gain_during_echo": 1},"floor_first_increase": 1e-05,"enforce_transparent": false,"enforce_empty_higher_bands": false}}}
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1
new file mode 100644
index 0000000000..cda107c534
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2
new file mode 100644
index 0000000000..bf1a98dccd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3
new file mode 100644
index 0000000000..f28283502a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4
new file mode 100644
index 0000000000..7b5d1cd790
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0
new file mode 100644
index 0000000000..da32f0c29c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1
new file mode 100644
index 0000000000..097af39c3f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2
new file mode 100644
index 0000000000..a9f4011d3f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3
new file mode 100644
index 0000000000..b4ba1578cd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0
new file mode 100644
index 0000000000..fc56e0e591
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1
new file mode 100644
index 0000000000..b5c147f9f3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10
new file mode 100644
index 0000000000..ced48741aa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11
new file mode 100644
index 0000000000..53afe97468
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11
@@ -0,0 +1 @@
+ÿÿÿÿÿ°Ë±±o \ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12
new file mode 100644
index 0000000000..4d126eacc3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13
new file mode 100644
index 0000000000..847e67b79a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14
new file mode 100644
index 0000000000..f5efdd1317
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15
new file mode 100644
index 0000000000..830dc8a679
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16
new file mode 100644
index 0000000000..06017917dc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2
new file mode 100644
index 0000000000..43cf72619c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3
new file mode 100644
index 0000000000..a2e8e0c9ae
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4
new file mode 100644
index 0000000000..ff5785f0c3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5
new file mode 100644
index 0000000000..f1196c98aa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6
new file mode 100644
index 0000000000..88ce0a1600
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7
new file mode 100644
index 0000000000..9adb5c2125
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8
new file mode 100644
index 0000000000..5a8f929a61
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8
@@ -0,0 +1,2 @@
+ÿÿÿÞ
+‚ÿ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9
new file mode 100644
index 0000000000..bde1b127b3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0
new file mode 100644
index 0000000000..73e1d22f10
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0
@@ -0,0 +1 @@
+WebRTC-DecoderDataDumpDirectory/Enabled/
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1
new file mode 100644
index 0000000000..997888a6fd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1
@@ -0,0 +1 @@
+WebRTC-DecoderDataDumpDirectory/Disabled/
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2
new file mode 100644
index 0000000000..7e897a418d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2
@@ -0,0 +1 @@
+WebRTC-DecoderDataDumpDirectory/Disabled/WebRTC-IPv6Default/Enabled/
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0
new file mode 100644
index 0000000000..dbe089f278
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1 b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1
new file mode 100644
index 0000000000..dcb9c476f0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns
new file mode 100644
index 0000000000..6e1789a83b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns
new file mode 100644
index 0000000000..f5fa6f8d17
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns
new file mode 100644
index 0000000000..f72f28c13c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns
new file mode 100644
index 0000000000..9efa76d64a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns
new file mode 100644
index 0000000000..538a5a62dc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns
new file mode 100644
index 0000000000..d4ce4efea8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns
new file mode 100644
index 0000000000..ff2810565b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns
new file mode 100644
index 0000000000..a1a02d7f8e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns
new file mode 100644
index 0000000000..ba30f7bc2f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns
new file mode 100644
index 0000000000..7cbdd3e7a0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns
new file mode 100644
index 0000000000..f70eaa3ab2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns
new file mode 100644
index 0000000000..7d259c2ea9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns
new file mode 100644
index 0000000000..6681f943e4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns
new file mode 100644
index 0000000000..3ac4fd6c98
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns
new file mode 100644
index 0000000000..3207842f48
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns
new file mode 100644
index 0000000000..871ea41405
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns
new file mode 100644
index 0000000000..ee2f8eca1c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns
new file mode 100644
index 0000000000..d37b935654
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns
new file mode 100644
index 0000000000..dd2f976afd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns
new file mode 100644
index 0000000000..a01e729342
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511 b/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511
new file mode 100644
index 0000000000..21f5cffa12
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp
new file mode 100644
index 0000000000..802eecf052
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp
new file mode 100644
index 0000000000..c062793b3c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp
new file mode 100644
index 0000000000..fdc7780218
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp
new file mode 100644
index 0000000000..994f721dca
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp
new file mode 100644
index 0000000000..557fe9c23a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp
new file mode 100644
index 0000000000..0f1b1809a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp
new file mode 100644
index 0000000000..df6bfed86c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp
new file mode 100644
index 0000000000..3b31b3079d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp
new file mode 100644
index 0000000000..0496ddf910
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp
new file mode 100644
index 0000000000..755b7198ba
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp
new file mode 100644
index 0000000000..04fd1e3417
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp
new file mode 100644
index 0000000000..8ae9812f10
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp
new file mode 100644
index 0000000000..ba38a0a599
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp
new file mode 100644
index 0000000000..debb7de940
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp
new file mode 100644
index 0000000000..3fcbd405e2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp
new file mode 100644
index 0000000000..3defd8c253
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp
new file mode 100644
index 0000000000..211ccbd5be
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp
new file mode 100644
index 0000000000..8ded9be7fd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp
new file mode 100644
index 0000000000..b5c8146cef
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp
new file mode 100644
index 0000000000..0fd4f25511
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp
new file mode 100644
index 0000000000..2c8bb63c9c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp
new file mode 100644
index 0000000000..6a20bc27d8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp
new file mode 100644
index 0000000000..76fd214197
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp
new file mode 100644
index 0000000000..72307e08bd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp
new file mode 100644
index 0000000000..cfa38faa67
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp
new file mode 100644
index 0000000000..8abf725057
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp
new file mode 100644
index 0000000000..76518c88dd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp
new file mode 100644
index 0000000000..92964965a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp
new file mode 100644
index 0000000000..9045c158b5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp
new file mode 100644
index 0000000000..f86df02448
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp
new file mode 100644
index 0000000000..d274d416a2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp
new file mode 100644
index 0000000000..b4f04f4069
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp
new file mode 100644
index 0000000000..8d65e0ff35
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp
new file mode 100644
index 0000000000..fb969f85f0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp
new file mode 100644
index 0000000000..5170185122
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp
new file mode 100644
index 0000000000..279047c6b2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp
new file mode 100644
index 0000000000..09a8a589bd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp
new file mode 100644
index 0000000000..f727b190a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp
new file mode 100644
index 0000000000..9aab33a48a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp
new file mode 100644
index 0000000000..2eba529c3a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp
new file mode 100644
index 0000000000..50c0beabed
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp
new file mode 100644
index 0000000000..2de424a5d1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp
new file mode 100644
index 0000000000..71d530b41f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp
@@ -0,0 +1 @@
+€ \ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp
new file mode 100644
index 0000000000..665695029a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp
new file mode 100644
index 0000000000..33b0f3d873
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp
new file mode 100644
index 0000000000..46bef3242a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp
new file mode 100644
index 0000000000..5bec125397
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp
new file mode 100644
index 0000000000..ff94fb84b7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp
new file mode 100644
index 0000000000..55cc76cd81
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp
new file mode 100644
index 0000000000..ac11523c94
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp
new file mode 100644
index 0000000000..f3f0bb8fa1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp
new file mode 100644
index 0000000000..f0012f1efa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp
new file mode 100644
index 0000000000..61517f01d8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp
new file mode 100644
index 0000000000..3688310a05
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp
new file mode 100644
index 0000000000..e914f83b16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp
new file mode 100644
index 0000000000..dcad8f6b40
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp
new file mode 100644
index 0000000000..8e999e7832
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp
new file mode 100644
index 0000000000..eb38d237aa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp
new file mode 100644
index 0000000000..6df94b715f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp
new file mode 100644
index 0000000000..a3b2acb3a8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp
new file mode 100644
index 0000000000..4d50c0f4ae
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp
new file mode 100644
index 0000000000..537d10c6ce
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp
new file mode 100644
index 0000000000..f280f3ca09
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp
new file mode 100644
index 0000000000..f8f74e12c6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp
new file mode 100644
index 0000000000..f0ceba83f4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp
new file mode 100644
index 0000000000..7cc07893c3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0
new file mode 100644
index 0000000000..c93ce82ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1
new file mode 100644
index 0000000000..84834aefea
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2
new file mode 100644
index 0000000000..3a5aedba9b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3
new file mode 100644
index 0000000000..300309ff37
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4
new file mode 100644
index 0000000000..84834aefea
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5
new file mode 100644
index 0000000000..7dd6632007
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6
new file mode 100644
index 0000000000..3a1145cd0f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7
new file mode 100644
index 0000000000..6c4a9feb52
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8
new file mode 100644
index 0000000000..4b069389b1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0
new file mode 100644
index 0000000000..540a770e29
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0
@@ -0,0 +1 @@
+ô0ÿÿÿ¸¸¸ \ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump
new file mode 100644
index 0000000000..328559820d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump
new file mode 100644
index 0000000000..4dc780cd16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin
new file mode 100644
index 0000000000..4374f5aad5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin
new file mode 100644
index 0000000000..1f1d0be301
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin
new file mode 100644
index 0000000000..21a0c22837
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin
new file mode 100644
index 0000000000..fc8600106e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin
new file mode 100644
index 0000000000..bec7b289e7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin
new file mode 100644
index 0000000000..ab98a0a4a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin
new file mode 100644
index 0000000000..59200abe5e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin
new file mode 100644
index 0000000000..cef8cfe929
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin
new file mode 100644
index 0000000000..80438434d0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin
new file mode 100644
index 0000000000..3fb4977d58
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin
new file mode 100644
index 0000000000..74c74f3377
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin
new file mode 100644
index 0000000000..fe4de63863
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin
new file mode 100644
index 0000000000..08494c1515
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp
new file mode 100644
index 0000000000..36319c4476
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp
new file mode 100644
index 0000000000..c3dbce401f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 49174 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp
new file mode 100644
index 0000000000..26d4ff6266
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp
new file mode 100644
index 0000000000..f625e3890c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 49170 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp
new file mode 100644
index 0000000000..c36b9fe6cb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 newhost.biloxi.example.com
+t=0 0
+m=audio 49178 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 49188 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp
new file mode 100644
index 0000000000..26d4ff6266
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp
new file mode 100644
index 0000000000..1d187a0dc5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp
@@ -0,0 +1,10 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=audio 51372 RTP/AVP 97 101
+a=rtpmap:97 iLBC/8000
+a=rtpmap:101 telephone-event/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp
new file mode 100644
index 0000000000..a328d16a16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 0 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=audio 49170 RTP/AVP 97 101
+a=rtpmap:97 iLBC/8000
+a=rtpmap:101 telephone-event/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp
new file mode 100644
index 0000000000..1e0d3f5705
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp
new file mode 100644
index 0000000000..a9a5e12138
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51374 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp
new file mode 100644
index 0000000000..b2c072af1d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp
@@ -0,0 +1,10 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp
new file mode 100644
index 0000000000..28e949133e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51374 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp
new file mode 100644
index 0000000000..36c7d70148
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49172 RTP/AVP 32
+c=IN IP4 otherhost.biloxi.example.com
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp
new file mode 100644
index 0000000000..6cf5dc5894
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp
@@ -0,0 +1,8 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp
new file mode 100644
index 0000000000..ac1ec85b29
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp
@@ -0,0 +1,8 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 placeholder.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp
new file mode 100644
index 0000000000..f0eb0d62a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp
new file mode 100644
index 0000000000..1e4f3b3e19
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49178 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp
new file mode 100644
index 0000000000..36319c4476
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp
new file mode 100644
index 0000000000..c3dbce401f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 49174 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp
new file mode 100644
index 0000000000..b0142f5dcf
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49170 RTP/AVP 32
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp
new file mode 100644
index 0000000000..0798631d2e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp
@@ -0,0 +1,11 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+a=sendonly
+m=audio 49174 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp
new file mode 100644
index 0000000000..78efdd8fcb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp
new file mode 100644
index 0000000000..6cf5dc5894
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp
@@ -0,0 +1,8 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp
new file mode 100644
index 0000000000..23f462f5a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp
new file mode 100644
index 0000000000..b52b947486
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp
@@ -0,0 +1,11 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 48282 RTP/AVP 98
+c=IN IP4 mediaserver.biloxi.example.com
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp
new file mode 100644
index 0000000000..07ad4f8758
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+c=IN IP4 host.atlanta.example.com
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp
new file mode 100644
index 0000000000..c75c6977bb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp
new file mode 100644
index 0000000000..d05dbd61fd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp
new file mode 100644
index 0000000000..253ac0705a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49172 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp
new file mode 100644
index 0000000000..57d3203c74
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49168 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp
new file mode 100644
index 0000000000..26d4ff6266
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp
new file mode 100644
index 0000000000..f625e3890c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 49170 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp
new file mode 100644
index 0000000000..2dda9bb252
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp
new file mode 100644
index 0000000000..83a2bf9e66
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp
new file mode 100644
index 0000000000..e187d7df7d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp
@@ -0,0 +1,5 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp
new file mode 100644
index 0000000000..9e344f035a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp
@@ -0,0 +1,5 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp
new file mode 100644
index 0000000000..8a63ca0992
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp
new file mode 100644
index 0000000000..66dadbb93f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp
new file mode 100644
index 0000000000..6df76ab942
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 0.0.0.0
+t=0 0
+m=audio 23442 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp
new file mode 100644
index 0000000000..23f462f5a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp
new file mode 100644
index 0000000000..264ab8024f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0 8
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp
new file mode 100644
index 0000000000..8a63ca0992
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp
new file mode 100644
index 0000000000..23f462f5a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp
new file mode 100644
index 0000000000..7c1730eb1e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp
new file mode 100644
index 0000000000..599157691a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 0.0.0.0
+t=0 0
+m=audio 9322 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp
new file mode 100644
index 0000000000..66dadbb93f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp
new file mode 100644
index 0000000000..bd724c471b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp
@@ -0,0 +1,8 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp
new file mode 100644
index 0000000000..3f80345e30
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 51372 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp
new file mode 100644
index 0000000000..920ad8229e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp
new file mode 100644
index 0000000000..a9a5e12138
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51374 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp
new file mode 100644
index 0000000000..6d664bc051
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp
@@ -0,0 +1,58 @@
+v=0
+o=mozilla...THIS_IS_SDPARTA-46.0.1 5115930144083302970 0 IN IP4 0.0.0.0
+s=-
+t=0 0
+a=fingerprint:sha-256 24:67:5E:1B:9A:B9:CF:36:C5:30:8F:35:F7:B1:50:66:88:81:92:CB:29:BA:53:A5:02:C8:0A:A5:4E:9C:AE:D9
+a=group:BUNDLE sdparta_0 sdparta_1 sdparta_2
+a=ice-options:trickle
+a=msid-semantic:WMS *
+m=audio 9 UDP/TLS/RTP/SAVPF 109 9 0 8
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=fmtp:109 maxplaybackrate=48000;stereo=1
+a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3
+a=ice-ufrag:3edc9012
+a=mid:sdparta_0
+a=msid:{258e92fb-547c-40ca-92e9-efe0cedb4cba} {bd1fafff-bfd0-40d4-b0a3-2a87cff307ee}
+a=rtcp-mux
+a=rtpmap:109 opus/48000/2
+a=rtpmap:9 G722/8000/1
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=setup:actpass
+a=ssrc:2121669360 cname:{387b0735-bde2-43a4-8484-7f5663b60f24}
+m=video 9 UDP/TLS/RTP/SAVPF 120 126 97
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=fmtp:126 profile-level-id=42e01f;level-asymmetry-allowed=1;packetization-mode=1
+a=fmtp:97 profile-level-id=42e01f;level-asymmetry-allowed=1
+a=fmtp:120 max-fs=12288;max-fr=60
