Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

323 files changed, 7273 insertions, 0 deletions

diff --git a/third_party/libwebrtc/test/fuzzers/BUILD.gn b/third_party/libwebrtc/test/fuzzers/BUILD.gn
new file mode 100644
index 0000000000..c3576713ab
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/BUILD.gn
@@ -0,0 +1,689 @@
+# Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+#
+# Use of this source code is governed by a BSD-style license
+# that can be found in the LICENSE file in the root of the source
+# tree. An additional intellectual property rights grant can be found
+# in the file PATENTS.  All contributing project authors may
+# be found in the AUTHORS file in the root of the source tree.
+
+import("//build/config/features.gni")
+import("//testing/libfuzzer/fuzzer_test.gni")
+import("../../webrtc.gni")
+
+rtc_library("webrtc_fuzzer_main") {
+  sources = [ "webrtc_fuzzer_main.cc" ]
+  deps = [
+    "../../rtc_base:logging",
+    "//testing/libfuzzer:libfuzzer_main",
+  ]
+
+  # When WebRTC fuzzer tests are built on Chromium bots they need to link
+  # with Chromium's implementation of metrics, field trial, and system time.
+  if (build_with_chromium) {
+    deps += [
+      "../../../webrtc_overrides:field_trial",
+      "../../../webrtc_overrides:metrics",
+      "../../../webrtc_overrides:system_time",
+    ]
+  }
+}
+
+rtc_library("fuzz_data_helper") {
+  testonly = true
+  sources = [
+    "fuzz_data_helper.cc",
+    "fuzz_data_helper.h",
+  ]
+  deps = [
+    "../../api:array_view",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+  visibility = [ ":*" ]  # Only targets in this file can depend on this.
+}
+
+set_defaults("webrtc_fuzzer_test") {
+  configs = rtc_add_configs
+  absl_deps = []
+}
+
+template("webrtc_fuzzer_test") {
+  fuzzer_test(target_name) {
+    forward_variables_from(invoker, "*")
+    deps += [
+      ":fuzz_data_helper",
+      ":webrtc_fuzzer_main",
+    ]
+    additional_configs = configs
+
+    # If absl_deps is [], no action is needed. If not [], then it needs to be
+    # converted to //third_party/abseil-cpp:absl when build_with_chromium=true
+    # otherwise it just needs to be added to deps.
+    if (absl_deps != []) {
+      if (!defined(deps)) {
+        deps = []
+      }
+      if (build_with_chromium) {
+        deps += [ "//third_party/abseil-cpp:absl" ]
+      } else {
+        deps += absl_deps
+      }
+    }
+
+    if (!build_with_chromium && is_clang) {
+      suppressed_configs = [ "//build/config/clang:find_bad_constructs" ]
+    }
+  }
+}
+
+webrtc_fuzzer_test("h264_depacketizer_fuzzer") {
+  sources = [ "h264_depacketizer_fuzzer.cc" ]
+  deps = [ "../../modules/rtp_rtcp" ]
+  seed_corpus = "corpora/h264-depacketizer-fuzzer-corpus"
+}
+
+webrtc_fuzzer_test("vp8_depacketizer_fuzzer") {
+  sources = [ "vp8_depacketizer_fuzzer.cc" ]
+  deps = [
+    "../../api:array_view",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_video_header",
+  ]
+}
+
+webrtc_fuzzer_test("vp9_depacketizer_fuzzer") {
+  sources = [ "vp9_depacketizer_fuzzer.cc" ]
+  deps = [
+    "../../api:array_view",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_video_header",
+  ]
+}
+
+webrtc_fuzzer_test("vp8_qp_parser_fuzzer") {
+  sources = [ "vp8_qp_parser_fuzzer.cc" ]
+  deps = [
+    "../../modules/video_coding:video_coding_utility",
+    "../../modules/video_coding/",
+  ]
+}
+
+webrtc_fuzzer_test("vp9_qp_parser_fuzzer") {
+  sources = [ "vp9_qp_parser_fuzzer.cc" ]
+  deps = [
+    "../../modules/video_coding:video_coding_utility",
+    "../../modules/video_coding/",
+  ]
+}
+
+webrtc_fuzzer_test("h264_bitstream_parser_fuzzer") {
+  sources = [ "h264_bitstream_parser_fuzzer.cc" ]
+  deps = [
+    "../../common_video",
+    "../../modules/video_coding/",
+  ]
+}
+
+webrtc_fuzzer_test("forward_error_correction_fuzzer") {
+  sources = [ "forward_error_correction_fuzzer.cc" ]
+  deps = [
+    "../../api:scoped_refptr",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:byte_buffer",
+  ]
+}
+
+webrtc_fuzzer_test("flexfec_header_reader_fuzzer") {
+  sources = [ "flexfec_header_reader_fuzzer.cc" ]
+  deps = [
+    "../../api:scoped_refptr",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+}
+
+webrtc_fuzzer_test("flexfec_sender_fuzzer") {
+  sources = [ "flexfec_sender_fuzzer.cc" ]
+  deps = [
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../system_wrappers",
+  ]
+}
+
+webrtc_fuzzer_test("ulpfec_header_reader_fuzzer") {
+  sources = [ "ulpfec_header_reader_fuzzer.cc" ]
+  deps = [
+    "../../api:scoped_refptr",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:fec_test_helper",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+}
+
+webrtc_fuzzer_test("ulpfec_generator_fuzzer") {
+  sources = [ "ulpfec_generator_fuzzer.cc" ]
+  deps = [
+    "../../modules:module_api_public",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:fec_test_helper",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:checks",
+    "../../rtc_base:copy_on_write_buffer",
+    "../../system_wrappers",
+  ]
+}
+
+webrtc_fuzzer_test("ulpfec_receiver_fuzzer") {
+  sources = [ "ulpfec_receiver_fuzzer.cc" ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+}
+
+webrtc_fuzzer_test("flexfec_receiver_fuzzer") {
+  sources = [ "flexfec_receiver_fuzzer.cc" ]
+  deps = [
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+}
+
+webrtc_fuzzer_test("rtp_video_frame_assembler_fuzzer") {
+  sources = [ "rtp_video_frame_assembler_fuzzer.cc" ]
+  deps = [
+    "../../api/video:rtp_video_frame_assembler",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+}
+
+webrtc_fuzzer_test("rtcp_receiver_fuzzer") {
+  sources = [ "rtcp_receiver_fuzzer.cc" ]
+  deps = [
+    "../../modules/rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:checks",
+    "../../system_wrappers",
+  ]
+  seed_corpus = "corpora/rtcp-corpus"
+}
+
+webrtc_fuzzer_test("rtp_packet_fuzzer") {
+  sources = [ "rtp_packet_fuzzer.cc" ]
+  deps = [ "../../modules/rtp_rtcp:rtp_rtcp_format" ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+  seed_corpus = "corpora/rtp-corpus"
+}
+
+webrtc_fuzzer_test("rtp_packetizer_av1_fuzzer") {
+  sources = [ "rtp_packetizer_av1_fuzzer.cc" ]
+  deps = [
+    "../../api/video:video_frame_type",
+    "../../modules/rtp_rtcp:rtp_rtcp",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:checks",
+  ]
+}
+
+webrtc_fuzzer_test("congestion_controller_feedback_fuzzer") {
+  sources = [ "congestion_controller_feedback_fuzzer.cc" ]
+  deps = [
+    "../../modules/congestion_controller",
+    "../../modules/pacing",
+    "../../modules/remote_bitrate_estimator",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/functional:bind_front" ]
+}
+
+rtc_library("audio_decoder_fuzzer") {
+  testonly = true
+  sources = [
+    "audio_decoder_fuzzer.cc",
+    "audio_decoder_fuzzer.h",
+  ]
+  deps = [
+    "../../api/audio_codecs:audio_codecs_api",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:checks",
+  ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+}
+
+webrtc_fuzzer_test("audio_decoder_g722_fuzzer") {
+  sources = [ "audio_decoder_g722_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../modules/audio_coding:g722",