+a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3
+a=ice-ufrag:3edc9012
+a=mid:sdparta_1
+a=msid:{258e92fb-547c-40ca-92e9-efe0cedb4cba} {9e8f5867-a9aa-4489-8bd4-3a8a57a5e592}
+a=rtcp-fb:120 nack
+a=rtcp-fb:120 nack pli
+a=rtcp-fb:120 ccm fir
+a=rtcp-fb:126 nack
+a=rtcp-fb:126 nack pli
+a=rtcp-fb:126 ccm fir
+a=rtcp-fb:97 nack
+a=rtcp-fb:97 nack pli
+a=rtcp-fb:97 ccm fir
+a=rtcp-mux
+a=rtpmap:120 VP8/90000
+a=rtpmap:126 H264/90000
+a=rtpmap:97 H264/90000
+a=setup:actpass
+a=ssrc:2158832026 cname:{387b0735-bde2-43a4-8484-7f5663b60f24}
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3
+a=ice-ufrag:3edc9012
+a=mid:sdparta_2
+a=sctpmap:5000 webrtc-datachannel 256
+a=setup:actpass
+a=ssrc:2670959794 cname:{387b0735-bde2-43a4-8484-7f5663b60f24}
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp
new file mode 100644
index 0000000000..07806eb225
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp
@@ -0,0 +1,43 @@
+v=0
+o=mozilla...THIS_IS_SDPARTA-46.0.1 3068771576687940834 0 IN IP4 0.0.0.0
+s=-
+t=0 0
+a=fingerprint:sha-256 AD:87:B3:11:E4:E2:BA:EF:D2:3F:2E:AC:24:57:8E:DC:1F:67:41:29:44:C4:96:E3:62:90:CC:90:59:CA:2C:84
+a=group:BUNDLE sdparta_0 sdparta_1 sdparta_2
+a=ice-options:trickle
+a=msid-semantic:WMS *
+m=audio 9 UDP/TLS/RTP/SAVPF 109
+c=IN IP4 0.0.0.0
+a=recvonly
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=fmtp:109 maxplaybackrate=48000;stereo=1
+a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5
+a=ice-ufrag:a539544b
+a=mid:sdparta_0
+a=rtcp-mux
+a=rtpmap:109 opus/48000/2
+a=setup:active
+a=ssrc:600995474 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a}
+m=video 9 UDP/TLS/RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=recvonly
+a=fmtp:120 max-fs=12288;max-fr=60
+a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5
+a=ice-ufrag:a539544b
+a=mid:sdparta_1
+a=rtcp-fb:120 nack
+a=rtcp-fb:120 nack pli
+a=rtcp-fb:120 ccm fir
+a=rtcp-mux
+a=rtpmap:120 VP8/90000
+a=setup:active
+a=ssrc:3480150809 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a}
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5
+a=ice-ufrag:a539544b
+a=mid:sdparta_2
+a=sctpmap:5000 webrtc-datachannel 256
+a=setup:active
+a=ssrc:3021788991 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a}
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp
new file mode 100644
index 0000000000..42d15e81f4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp
@@ -0,0 +1,85 @@
+v=0
+o=- 1656229333038673902 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE audio video data
+a=msid-semantic: WMS Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 126
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:1Jyk4q3nLIL5NiMx
+a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:actpass
+a=mid:audio
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=sendrecv
+a=rtcp-mux
+a=rtpmap:111 opus/48000/2
+a=rtcp-fb:111 transport-cc
+a=fmtp:111 minptime=10; useinbandfec=1
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=rtpmap:9 G722/8000
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:106 CN/32000
+a=rtpmap:105 CN/16000
+a=rtpmap:13 CN/8000
+a=rtpmap:126 telephone-event/8000
+a=maxptime:60
+a=ssrc:2233075910 cname:VhHMGYCjn4alR9zP
+a=ssrc:2233075910 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 689d3496-0896-4d52-bce6-8e90512a368b
+a=ssrc:2233075910 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+a=ssrc:2233075910 label:689d3496-0896-4d52-bce6-8e90512a368b
+m=video 9 UDP/TLS/RTP/SAVPF 100 101 116 117 96 97 98
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:1Jyk4q3nLIL5NiMx
+a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:actpass
+a=mid:video
+a=extmap:2 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:4 urn:3gpp:video-orientation
+a=sendrecv
+a=rtcp-mux
+a=rtpmap:100 VP8/90000
+a=rtcp-fb:100 ccm fir
+a=rtcp-fb:100 nack
+a=rtcp-fb:100 nack pli
+a=rtcp-fb:100 goog-remb
+a=rtcp-fb:100 transport-cc
+a=rtpmap:101 VP9/90000
+a=rtcp-fb:101 ccm fir
+a=rtcp-fb:101 nack
+a=rtcp-fb:101 nack pli
+a=rtcp-fb:101 goog-remb
+a=rtcp-fb:101 transport-cc
+a=rtpmap:116 red/90000
+a=rtpmap:117 ulpfec/90000
+a=rtpmap:96 rtx/90000
+a=fmtp:96 apt=100
+a=rtpmap:97 rtx/90000
+a=fmtp:97 apt=101
+a=rtpmap:98 rtx/90000
+a=fmtp:98 apt=116
+a=ssrc-group:FID 50498894 2399294607
+a=ssrc:50498894 cname:VhHMGYCjn4alR9zP
+a=ssrc:50498894 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+a=ssrc:50498894 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+a=ssrc:50498894 label:1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+a=ssrc:2399294607 cname:VhHMGYCjn4alR9zP
+a=ssrc:2399294607 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+a=ssrc:2399294607 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+a=ssrc:2399294607 label:1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+a=ice-ufrag:1Jyk4q3nLIL5NiMx
+a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:actpass
+a=mid:data
+a=sctpmap:5000 webrtc-datachannel 1024
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp
new file mode 100644
index 0000000000..6ed4e3b4a8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp
@@ -0,0 +1,73 @@
+v=0
+o=- 2013283641453412290 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE audio video data
+a=msid-semantic: WMS
+m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 126
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:YVa3KTlFDCwsfPOQ
+a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:active
+a=mid:audio
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=recvonly
+a=rtcp-mux
+a=rtpmap:111 opus/48000/2
+a=rtcp-fb:111 transport-cc
+a=fmtp:111 minptime=10; useinbandfec=1
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=rtpmap:9 G722/8000
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:106 CN/32000
+a=rtpmap:105 CN/16000
+a=rtpmap:13 CN/8000
+a=rtpmap:126 telephone-event/8000
+a=maxptime:60
+m=video 9 UDP/TLS/RTP/SAVPF 100 101 116 117 96 97 98
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:YVa3KTlFDCwsfPOQ
+a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:active
+a=mid:video
+a=extmap:2 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:4 urn:3gpp:video-orientation
+a=recvonly
+a=rtcp-mux
+a=rtpmap:100 VP8/90000
+a=rtcp-fb:100 ccm fir
+a=rtcp-fb:100 nack
+a=rtcp-fb:100 nack pli
+a=rtcp-fb:100 goog-remb
+a=rtcp-fb:100 transport-cc
+a=rtpmap:101 VP9/90000
+a=rtcp-fb:101 ccm fir
+a=rtcp-fb:101 nack
+a=rtcp-fb:101 nack pli
+a=rtcp-fb:101 goog-remb
+a=rtcp-fb:101 transport-cc
+a=rtpmap:116 red/90000
+a=rtpmap:117 ulpfec/90000
+a=rtpmap:96 rtx/90000
+a=fmtp:96 apt=100
+a=rtpmap:97 rtx/90000
+a=fmtp:97 apt=101
+a=rtpmap:98 rtx/90000
+a=fmtp:98 apt=116
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+b=AS:30
+a=ice-ufrag:YVa3KTlFDCwsfPOQ
+a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:active
+a=mid:data
+a=sctpmap:5000 webrtc-datachannel 1024
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp
new file mode 100644
index 0000000000..e7a219812b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp
@@ -0,0 +1,41 @@
+v=0
+o=- 367669362084170381 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE 0
+a=msid-semantic: WMS VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1
+m=video 9 UDP/TLS/RTP/SAVPF 96
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:OLwt
+a=ice-pwd:kjGBqIFYs8UqCyfmJ7nEJw/Q
+a=ice-options:trickle
+a=fingerprint:sha-256 B4:AB:3E:01:90:D1:FC:22:8F:05:6A:01:76:B6:C5:0D:45:88:1A:E1:99:AF:18:43:E6:18:BB:D0:92:51:9B:0E
+a=setup:actpass
+a=mid:0
+a=extmap:14 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:13 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:12 urn:3gpp:video-orientation
+a=extmap:2 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
+a=extmap:11 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
+a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
+a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing
+a=extmap:8 http://tools.ietf.org/html/draft-ietf-avtext-framemarking-07
+a=extmap:9 http://www.webrtc.org/experiments/rtp-hdrext/color-space
+a=extmap:3 urn:ietf:params:rtp-hdrext:sdes:mid
+a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
+a=extmap:5 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
+a=sendrecv
+a=msid:VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 a8c06601-e9ed-4312-a7d4-283e078c5966
+a=rtcp-mux
+a=rtcp-rsize
+a=rtpmap:96 VP8/90000
+a=rtcp-fb:96 goog-remb
+a=rtcp-fb:96 transport-cc
+a=rtcp-fb:96 ccm fir
+a=rtcp-fb:96 nack
+a=rtcp-fb:96 nack pli
+a=rid:f send
+a=rid:h send
+a=rid:q send
+a=simulcast:send f;h;q
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp
new file mode 100644
index 0000000000..52879f9e66
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp
@@ -0,0 +1,41 @@
+v=0
+o=- 367669362084170381 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE 0
+a=msid-semantic: WMS VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1
+m=video 9 UDP/TLS/RTP/SAVPF 96
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:OLwt
+a=ice-pwd:kjGBqIFYs8UqCyfmJ7nEJw/Q
+a=ice-options:trickle
+a=fingerprint:sha-256 B4:AB:3E:01:90:D1:FC:22:8F:05:6A:01:76:B6:C5:0D:45:88:1A:E1:99:AF:18:43:E6:18:BB:D0:92:51:9B:0E
+a=setup:actpass
+a=mid:0
+a=extmap:14 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:13 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:12 urn:3gpp:video-orientation
+a=extmap:2 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
+a=extmap:11 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
+a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
+a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing
+a=extmap:8 http://tools.ietf.org/html/draft-ietf-avtext-framemarking-07
+a=extmap:9 http://www.webrtc.org/experiments/rtp-hdrext/color-space
+a=extmap:3 urn:ietf:params:rtp-hdrext:sdes:mid
+a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
+a=extmap:5 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
+a=sendrecv
+a=msid:VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 a8c06601-e9ed-4312-a7d4-283e078c5966
+a=rtcp-mux
+a=rtcp-rsize
+a=rtpmap:96 VP8/90000
+a=rtcp-fb:96 goog-remb
+a=rtcp-fb:96 transport-cc
+a=rtcp-fb:96 ccm fir
+a=rtcp-fb:96 nack
+a=rtcp-fb:96 nack pli
+a=rid:f recv
+a=rid:h recv
+a=rid:q recv
+a=simulcast:recv f;h;q
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp
new file mode 100644
index 0000000000..ce349ac30f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp
@@ -0,0 +1,52 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1
+m=audio 2345 RTP/SAVPF 111 103 104
+c=IN IP4 74.125.127.126
+a=rtcp:2347 IN IP4 74.125.127.126
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2
+a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2
+a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+m=video 3457 RTP/SAVPF 120
+c=IN IP4 74.125.224.39
+a=rtcp:3456 IN IP4 74.125.224.39
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2
+a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2
+a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp
new file mode 100644
index 0000000000..a35392513f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp
@@ -0,0 +1,40 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1
+m=audio 9 RTP/SAVPF 111 103 104
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+m=video 9 RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp
new file mode 100644
index 0000000000..50f8e55ef7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp
@@ -0,0 +1,13 @@
+m=application 9 RTP/SAVPF 101
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_data
+a=ice-pwd:pwd_data
+a=mid:data_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:FvLcvU2P3ZWmQxgPAgcDu7Zl9vftYElFOjEzhWs5
+a=rtpmap:101 google-data/90000
+a=ssrc:10 cname:data_channel_cname
+a=ssrc:10 msid:data_channel data_channeld0
+a=ssrc:10 mslabel:data_channel
+a=ssrc:10 label:data_channeld0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp
new file mode 100644
index 0000000000..709db42c00
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp
@@ -0,0 +1,11 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS
+m=audio 9 RTP/SAVPF 111 103 104
+c=IN IP4 0.0.0.0
+a=x-google-flag:conference
+m=video 9 RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=x-google-flag:conference
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp
new file mode 100644
index 0000000000..c440386062
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp
@@ -0,0 +1,5 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp
new file mode 100644
index 0000000000..e07b5647bf
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp
@@ -0,0 +1,12 @@
+m=audio 9 RTP/SAVPF 111
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtpmap:111 opus/48000/2
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream audio_track_id_1
+a=ssrc:1 mslabel:local_stream
+a=ssrc:1 label:audio_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp
new file mode 100644
index 0000000000..8bdacc2baa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp
@@ -0,0 +1,12 @@
+m=video 9 RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=rtpmap:120 VP8/90000
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream video_track_id_1
+a=ssrc:2 mslabel:local_stream
+a=ssrc:2 label:video_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp
new file mode 100644
index 0000000000..9688fc46a2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp
@@ -0,0 +1,64 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1 local_stream_2
+m=audio 2345 RTP/SAVPF 111 103 104
+c=IN IP4 74.125.127.126
+a=rtcp:2347 IN IP4 74.125.127.126
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2
+a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2
+a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+a=ssrc:4 cname:stream_2_cname
+a=ssrc:4 msid:local_stream_2 audio_track_id_2
+a=ssrc:4 mslabel:local_stream_2
+a=ssrc:4 label:audio_track_id_2
+m=video 3457 RTP/SAVPF 120
+c=IN IP4 74.125.224.39
+a=rtcp:3456 IN IP4 74.125.224.39
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2
+a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2
+a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
+a=ssrc:5 cname:stream_2_cname
+a=ssrc:5 msid:local_stream_2 video_track_id_2
+a=ssrc:5 mslabel:local_stream_2
+a=ssrc:5 label:video_track_id_2
+a=ssrc:6 cname:stream_2_cname
+a=ssrc:6 msid:local_stream_2 video_track_id_3
+a=ssrc:6 mslabel:local_stream_2
+a=ssrc:6 label:video_track_id_3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp
new file mode 100644
index 0000000000..8c7c4c7c3d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp
@@ -0,0 +1,66 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1 local_stream_2
+m=audio 2345 RTP/SAVPF 111 103 104
+c=IN IP4 74.125.127.126
+a=rtcp:2347 IN IP4 74.125.127.126
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2
+a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2
+a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=msid:local_stream_1 audio_track_id_1
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+a=ssrc:4 cname:stream_2_cname
+a=ssrc:4 msid:local_stream_2 audio_track_id_2
+a=ssrc:4 mslabel:local_stream_2
+a=ssrc:4 label:audio_track_id_2
+m=video 3457 RTP/SAVPF 120
+c=IN IP4 74.125.224.39
+a=rtcp:3456 IN IP4 74.125.224.39
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2
+a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2
+a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=msid:local_stream_1 video_track_id_1
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
+a=ssrc:5 cname:stream_2_cname
+a=ssrc:5 msid:local_stream_2 video_track_id_2
+a=ssrc:5 mslabel:local_stream_2
+a=ssrc:5 label:video_track_id_2
+a=ssrc:6 cname:stream_2_cname
+a=ssrc:6 msid:local_stream_2 video_track_id_3
+a=ssrc:6 mslabel:local_stream_2
+a=ssrc:6 label:video_track_id_3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens b/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens
new file mode 100644
index 0000000000..ddfdad5811
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens
@@ -0,0 +1,56 @@
+"0.0.0.0"
+"127.0.0.1"
+"application"
+"audio"
+"candidate"
+"cname"
+"conference"
+"crypto"
+"default"
+"extmap"
+"fingerprint"
+"fmtp"
+"generation"
+"group"
+"host"
+"ice-lite"
+"ice-options"
+"ice-pwd"
+"ice-ufrag"
+"inactive"
+"IP4"
+"IP6"
+"ISAC"
+"label"
+"mid"
+"msid"
+"msid-semantic"
+"mslabel"
+"network-cost"
+"network-id"
+"prflx"
+"pwd"
+"raddr"
+"recvonly"
+"relay"
+"rport"
+"rtcp"
+"rtcp-fb"
+"rtcp-mux"
+"rtcp-rsize"
+"rtpmap"
+"sctpmap"
+"sctp-port"
+"sendonly"
+"sendrecv"
+"setup"
+"srflx"
+"ssrc"
+"ssrc-group"
+"tcptype"
+"typ"
+"ufrag"
+"video"
+"webrtc-datachannel"
+"WMS"
+"x-google-flag" \ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0
new file mode 100644
index 0000000000..fbfcbf9105
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0
@@ -0,0 +1 @@
+90742757
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1
new file mode 100644
index 0000000000..587611a1d6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1
@@ -0,0 +1 @@
+27.70727677
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2
new file mode 100644
index 0000000000..45a4fb75db
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2
@@ -0,0 +1 @@
+8
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3
new file mode 100644
index 0000000000..a0a162047c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3
@@ -0,0 +1 @@
+0.0001
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4
new file mode 100644
index 0000000000..da24ab1137
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4
@@ -0,0 +1 @@
+27277272727272727272
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5
new file mode 100644
index 0000000000..575c0a830c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5
@@ -0,0 +1 @@
+999999999999999999999999999999999999999999999999999999999999999999999999999999
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun
new file mode 100644
index 0000000000..205997706f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun
new file mode 100644
index 0000000000..1f82c03ffa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun
new file mode 100644
index 0000000000..a6b06b2be8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun
new file mode 100644
index 0000000000..1f82c03ffa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun
new file mode 100644
index 0000000000..cb91baa250
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun
new file mode 100644
index 0000000000..63298fce7d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun
new file mode 100644
index 0000000000..31f9f732d4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun
new file mode 100644
index 0000000000..3d15a67193
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun
new file mode 100644
index 0000000000..8ccf0af26d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun
new file mode 100644
index 0000000000..9c3efa0b80
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun
new file mode 100644
index 0000000000..50fe614adb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun
new file mode 100644
index 0000000000..50fe614adb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun
new file mode 100644
index 0000000000..a6b06b2be8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun
new file mode 100644
index 0000000000..c0a79fa7ab
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun
new file mode 100644
index 0000000000..1f43a4787d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun
new file mode 100644
index 0000000000..f5e824a68d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun
new file mode 100644
index 0000000000..99f4e3bcf8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun
new file mode 100644
index 0000000000..cbbcab4e74
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun
new file mode 100644
index 0000000000..5428c38d75
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens b/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens
new file mode 100644
index 0000000000..e01130f12e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens
@@ -0,0 +1,2 @@
+"2112A442"
+"12214A24"
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0 b/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0
new file mode 100644
index 0000000000..1b6fdf78f6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0
@@ -0,0 +1 @@
+@2?ÿÿ \ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2 b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2
new file mode 100644
index 0000000000..febe4ad130
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682 b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682
new file mode 100644
index 0000000000..fc538ac83f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f
new file mode 100644
index 0000000000..1bd09373c8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f
Binary files differ
diff --git a/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc
new file mode 100644
index 0000000000..2fc3fe10f1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "net/dcsctp/packet/chunk/chunk.h"
+#include "net/dcsctp/packet/sctp_packet.h"
+
+namespace webrtc {
+using dcsctp::SctpPacket;
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ absl::optional<SctpPacket> c =
+ SctpPacket::Parse(rtc::ArrayView<const uint8_t>(data, size),
+ /*disable_checksum_verification=*/true);
+
+ if (!c.has_value()) {
+ return;
+ }
+
+ for (const SctpPacket::ChunkDescriptor& desc : c->descriptors()) {
+ dcsctp::DebugConvertChunkToString(desc.data);
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc
new file mode 100644
index 0000000000..390cbb7f6c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "net/dcsctp/fuzzers/dcsctp_fuzzers.h"
+#include "net/dcsctp/public/dcsctp_message.h"
+#include "net/dcsctp/public/dcsctp_options.h"
+#include "net/dcsctp/public/dcsctp_socket.h"
+#include "net/dcsctp/socket/dcsctp_socket.h"
+#include "rtc_base/logging.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ dcsctp::dcsctp_fuzzers::FuzzerCallbacks cb;
+ dcsctp::DcSctpOptions options;
+ options.disable_checksum_verification = true;
+ dcsctp::DcSctpSocket socket("A", cb, nullptr, options);
+
+ dcsctp::dcsctp_fuzzers::FuzzSocket(socket, cb,
+ rtc::ArrayView<const uint8_t>(data, size));
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc
new file mode 100644
index 0000000000..74fe65ce56
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "system_wrappers/include/field_trial.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ std::string field_trial(reinterpret_cast<const char*>(data), size);
+ field_trial::InitFieldTrialsFromString(field_trial.c_str());
+ field_trial::FindFullName(field_trial);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc
new file mode 100644
index 0000000000..854cc8b811
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "api/scoped_refptr.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/flexfec_header_reader_writer.h"
+#include "modules/rtp_rtcp/source/forward_error_correction.h"
+
+namespace webrtc {
+
+using Packet = ForwardErrorCorrection::Packet;
+using ReceivedFecPacket = ForwardErrorCorrection::ReceivedFecPacket;
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ ReceivedFecPacket packet;
+ packet.pkt = rtc::scoped_refptr<Packet>(new Packet());
+ const size_t packet_size =
+ std::min(size, static_cast<size_t>(IP_PACKET_SIZE));
+ packet.pkt->data.SetSize(packet_size);
+ packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE);
+ memcpy(packet.pkt->data.MutableData(), data, packet_size);
+
+ FlexfecHeaderReader flexfec_reader;
+ flexfec_reader.ReadFecHeader(&packet);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
new file mode 100644
index 0000000000..67d603d3fc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "modules/rtp_rtcp/include/flexfec_receiver.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+
+namespace webrtc {
+
+namespace {
+class DummyCallback : public RecoveredPacketReceiver {
+ void OnRecoveredPacket(const RtpPacketReceived& packet) override {}
+};
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ constexpr size_t kMinDataNeeded = 12;
+ if (size < kMinDataNeeded || size > 2000) {
+ return;
+ }
+
+ uint32_t flexfec_ssrc;
+ memcpy(&flexfec_ssrc, data + 0, 4);
+ uint16_t flexfec_seq_num;
+ memcpy(&flexfec_seq_num, data + 4, 2);
+ uint32_t media_ssrc;
+ memcpy(&media_ssrc, data + 6, 4);
+ uint16_t media_seq_num;
+ memcpy(&media_seq_num, data + 10, 2);
+
+ DummyCallback callback;
+ FlexfecReceiver receiver(flexfec_ssrc, media_ssrc, &callback);
+
+ std::unique_ptr<uint8_t[]> packet;
+ size_t packet_length;
+ size_t i = kMinDataNeeded;
+ while (i < size) {
+ packet_length = kRtpHeaderSize + data[i++];
+ packet = std::unique_ptr<uint8_t[]>(new uint8_t[packet_length]);
+ if (i + packet_length >= size) {
+ break;
+ }
+ memcpy(packet.get(), data + i, packet_length);
+ i += packet_length;
+ if (i < size && data[i++] % 2 == 0) {
+ // Simulate FlexFEC packet.
+ ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, flexfec_seq_num++);
+ ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, flexfec_ssrc);
+ } else {
+ // Simulate media packet.
+ ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, media_seq_num++);
+ ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, media_ssrc);
+ }
+ RtpPacketReceived parsed_packet;
+ if (parsed_packet.Parse(packet.get(), packet_length)) {
+ receiver.OnRtpPacket(parsed_packet);
+ }
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc
new file mode 100644
index 0000000000..8ddd1c0fe0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/rtp_rtcp/include/flexfec_sender.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/rtp_packet_to_send.h"
+#include "system_wrappers/include/clock.h"
+
+namespace webrtc {
+
+namespace {
+
+constexpr int kFlexfecPayloadType = 123;
+constexpr uint32_t kMediaSsrc = 1234;
+constexpr uint32_t kFlexfecSsrc = 5678;
+const char kNoMid[] = "";
+const std::vector<RtpExtension> kNoRtpHeaderExtensions;
+const std::vector<RtpExtensionSize> kNoRtpHeaderExtensionSizes;
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ size_t i = 0;
+ if (size < 5 || size > 200) {
+ return;
+ }
+ SimulatedClock clock(1 + data[i++]);
+ FlexfecSender sender(kFlexfecPayloadType, kFlexfecSsrc, kMediaSsrc, kNoMid,
+ kNoRtpHeaderExtensions, kNoRtpHeaderExtensionSizes,
+ nullptr /* rtp_state */, &clock);
+ FecProtectionParams params = {
+ data[i++], static_cast<int>(data[i++] % 100),
+ data[i++] <= 127 ? kFecMaskRandom : kFecMaskBursty};
+ sender.SetProtectionParameters(params, params);
+ uint16_t seq_num = data[i++];
+
+ while (i + 1 < size) {
+ // Everything past the base RTP header (12 bytes) is payload,
+ // from the perspective of FlexFEC.
+ size_t payload_size = data[i++];
+ if (i + kRtpHeaderSize + payload_size >= size)
+ break;
+ std::unique_ptr<uint8_t[]> packet(
+ new uint8_t[kRtpHeaderSize + payload_size]);
+ memcpy(packet.get(), &data[i], kRtpHeaderSize + payload_size);
+ i += kRtpHeaderSize + payload_size;
+ ByteWriter<uint16_t>::WriteBigEndian(&packet[2], seq_num++);
+ ByteWriter<uint32_t>::WriteBigEndian(&packet[8], kMediaSsrc);
+ RtpPacketToSend rtp_packet(nullptr);
+ if (!rtp_packet.Parse(packet.get(), kRtpHeaderSize + payload_size))
+ break;
+ sender.AddPacketAndGenerateFec(rtp_packet);
+ sender.GetFecPackets();
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc
new file mode 100644
index 0000000000..04a459bc71
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc
@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "api/scoped_refptr.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/forward_error_correction.h"
+#include "rtc_base/byte_buffer.h"
+
+namespace webrtc {
+
+namespace {
+constexpr uint32_t kMediaSsrc = 100200300;
+constexpr uint32_t kFecSsrc = 111222333;
+
+constexpr size_t kPacketSize = 50;
+constexpr size_t kMaxPacketsInBuffer = 48;
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 5000) {
+ return;
+ }
+ // Object under test.
+ std::unique_ptr<ForwardErrorCorrection> fec =
+ ForwardErrorCorrection::CreateFlexfec(kFecSsrc, kMediaSsrc);
+
+ // Entropy from fuzzer.
+ rtc::ByteBufferReader fuzz_buffer(reinterpret_cast<const char*>(data), size);
+
+ // Initial stream state.
+ uint16_t media_seqnum;
+ if (!fuzz_buffer.ReadUInt16(&media_seqnum))
+ return;
+ const uint16_t original_media_seqnum = media_seqnum;
+ uint16_t fec_seqnum;
+ if (!fuzz_buffer.ReadUInt16(&fec_seqnum))
+ return;
+
+ // Existing packets in the packet buffer.
+ ForwardErrorCorrection::RecoveredPacketList recovered_packets;
+ uint8_t num_existing_recovered_packets;
+ if (!fuzz_buffer.ReadUInt8(&num_existing_recovered_packets))
+ return;
+ for (size_t i = 0; i < num_existing_recovered_packets % kMaxPacketsInBuffer;
+ ++i) {
+ ForwardErrorCorrection::RecoveredPacket* recovered_packet =
+ new ForwardErrorCorrection::RecoveredPacket();
+ recovered_packet->pkt = rtc::scoped_refptr<ForwardErrorCorrection::Packet>(
+ new ForwardErrorCorrection::Packet());
+ recovered_packet->pkt->data.SetSize(kPacketSize);
+ memset(recovered_packet->pkt->data.MutableData(), 0, kPacketSize);
+ recovered_packet->ssrc = kMediaSsrc;
+ recovered_packet->seq_num = media_seqnum++;
+ recovered_packets.emplace_back(recovered_packet);
+ }
+
+ // New packets received from the network.
+ ForwardErrorCorrection::ReceivedPacket received_packet;
+ received_packet.pkt = rtc::scoped_refptr<ForwardErrorCorrection::Packet>(
+ new ForwardErrorCorrection::Packet());
+ received_packet.pkt->data.SetSize(kPacketSize);
+ received_packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE);
+ uint8_t* packet_buffer = received_packet.pkt->data.MutableData();
+ uint8_t reordering;
+ uint16_t seq_num_diff;
+ uint8_t packet_type;
+ uint8_t packet_loss;
+ while (true) {
+ if (!fuzz_buffer.ReadBytes(reinterpret_cast<char*>(packet_buffer),
+ kPacketSize)) {
+ return;
+ }
+ if (!fuzz_buffer.ReadUInt8(&reordering))
+ return;
+ if (!fuzz_buffer.ReadUInt16(&seq_num_diff))
+ return;
+ if (!fuzz_buffer.ReadUInt8(&packet_type))
+ return;
+ if (!fuzz_buffer.ReadUInt8(&packet_loss))
+ return;
+
+ if (reordering % 10 != 0)
+ seq_num_diff = 0;
+
+ if (packet_type % 2 == 0) {
+ received_packet.is_fec = true;
+ received_packet.ssrc = kFecSsrc;
+ received_packet.seq_num = seq_num_diff + fec_seqnum++;
+
+ // Overwrite parts of the FlexFEC header for fuzzing efficiency.
+ packet_buffer[0] = 0; // R, F bits.
+ ByteWriter<uint8_t>::WriteBigEndian(&packet_buffer[8], 1); // SSRCCount.
+ ByteWriter<uint32_t>::WriteBigEndian(&packet_buffer[12],
+ kMediaSsrc); // SSRC_i.
+ ByteWriter<uint16_t>::WriteBigEndian(
+ &packet_buffer[16], original_media_seqnum); // SN base_i.
+ } else {
+ received_packet.is_fec = false;
+ received_packet.ssrc = kMediaSsrc;
+ received_packet.seq_num = seq_num_diff + media_seqnum++;
+ }
+
+ if (packet_loss % 10 == 0)
+ continue;
+
+ fec->DecodeFec(received_packet, &recovered_packets);
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc
new file mode 100644
index 0000000000..ec1bbbb4c1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "api/task_queue/task_queue_base.h"
+#include "modules/video_coding/frame_buffer2.h"
+#include "modules/video_coding/timing/timing.h"
+#include "test/scoped_key_value_config.h"
+#include "test/time_controller/simulated_time_controller.h"
+
+namespace webrtc {
+
+namespace {
+
+// When DataReader runs out of data provided in the constructor it will
+// just set/return 0 instead.
+struct DataReader {
+ DataReader(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+
+ void CopyTo(void* destination, size_t dest_size) {
+ memset(destination, 0, dest_size);
+
+ size_t bytes_to_copy = std::min(size_ - offset_, dest_size);
+ memcpy(destination, data_ + offset_, bytes_to_copy);
+ offset_ += bytes_to_copy;
+ }
+
+ template <typename T>
+ T GetNum() {
+ T res;
+ if (offset_ + sizeof(res) < size_) {
+ memcpy(&res, data_ + offset_, sizeof(res));
+ offset_ += sizeof(res);
+ return res;
+ }
+
+ offset_ = size_;
+ return T(0);
+ }
+
+ bool MoreToRead() { return offset_ < size_; }
+
+ const uint8_t* const data_;
+ size_t size_;
+ size_t offset_ = 0;
+};
+
+class FuzzyFrameObject : public EncodedFrame {
+ public:
+ FuzzyFrameObject() {}
+ ~FuzzyFrameObject() {}
+
+ int64_t ReceivedTime() const override { return 0; }
+ int64_t RenderTime() const override { return _renderTimeMs; }
+};
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000) {
+ return;
+ }
+ DataReader reader(data, size);
+ GlobalSimulatedTimeController time_controller(Timestamp::Seconds(0));
+ std::unique_ptr<TaskQueueBase, TaskQueueDeleter> task_queue =
+ time_controller.GetTaskQueueFactory()->CreateTaskQueue(
+ "time_tq", TaskQueueFactory::Priority::NORMAL);
+ test::ScopedKeyValueConfig field_trials;
+ VCMTiming timing(time_controller.GetClock(), field_trials);
+ video_coding::FrameBuffer frame_buffer(time_controller.GetClock(), &timing,
+ field_trials);
+
+ bool next_frame_task_running = false;
+
+ while (reader.MoreToRead()) {
+ if (reader.GetNum<uint8_t>() % 2) {
+ std::unique_ptr<FuzzyFrameObject> frame(new FuzzyFrameObject());
+ frame->SetId(reader.GetNum<int64_t>());
+ frame->SetSpatialIndex(reader.GetNum<uint8_t>() % 5);
+ frame->SetTimestamp(reader.GetNum<uint32_t>());
+ frame->num_references =
+ reader.GetNum<uint8_t>() % EncodedFrame::kMaxFrameReferences;
+
+ for (size_t r = 0; r < frame->num_references; ++r)
+ frame->references[r] = reader.GetNum<int64_t>();
+
+ frame_buffer.InsertFrame(std::move(frame));
+ } else {
+ if (!next_frame_task_running) {
+ next_frame_task_running = true;
+ bool keyframe_required = reader.GetNum<uint8_t>() % 2;
+ int max_wait_time_ms = reader.GetNum<uint8_t>();
+ task_queue->PostTask([&task_queue, &frame_buffer,
+ &next_frame_task_running, keyframe_required,
+ max_wait_time_ms] {
+ frame_buffer.NextFrame(
+ max_wait_time_ms, keyframe_required, task_queue.get(),
+ [&next_frame_task_running](std::unique_ptr<EncodedFrame> frame) {
+ next_frame_task_running = false;
+ });
+ });
+ }
+ }
+
+ time_controller.AdvanceTime(TimeDelta::Millis(reader.GetNum<uint8_t>()));
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc
new file mode 100644
index 0000000000..e58d5e9f98
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "api/array_view.h"
+#include "api/video/encoded_frame.h"
+#include "api/video/frame_buffer.h"
+#include "rtc_base/numerics/sequence_number_unwrapper.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+#include "test/scoped_key_value_config.h"
+
+namespace webrtc {
+namespace {
+class FuzzyFrameObject : public EncodedFrame {
+ public:
+ int64_t ReceivedTime() const override { return 0; }
+ int64_t RenderTime() const override { return 0; }
+};
+
+constexpr int kFrameIdLength = 1 << 15;
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 10000) {
+ return;
+ }
+
+ test::ScopedKeyValueConfig field_trials;
+ FrameBuffer buffer(/*max_frame_slots=*/100, /*max_decode_history=*/1000,
+ field_trials);
+ test::FuzzDataHelper helper(rtc::MakeArrayView(data, size));
+ SeqNumUnwrapper<uint16_t, kFrameIdLength> unwrapper;
+
+ while (helper.BytesLeft() > 0) {
+ int action = helper.ReadOrDefaultValue<uint8_t>(0) % 6;
+
+ switch (action) {
+ case 0: {
+ buffer.LastContinuousFrameId();
+ break;
+ }
+ case 1: {
+ buffer.LastContinuousTemporalUnitFrameId();
+ break;
+ }
+ case 2: {
+ buffer.DecodableTemporalUnitsInfo();
+ break;
+ }
+ case 3: {
+ buffer.ExtractNextDecodableTemporalUnit();
+ break;
+ }
+ case 4: {
+ buffer.DropNextDecodableTemporalUnit();
+ break;
+ }
+ case 5: {
+ auto frame = std::make_unique<FuzzyFrameObject>();
+ frame->SetTimestamp(helper.ReadOrDefaultValue<uint32_t>(0));
+ int64_t wire_id =
+ helper.ReadOrDefaultValue<uint16_t>(0) & (kFrameIdLength - 1);
+ frame->SetId(unwrapper.Unwrap(wire_id));
+ frame->is_last_spatial_layer = helper.ReadOrDefaultValue<bool>(false);
+
+ frame->num_references = helper.ReadOrDefaultValue<uint8_t>(0) %
+ EncodedFrame::kMaxFrameReferences;
+
+ for (uint8_t i = 0; i < frame->num_references; ++i) {
+ frame->references[i] = helper.ReadOrDefaultValue<int64_t>(0);
+ }
+
+ buffer.InsertFrame(std::move(frame));
+ break;
+ }
+ }
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc
new file mode 100644
index 0000000000..866f7bc4b8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace test {
+
+FuzzDataHelper::FuzzDataHelper(rtc::ArrayView<const uint8_t> data)
+ : data_(data) {}
+
+} // namespace test
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h
new file mode 100644
index 0000000000..cedc31d0a4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_FUZZ_DATA_HELPER_H_
+#define TEST_FUZZERS_FUZZ_DATA_HELPER_H_
+
+#include <limits>
+
+#include "api/array_view.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+namespace test {
+
+// Helper class to take care of the fuzzer input, read from it, and keep track
+// of when the end of the data has been reached.
+class FuzzDataHelper {
+ public:
+ explicit FuzzDataHelper(rtc::ArrayView<const uint8_t> data);
+
+ // Returns true if n bytes can be read.
+ bool CanReadBytes(size_t n) const { return data_ix_ + n <= data_.size(); }
+
+ // Reads and returns data of type T.
+ template <typename T>
+ T Read() {
+ RTC_CHECK(CanReadBytes(sizeof(T)));
+ T x = ByteReader<T>::ReadLittleEndian(&data_[data_ix_]);
+ data_ix_ += sizeof(T);
+ return x;
+ }
+
+ // Reads and returns data of type T. Returns default_value if not enough
+ // fuzzer input remains to read a T.
+ template <typename T>
+ T ReadOrDefaultValue(T default_value) {
+ if (!CanReadBytes(sizeof(T))) {
+ return default_value;
+ }
+ return Read<T>();
+ }
+
+ // Like ReadOrDefaultValue, but replaces the value 0 with default_value.
+ template <typename T>
+ T ReadOrDefaultValueNotZero(T default_value) {
+ static_assert(std::is_integral<T>::value, "");
+ T x = ReadOrDefaultValue(default_value);
+ return x == 0 ? default_value : x;
+ }
+
+ // Returns one of the elements from the provided input array. The selection
+ // is based on the fuzzer input data. If not enough fuzzer data is available,
+ // the method will return the first element in the input array. The reason for
+ // not flagging this as an error is to allow the method to be called from
+ // class constructors, and in constructors we typically do not handle
+ // errors. The code will work anyway, and the fuzzer will likely see that
+ // providing more data will actually make this method return something else.
+ template <typename T, size_t N>
+ T SelectOneOf(const T (&select_from)[N]) {
+ static_assert(N <= std::numeric_limits<uint8_t>::max(), "");
+ // Read an index between 0 and select_from.size() - 1 from the fuzzer data.
+ uint8_t index = ReadOrDefaultValue<uint8_t>(0) % N;
+ return select_from[index];
+ }
+
+ rtc::ArrayView<const uint8_t> ReadByteArray(size_t bytes) {
+ if (!CanReadBytes(bytes)) {
+ return rtc::ArrayView<const uint8_t>(nullptr, 0);
+ }
+ const size_t index_to_return = data_ix_;
+ data_ix_ += bytes;
+ return data_.subview(index_to_return, bytes);
+ }
+
+ // If sizeof(T) > BytesLeft then the remaining bytes will be used and the rest
+ // of the object will be zero initialized.