+  ]
+}
+
+webrtc_fuzzer_test("audio_decoder_ilbc_fuzzer") {
+  sources = [ "audio_decoder_ilbc_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../modules/audio_coding:ilbc",
+  ]
+}
+
+webrtc_fuzzer_test("audio_decoder_opus_fuzzer") {
+  sources = [ "audio_decoder_opus_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../modules/audio_coding:webrtc_opus",
+  ]
+}
+
+webrtc_fuzzer_test("audio_decoder_opus_redundant_fuzzer") {
+  sources = [ "audio_decoder_opus_redundant_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../modules/audio_coding:webrtc_opus",
+  ]
+}
+
+webrtc_fuzzer_test("audio_decoder_multiopus_fuzzer") {
+  sources = [ "audio_decoder_multistream_opus_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../api/audio_codecs/opus:audio_decoder_multiopus",
+    "../../api/audio_codecs/opus:audio_decoder_opus_config",
+  ]
+}
+
+webrtc_fuzzer_test("audio_decoder_pcm_fuzzer") {
+  sources = [ "audio_decoder_pcm_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../modules/audio_coding:g711",
+  ]
+}
+
+webrtc_fuzzer_test("audio_decoder_pcm16b_fuzzer") {
+  sources = [ "audio_decoder_pcm16b_fuzzer.cc" ]
+  deps = [
+    ":audio_decoder_fuzzer",
+    "../../modules/audio_coding:pcm16b",
+  ]
+}
+
+rtc_library("audio_encoder_fuzzer") {
+  testonly = true
+  sources = [
+    "audio_encoder_fuzzer.cc",
+    "audio_encoder_fuzzer.h",
+  ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../api:array_view",
+    "../../api/audio_codecs:audio_codecs_api",
+    "../../rtc_base:buffer",
+    "../../rtc_base:checks",
+  ]
+}
+
+webrtc_fuzzer_test("audio_encoder_opus_fuzzer") {
+  sources = [ "audio_encoder_opus_fuzzer.cc" ]
+  deps = [
+    ":audio_encoder_fuzzer",
+    "../../api/audio_codecs/opus:audio_encoder_opus",
+    "../../rtc_base:checks",
+  ]
+}
+
+webrtc_fuzzer_test("turn_unwrap_fuzzer") {
+  sources = [ "turn_unwrap_fuzzer.cc" ]
+  deps = [
+    "../../media",
+    "../../media:rtc_media_base",
+    "../../media:turn_utils",
+  ]
+}
+
+webrtc_fuzzer_test("neteq_rtp_fuzzer") {
+  sources = [ "neteq_rtp_fuzzer.cc" ]
+  deps = [
+    "../../api:array_view",
+    "../../api/audio_codecs:builtin_audio_decoder_factory",
+    "../../modules/audio_coding:neteq",
+    "../../modules/audio_coding:neteq_test_tools",
+    "../../modules/audio_coding:neteq_tools_minimal",
+    "../../modules/audio_coding:pcm16b",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+  ]
+}
+
+webrtc_fuzzer_test("neteq_signal_fuzzer") {
+  sources = [ "neteq_signal_fuzzer.cc" ]
+  deps = [
+    "../../api:array_view",
+    "../../api/audio_codecs:builtin_audio_decoder_factory",
+    "../../modules/audio_coding:neteq",
+    "../../modules/audio_coding:neteq_test_tools",
+    "../../modules/audio_coding:neteq_tools_minimal",
+    "../../modules/audio_coding:pcm16b",
+    "../../rtc_base:random",
+    "../../rtc_base:safe_conversions",
+  ]
+}
+
+webrtc_fuzzer_test("residual_echo_detector_fuzzer") {
+  sources = [ "residual_echo_detector_fuzzer.cc" ]
+  deps = [
+    "../../api/audio:echo_detector_creator",
+    "../../rtc_base:checks",
+    "../../rtc_base:refcount",
+  ]
+}
+
+webrtc_fuzzer_test("sdp_parser_fuzzer") {
+  sources = [ "sdp_parser_fuzzer.cc" ]
+  deps = [
+    "../../api:libjingle_peerconnection_api",
+    "../../pc:libjingle_peerconnection",
+  ]
+  seed_corpus = "corpora/sdp-corpus"
+}
+
+if (!build_with_chromium) {
+  # This target depends on test infrastructure that can't be built
+  # with Chromium at the moment.
+  # TODO(bugs.chromium.org/12534): Make this fuzzer build in Chromium.
+
+  webrtc_fuzzer_test("sdp_integration_fuzzer") {
+    sources = [ "sdp_integration_fuzzer.cc" ]
+    deps = [
+      "../../api:libjingle_peerconnection_api",
+      "../../pc:integration_test_helpers",
+      "../../pc:libjingle_peerconnection",
+      "../../test:test_support",
+    ]
+    absl_deps = [ "//third_party/abseil-cpp/absl/strings" ]
+    seed_corpus = "corpora/sdp-corpus"
+  }
+}
+
+webrtc_fuzzer_test("stun_parser_fuzzer") {
+  sources = [ "stun_parser_fuzzer.cc" ]
+  deps = [
+    "../../api/transport:stun_types",
+    "../../p2p:rtc_p2p",
+  ]
+  seed_corpus = "corpora/stun-corpus"
+  dict = "corpora/stun.tokens"
+}
+
+webrtc_fuzzer_test("stun_validator_fuzzer") {
+  sources = [ "stun_validator_fuzzer.cc" ]
+  deps = [
+    "../../api/transport:stun_types",
+    "../../p2p:rtc_p2p",
+  ]
+  seed_corpus = "corpora/stun-corpus"
+  dict = "corpora/stun.tokens"
+}
+
+webrtc_fuzzer_test("pseudotcp_parser_fuzzer") {
+  sources = [ "pseudotcp_parser_fuzzer.cc" ]
+  deps = [
+    "../../p2p:rtc_p2p",
+    "../../rtc_base:threading",
+  ]
+}
+
+rtc_library("audio_processing_fuzzer_helper") {
+  testonly = true
+  sources = [
+    "audio_processing_fuzzer_helper.cc",
+    "audio_processing_fuzzer_helper.h",
+  ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../api/audio:audio_frame_api",
+    "../../modules/audio_processing",
+    "../../modules/audio_processing:api",
+    "../../modules/audio_processing:audio_frame_proxies",
+    "../../rtc_base:checks",
+  ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+}
+
+webrtc_fuzzer_test("audio_processing_fuzzer") {
+  sources = [ "audio_processing_configs_fuzzer.cc" ]
+  deps = [
+    ":audio_processing_fuzzer_helper",
+    "../../api:scoped_refptr",
+    "../../api/audio:aec3_factory",
+    "../../api/audio:echo_detector_creator",
+    "../../api/task_queue:default_task_queue_factory",
+    "../../modules/audio_processing",
+    "../../modules/audio_processing:api",
+    "../../modules/audio_processing:audio_buffer",
+    "../../modules/audio_processing:audioproc_test_utils",
+    "../../modules/audio_processing/aec3",
+    "../../modules/audio_processing/aec_dump",
+    "../../modules/audio_processing/aec_dump:aec_dump_impl",
+    "../../rtc_base:macromagic",
+    "../../rtc_base:rtc_task_queue",
+    "../../rtc_base:safe_minmax",
+    "../../system_wrappers:field_trial",
+  ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/memory" ]
+  seed_corpus = "corpora/audio_processing-corpus"
+}
+
+webrtc_fuzzer_test("audio_processing_sample_rate_fuzzer") {
+  sources = [ "audio_processing_sample_rate_fuzzer.cc" ]
+  deps = [
+    "../../api:scoped_refptr",
+    "../../api/audio:audio_frame_api",
+    "../../modules/audio_processing",
+    "../../modules/audio_processing:api",
+    "../../modules/audio_processing:audio_frame_proxies",
+    "../../modules/audio_processing:audioproc_test_utils",
+    "../../rtc_base:checks",
+    "../../rtc_base:macromagic",
+    "../../rtc_base:safe_minmax",
+  ]
+}
+
+webrtc_fuzzer_test("agc_fuzzer") {
+  sources = [ "agc_fuzzer.cc" ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../modules/audio_processing",
+    "../../modules/audio_processing:api",
+    "../../modules/audio_processing:audio_buffer",
+    "../../rtc_base:macromagic",
+    "../../rtc_base:safe_minmax",
+  ]
+
+  seed_corpus = "corpora/agc-corpus"
+}
+
+webrtc_fuzzer_test("aec3_config_json_fuzzer") {
+  sources = [ "aec3_config_json_fuzzer.cc" ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../api/audio:aec3_config",
+    "../../api/audio:aec3_config_json",
+  ]
+  dict = "//testing/libfuzzer/fuzzers/dicts/json.dict"
+  seed_corpus = "corpora/aec3-config-json-corpus"
+}
+
+webrtc_fuzzer_test("aec3_fuzzer") {