+ template <typename T>
+ void CopyTo(T* object) {
+ memset(object, 0, sizeof(T));
+
+ size_t bytes_to_copy = std::min(BytesLeft(), sizeof(T));
+ memcpy(object, data_.data() + data_ix_, bytes_to_copy);
+ data_ix_ += bytes_to_copy;
+ }
+
+ size_t BytesRead() const { return data_ix_; }
+
+ size_t BytesLeft() const { return data_.size() - data_ix_; }
+
+ private:
+ rtc::ArrayView<const uint8_t> data_;
+ size_t data_ix_ = 0;
+};
+
+} // namespace test
+} // namespace webrtc
+
+#endif // TEST_FUZZERS_FUZZ_DATA_HELPER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc
new file mode 100644
index 0000000000..cd1128c0b4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include <stdint.h>
+
+#include "common_video/h264/h264_bitstream_parser.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ H264BitstreamParser h264_bitstream_parser;
+ h264_bitstream_parser.ParseBitstream(
+ rtc::ArrayView<const uint8_t>(data, size));
+ h264_bitstream_parser.GetLastSliceQp();
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc
new file mode 100644
index 0000000000..97127228ed
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc
@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_h264.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 200000)
+ return;
+ VideoRtpDepacketizerH264 depacketizer;
+ depacketizer.Parse(rtc::CopyOnWriteBuffer(data, size));
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc
new file mode 100644
index 0000000000..348c84f040
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc
@@ -0,0 +1,184 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <cmath>
+#include <cstring>
+#include <memory>
+#include <vector>
+
+#include "api/array_view.h"
+#include "api/audio_codecs/builtin_audio_decoder_factory.h"
+#include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h"
+#include "modules/audio_coding/neteq/tools/audio_checksum.h"
+#include "modules/audio_coding/neteq/tools/encode_neteq_input.h"
+#include "modules/audio_coding/neteq/tools/neteq_test.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+namespace test {
+namespace {
+constexpr int kPayloadType = 95;
+
+class SineGenerator : public EncodeNetEqInput::Generator {
+ public:
+ explicit SineGenerator(int sample_rate_hz)
+ : sample_rate_hz_(sample_rate_hz) {}
+
+ rtc::ArrayView<const int16_t> Generate(size_t num_samples) override {
+ if (samples_.size() < num_samples) {
+ samples_.resize(num_samples);
+ }
+
+ rtc::ArrayView<int16_t> output(samples_.data(), num_samples);
+ for (auto& x : output) {
+ x = static_cast<int16_t>(2000.0 * std::sin(phase_));
+ phase_ += 2 * kPi * kFreqHz / sample_rate_hz_;
+ }
+ return output;
+ }
+
+ private:
+ static constexpr int kFreqHz = 300; // The sinewave frequency.
+ const int sample_rate_hz_;
+ const double kPi = std::acos(-1);
+ std::vector<int16_t> samples_;
+ double phase_ = 0.0;
+};
+
+class FuzzRtpInput : public NetEqInput {
+ public:
+ explicit FuzzRtpInput(rtc::ArrayView<const uint8_t> data) : data_(data) {
+ AudioEncoderPcm16B::Config config;
+ config.payload_type = kPayloadType;
+ config.sample_rate_hz = 32000;
+ std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config));
+ std::unique_ptr<EncodeNetEqInput::Generator> generator(
+ new SineGenerator(config.sample_rate_hz));
+ input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder),
+ std::numeric_limits<int64_t>::max()));
+ packet_ = input_->PopPacket();
+ FuzzHeader();
+ MaybeFuzzPayload();
+ }
+
+ absl::optional<int64_t> NextPacketTime() const override {
+ return packet_->time_ms;
+ }
+
+ absl::optional<int64_t> NextOutputEventTime() const override {
+ return input_->NextOutputEventTime();
+ }
+
+ std::unique_ptr<PacketData> PopPacket() override {
+ RTC_DCHECK(packet_);
+ std::unique_ptr<PacketData> packet_to_return = std::move(packet_);
+ packet_ = input_->PopPacket();
+ FuzzHeader();
+ MaybeFuzzPayload();
+ return packet_to_return;
+ }
+
+ void AdvanceOutputEvent() override { return input_->AdvanceOutputEvent(); }
+
+ bool ended() const override { return ended_; }
+
+ absl::optional<RTPHeader> NextHeader() const override {
+ RTC_DCHECK(packet_);
+ return packet_->header;
+ }
+
+ private:
+ void FuzzHeader() {
+ constexpr size_t kNumBytesToFuzz = 11;
+ if (data_ix_ + kNumBytesToFuzz > data_.size()) {
+ ended_ = true;
+ return;
+ }
+ RTC_DCHECK(packet_);
+ const size_t start_ix = data_ix_;
+ packet_->header.payloadType =
+ ByteReader<uint8_t>::ReadLittleEndian(&data_[data_ix_]);
+ packet_->header.payloadType &= 0x7F;
+ data_ix_ += sizeof(uint8_t);
+ packet_->header.sequenceNumber =
+ ByteReader<uint16_t>::ReadLittleEndian(&data_[data_ix_]);
+ data_ix_ += sizeof(uint16_t);
+ packet_->header.timestamp =
+ ByteReader<uint32_t>::ReadLittleEndian(&data_[data_ix_]);
+ data_ix_ += sizeof(uint32_t);
+ packet_->header.ssrc =
+ ByteReader<uint32_t>::ReadLittleEndian(&data_[data_ix_]);
+ data_ix_ += sizeof(uint32_t);
+ RTC_CHECK_EQ(data_ix_ - start_ix, kNumBytesToFuzz);
+ }
+
+ void MaybeFuzzPayload() {
+ // Read one byte of fuzz data to determine how many payload bytes to fuzz.
+ if (data_ix_ + 1 > data_.size()) {
+ ended_ = true;
+ return;
+ }
+ size_t bytes_to_fuzz = data_[data_ix_++];
+
+ // Restrict number of bytes to fuzz to 16; a reasonably low number enough to
+ // cover a few RED headers. Also don't write outside the payload length.
+ bytes_to_fuzz = std::min(bytes_to_fuzz % 16, packet_->payload.size());
+
+ if (bytes_to_fuzz == 0)
+ return;
+
+ if (data_ix_ + bytes_to_fuzz > data_.size()) {
+ ended_ = true;
+ return;
+ }
+
+ std::memcpy(packet_->payload.data(), &data_[data_ix_], bytes_to_fuzz);
+ data_ix_ += bytes_to_fuzz;
+ }
+
+ bool ended_ = false;
+ rtc::ArrayView<const uint8_t> data_;
+ size_t data_ix_ = 0;
+ std::unique_ptr<EncodeNetEqInput> input_;
+ std::unique_ptr<PacketData> packet_;
+};
+} // namespace
+
+void FuzzOneInputTest(const uint8_t* data, size_t size) {
+ std::unique_ptr<FuzzRtpInput> input(
+ new FuzzRtpInput(rtc::ArrayView<const uint8_t>(data, size)));
+ std::unique_ptr<AudioChecksum> output(new AudioChecksum);
+ NetEqTest::Callbacks callbacks;
+ NetEq::Config config;
+ auto codecs = NetEqTest::StandardDecoderMap();
+ // kPayloadType is the payload type that will be used for encoding. Verify
+ // that it is included in the standard decoder map, and that it points to the
+ // expected decoder type.
+ const auto it = codecs.find(kPayloadType);
+ RTC_CHECK(it != codecs.end());
+ RTC_CHECK(it->second == SdpAudioFormat("L16", 32000, 1));
+
+ NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs,
+ /*text_log=*/nullptr, /*neteq_factory=*/nullptr,
+ std::move(input), std::move(output), callbacks);
+ test.Run();
+}
+
+} // namespace test
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 70000) {
+ return;
+ }
+ test::FuzzOneInputTest(data, size);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc
new file mode 100644
index 0000000000..8653f137a2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc
@@ -0,0 +1,201 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <cmath>
+#include <limits>
+#include <memory>
+#include <vector>
+
+#include "api/array_view.h"
+#include "api/audio_codecs/builtin_audio_decoder_factory.h"
+#include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h"
+#include "modules/audio_coding/neteq/tools/audio_checksum.h"
+#include "modules/audio_coding/neteq/tools/encode_neteq_input.h"
+#include "modules/audio_coding/neteq/tools/neteq_test.h"
+#include "rtc_base/numerics/safe_conversions.h"
+#include "rtc_base/random.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace test {
+namespace {
+// Generate a mixture of sine wave and gaussian noise.
+class SineAndNoiseGenerator : public EncodeNetEqInput::Generator {
+ public:
+ // The noise generator is seeded with a value from the fuzzer data, but 0 is
+ // avoided (since it is not allowed by the Random class).
+ SineAndNoiseGenerator(int sample_rate_hz, FuzzDataHelper* fuzz_data)
+ : sample_rate_hz_(sample_rate_hz),
+ fuzz_data_(*fuzz_data),
+ noise_generator_(fuzz_data_.ReadOrDefaultValueNotZero<uint64_t>(1)) {}
+
+ // Generates num_samples of the sine-gaussian mixture.
+ rtc::ArrayView<const int16_t> Generate(size_t num_samples) override {
+ if (samples_.size() < num_samples) {
+ samples_.resize(num_samples);
+ }
+
+ rtc::ArrayView<int16_t> output(samples_.data(), num_samples);
+ // Randomize an amplitude between 0 and 32768; use 65000/2 if we are out of
+ // fuzzer data.
+ const float amplitude = fuzz_data_.ReadOrDefaultValue<uint16_t>(65000) / 2;
+ // Randomize a noise standard deviation between 0 and 1999.
+ const float noise_std = fuzz_data_.ReadOrDefaultValue<uint16_t>(0) % 2000;
+ for (auto& x : output) {
+ x = rtc::saturated_cast<int16_t>(amplitude * std::sin(phase_) +
+ noise_generator_.Gaussian(0, noise_std));
+ phase_ += 2 * kPi * kFreqHz / sample_rate_hz_;
+ }
+ return output;
+ }
+
+ private:
+ static constexpr int kFreqHz = 300; // The sinewave frequency.
+ const int sample_rate_hz_;
+ const double kPi = std::acos(-1);
+ std::vector<int16_t> samples_;
+ double phase_ = 0.0;
+ FuzzDataHelper& fuzz_data_;
+ Random noise_generator_;
+};
+
+class FuzzSignalInput : public NetEqInput {
+ public:
+ explicit FuzzSignalInput(FuzzDataHelper* fuzz_data,
+ int sample_rate,
+ uint8_t payload_type)
+ : fuzz_data_(*fuzz_data) {
+ AudioEncoderPcm16B::Config config;
+ config.payload_type = payload_type;
+ config.sample_rate_hz = sample_rate;
+ std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config));
+ std::unique_ptr<EncodeNetEqInput::Generator> generator(
+ new SineAndNoiseGenerator(config.sample_rate_hz, fuzz_data));
+ input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder),
+ std::numeric_limits<int64_t>::max()));
+ packet_ = input_->PopPacket();
+
+ // Select an output event period. This is how long time we wait between each
+ // call to NetEq::GetAudio. 10 ms is nominal, 9 and 11 ms will both lead to
+ // clock drift (in different directions).
+ constexpr int output_event_periods[] = {9, 10, 11};
+ output_event_period_ms_ = fuzz_data_.SelectOneOf(output_event_periods);
+ }
+
+ absl::optional<int64_t> NextPacketTime() const override {
+ return packet_->time_ms;
+ }
+
+ absl::optional<int64_t> NextOutputEventTime() const override {
+ return next_output_event_ms_;
+ }
+
+ std::unique_ptr<PacketData> PopPacket() override {
+ RTC_DCHECK(packet_);
+ std::unique_ptr<PacketData> packet_to_return = std::move(packet_);
+ do {
+ packet_ = input_->PopPacket();
+ // If the next value from the fuzzer input is 0, the packet is discarded
+ // and the next one is pulled from the source.
+ } while (fuzz_data_.CanReadBytes(1) && fuzz_data_.Read<uint8_t>() == 0);
+ if (fuzz_data_.CanReadBytes(1)) {
+ // Generate jitter by setting an offset for the arrival time.
+ const int8_t arrival_time_offset_ms = fuzz_data_.Read<int8_t>();
+ // The arrival time can not be before the previous packets.
+ packet_->time_ms = std::max(packet_to_return->time_ms,
+ packet_->time_ms + arrival_time_offset_ms);
+ } else {
+ // Mark that we are at the end of the test. However, the current packet is
+ // still valid (but it may not have been fuzzed as expected).
+ ended_ = true;
+ }
+ return packet_to_return;
+ }
+
+ void AdvanceOutputEvent() override {
+ next_output_event_ms_ += output_event_period_ms_;
+ }
+
+ bool ended() const override { return ended_; }
+
+ absl::optional<RTPHeader> NextHeader() const override {
+ RTC_DCHECK(packet_);
+ return packet_->header;
+ }
+
+ private:
+ bool ended_ = false;
+ FuzzDataHelper& fuzz_data_;
+ std::unique_ptr<EncodeNetEqInput> input_;
+ std::unique_ptr<PacketData> packet_;
+ int64_t next_output_event_ms_ = 0;
+ int64_t output_event_period_ms_ = 10;
+};
+
+template <class T>
+bool MapHas(const std::map<int, T>& m, int key, const T& value) {
+ const auto it = m.find(key);
+ return (it != m.end() && it->second == value);
+}
+
+} // namespace
+
+void FuzzOneInputTest(const uint8_t* data, size_t size) {
+ if (size < 1 || size > 65000) {
+ return;
+ }
+
+ FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+
+ // Allowed sample rates and payload types used in the test.
+ std::pair<int, uint8_t> rate_types[] = {
+ {8000, 93}, {16000, 94}, {32000, 95}, {48000, 96}};
+ const auto rate_type = fuzz_data.SelectOneOf(rate_types);
+ const int sample_rate = rate_type.first;
+ const uint8_t payload_type = rate_type.second;
+
+ // Set up the input signal generator.
+ std::unique_ptr<FuzzSignalInput> input(
+ new FuzzSignalInput(&fuzz_data, sample_rate, payload_type));
+
+ // Output sink for the test.
+ std::unique_ptr<AudioChecksum> output(new AudioChecksum);
+
+ // Configure NetEq and the NetEqTest object.
+ NetEqTest::Callbacks callbacks;
+ NetEq::Config config;
+ config.enable_post_decode_vad = true;
+ config.enable_fast_accelerate = true;
+ auto codecs = NetEqTest::StandardDecoderMap();
+ // rate_types contains the payload types that will be used for encoding.
+ // Verify that they all are included in the standard decoder map, and that
+ // they point to the expected decoder types.
+ RTC_CHECK(
+ MapHas(codecs, rate_types[0].second, SdpAudioFormat("l16", 8000, 1)));
+ RTC_CHECK(
+ MapHas(codecs, rate_types[1].second, SdpAudioFormat("l16", 16000, 1)));
+ RTC_CHECK(
+ MapHas(codecs, rate_types[2].second, SdpAudioFormat("l16", 32000, 1)));
+ RTC_CHECK(
+ MapHas(codecs, rate_types[3].second, SdpAudioFormat("l16", 48000, 1)));
+
+ NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs,
+ /*text_log=*/nullptr, /*neteq_factory=*/nullptr,
+ std::move(input), std::move(output), callbacks);
+ test.Run();
+}
+
+} // namespace test
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ test::FuzzOneInputTest(data, size);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc
new file mode 100644
index 0000000000..78ddf0e455
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "p2p/base/pseudo_tcp.h"
+#include "rtc_base/thread.h"
+
+namespace webrtc {
+class FakeIPseudoTcpNotify : public cricket::IPseudoTcpNotify {
+ public:
+ void OnTcpOpen(cricket::PseudoTcp* tcp) {}
+ void OnTcpReadable(cricket::PseudoTcp* tcp) {}
+ void OnTcpWriteable(cricket::PseudoTcp* tcp) {}
+ void OnTcpClosed(cricket::PseudoTcp* tcp, uint32_t error) {}
+
+ cricket::IPseudoTcpNotify::WriteResult TcpWritePacket(cricket::PseudoTcp* tcp,
+ const char* buffer,
+ size_t len) {
+ return cricket::IPseudoTcpNotify::WriteResult::WR_SUCCESS;
+ }
+};
+
+struct Environment {
+ explicit Environment(cricket::IPseudoTcpNotify* notifier)
+ : ptcp(notifier, 0) {}
+
+ // We need the thread to avoid some uninteresting crashes, since the
+ // production code expects there to be a thread object available.
+ rtc::AutoThread thread;
+ cricket::PseudoTcp ptcp;
+};
+
+Environment* env = new Environment(new FakeIPseudoTcpNotify());
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ env->ptcp.NotifyPacket(reinterpret_cast<const char*>(data), size);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc
new file mode 100644
index 0000000000..0efe81f220
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <math.h>
+#include <string.h>
+
+#include <algorithm>
+#include <bitset>
+#include <vector>
+
+#include "api/audio/echo_detector_creator.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ // Number of times to update the echo detector.
+ constexpr size_t kNrOfUpdates = 7;
+ // Each round of updates requires a call to both AnalyzeRender and
+ // AnalyzeCapture, so the amount of needed input bytes doubles. Also, two
+ // bytes are used to set the call order.
+ constexpr size_t kNrOfNeededInputBytes = 2 * kNrOfUpdates * sizeof(float) + 2;
+ // The maximum audio energy that an audio frame can have is equal to the
+ // number of samples in the frame multiplied by 2^30. We use a single sample
+ // to represent an audio frame in this test, so it should have a maximum value
+ // equal to the square root of that value.
+ const float maxFuzzedValue = sqrtf(20 * 48) * 32768;
+ if (size < kNrOfNeededInputBytes) {
+ return;
+ }
+ size_t read_idx = 0;
+ // Use the first two bytes to choose the call order.
+ uint16_t call_order_int;
+ memcpy(&call_order_int, &data[read_idx], 2);
+ read_idx += 2;
+ std::bitset<16> call_order(call_order_int);
+
+ rtc::scoped_refptr<EchoDetector> echo_detector = CreateEchoDetector();
+ std::vector<float> input(1);
+ // Call AnalyzeCaptureAudio once to prevent the flushing of the buffer.
+ echo_detector->AnalyzeCaptureAudio(input);
+ for (size_t i = 0; i < 2 * kNrOfUpdates; ++i) {
+ // Convert 4 input bytes to a float.
+ RTC_DCHECK_LE(read_idx + sizeof(float), size);
+ memcpy(input.data(), &data[read_idx], sizeof(float));
+ read_idx += sizeof(float);
+ if (!isfinite(input[0]) || fabs(input[0]) > maxFuzzedValue) {
+ // Ignore infinity, nan values and values that are unrealistically large.
+ continue;
+ }
+ if (call_order[i]) {
+ echo_detector->AnalyzeRenderAudio(input);
+ } else {
+ echo_detector->AnalyzeCaptureAudio(input);
+ }
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc
new file mode 100644
index 0000000000..8bad9e456a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/rtp_rtcp/source/rtcp_packet/tmmb_item.h"
+#include "modules/rtp_rtcp/source/rtcp_receiver.h"
+#include "modules/rtp_rtcp/source/rtp_rtcp_interface.h"
+#include "rtc_base/checks.h"
+#include "system_wrappers/include/clock.h"
+
+namespace webrtc {
+namespace {
+
+constexpr int kRtcpIntervalMs = 1000;
+
+// RTCP is typically sent over UDP, which has a maximum payload length
+// of 65535 bytes. We err on the side of caution and check a bit above that.