+  defines = []
+  if (apm_debug_dump) {
+    defines += [ "WEBRTC_APM_DEBUG_DUMP=1" ]
+  } else {
+    defines += [ "WEBRTC_APM_DEBUG_DUMP=0" ]
+  }
+  sources = [ "aec3_fuzzer.cc" ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../modules/audio_processing:api",
+    "../../modules/audio_processing:audio_buffer",
+    "../../modules/audio_processing/aec3",
+  ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ]
+}
+
+webrtc_fuzzer_test("comfort_noise_decoder_fuzzer") {
+  sources = [ "comfort_noise_decoder_fuzzer.cc" ]
+  deps = [
+    "../../api:array_view",
+    "../../modules/audio_coding:webrtc_cng",
+    "../../rtc_base:buffer",
+  ]
+}
+
+webrtc_fuzzer_test("rtp_depacketizer_av1_assemble_frame_fuzzer") {
+  sources = [ "rtp_depacketizer_av1_assemble_frame_fuzzer.cc" ]
+  seed_corpus = "corpora/rtp-depacketizer-av1-assemble-frame-corpus"
+  deps = [
+    ":fuzz_data_helper",
+    "../../api:array_view",
+    "../../modules/rtp_rtcp",
+  ]
+}
+
+webrtc_fuzzer_test("rtp_dependency_descriptor_fuzzer") {
+  sources = [ "rtp_dependency_descriptor_fuzzer.cc" ]
+  seed_corpus = "corpora/dependency_descriptor-corpus"
+  deps = [
+    "../../api:array_view",
+    "../../common_video/generic_frame_descriptor",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:checks",
+  ]
+}
+
+webrtc_fuzzer_test("rtp_video_layers_allocation_fuzzer") {
+  sources = [ "rtp_video_layers_allocation_fuzzer.cc" ]
+  seed_corpus = "corpora/video_layers_allocation-corpus"
+  deps = [
+    "../../api:array_view",
+    "../../api/video:video_layers_allocation",
+    "../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../rtc_base:checks",
+  ]
+
+  # video_layers_allocation is an rtp header extension and thus can't be longer
+  # than 255 bytes on the wire.
+  libfuzzer_options = [ "max_len=255" ]
+}
+
+webrtc_fuzzer_test("rtp_frame_reference_finder_fuzzer") {
+  sources = [ "rtp_frame_reference_finder_fuzzer.cc" ]
+  deps = [
+    "../../api:rtp_packet_info",
+    "../../api:scoped_refptr",
+    "../../modules/video_coding/",
+    "../../system_wrappers",
+  ]
+}
+
+webrtc_fuzzer_test("frame_buffer2_fuzzer") {
+  sources = [ "frame_buffer2_fuzzer.cc" ]
+  deps = [
+    "../../api/task_queue",
+    "../../modules/video_coding:frame_buffer2",
+    "../../modules/video_coding/timing:timing_module",
+    "../../test:scoped_key_value_config",
+    "../time_controller:time_controller",
+  ]
+}
+
+webrtc_fuzzer_test("frame_buffer_fuzzer") {
+  sources = [ "frame_buffer_fuzzer.cc" ]
+  deps = [
+    ":fuzz_data_helper",
+    "../../api:array_view",
+    "../../api/video:encoded_frame",
+    "../../api/video:frame_buffer",
+    "../../rtc_base:rtc_numerics",
+    "../../test:scoped_key_value_config",
+  ]
+}
+
+webrtc_fuzzer_test("field_trial_fuzzer") {
+  sources = [ "field_trial_fuzzer.cc" ]
+  deps = [ "../../system_wrappers:field_trial" ]
+  seed_corpus = "corpora/field_trial-corpus"
+}
+
+webrtc_fuzzer_test("string_to_number_fuzzer") {
+  sources = [ "string_to_number_fuzzer.cc" ]
+  deps = [ "../../rtc_base:stringutils" ]
+  seed_corpus = "corpora/string_to_number-corpus"
+}
+
+webrtc_fuzzer_test("sctp_utils_fuzzer") {
+  sources = [ "sctp_utils_fuzzer.cc" ]
+  deps = [
+    "../../api:libjingle_peerconnection_api",
+    "../../pc:libjingle_peerconnection",
+    "../../pc:sctp_utils",
+    "../../rtc_base:copy_on_write_buffer",
+  ]
+}
+
+webrtc_fuzzer_test("dcsctp_socket_fuzzer") {
+  sources = [ "dcsctp_socket_fuzzer.cc" ]
+  deps = [
+    "../../net/dcsctp/fuzzers:dcsctp_fuzzers",
+    "../../net/dcsctp/public:socket",
+    "../../net/dcsctp/public:types",
+    "../../net/dcsctp/socket:dcsctp_socket",
+    "../../rtc_base:logging",
+  ]
+}
+
+webrtc_fuzzer_test("ssl_certificate_fuzzer") {
+  sources = [ "ssl_certificate_fuzzer.cc" ]
+  deps = [
+    "../:rtp_test_utils",
+    "../../rtc_base:ssl",
+    "../../rtc_base:stringutils",
+  ]
+}
+
+webrtc_fuzzer_test("vp8_replay_fuzzer") {
+  sources = [ "vp8_replay_fuzzer.cc" ]
+  deps = [ "utils:rtp_replayer" ]
+  seed_corpus = "corpora/rtpdump-corpus/vp8"
+}
+
+if (rtc_build_libvpx) {
+  webrtc_fuzzer_test("vp9_encoder_references_fuzzer") {
+    sources = [ "vp9_encoder_references_fuzzer.cc" ]
+    deps = [
+      "..:test_support",
+      "../../api:array_view",
+      "../../api:field_trials_view",
+      "../../api/video:video_frame",
+      "../../api/video_codecs:video_codecs_api",
+      "../../modules/video_coding:frame_dependencies_calculator",
+      "../../modules/video_coding:webrtc_libvpx_interface",
+      "../../modules/video_coding:webrtc_vp9",
+      "../../rtc_base:safe_compare",
+      rtc_libvpx_dir,
+    ]
+    absl_deps = [
+      "//third_party/abseil-cpp/absl/algorithm:container",
+      "//third_party/abseil-cpp/absl/base:core_headers",
+      "//third_party/abseil-cpp/absl/container:inlined_vector",
+    ]
+    seed_corpus = "corpora/vp9-encoder-references-corpus"
+    defines = [ "RTC_ENABLE_VP9" ]
+  }
+}
+
+webrtc_fuzzer_test("vp9_replay_fuzzer") {
+  sources = [ "vp9_replay_fuzzer.cc" ]
+  deps = [ "utils:rtp_replayer" ]
+  seed_corpus = "corpora/rtpdump-corpus/vp9"
+}
diff --git a/third_party/libwebrtc/test/fuzzers/DEPS b/third_party/libwebrtc/test/fuzzers/DEPS
new file mode 100644
index 0000000000..50b1c8adce
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/DEPS
@@ -0,0 +1,5 @@
+include_rules = [
+  "+audio",
+  "+pc",
+  "+net/dcsctp",
+]
diff --git a/third_party/libwebrtc/test/fuzzers/OWNERS b/third_party/libwebrtc/test/fuzzers/OWNERS
new file mode 100644
index 0000000000..3d97816b3b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/OWNERS
@@ -0,0 +1,3 @@
+danilchap@webrtc.org
+henrik.lundin@webrtc.org
+saza@webrtc.org
diff --git a/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc
new file mode 100644
index 0000000000..626350c52c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc
@@ -0,0 +1,30 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <string>
+
+#include "api/audio/echo_canceller3_config.h"
+#include "api/audio/echo_canceller3_config_json.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000) {
+    return;
+  }
+  std::string config_json(reinterpret_cast<const char*>(data), size);
+
+  EchoCanceller3Config config;
+  bool success;
+  Aec3ConfigFromJsonString(config_json, &config, &success);
+  EchoCanceller3Config::Validate(&config);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc
new file mode 100644
index 0000000000..a12ca30f63
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "absl/types/optional.h"
+#include "modules/audio_processing/aec3/echo_canceller3.h"
+#include "modules/audio_processing/audio_buffer.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+using SampleRate = ::webrtc::AudioProcessing::NativeRate;
+
+void PrepareAudioBuffer(int sample_rate_hz,
+                        test::FuzzDataHelper* fuzz_data,
+                        AudioBuffer* buffer) {
+  float* const* channels = buffer->channels_f();
+  for (size_t i = 0; i < buffer->num_channels(); ++i) {
+    for (size_t j = 0; j < buffer->num_frames(); ++j) {
+      channels[i][j] =
+          static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0));
+    }
+  }
+  if (sample_rate_hz == 32000 || sample_rate_hz == 48000) {
+    buffer->SplitIntoFrequencyBands();
+  }
+}
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 200000) {
+    return;
+  }
+
+  test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+
+  constexpr int kSampleRates[] = {16000, 32000, 48000};