+constexpr size_t kMaxInputLenBytes = 66000;
+
+class NullModuleRtpRtcp : public RTCPReceiver::ModuleRtpRtcp {
+ public:
+ void SetTmmbn(std::vector<rtcp::TmmbItem>) override {}
+ void OnRequestSendReport() override {}
+ void OnReceivedNack(const std::vector<uint16_t>&) override {}
+ void OnReceivedRtcpReportBlocks(const ReportBlockList&) override {}
+};
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > kMaxInputLenBytes) {
+ return;
+ }
+
+ NullModuleRtpRtcp rtp_rtcp_module;
+ SimulatedClock clock(1234);
+
+ RtpRtcpInterface::Configuration config;
+ config.clock = &clock;
+ config.rtcp_report_interval_ms = kRtcpIntervalMs;
+ config.local_media_ssrc = 1;
+
+ RTCPReceiver receiver(config, &rtp_rtcp_module);
+
+ receiver.IncomingPacket(data, size);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc
new file mode 100644
index 0000000000..168e7b606b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_av1.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <vector>
+
+#include "api/array_view.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ std::vector<rtc::ArrayView<const uint8_t>> rtp_payloads;
+
+ // Convert plain array of bytes into array of array bytes.
+ test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size));
+ while (fuzz_input.CanReadBytes(sizeof(uint16_t))) {
+ // In practice one rtp payload can be up to ~1200 - 1500 bytes. Majority
+ // of the payload is just copied. To make fuzzing more efficient limit the
+ // size of rtp payload to realistic value.
+ uint16_t next_size = fuzz_input.Read<uint16_t>() % 1200;
+ if (next_size > fuzz_input.BytesLeft()) {
+ next_size = fuzz_input.BytesLeft();
+ }
+ rtp_payloads.push_back(fuzz_input.ReadByteArray(next_size));
+ }
+ // Run code under test.
+ VideoRtpDepacketizerAv1().AssembleFrame(rtp_payloads);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc
new file mode 100644
index 0000000000..82404f7264
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <utility>
+
+#include "api/array_view.h"
+#include "common_video/generic_frame_descriptor/generic_frame_info.h"
+#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ FrameDependencyStructure structure1;
+ // nullptr during 1st while loop, after that should point to structure1.
+ const FrameDependencyStructure* structure1_ptr = nullptr;
+ std::unique_ptr<const FrameDependencyStructure> structure2;
+
+ test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size));
+ while (fuzz_data.CanReadBytes(1)) {
+ // Treat next byte as size of the next extension. That aligns how
+ // two-byte rtp header extension sizes are written.
+ size_t next_size = fuzz_data.Read<uint8_t>();
+ auto raw =
+ fuzz_data.ReadByteArray(std::min(next_size, fuzz_data.BytesLeft()));
+
+ // Read the random input.
+ DependencyDescriptor descriptor1;
+ if (!RtpDependencyDescriptorExtension::Parse(raw, structure1_ptr,
+ &descriptor1)) {
+ // Ignore invalid buffer and move on.
+ continue;
+ }
+ if (descriptor1.attached_structure) {
+ structure1 = *descriptor1.attached_structure;
+ structure1_ptr = &structure1;
+ }
+ RTC_CHECK(structure1_ptr);
+
+ // Write parsed descriptor back into raw buffer.
+ size_t value_size =
+ RtpDependencyDescriptorExtension::ValueSize(structure1, descriptor1);
+ // Check `writer` use minimal number of bytes to pack the descriptor by
+ // checking it doesn't use more than reader consumed.
+ RTC_CHECK_LE(value_size, raw.size());
+ uint8_t some_memory[256];
+ // That should be true because value_size <= next_size < 256
+ RTC_CHECK_LT(value_size, 256);
+ rtc::ArrayView<uint8_t> write_buffer(some_memory, value_size);
+ RTC_CHECK(RtpDependencyDescriptorExtension::Write(write_buffer, structure1,
+ descriptor1));
+
+ // Parse what Write assembled.
+ // Unlike random input that should always succeed.
+ DependencyDescriptor descriptor2;
+ RTC_CHECK(RtpDependencyDescriptorExtension::Parse(
+ write_buffer, structure2.get(), &descriptor2));
+ // Check descriptor1 and descriptor2 have same values.
+ RTC_CHECK_EQ(descriptor1.first_packet_in_frame,
+ descriptor2.first_packet_in_frame);
+ RTC_CHECK_EQ(descriptor1.last_packet_in_frame,
+ descriptor2.last_packet_in_frame);
+ RTC_CHECK_EQ(descriptor1.attached_structure != nullptr,
+ descriptor2.attached_structure != nullptr);
+ // Using value_or would miss invalid corner case when one value is nullopt
+ // while another one is 0, but for other errors would produce much nicer
+ // error message than using RTC_CHECK(optional1 == optional2);
+ // If logger would support pretty printing optional values, value_or can be
+ // removed.
+ RTC_CHECK_EQ(descriptor1.active_decode_targets_bitmask.value_or(0),
+ descriptor2.active_decode_targets_bitmask.value_or(0));
+ RTC_CHECK_EQ(descriptor1.frame_number, descriptor2.frame_number);
+ RTC_CHECK(descriptor1.resolution == descriptor2.resolution);
+ RTC_CHECK(descriptor1.frame_dependencies == descriptor2.frame_dependencies);
+
+ if (descriptor2.attached_structure) {
+ structure2 = std::move(descriptor2.attached_structure);
+ }
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc
new file mode 100644
index 0000000000..fdb4aa5f3c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "api/rtp_packet_infos.h"
+#include "modules/video_coding/frame_object.h"
+#include "modules/video_coding/rtp_frame_reference_finder.h"
+
+namespace webrtc {
+
+namespace {
+class DataReader {
+ public:
+ DataReader(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+
+ template <typename T>
+ void CopyTo(T* object) {
+ static_assert(std::is_pod<T>(), "");
+ uint8_t* destination = reinterpret_cast<uint8_t*>(object);
+ size_t object_size = sizeof(T);
+ size_t num_bytes = std::min(size_ - offset_, object_size);
+ memcpy(destination, data_ + offset_, num_bytes);
+ offset_ += num_bytes;
+
+ // If we did not have enough data, fill the rest with 0.
+ object_size -= num_bytes;
+ memset(destination + num_bytes, 0, object_size);
+ }
+
+ template <typename T>
+ T GetNum() {
+ T res;
+ if (offset_ + sizeof(res) < size_) {
+ memcpy(&res, data_ + offset_, sizeof(res));
+ offset_ += sizeof(res);
+ return res;
+ }
+
+ offset_ = size_;
+ return T(0);
+ }
+
+ bool MoreToRead() { return offset_ < size_; }
+
+ private:
+ const uint8_t* data_;
+ size_t size_;
+ size_t offset_ = 0;
+};
+
+absl::optional<RTPVideoHeader::GenericDescriptorInfo>
+GenerateGenericFrameDependencies(DataReader* reader) {
+ absl::optional<RTPVideoHeader::GenericDescriptorInfo> result;
+ uint8_t flags = reader->GetNum<uint8_t>();
+ if (flags & 0b1000'0000) {
+ // i.e. with 50% chance there are no generic dependencies.
+ // in such case codec-specfic code path of the RtpFrameReferenceFinder will
+ // be validated.
+ return result;
+ }
+
+ result.emplace();
+ result->frame_id = reader->GetNum<int32_t>();
+ result->spatial_index = (flags & 0b0111'0000) >> 4;
+ result->temporal_index = (flags & 0b0000'1110) >> 1;
+
+ // Larger than supported by the RtpFrameReferenceFinder.
+ int num_diffs = (reader->GetNum<uint8_t>() % 16);
+ for (int i = 0; i < num_diffs; ++i) {
+ result->dependencies.push_back(result->frame_id -
+ (reader->GetNum<uint16_t>() % (1 << 14)));
+ }
+
+ return result;
+}
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ DataReader reader(data, size);
+ RtpFrameReferenceFinder reference_finder;
+
+ auto codec = static_cast<VideoCodecType>(reader.GetNum<uint8_t>() % 5);
+
+ while (reader.MoreToRead()) {
+ uint16_t first_seq_num = reader.GetNum<uint16_t>();
+ uint16_t last_seq_num = reader.GetNum<uint16_t>();
+ bool marker_bit = reader.GetNum<uint8_t>();
+
+ RTPVideoHeader video_header;
+ switch (reader.GetNum<uint8_t>() % 3) {
+ case 0:
+ video_header.frame_type = VideoFrameType::kEmptyFrame;
+ break;
+ case 1:
+ video_header.frame_type = VideoFrameType::kVideoFrameKey;
+ break;
+ case 2:
+ video_header.frame_type = VideoFrameType::kVideoFrameDelta;
+ break;
+ }
+
+ switch (codec) {
+ case kVideoCodecVP8:
+ reader.CopyTo(
+ &video_header.video_type_header.emplace<RTPVideoHeaderVP8>());
+ break;
+ case kVideoCodecVP9:
+ reader.CopyTo(
+ &video_header.video_type_header.emplace<RTPVideoHeaderVP9>());
+ break;
+ case kVideoCodecH264:
+ reader.CopyTo(
+ &video_header.video_type_header.emplace<RTPVideoHeaderH264>());
+ break;
+ default:
+ break;
+ }
+
+ video_header.generic = GenerateGenericFrameDependencies(&reader);
+
+ // clang-format off
+ auto frame = std::make_unique<RtpFrameObject>(
+ first_seq_num,
+ last_seq_num,
+ marker_bit,
+ /*times_nacked=*/0,
+ /*first_packet_received_time=*/0,
+ /*last_packet_received_time=*/0,
+ /*rtp_timestamp=*/0,
+ /*ntp_time_ms=*/0,
+ VideoSendTiming(),
+ /*payload_type=*/0,
+ codec,
+ kVideoRotation_0,
+ VideoContentType::UNSPECIFIED,
+ video_header,
+ /*color_space=*/absl::nullopt,
+ RtpPacketInfos(),
+ EncodedImageBuffer::Create(/*size=*/0));
+ // clang-format on
+
+ reference_finder.ManageFrame(std::move(frame));
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc
new file mode 100644
index 0000000000..5d117529bb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc
@@ -0,0 +1,182 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <bitset>
+#include <vector>
+
+#include "absl/types/optional.h"
+#include "modules/rtp_rtcp/include/rtp_header_extension_map.h"
+#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h"
+#include "modules/rtp_rtcp/source/rtp_header_extensions.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+#include "modules/rtp_rtcp/source/rtp_video_layers_allocation_extension.h"
+
+namespace webrtc {
+// We decide which header extensions to register by reading four bytes
+// from the beginning of `data` and interpreting it as a bitmask over
+// the RTPExtensionType enum. This assert ensures four bytes are enough.
+static_assert(kRtpExtensionNumberOfExtensions <= 32,
+ "Insufficient bits read to configure all header extensions. Add "
+ "an extra byte and update the switches.");
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size <= 4)
+ return;
+
+ // Don't use the configuration byte as part of the packet.
+ std::bitset<32> extensionMask(*reinterpret_cast<const uint32_t*>(data));
+ data += 4;
+ size -= 4;
+
+ RtpPacketReceived::ExtensionManager extensions(/*extmap_allow_mixed=*/true);
+ // Start at local_id = 1 since 0 is an invalid extension id.
+ int local_id = 1;
+ // Skip i = 0 since it maps to kRtpExtensionNone.
+ for (int i = 1; i < kRtpExtensionNumberOfExtensions; i++) {
+ RTPExtensionType extension_type = static_cast<RTPExtensionType>(i);
+ if (extensionMask[i]) {
+ // Extensions are registered with an ID, which you signal to the
+ // peer so they know what to expect. This code only cares about
+ // parsing so the value of the ID isn't relevant.
+ extensions.RegisterByType(local_id++, extension_type);
+ }
+ }
+
+ RtpPacketReceived packet(&extensions);
+ packet.Parse(data, size);
+
+ // Call packet accessors because they have extra checks.
+ packet.Marker();
+ packet.PayloadType();
+ packet.SequenceNumber();
+ packet.Timestamp();
+ packet.Ssrc();
+ packet.Csrcs();
+
+ // Each extension has its own getter. It is supported behaviour to
+ // call GetExtension on an extension which was not registered, so we
+ // don't check the bitmask here.
+ for (int i = 0; i < kRtpExtensionNumberOfExtensions; i++) {
+ switch (static_cast<RTPExtensionType>(i)) {
+ case kRtpExtensionNone:
+ case kRtpExtensionNumberOfExtensions:
+ break;
+ case kRtpExtensionTransmissionTimeOffset:
+ int32_t offset;
+ packet.GetExtension<TransmissionOffset>(&offset);
+ break;
+ case kRtpExtensionAudioLevel:
+ bool voice_activity;
+ uint8_t audio_level;
+ packet.GetExtension<AudioLevel>(&voice_activity, &audio_level);
+ break;
+#if !defined(WEBRTC_MOZILLA_BUILD)
+ case kRtpExtensionCsrcAudioLevel: {
+ std::vector<uint8_t> audio_levels;
+ packet.GetExtension<CsrcAudioLevel>(&audio_levels);
+ break;
+ }
+#endif
+ case kRtpExtensionAbsoluteSendTime:
+ uint32_t sendtime;
+ packet.GetExtension<AbsoluteSendTime>(&sendtime);
+ break;
+ case kRtpExtensionAbsoluteCaptureTime: {
+ AbsoluteCaptureTime extension;
+ packet.GetExtension<AbsoluteCaptureTimeExtension>(&extension);
+ break;
+ }
+ case kRtpExtensionVideoRotation:
+ uint8_t rotation;
+ packet.GetExtension<VideoOrientation>(&rotation);
+ break;
+ case kRtpExtensionTransportSequenceNumber:
+ uint16_t seqnum;
+ packet.GetExtension<TransportSequenceNumber>(&seqnum);
+ break;
+ case kRtpExtensionTransportSequenceNumber02: {
+ uint16_t seqnum;
+ absl::optional<FeedbackRequest> feedback_request;
+ packet.GetExtension<TransportSequenceNumberV2>(&seqnum,
+ &feedback_request);
+ break;
+ }
+ case kRtpExtensionPlayoutDelay: {
+ VideoPlayoutDelay playout;
+ packet.GetExtension<PlayoutDelayLimits>(&playout);
+ break;
+ }
+ case kRtpExtensionVideoContentType:
+ VideoContentType content_type;
+ packet.GetExtension<VideoContentTypeExtension>(&content_type);
+ break;
+ case kRtpExtensionVideoTiming: {
+ VideoSendTiming timing;
+ packet.GetExtension<VideoTimingExtension>(&timing);
+ break;
+ }
+ case kRtpExtensionRtpStreamId: {
+ std::string rsid;
+ packet.GetExtension<RtpStreamId>(&rsid);
+ break;
+ }
+ case kRtpExtensionRepairedRtpStreamId: {
+ std::string rsid;
+ packet.GetExtension<RepairedRtpStreamId>(&rsid);
+ break;
+ }
+ case kRtpExtensionMid: {
+ std::string mid;
+ packet.GetExtension<RtpMid>(&mid);
+ break;
+ }
+ case kRtpExtensionGenericFrameDescriptor: {
+ RtpGenericFrameDescriptor descriptor;
+ packet.GetExtension<RtpGenericFrameDescriptorExtension00>(&descriptor);
+ break;
+ }
+ case kRtpExtensionColorSpace: {
+ ColorSpace color_space;
+ packet.GetExtension<ColorSpaceExtension>(&color_space);
+ break;
+ }
+ case kRtpExtensionInbandComfortNoise: {
+ absl::optional<uint8_t> noise_level;
+ packet.GetExtension<InbandComfortNoiseExtension>(&noise_level);
+ break;
+ }
+ case kRtpExtensionVideoLayersAllocation: {
+ VideoLayersAllocation allocation;
+ packet.GetExtension<RtpVideoLayersAllocationExtension>(&allocation);
+ break;
+ }
+ case kRtpExtensionVideoFrameTrackingId: {
+ uint16_t tracking_id;
+ packet.GetExtension<VideoFrameTrackingIdExtension>(&tracking_id);
+ break;
+ }
+ case kRtpExtensionDependencyDescriptor:
+ // This extension requires state to read and so complicated that
+ // deserves own fuzzer.
+ break;
+#if defined(WEBRTC_MOZILLA_BUILD)
+ case kRtpExtensionCsrcAudioLevel: {
+ CsrcAudioLevelList levels;
+ packet.GetExtension<CsrcAudioLevel>(&levels);
+ break;
+ }
+#endif
+ }
+ }
+
+ // Check that zero-ing mutable extensions wouldn't cause any problems.
+ packet.ZeroMutableExtensions();
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc
new file mode 100644
index 0000000000..e5550c1279
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/video/video_frame_type.h"
+#include "modules/rtp_rtcp/source/rtp_format.h"
+#include "modules/rtp_rtcp/source/rtp_packet_to_send.h"
+#include "modules/rtp_rtcp/source/rtp_packetizer_av1.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size));
+
+ RtpPacketizer::PayloadSizeLimits limits;
+ limits.max_payload_len = 1200;
+ // Read uint8_t to be sure reduction_lens are much smaller than
+ // max_payload_len and thus limits structure is valid.
+ limits.first_packet_reduction_len = fuzz_input.ReadOrDefaultValue<uint8_t>(0);
+ limits.last_packet_reduction_len = fuzz_input.ReadOrDefaultValue<uint8_t>(0);
+ limits.single_packet_reduction_len =
+ fuzz_input.ReadOrDefaultValue<uint8_t>(0);
+ const VideoFrameType kFrameTypes[] = {VideoFrameType::kVideoFrameKey,
+ VideoFrameType::kVideoFrameDelta};
+ VideoFrameType frame_type = fuzz_input.SelectOneOf(kFrameTypes);
+
+ // Main function under test: RtpPacketizerAv1's constructor.
+ RtpPacketizerAv1 packetizer(fuzz_input.ReadByteArray(fuzz_input.BytesLeft()),
+ limits, frame_type,
+ /*is_last_frame_in_picture=*/true);
+
+ size_t num_packets = packetizer.NumPackets();
+ if (num_packets == 0) {
+ return;
+ }
+ // When packetization was successful, validate NextPacket function too.
+ // While at it, check that packets respect the payload size limits.
+ RtpPacketToSend rtp_packet(nullptr);
+ // Single packet.
+ if (num_packets == 1) {
+ RTC_CHECK(packetizer.NextPacket(&rtp_packet));
+ RTC_CHECK_LE(rtp_packet.payload_size(),
+ limits.max_payload_len - limits.single_packet_reduction_len);
+ return;
+ }
+ // First packet.
+ RTC_CHECK(packetizer.NextPacket(&rtp_packet));
+ RTC_CHECK_LE(rtp_packet.payload_size(),
+ limits.max_payload_len - limits.first_packet_reduction_len);
+ // Middle packets.
+ for (size_t i = 1; i < num_packets - 1; ++i) {
+ RTC_CHECK(packetizer.NextPacket(&rtp_packet))
+ << "Failed to get packet#" << i;
+ RTC_CHECK_LE(rtp_packet.payload_size(), limits.max_payload_len)
+ << "Packet #" << i << " exceeds it's limit";
+ }
+ // Last packet.
+ RTC_CHECK(packetizer.NextPacket(&rtp_packet));
+ RTC_CHECK_LE(rtp_packet.payload_size(),
+ limits.max_payload_len - limits.last_packet_reduction_len);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc
new file mode 100644
index 0000000000..6ab6b9a905
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2023 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+
+#include "api/video/rtp_video_frame_assembler.h"
+#include "modules/rtp_rtcp/include/rtp_header_extension_map.h"
+#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h"
+#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size == 0) {
+ return;
+ }
+ RtpHeaderExtensionMap extensions;
+ extensions.Register<RtpDependencyDescriptorExtension>(1);
+ extensions.Register<RtpGenericFrameDescriptorExtension00>(2);
+ RtpPacketReceived rtp_packet(&extensions);
+
+ RtpVideoFrameAssembler assembler(
+ static_cast<RtpVideoFrameAssembler::PayloadFormat>(data[0] % 6));
+
+ for (size_t i = 1; i < size;) {
+ size_t packet_size = std::min<size_t>(size - i, 300);
+ if (rtp_packet.Parse(data + i, packet_size)) {
+ assembler.InsertPacket(rtp_packet);
+ }
+ i += packet_size;
+ }
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc
new file mode 100644
index 0000000000..ae8b8728fb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+
+#include "api/array_view.h"
+#include "api/video/video_layers_allocation.h"
+#include "modules/rtp_rtcp/source/rtp_video_layers_allocation_extension.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ // Video layers allocation is an rtp header extension.
+ // Per https://datatracker.ietf.org/doc/html/rfc8285#section-4.3
+ // rtp header extension uses up to one byte to store the size, i.e.
+ // maximum size of any rtp header extension is 255 bytes.
+ constexpr int kMaxSize = std::numeric_limits<uint8_t>::max();
+ if (size > kMaxSize) {
+ return;
+ }
+ auto raw = rtc::MakeArrayView(data, size);
+
+ VideoLayersAllocation allocation1;
+ if (!RtpVideoLayersAllocationExtension::Parse(raw, &allocation1)) {
+ // Ignore invalid buffer and move on.
+ return;
+ }
+
+ // Write parsed allocation back into raw buffer.
+ size_t value_size = RtpVideoLayersAllocationExtension::ValueSize(allocation1);
+ // Check `writer` use minimal number of bytes to pack the extension by
+ // checking it doesn't use more than reader consumed.
+ RTC_CHECK_LE(value_size, raw.size());
+ uint8_t some_memory[kMaxSize];
+ RTC_CHECK_LE(value_size, kMaxSize);
+ rtc::ArrayView<uint8_t> write_buffer(some_memory, value_size);
+ RTC_CHECK(
+ RtpVideoLayersAllocationExtension::Write(write_buffer, allocation1));
+
+ // Parse what Write assembled.
+ // Unlike random input that should always succeed.
+ VideoLayersAllocation allocation2;
+ RTC_CHECK(
+ RtpVideoLayersAllocationExtension::Parse(write_buffer, &allocation2));
+
+ RTC_CHECK_EQ(allocation1.rtp_stream_index, allocation2.rtp_stream_index);
+ RTC_CHECK_EQ(allocation1.resolution_and_frame_rate_is_valid,
+ allocation2.resolution_and_frame_rate_is_valid);
+ RTC_CHECK_EQ(allocation1.active_spatial_layers.size(),
+ allocation2.active_spatial_layers.size());
+ RTC_CHECK(allocation1 == allocation2);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc
new file mode 100644
index 0000000000..249707514e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "api/data_channel_interface.h"
+#include "pc/sctp_utils.h"
+#include "rtc_base/copy_on_write_buffer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ rtc::CopyOnWriteBuffer payload(data, size);
+ std::string label;
+ DataChannelInit config;
+ IsOpenMessage(payload);
+ ParseDataChannelOpenMessage(payload, &label, &config);
+ ParseDataChannelOpenAckMessage(payload);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc
new file mode 100644
index 0000000000..ece4b50505
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "absl/strings/string_view.h"
+#include "pc/test/integration_test_helpers.h"
+
+namespace webrtc {
+
+class FuzzerTest : public PeerConnectionIntegrationBaseTest {
+ public:
+ FuzzerTest()
+ : PeerConnectionIntegrationBaseTest(SdpSemantics::kUnifiedPlan) {}
+
+ void RunNegotiateCycle(absl::string_view message) {
+ CreatePeerConnectionWrappers();
+ // Note - we do not do test.ConnectFakeSignaling(); all signals
+ // generated are discarded.
+
+ auto srd_observer =
+ rtc::make_ref_counted<FakeSetRemoteDescriptionObserver>();
+
+ SdpParseError error;
+ std::unique_ptr<SessionDescriptionInterface> sdp(
+ CreateSessionDescription("offer", std::string(message), &error));
+ caller()->pc()->SetRemoteDescription(std::move(sdp), srd_observer);
+ // Wait a short time for observer to be called. Timeout is short
+ // because the fuzzer should be trying many branches.
+ EXPECT_TRUE_WAIT(srd_observer->called(), 100);
+
+ // If set-remote-description was successful, try to answer.
+ auto sld_observer =
+ rtc::make_ref_counted<FakeSetLocalDescriptionObserver>();
+ if (srd_observer->error().ok()) {
+ caller()->pc()->SetLocalDescription(sld_observer);
+ EXPECT_TRUE_WAIT(sld_observer->called(), 100);
+ }
+ // If there is an EXPECT failure, die here.
+ RTC_CHECK(!HasFailure());
+ }
+
+ // This test isn't using the test definition macros, so we have to
+ // define the TestBody() function, even though we don't need it.
+ void TestBody() override {}
+};
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 16384) {
+ return;
+ }
+
+ FuzzerTest test;
+ test.RunNegotiateCycle(
+ absl::string_view(reinterpret_cast<const char*>(data), size));
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc
new file mode 100644
index 0000000000..c85eab4047
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/jsep_session_description.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ if (size > 16384) {
+ return;
+ }
+ std::string message(reinterpret_cast<const char*>(data), size);
+ webrtc::SdpParseError error;
+
+ std::unique_ptr<webrtc::SessionDescriptionInterface> sdp(
+ CreateSessionDescription("offer", message, &error));
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc
new file mode 100644
index 0000000000..4bab5c8f02
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "rtc_base/message_digest.h"
+#include "rtc_base/ssl_certificate.h"
+#include "rtc_base/string_encode.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ std::string pem_certificate(reinterpret_cast<const char*>(data), size);
+
+ std::unique_ptr<rtc::SSLCertificate> cert =
+ rtc::SSLCertificate::FromPEMString(pem_certificate);
+
+ if (cert == nullptr) {
+ return;
+ }
+
+ cert->Clone();
+ cert->GetStats();
+ cert->ToPEMString();
+ cert->CertificateExpirationTime();
+
+ std::string algorithm;
+ cert->GetSignatureDigestAlgorithm(&algorithm);
+
+ unsigned char digest[rtc::MessageDigest::kMaxSize];
+ size_t digest_len;
+ cert->ComputeDigest(algorithm, digest, rtc::MessageDigest::kMaxSize,
+ &digest_len);
+
+ rtc::Buffer der_buffer;
+ cert->ToDER(&der_buffer);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc
new file mode 100644
index 0000000000..28b36a73ce
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "rtc_base/string_to_number.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ std::string number_to_parse(reinterpret_cast<const char*>(data), size);
+ rtc::StringToNumber<int8_t>(number_to_parse);
+ rtc::StringToNumber<int16_t>(number_to_parse);
+ rtc::StringToNumber<int32_t>(number_to_parse);
+ rtc::StringToNumber<int64_t>(number_to_parse);
+ rtc::StringToNumber<uint8_t>(number_to_parse);
+ rtc::StringToNumber<uint16_t>(number_to_parse);
+ rtc::StringToNumber<uint32_t>(number_to_parse);
+ rtc::StringToNumber<uint64_t>(number_to_parse);
+ rtc::StringToNumber<float>(number_to_parse);
+ rtc::StringToNumber<double>(number_to_parse);
+ rtc::StringToNumber<long double>(number_to_parse);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc
new file mode 100644
index 0000000000..6ca9eac8b2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/transport/stun.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ const char* message = reinterpret_cast<const char*>(data);
+
+ // Normally we'd check the integrity first, but those checks are
+ // fuzzed separately in stun_validator_fuzzer.cc. We still want to
+ // fuzz this target since the integrity checks could be forged by a
+ // malicious adversary who receives a call.
+ std::unique_ptr<cricket::IceMessage> stun_msg(new cricket::IceMessage());
+ rtc::ByteBufferReader buf(message, size);
+ stun_msg->Read(&buf);
+ stun_msg->ValidateMessageIntegrity("");
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc
new file mode 100644
index 0000000000..421638db1b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/transport/stun.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ const char* message = reinterpret_cast<const char*>(data);
+
+ cricket::StunMessage::ValidateFingerprint(message, size);
+ cricket::StunMessage::ValidateMessageIntegrityForTesting(message, size, "");
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc
new file mode 100644
index 0000000000..47ee7fd205
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "media/base/turn_utils.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ size_t content_position;
+ size_t content_size;
+ cricket::UnwrapTurnPacket(data, size, &content_position, &content_size);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc
new file mode 100644
index 0000000000..43d9450918
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/include/module_common_types_public.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/fec_test_helper.h"
+#include "modules/rtp_rtcp/source/ulpfec_generator.h"
+#include "rtc_base/checks.h"
+#include "rtc_base/copy_on_write_buffer.h"
+#include "system_wrappers/include/clock.h"
+
+namespace webrtc {
+
+namespace {
+constexpr uint8_t kFecPayloadType = 96;
+constexpr uint8_t kRedPayloadType = 97;
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ SimulatedClock clock(1);
+ UlpfecGenerator generator(kRedPayloadType, kFecPayloadType, &clock);
+ size_t i = 0;
+ if (size < 4)
+ return;
+ FecProtectionParams params = {
+ data[i++] % 128, static_cast<int>(data[i++] % 10), kFecMaskBursty};
+ generator.SetProtectionParameters(params, params);
+ uint16_t seq_num = data[i++];
+ uint16_t prev_seq_num = 0;
+ while (i + 3 < size) {
+ size_t rtp_header_length = data[i++] % 10 + 12;
+ size_t payload_size = data[i++] % 10;
+ if (i + payload_size + rtp_header_length + 2 > size)
+ break;
+ rtc::CopyOnWriteBuffer packet(&data[i], payload_size + rtp_header_length);
+ packet.EnsureCapacity(IP_PACKET_SIZE);
+ // Write a valid parsable header (version = 2, no padding, no extensions,
+ // no CSRCs).
+ ByteWriter<uint8_t>::WriteBigEndian(packet.MutableData(), 2 << 6);
+ // Make sure sequence numbers are increasing.
+ ByteWriter<uint16_t>::WriteBigEndian(packet.MutableData() + 2, seq_num++);
+ i += payload_size + rtp_header_length;
+ const bool protect = data[i++] % 2 == 1;
+
+ // Check the sequence numbers are monotonic. In rare case the packets number
+ // may loop around and in the same FEC-protected group the packet sequence
+ // number became out of order.
+ if (protect && IsNewerSequenceNumber(seq_num, prev_seq_num) &&
+ seq_num < prev_seq_num + kUlpfecMaxMediaPackets) {
+ RtpPacketToSend rtp_packet(nullptr);
+ // Check that we actually have a parsable packet, we want to fuzz FEC
+ // logic, not RTP header parsing.
+ RTC_CHECK(rtp_packet.Parse(packet));
+ generator.AddPacketAndGenerateFec(rtp_packet);
+ prev_seq_num = seq_num;
+ }
+
+ generator.GetFecPackets();
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc
new file mode 100644
index 0000000000..243cb4ed70
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "api/scoped_refptr.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/forward_error_correction.h"
+#include "modules/rtp_rtcp/source/ulpfec_header_reader_writer.h"
+
+namespace webrtc {
+
+using Packet = ForwardErrorCorrection::Packet;
+using ReceivedFecPacket = ForwardErrorCorrection::ReceivedFecPacket;
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ ReceivedFecPacket packet;
+ packet.pkt = rtc::scoped_refptr<Packet>(new Packet());
+ const size_t packet_size =
+ std::min(size, static_cast<size_t>(IP_PACKET_SIZE));
+ packet.pkt->data.SetSize(packet_size);
+ packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE);
+ memcpy(packet.pkt->data.MutableData(), data, packet_size);
+
+ UlpfecHeaderReader ulpfec_reader;
+ ulpfec_reader.ReadFecHeader(&packet);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc
new file mode 100644
index 0000000000..0a29ba3259
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+#include "modules/rtp_rtcp/source/ulpfec_receiver.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+
+namespace {
+class DummyCallback : public RecoveredPacketReceiver {
+ void OnRecoveredPacket(const RtpPacketReceived& packet) override {}
+};
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ constexpr size_t kMinDataNeeded = 12;
+ if (size < kMinDataNeeded || size > 2000) {
+ return;
+ }
+
+ uint32_t ulpfec_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 0);
+ uint16_t ulpfec_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 4);
+ uint32_t media_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 6);
+ uint16_t media_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 10);
+
+ DummyCallback callback;
+ UlpfecReceiver receiver(ulpfec_ssrc, 0, &callback, Clock::GetRealTimeClock());
+
+ test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size));
+ while (fuzz_data.CanReadBytes(kMinDataNeeded)) {
+ size_t packet_length = kRtpHeaderSize + fuzz_data.Read<uint8_t>();
+ auto raw_packet = fuzz_data.ReadByteArray(packet_length);
+
+ RtpPacketReceived parsed_packet;
+ if (!parsed_packet.Parse(raw_packet))
+ continue;
+
+ // Overwrite the fields for the sequence number and SSRC with
+ // consistent values for either a received UlpFEC packet or received media
+ // packet. (We're still relying on libfuzzer to manage to generate packet
+ // headers that interact together; this just ensures that we have two
+ // consistent streams).
+ if (fuzz_data.ReadOrDefaultValue<uint8_t>(0) % 2 == 0) {
+ // Simulate UlpFEC packet.
+ parsed_packet.SetSequenceNumber(ulpfec_seq_num++);
+ parsed_packet.SetSsrc(ulpfec_ssrc);
+ } else {
+ // Simulate media packet.
+ parsed_packet.SetSequenceNumber(media_seq_num++);
+ parsed_packet.SetSsrc(media_ssrc);
+ }
+
+ receiver.AddReceivedRedPacket(parsed_packet);
+ }
+
+ receiver.ProcessReceivedFec();
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn b/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn
new file mode 100644
index 0000000000..c5744fc33b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn
@@ -0,0 +1,47 @@
+# Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+#
+# Use of this source code is governed by a BSD-style license
+# that can be found in the LICENSE file in the root of the source
+# tree. An additional intellectual property rights grant can be found
+# in the file PATENTS. All contributing project authors may
+# be found in the AUTHORS file in the root of the source tree.
+
+import("../../../webrtc.gni")
+
+rtc_library("rtp_replayer") {
+ testonly = true
+ sources = [
+ "rtp_replayer.cc",
+ "rtp_replayer.h",
+ ]
+ deps = [
+ "../../../api/rtc_event_log",
+ "../../../api/task_queue:default_task_queue_factory",
+ "../../../api/test/video:function_video_factory",
+ "../../../api/transport:field_trial_based_config",
+ "../../../api/units:timestamp",
+ "../../../api/video_codecs:video_codecs_api",
+ "../../../call",
+ "../../../call:call_interfaces",
+ "../../../common_video",
+ "../../../media:rtc_internal_video_codecs",
+ "../../../modules/rtp_rtcp:rtp_rtcp_format",
+ "../../../rtc_base:checks",
+ "../../../rtc_base:rtc_base_tests_utils",
+ "../../../rtc_base:rtc_json",
+ "../../../rtc_base:timeutils",
+ "../../../system_wrappers",
+ "../../../test:call_config_utils",
+ "../../../test:encoder_settings",
+ "../../../test:fake_video_codecs",
+ "../../../test:null_transport",
+ "../../../test:rtp_test_utils",
+ "../../../test:run_loop",
+ "../../../test:run_test",
+ "../../../test:run_test_interface",
+ "../../../test:test_renderer",
+ "../../../test:test_support",
+ "../../../test:video_test_common",
+ ]
+ absl_deps = [ "//third_party/abseil-cpp/absl/memory:memory" ]
+}
diff --git a/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc
new file mode 100644
index 0000000000..12743d89d9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc
@@ -0,0 +1,200 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/utils/rtp_replayer.h"
+
+#include <algorithm>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "absl/memory/memory.h"
+#include "api/task_queue/default_task_queue_factory.h"
+#include "api/transport/field_trial_based_config.h"
+#include "api/units/timestamp.h"
+#include "modules/rtp_rtcp/source/rtp_packet.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+#include "rtc_base/strings/json.h"
+#include "system_wrappers/include/clock.h"
+#include "test/call_config_utils.h"
+#include "test/encoder_settings.h"
+#include "test/fake_decoder.h"
+#include "test/rtp_file_reader.h"
+#include "test/run_loop.h"
+
+namespace webrtc {
+namespace test {
+
+void RtpReplayer::Replay(const std::string& replay_config_filepath,
+ const uint8_t* rtp_dump_data,
+ size_t rtp_dump_size) {
+ auto stream_state = std::make_unique<StreamState>();
+ std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs =
+ ReadConfigFromFile(replay_config_filepath, &(stream_state->transport));
+ return Replay(std::move(stream_state), std::move(receive_stream_configs),
+ rtp_dump_data, rtp_dump_size);
+}
+
+void RtpReplayer::Replay(
+ std::unique_ptr<StreamState> stream_state,
+ std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs,
+ const uint8_t* rtp_dump_data,
+ size_t rtp_dump_size) {
+ RunLoop loop;
+ rtc::ScopedBaseFakeClock fake_clock;
+
+ // Work around: webrtc calls webrtc::Random(clock.TimeInMicroseconds())
+ // everywhere and Random expects non-zero seed. Let's set the clock non-zero
+ // to make them happy.
+ fake_clock.SetTime(webrtc::Timestamp::Millis(1));
+
+ // Attempt to create an RtpReader from the input file.
+ auto rtp_reader = CreateRtpReader(rtp_dump_data, rtp_dump_size);
+ if (rtp_reader == nullptr) {
+ RTC_LOG(LS_ERROR) << "Failed to create the rtp_reader";
+ return;
+ }
+
+ RtpHeaderExtensionMap extensions(/*extmap_allow_mixed=*/true);
+ // Skip i = 0 since it maps to kRtpExtensionNone.
+ for (int i = 1; i < kRtpExtensionNumberOfExtensions; i++) {
+ RTPExtensionType extension_type = static_cast<RTPExtensionType>(i);
+ // Extensions are registered with an ID, which you signal to the
+ // peer so they know what to expect. This code only cares about
+ // parsing so the value of the ID isn't relevant.
+ extensions.RegisterByType(i, extension_type);
+ }
+
+ // Setup the video streams based on the configuration.
+ webrtc::RtcEventLogNull event_log;
+ std::unique_ptr<TaskQueueFactory> task_queue_factory =
+ CreateDefaultTaskQueueFactory();
+ Call::Config call_config(&event_log);
+ call_config.task_queue_factory = task_queue_factory.get();
+ FieldTrialBasedConfig field_trials;
+ call_config.trials = &field_trials;
+ std::unique_ptr<Call> call(Call::Create(call_config));
+ SetupVideoStreams(&receive_stream_configs, stream_state.get(), call.get());
+
+ // Start replaying the provided stream now that it has been configured.
+ for (const auto& receive_stream : stream_state->receive_streams) {
+ receive_stream->Start();
+ }
+
+ ReplayPackets(&fake_clock, call.get(), rtp_reader.get(), extensions);
+
+ for (const auto& receive_stream : stream_state->receive_streams) {
+ call->DestroyVideoReceiveStream(receive_stream);
+ }
+}
+
+std::vector<VideoReceiveStreamInterface::Config>
+RtpReplayer::ReadConfigFromFile(const std::string& replay_config,
+ Transport* transport) {
+ Json::CharReaderBuilder factory;
+ std::unique_ptr<Json::CharReader> json_reader =
+ absl::WrapUnique(factory.newCharReader());
+ Json::Value json_configs;
+ Json::String errors;
+ if (!json_reader->parse(replay_config.data(),
+ replay_config.data() + replay_config.length(),
+ &json_configs, &errors)) {
+ RTC_LOG(LS_ERROR)
+ << "Error parsing JSON replay configuration for the fuzzer: " << errors;
+ return {};
+ }
+
+ std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs;
+ receive_stream_configs.reserve(json_configs.size());
+ for (const auto& json : json_configs) {
+ receive_stream_configs.push_back(
+ ParseVideoReceiveStreamJsonConfig(transport, json));
+ }
+ return receive_stream_configs;
+}
+
+void RtpReplayer::SetupVideoStreams(
+ std::vector<VideoReceiveStreamInterface::Config>* receive_stream_configs,
+ StreamState* stream_state,
+ Call* call) {
+ stream_state->decoder_factory = std::make_unique<InternalDecoderFactory>();
+ for (auto& receive_config : *receive_stream_configs) {
+ // Attach the decoder for the corresponding payload type in the config.
+ for (auto& decoder : receive_config.decoders) {
+ decoder = test::CreateMatchingDecoder(decoder.payload_type,
+ decoder.video_format.name);
+ }
+
+ // Create the window to display the rendered video.
+ stream_state->sinks.emplace_back(
+ test::VideoRenderer::Create("Fuzzing WebRTC Video Config", 640, 480));
+ // Create a receive stream for this config.
+ receive_config.renderer = stream_state->sinks.back().get();
+ receive_config.decoder_factory = stream_state->decoder_factory.get();
+ stream_state->receive_streams.emplace_back(
+ call->CreateVideoReceiveStream(std::move(receive_config)));
+ }
+}
+
+std::unique_ptr<test::RtpFileReader> RtpReplayer::CreateRtpReader(
+ const uint8_t* rtp_dump_data,
+ size_t rtp_dump_size) {
+ std::unique_ptr<test::RtpFileReader> rtp_reader(test::RtpFileReader::Create(
+ test::RtpFileReader::kRtpDump, rtp_dump_data, rtp_dump_size, {}));
+ if (!rtp_reader) {
+ RTC_LOG(LS_ERROR) << "Unable to open input file with any supported format";
+ return nullptr;
+ }
+ return rtp_reader;
+}
+
+void RtpReplayer::ReplayPackets(
+ rtc::FakeClock* clock,
+ Call* call,
+ test::RtpFileReader* rtp_reader,
+ const RtpPacketReceived::ExtensionManager& extensions) {
+ int64_t replay_start_ms = -1;
+
+ while (true) {
+ int64_t now_ms = rtc::TimeMillis();
+ if (replay_start_ms == -1) {
+ replay_start_ms = now_ms;
+ }
+
+ test::RtpPacket packet;
+ if (!rtp_reader->NextPacket(&packet)) {
+ break;
+ }
+
+ int64_t deliver_in_ms = replay_start_ms + packet.time_ms - now_ms;
+ if (deliver_in_ms > 0) {
+ // StatsCounter::ReportMetricToAggregatedCounter is O(elapsed time).
+ // Set an upper limit to prevent waste time.
+ clock->AdvanceTime(webrtc::TimeDelta::Millis(
+ std::min(deliver_in_ms, static_cast<int64_t>(100))));
+ }
+
+ RtpPacketReceived received_packet(
+ &extensions, Timestamp::Micros(clock->TimeNanos() / 1000));
+ if (!received_packet.Parse(packet.data, packet.length)) {
+ RTC_LOG(LS_ERROR) << "Packet error, corrupt packets or incorrect setup?";
+ break;
+ }
+
+ call->Receiver()->DeliverRtpPacket(
+ MediaType::VIDEO, std::move(received_packet),
+ [&](const RtpPacketReceived& parsed_packet) {
+ RTC_LOG(LS_ERROR) << "Unknown SSRC: " << parsed_packet.Ssrc();
+ return false;
+ });
+ }
+}
+} // namespace test
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h
new file mode 100644
index 0000000000..ae94a640a5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_UTILS_RTP_REPLAYER_H_
+#define TEST_FUZZERS_UTILS_RTP_REPLAYER_H_
+
+#include <stdio.h>
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "api/rtc_event_log/rtc_event_log.h"
+#include "api/test/video/function_video_decoder_factory.h"
+#include "api/video_codecs/video_decoder.h"
+#include "call/call.h"
+#include "media/engine/internal_decoder_factory.h"
+#include "rtc_base/fake_clock.h"
+#include "rtc_base/time_utils.h"
+#include "test/null_transport.h"
+#include "test/rtp_file_reader.h"
+#include "test/test_video_capturer.h"
+#include "test/video_renderer.h"
+
+namespace webrtc {
+namespace test {
+
+// The RtpReplayer is a utility for fuzzing the RTP/RTCP receiver stack in
+// WebRTC. It achieves this by accepting a set of Receiver configurations and
+// an RtpDump (consisting of both RTP and RTCP packets). The `rtp_dump` is
+// passed in as a buffer to allow simple mutation fuzzing directly on the dump.
+class RtpReplayer final {
+ public:
+ // Holds all the important stream information required to emulate the WebRTC
+ // rtp receival code path.
+ struct StreamState {
+ test::NullTransport transport;
+ std::vector<std::unique_ptr<rtc::VideoSinkInterface<VideoFrame>>> sinks;
+ std::vector<VideoReceiveStreamInterface*> receive_streams;
+ std::unique_ptr<VideoDecoderFactory> decoder_factory;
+ };
+
+ // Construct an RtpReplayer from a JSON replay configuration file.
+ static void Replay(const std::string& replay_config_filepath,
+ const uint8_t* rtp_dump_data,
+ size_t rtp_dump_size);
+
+ // Construct an RtpReplayer from a set of
+ // VideoReceiveStreamInterface::Configs. Note the stream_state.transport must
+ // be set for each receiver stream.
+ static void Replay(
+ std::unique_ptr<StreamState> stream_state,
+ std::vector<VideoReceiveStreamInterface::Config> receive_stream_config,
+ const uint8_t* rtp_dump_data,
+ size_t rtp_dump_size);
+
+ private:
+ // Reads the replay configuration from Json.
+ static std::vector<VideoReceiveStreamInterface::Config> ReadConfigFromFile(
+ const std::string& replay_config,
+ Transport* transport);
+
+ // Configures the stream state based on the receiver configurations.
+ static void SetupVideoStreams(
+ std::vector<VideoReceiveStreamInterface::Config>* receive_stream_configs,
+ StreamState* stream_state,
+ Call* call);
+
+ // Creates a new RtpReader which can read the RtpDump
+ static std::unique_ptr<test::RtpFileReader> CreateRtpReader(
+ const uint8_t* rtp_dump_data,
+ size_t rtp_dump_size);
+
+ // Replays each packet to from the RtpDump.
+ static void ReplayPackets(rtc::FakeClock* clock,
+ Call* call,
+ test::RtpFileReader* rtp_reader,
+ const RtpHeaderExtensionMap& extensions);
+}; // class RtpReplayer
+
+} // namespace test
+} // namespace webrtc
+
+#endif // TEST_FUZZERS_UTILS_RTP_REPLAYER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc
new file mode 100644
index 0000000000..1691b55cc0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "api/array_view.h"
+#include "modules/rtp_rtcp/source/rtp_video_header.h"
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_vp8.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ RTPVideoHeader video_header;
+ VideoRtpDepacketizerVp8::ParseRtpPayload(rtc::MakeArrayView(data, size),
+ &video_header);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc
new file mode 100644
index 0000000000..2ecfd820c8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/video_coding/utility/vp8_header_parser.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ int qp;
+ vp8::GetQp(data, size, &qp);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc
new file mode 100644
index 0000000000..819b9626f9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+
+#include "test/fuzzers/utils/rtp_replayer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ auto stream_state = std::make_unique<test::RtpReplayer::StreamState>();
+ VideoReceiveStreamInterface::Config vp8_config(&(stream_state->transport));
+
+ VideoReceiveStreamInterface::Decoder vp8_decoder;
+ vp8_decoder.video_format = SdpVideoFormat("VP8");
+ vp8_decoder.payload_type = 125;
+ vp8_config.decoders.push_back(std::move(vp8_decoder));
+
+ vp8_config.rtp.local_ssrc = 7731;
+ vp8_config.rtp.remote_ssrc = 1337;
+ vp8_config.rtp.rtx_ssrc = 100;
+ vp8_config.rtp.nack.rtp_history_ms = 1000;
+ vp8_config.rtp.lntf.enabled = true;
+
+ std::vector<VideoReceiveStreamInterface::Config> replay_configs;
+ replay_configs.push_back(std::move(vp8_config));
+
+ test::RtpReplayer::Replay(std::move(stream_state), std::move(replay_configs),
+ data, size);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc
new file mode 100644
index 0000000000..ae36a94931
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+#include "api/array_view.h"
+#include "modules/rtp_rtcp/source/rtp_video_header.h"
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_vp9.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ RTPVideoHeader video_header;
+ VideoRtpDepacketizerVp9::ParseRtpPayload(rtc::MakeArrayView(data, size),
+ &video_header);
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc
new file mode 100644
index 0000000000..09848ae4de
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc
@@ -0,0 +1,624 @@
+/*
+ * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stdint.h>
+
+#include "absl/algorithm/container.h"
+#include "absl/base/macros.h"
+#include "absl/container/inlined_vector.h"
+#include "api/array_view.h"
+#include "api/field_trials_view.h"
+#include "api/video/video_frame.h"
+#include "api/video_codecs/video_codec.h"
+#include "api/video_codecs/video_encoder.h"
+#include "modules/video_coding/codecs/interface/libvpx_interface.h"
+#include "modules/video_coding/codecs/vp9/libvpx_vp9_encoder.h"
+#include "modules/video_coding/frame_dependencies_calculator.h"
+#include "rtc_base/numerics/safe_compare.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+// Fuzzer simulates various svc configurations and libvpx encoder dropping
+// layer frames.
+// Validates vp9 encoder wrapper produces consistent frame references.
+namespace webrtc {
+namespace {
+
+using test::FuzzDataHelper;
+
+constexpr int kBitrateEnabledBps = 100'000;
+
+class FrameValidator : public EncodedImageCallback {
+ public:
+ ~FrameValidator() override = default;
+
+ Result OnEncodedImage(const EncodedImage& encoded_image,
+ const CodecSpecificInfo* codec_specific_info) override {
+ RTC_CHECK(codec_specific_info);
+ RTC_CHECK_EQ(codec_specific_info->codecType, kVideoCodecVP9);
+ if (codec_specific_info->codecSpecific.VP9.first_frame_in_picture) {
+ ++picture_id_;
+ }
+ int64_t frame_id = frame_id_++;
+ LayerFrame& layer_frame = frames_[frame_id % kMaxFrameHistorySize];
+ layer_frame.picture_id = picture_id_;
+ layer_frame.spatial_id = encoded_image.SpatialIndex().value_or(0);
+ layer_frame.frame_id = frame_id;
+ layer_frame.temporal_id =
+ codec_specific_info->codecSpecific.VP9.temporal_idx;
+ if (layer_frame.temporal_id == kNoTemporalIdx) {
+ layer_frame.temporal_id = 0;
+ }
+ layer_frame.vp9_non_ref_for_inter_layer_pred =
+ codec_specific_info->codecSpecific.VP9.non_ref_for_inter_layer_pred;
+ CheckVp9References(layer_frame, codec_specific_info->codecSpecific.VP9);
+
+ if (codec_specific_info->generic_frame_info.has_value()) {
+ absl::InlinedVector<int64_t, 5> frame_dependencies =
+ dependencies_calculator_.FromBuffersUsage(
+ frame_id,
+ codec_specific_info->generic_frame_info->encoder_buffers);
+
+ CheckGenericReferences(frame_dependencies,
+ *codec_specific_info->generic_frame_info);
+ CheckGenericAndCodecSpecificReferencesAreConsistent(
+ frame_dependencies, *codec_specific_info, layer_frame);
+ }
+
+ return Result(Result::OK);
+ }
+
+ private:
+ // With 4 spatial layers and patterns up to 8 pictures, it should be enough to
+ // keep the last 32 frames to validate dependencies.
+ static constexpr size_t kMaxFrameHistorySize = 32;
+ struct LayerFrame {
+ int64_t frame_id;
+ int64_t picture_id;
+ int spatial_id;
+ int temporal_id;
+ bool vp9_non_ref_for_inter_layer_pred;
+ };
+
+ void CheckVp9References(const LayerFrame& layer_frame,
+ const CodecSpecificInfoVP9& vp9_info) {
+ if (layer_frame.frame_id == 0) {
+ RTC_CHECK(!vp9_info.inter_layer_predicted);
+ } else {
+ const LayerFrame& previous_frame = Frame(layer_frame.frame_id - 1);
+ if (vp9_info.inter_layer_predicted) {
+ RTC_CHECK(!previous_frame.vp9_non_ref_for_inter_layer_pred);
+ RTC_CHECK_EQ(layer_frame.picture_id, previous_frame.picture_id);
+ }
+ if (previous_frame.picture_id == layer_frame.picture_id) {
+ RTC_CHECK_GT(layer_frame.spatial_id, previous_frame.spatial_id);
+ // The check below would fail for temporal shift structures. Remove it
+ // or move it to !flexible_mode section when vp9 encoder starts
+ // supporting such structures.
+ RTC_CHECK_EQ(layer_frame.temporal_id, previous_frame.temporal_id);
+ }
+ }
+ if (!vp9_info.flexible_mode) {
+ if (vp9_info.gof.num_frames_in_gof > 0) {
+ gof_.CopyGofInfoVP9(vp9_info.gof);
+ }
+ RTC_CHECK_EQ(gof_.temporal_idx[vp9_info.gof_idx],
+ layer_frame.temporal_id);
+ }
+ }
+
+ void CheckGenericReferences(rtc::ArrayView<const int64_t> frame_dependencies,
+ const GenericFrameInfo& generic_info) const {
+ for (int64_t dependency_frame_id : frame_dependencies) {
+ RTC_CHECK_GE(dependency_frame_id, 0);
+ const LayerFrame& dependency = Frame(dependency_frame_id);
+ RTC_CHECK_GE(generic_info.spatial_id, dependency.spatial_id);
+ RTC_CHECK_GE(generic_info.temporal_id, dependency.temporal_id);
+ }
+ }
+
+ void CheckGenericAndCodecSpecificReferencesAreConsistent(
+ rtc::ArrayView<const int64_t> frame_dependencies,
+ const CodecSpecificInfo& info,
+ const LayerFrame& layer_frame) const {
+ const CodecSpecificInfoVP9& vp9_info = info.codecSpecific.VP9;
+ const GenericFrameInfo& generic_info = *info.generic_frame_info;
+
+ RTC_CHECK_EQ(generic_info.spatial_id, layer_frame.spatial_id);
+ RTC_CHECK_EQ(generic_info.temporal_id, layer_frame.temporal_id);
+ auto picture_id_diffs =
+ rtc::MakeArrayView(vp9_info.p_diff, vp9_info.num_ref_pics);
+ RTC_CHECK_EQ(
+ frame_dependencies.size(),
+ picture_id_diffs.size() + (vp9_info.inter_layer_predicted ? 1 : 0));
+ for (int64_t dependency_frame_id : frame_dependencies) {
+ RTC_CHECK_GE(dependency_frame_id, 0);
+ const LayerFrame& dependency = Frame(dependency_frame_id);
+ if (dependency.spatial_id != layer_frame.spatial_id) {
+ RTC_CHECK(vp9_info.inter_layer_predicted);
+ RTC_CHECK_EQ(layer_frame.picture_id, dependency.picture_id);
+ RTC_CHECK_GT(layer_frame.spatial_id, dependency.spatial_id);
+ } else {
+ RTC_CHECK(vp9_info.inter_pic_predicted);
+ RTC_CHECK_EQ(layer_frame.spatial_id, dependency.spatial_id);
+ RTC_CHECK(absl::c_linear_search(
+ picture_id_diffs, layer_frame.picture_id - dependency.picture_id));
+ }
+ }
+ }
+
+ const LayerFrame& Frame(int64_t frame_id) const {
+ auto& frame = frames_[frame_id % kMaxFrameHistorySize];
+ RTC_CHECK_EQ(frame.frame_id, frame_id);
+ return frame;
+ }
+
+ GofInfoVP9 gof_;
+ int64_t frame_id_ = 0;
+ int64_t picture_id_ = 1;
+ FrameDependenciesCalculator dependencies_calculator_;
+ LayerFrame frames_[kMaxFrameHistorySize];
+};
+
+class FieldTrials : public FieldTrialsView {
+ public:
+ explicit FieldTrials(FuzzDataHelper& config)
+ : flags_(config.ReadOrDefaultValue<uint8_t>(0)) {}
+
+ ~FieldTrials() override = default;
+ std::string Lookup(absl::string_view key) const override {
+ static constexpr absl::string_view kBinaryFieldTrials[] = {
+ "WebRTC-Vp9ExternalRefCtrl",
+ "WebRTC-Vp9IssueKeyFrameOnLayerDeactivation",
+ };
+ for (size_t i = 0; i < ABSL_ARRAYSIZE(kBinaryFieldTrials); ++i) {
+ if (key == kBinaryFieldTrials[i]) {
+ return (flags_ & (1u << i)) ? "Enabled" : "Disabled";
+ }
+ }
+
+ // Ignore following field trials.
+ if (key == "WebRTC-CongestionWindow" ||
+ key == "WebRTC-UseBaseHeavyVP8TL3RateAllocation" ||
+ key == "WebRTC-SimulcastUpswitchHysteresisPercent" ||
+ key == "WebRTC-SimulcastScreenshareUpswitchHysteresisPercent" ||
+ key == "WebRTC-VideoRateControl" ||
+ key == "WebRTC-VP9-PerformanceFlags" ||
+ key == "WebRTC-VP9VariableFramerateScreenshare" ||
+ key == "WebRTC-VP9QualityScaler") {
+ return "";
+ }
+ // Crash when using unexpected field trial to decide if it should be fuzzed
+ // or have a constant value.
+ RTC_CHECK(false) << "Unfuzzed field trial " << key << "\n";
+ }
+
+ private:
+ const uint8_t flags_;
+};
+
+VideoCodec CodecSettings(FuzzDataHelper& rng) {
+ uint16_t config = rng.ReadOrDefaultValue<uint16_t>(0);
+ // Test up to to 4 spatial and 4 temporal layers.
+ int num_spatial_layers = 1 + (config & 0b11);
+ int num_temporal_layers = 1 + ((config >> 2) & 0b11);
+
+ VideoCodec codec_settings = {};
+ codec_settings.codecType = kVideoCodecVP9;
+ codec_settings.maxFramerate = 30;
+ codec_settings.width = 320 << (num_spatial_layers - 1);
+ codec_settings.height = 180 << (num_spatial_layers - 1);
+ if (num_spatial_layers > 1) {
+ for (int sid = 0; sid < num_spatial_layers; ++sid) {
+ SpatialLayer& spatial_layer = codec_settings.spatialLayers[sid];
+ codec_settings.width = 320 << sid;
+ codec_settings.height = 180 << sid;
+ spatial_layer.width = codec_settings.width;
+ spatial_layer.height = codec_settings.height;
+ spatial_layer.targetBitrate = kBitrateEnabledBps * num_temporal_layers;
+ spatial_layer.maxFramerate = codec_settings.maxFramerate;
+ spatial_layer.numberOfTemporalLayers = num_temporal_layers;
+ }
+ }
+ codec_settings.VP9()->numberOfSpatialLayers = num_spatial_layers;
+ codec_settings.VP9()->numberOfTemporalLayers = num_temporal_layers;
+ int inter_layer_pred = (config >> 4) & 0b11;
+ // There are only 3 valid values.
+ codec_settings.VP9()->interLayerPred = static_cast<InterLayerPredMode>(
+ inter_layer_pred < 3 ? inter_layer_pred : 0);
+ codec_settings.VP9()->flexibleMode = (config & (1u << 6)) != 0;
+ codec_settings.SetFrameDropEnabled((config & (1u << 7)) != 0);
+ codec_settings.mode = VideoCodecMode::kRealtimeVideo;
+ return codec_settings;
+}
+
+VideoEncoder::Settings EncoderSettings() {
+ return VideoEncoder::Settings(VideoEncoder::Capabilities(false),
+ /*number_of_cores=*/1,
+ /*max_payload_size=*/0);
+}
+
+bool IsSupported(int num_spatial_layers,
+ int num_temporal_layers,
+ const VideoBitrateAllocation& allocation) {
+ // VP9 encoder doesn't support certain configurations.
+ // BitrateAllocator shouldn't produce them.
+ if (allocation.get_sum_bps() == 0) {
+ // Ignore allocation that turns off all the layers.
+ // In such a case it is up to upper layer code not to call Encode.
+ return false;
+ }
+
+ for (int tid = 0; tid < num_temporal_layers; ++tid) {
+ int min_enabled_spatial_id = -1;
+ int max_enabled_spatial_id = -1;
+ int num_enabled_spatial_layers = 0;
+ for (int sid = 0; sid < num_spatial_layers; ++sid) {
+ if (allocation.GetBitrate(sid, tid) > 0) {
+ if (min_enabled_spatial_id == -1) {
+ min_enabled_spatial_id = sid;
+ }
+ max_enabled_spatial_id = sid;
+ ++num_enabled_spatial_layers;
+ }
+ }
+ if (num_enabled_spatial_layers == 0) {
+ // Each temporal layer should be enabled because skipping a full frame is
+ // not supported in non-flexible mode.
+ return false;
+ }
+ if (max_enabled_spatial_id - min_enabled_spatial_id + 1 !=
+ num_enabled_spatial_layers) {
+ // To avoid odd spatial dependencies, there should be no gaps in active
+ // spatial layers.
+ return false;
+ }
+ }
+
+ return true;
+}
+
+struct LibvpxState {
+ LibvpxState() {
+ pkt.kind = VPX_CODEC_CX_FRAME_PKT;
+ pkt.data.frame.buf = pkt_buffer;
+ pkt.data.frame.sz = ABSL_ARRAYSIZE(pkt_buffer);
+ layer_id.spatial_layer_id = -1;
+ }
+
+ uint8_t pkt_buffer[1000] = {};
+ vpx_codec_enc_cfg_t config = {};
+ vpx_codec_priv_output_cx_pkt_cb_pair_t callback = {};
+ vpx_image_t img = {};
+ vpx_svc_ref_frame_config_t ref_config = {};
+ vpx_svc_layer_id_t layer_id = {};
+ vpx_svc_frame_drop_t frame_drop = {};
+ vpx_codec_cx_pkt pkt = {};
+};
+
+class StubLibvpx : public LibvpxInterface {
+ public:
+ explicit StubLibvpx(LibvpxState* state) : state_(state) { RTC_CHECK(state_); }
+
+ vpx_codec_err_t codec_enc_config_default(vpx_codec_iface_t* iface,
+ vpx_codec_enc_cfg_t* cfg,
+ unsigned int usage) const override {
+ state_->config = *cfg;
+ return VPX_CODEC_OK;
+ }
+
+ vpx_codec_err_t codec_enc_init(vpx_codec_ctx_t* ctx,
+ vpx_codec_iface_t* iface,
+ const vpx_codec_enc_cfg_t* cfg,
+ vpx_codec_flags_t flags) const override {
+ RTC_CHECK(ctx);
+ ctx->err = VPX_CODEC_OK;
+ return VPX_CODEC_OK;
+ }
+
+ vpx_image_t* img_wrap(vpx_image_t* img,
+ vpx_img_fmt_t fmt,
+ unsigned int d_w,
+ unsigned int d_h,
+ unsigned int stride_align,
+ unsigned char* img_data) const override {
+ state_->img.fmt = fmt;
+ state_->img.d_w = d_w;
+ state_->img.d_h = d_h;
+ return &state_->img;
+ }
+
+ vpx_codec_err_t codec_encode(vpx_codec_ctx_t* ctx,
+ const vpx_image_t* img,
+ vpx_codec_pts_t pts,
+ uint64_t duration,
+ vpx_enc_frame_flags_t flags,
+ uint64_t deadline) const override {
+ if (flags & VPX_EFLAG_FORCE_KF) {
+ state_->pkt.data.frame.flags = VPX_FRAME_IS_KEY;
+ } else {
+ state_->pkt.data.frame.flags = 0;
+ }
+ state_->pkt.data.frame.duration = duration;
+ return VPX_CODEC_OK;
+ }
+
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ void* param) const override {
+ if (ctrl_id == VP9E_REGISTER_CX_CALLBACK) {
+ state_->callback =
+ *reinterpret_cast<vpx_codec_priv_output_cx_pkt_cb_pair_t*>(param);
+ }
+ return VPX_CODEC_OK;
+ }
+
+ vpx_codec_err_t codec_control(
+ vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_svc_ref_frame_config_t* param) const override {
+ switch (ctrl_id) {
+ case VP9E_SET_SVC_REF_FRAME_CONFIG:
+ state_->ref_config = *param;
+ break;
+ case VP9E_GET_SVC_REF_FRAME_CONFIG:
+ *param = state_->ref_config;
+ break;
+ default:
+ break;
+ }
+ return VPX_CODEC_OK;
+ }
+
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_svc_layer_id_t* param) const override {
+ switch (ctrl_id) {
+ case VP9E_SET_SVC_LAYER_ID:
+ state_->layer_id = *param;
+ break;
+ case VP9E_GET_SVC_LAYER_ID:
+ *param = state_->layer_id;
+ break;
+ default:
+ break;
+ }
+ return VPX_CODEC_OK;
+ }
+
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_svc_frame_drop_t* param) const override {
+ if (ctrl_id == VP9E_SET_SVC_FRAME_DROP_LAYER) {
+ state_->frame_drop = *param;
+ }
+ return VPX_CODEC_OK;
+ }
+
+ vpx_codec_err_t codec_enc_config_set(
+ vpx_codec_ctx_t* ctx,
+ const vpx_codec_enc_cfg_t* cfg) const override {
+ state_->config = *cfg;
+ return VPX_CODEC_OK;
+ }
+
+ vpx_image_t* img_alloc(vpx_image_t* img,
+ vpx_img_fmt_t fmt,
+ unsigned int d_w,
+ unsigned int d_h,
+ unsigned int align) const override {
+ return nullptr;
+ }
+ void img_free(vpx_image_t* img) const override {}
+ vpx_codec_err_t codec_enc_init_multi(vpx_codec_ctx_t* ctx,
+ vpx_codec_iface_t* iface,
+ vpx_codec_enc_cfg_t* cfg,
+ int num_enc,
+ vpx_codec_flags_t flags,
+ vpx_rational_t* dsf) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_destroy(vpx_codec_ctx_t* ctx) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ uint32_t param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ int param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ int* param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_roi_map* param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_active_map* param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_scaling_mode* param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_svc_extra_cfg_t* param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(
+ vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_svc_spatial_layer_sync_t* param) const override {
+ return VPX_CODEC_OK;
+ }
+ vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+ vp8e_enc_control_id ctrl_id,
+ vpx_rc_funcs_t* param) const override {
+ return VPX_CODEC_OK;
+ }
+ const vpx_codec_cx_pkt_t* codec_get_cx_data(
+ vpx_codec_ctx_t* ctx,
+ vpx_codec_iter_t* iter) const override {
+ return nullptr;
+ }
+ const char* codec_error_detail(vpx_codec_ctx_t* ctx) const override {
+ return nullptr;
+ }
+ const char* codec_error(vpx_codec_ctx_t* ctx) const override {
+ return nullptr;
+ }
+ const char* codec_err_to_string(vpx_codec_err_t err) const override {
+ return nullptr;
+ }
+
+ private:
+ LibvpxState* const state_;
+};
+
+enum Actions {
+ kEncode,
+ kSetRates,
+};
+
+// When a layer frame is marked for drop, drops all layer frames from that
+// pictures with larger spatial ids.
+constexpr bool DropAbove(uint8_t layers_mask, int sid) {
+ uint8_t full_mask = (uint8_t{1} << (sid + 1)) - 1;
+ return (layers_mask & full_mask) != full_mask;
+}
+// inline unittests
+static_assert(DropAbove(0b1011, /*sid=*/0) == false, "");
+static_assert(DropAbove(0b1011, /*sid=*/1) == false, "");
+static_assert(DropAbove(0b1011, /*sid=*/2) == true, "");
+static_assert(DropAbove(0b1011, /*sid=*/3) == true, "");
+
+// When a layer frame is marked for drop, drops all layer frames from that
+// pictures with smaller spatial ids.
+constexpr bool DropBelow(uint8_t layers_mask, int sid, int num_layers) {
+ return (layers_mask >> sid) != (1 << (num_layers - sid)) - 1;
+}
+// inline unittests
+static_assert(DropBelow(0b1101, /*sid=*/0, 4) == true, "");
+static_assert(DropBelow(0b1101, /*sid=*/1, 4) == true, "");
+static_assert(DropBelow(0b1101, /*sid=*/2, 4) == false, "");
+static_assert(DropBelow(0b1101, /*sid=*/3, 4) == false, "");
+
+} // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ FuzzDataHelper helper(rtc::MakeArrayView(data, size));
+
+ FrameValidator validator;
+ FieldTrials field_trials(helper);
+ // Setup call callbacks for the fake
+ LibvpxState state;
+
+ // Initialize encoder
+ LibvpxVp9Encoder encoder(cricket::VideoCodec(),
+ std::make_unique<StubLibvpx>(&state), field_trials);
+ VideoCodec codec = CodecSettings(helper);
+ if (encoder.InitEncode(&codec, EncoderSettings()) != WEBRTC_VIDEO_CODEC_OK) {
+ return;
+ }
+ RTC_CHECK_EQ(encoder.RegisterEncodeCompleteCallback(&validator),
+ WEBRTC_VIDEO_CODEC_OK);
+ {
+ // Enable all the layers initially. Encoder doesn't support producing
+ // frames when no layers are enabled.
+ LibvpxVp9Encoder::RateControlParameters parameters;
+ parameters.framerate_fps = 30.0;
+ for (int sid = 0; sid < codec.VP9()->numberOfSpatialLayers; ++sid) {
+ for (int tid = 0; tid < codec.VP9()->numberOfTemporalLayers; ++tid) {
+ parameters.bitrate.SetBitrate(sid, tid, kBitrateEnabledBps);
+ }
+ }
+ encoder.SetRates(parameters);
+ }
+
+ std::vector<VideoFrameType> frame_types(1);
+ VideoFrame fake_image = VideoFrame::Builder()
+ .set_video_frame_buffer(I420Buffer::Create(
+ int{codec.width}, int{codec.height}))
+ .build();
+
+ // Start producing frames at random.
+ while (helper.CanReadBytes(1)) {
+ uint8_t action = helper.Read<uint8_t>();
+ switch (action & 0b11) {
+ case kEncode: {
+ // bitmask of the action: SSSS-K00, where
+ // four S bit indicate which spatial layers should be produced,
+ // K bit indicates if frame should be a key frame.
+ frame_types[0] = (action & 0b100) ? VideoFrameType::kVideoFrameKey
+ : VideoFrameType::kVideoFrameDelta;
+ encoder.Encode(fake_image, &frame_types);
+ uint8_t encode_spatial_layers = (action >> 4);
+ for (size_t sid = 0; sid < state.config.ss_number_layers; ++sid) {
+ if (state.config.ss_target_bitrate[sid] == 0) {
+ // Don't encode disabled spatial layers.
+ continue;
+ }
+ bool drop = true;
+ switch (state.frame_drop.framedrop_mode) {
+ case FULL_SUPERFRAME_DROP:
+ drop = encode_spatial_layers == 0;
+ break;
+ case LAYER_DROP:
+ drop = (encode_spatial_layers & (1 << sid)) == 0;
+ break;
+ case CONSTRAINED_LAYER_DROP:
+ drop = DropBelow(encode_spatial_layers, sid,
+ state.config.ss_number_layers);
+ break;
+ case CONSTRAINED_FROM_ABOVE_DROP:
+ drop = DropAbove(encode_spatial_layers, sid);
+ break;
+ }
+ if (!drop) {
+ state.layer_id.spatial_layer_id = sid;
+ state.callback.output_cx_pkt(&state.pkt, state.callback.user_priv);
+ }
+ }
+ } break;
+ case kSetRates: {
+ // bitmask of the action: (S2)(S1)(S0)01,
+ // where Sx is number of temporal layers to enable for spatial layer x
+ // In pariculat Sx = 0 indicates spatial layer x should be disabled.
+ LibvpxVp9Encoder::RateControlParameters parameters;
+ parameters.framerate_fps = 30.0;
+ for (int sid = 0; sid < codec.VP9()->numberOfSpatialLayers; ++sid) {
+ int temporal_layers = (action >> ((1 + sid) * 2)) & 0b11;
+ for (int tid = 0; tid < temporal_layers; ++tid) {
+ parameters.bitrate.SetBitrate(sid, tid, kBitrateEnabledBps);
+ }
+ }
+ if (IsSupported(codec.VP9()->numberOfSpatialLayers,
+ codec.VP9()->numberOfTemporalLayers,
+ parameters.bitrate)) {
+ encoder.SetRates(parameters);
+ }
+ } break;
+ default:
+ // Unspecificed values are noop.
+ break;
+ }
+ }
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc
new file mode 100644
index 0000000000..80dfe15b16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/video_coding/utility/vp9_uncompressed_header_parser.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ ParseUncompressedVp9Header(rtc::MakeArrayView(data, size));
+}
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc
new file mode 100644
index 0000000000..fc10d9ffc7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+
+#include "test/fuzzers/utils/rtp_replayer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+ auto stream_state = std::make_unique<test::RtpReplayer::StreamState>();
+ VideoReceiveStreamInterface::Config vp9_config(&(stream_state->transport));
+
+ VideoReceiveStreamInterface::Decoder vp9_decoder;
+ vp9_decoder.video_format = SdpVideoFormat("VP9");
+ vp9_decoder.payload_type = 124;
+ vp9_config.decoders.push_back(std::move(vp9_decoder));
+
+ vp9_config.rtp.local_ssrc = 7731;
+ vp9_config.rtp.remote_ssrc = 1337;
+ vp9_config.rtp.rtx_ssrc = 100;
+ vp9_config.rtp.nack.rtp_history_ms = 1000;
+
+ std::vector<VideoReceiveStreamInterface::Config> replay_configs;
+ replay_configs.push_back(std::move(vp9_config));
+
+ test::RtpReplayer::Replay(std::move(stream_state), std::move(replay_configs),
+ data, size);
+}
+
+} // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc b/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc
new file mode 100644
index 0000000000..a52dd231be
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ * Use of this source code is governed by a BSD-style license
+ * that can be found in the LICENSE file in the root of the source
+ * tree. An additional intellectual property rights grant can be found
+ * in the file PATENTS. All contributing project authors may
+ * be found in the AUTHORS file in the root of the source tree.
+ */
+
+// This file is intended to provide a common interface for fuzzing functions.
+// It's intended to set sane defaults, such as removing logging for further
+// fuzzing efficiency.
+
+#include "rtc_base/logging.h"
+
+namespace {
+bool g_initialized = false;
+void InitializeWebRtcFuzzDefaults() {
+ if (g_initialized)
+ return;
+
+// Remove default logging to prevent huge slowdowns.
+// TODO(pbos): Disable in Chromium: http://crbug.com/561667
+#if !defined(WEBRTC_CHROMIUM_BUILD)
+ rtc::LogMessage::LogToDebug(rtc::LS_NONE);
+#endif // !defined(WEBRTC_CHROMIUM_BUILD)
+
+ g_initialized = true;
+}
+} // namespace
+
+namespace webrtc {
+extern void FuzzOneInput(const uint8_t* data, size_t size);
+} // namespace webrtc
+
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size) {
+ InitializeWebRtcFuzzDefaults();
+ webrtc::FuzzOneInput(data, size);
+ return 0;
+}