+  const int sample_rate_hz =
+      static_cast<size_t>(fuzz_data.SelectOneOf(kSampleRates));
+
+  constexpr int kMaxNumChannels = 9;
+  const size_t num_render_channels =
+      1 + fuzz_data.ReadOrDefaultValue<uint8_t>(0) % (kMaxNumChannels - 1);
+  const size_t num_capture_channels =
+      1 + fuzz_data.ReadOrDefaultValue<uint8_t>(0) % (kMaxNumChannels - 1);
+
+  EchoCanceller3 aec3(EchoCanceller3Config(),
+                      /*multichannel_config=*/absl::nullopt, sample_rate_hz,
+                      num_render_channels, num_capture_channels);
+
+  AudioBuffer capture_audio(sample_rate_hz, num_capture_channels,
+                            sample_rate_hz, num_capture_channels,
+                            sample_rate_hz, num_capture_channels);
+  AudioBuffer render_audio(sample_rate_hz, num_render_channels, sample_rate_hz,
+                           num_render_channels, sample_rate_hz,
+                           num_render_channels);
+
+  // Fuzz frames while there is still fuzzer data.
+  while (fuzz_data.BytesLeft() > 0) {
+    bool is_capture = fuzz_data.ReadOrDefaultValue(true);
+    bool level_changed = fuzz_data.ReadOrDefaultValue(true);
+    if (is_capture) {
+      PrepareAudioBuffer(sample_rate_hz, &fuzz_data, &capture_audio);
+      aec3.ProcessCapture(&capture_audio, level_changed);
+    } else {
+      PrepareAudioBuffer(sample_rate_hz, &fuzz_data, &render_audio);
+      aec3.AnalyzeRender(&render_audio);
+    }
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc
new file mode 100644
index 0000000000..597103993e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc
@@ -0,0 +1,124 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/audio_processing/audio_buffer.h"
+#include "modules/audio_processing/gain_control_impl.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "rtc_base/numerics/safe_minmax.h"
+#include "rtc_base/thread_annotations.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+
+void FillAudioBuffer(size_t sample_rate_hz,
+                     test::FuzzDataHelper* fuzz_data,
+                     AudioBuffer* buffer) {
+  float* const* channels = buffer->channels_f();
+  for (size_t i = 0; i < buffer->num_channels(); ++i) {
+    for (size_t j = 0; j < buffer->num_frames(); ++j) {
+      channels[i][j] =
+          static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0));
+    }
+  }
+
+  if (sample_rate_hz != 16000) {
+    buffer->SplitIntoFrequencyBands();
+  }
+}
+
+// This function calls the GainControl functions that are overriden as private
+// in GainControlInterface.
+void FuzzGainControllerConfig(test::FuzzDataHelper* fuzz_data,
+                              GainControl* gc) {
+  GainControl::Mode modes[] = {GainControl::Mode::kAdaptiveAnalog,
+                               GainControl::Mode::kAdaptiveDigital,
+                               GainControl::Mode::kFixedDigital};
+  GainControl::Mode mode = fuzz_data->SelectOneOf(modes);
+  const bool enable_limiter = fuzz_data->ReadOrDefaultValue(true);
+  // The values are capped to comply with the API of webrtc::GainControl.
+  const int analog_level_min =
+      rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(0), 0, 65534);
+  const int analog_level_max =
+      rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(65535),
+                          analog_level_min + 1, 65535);
+  const int stream_analog_level =
+      rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(30000),
+                          analog_level_min, analog_level_max);
+  const int gain =
+      rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(30), -1, 100);
+  const int target_level_dbfs =
+      rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(15), -1, 35);
+
+  gc->set_mode(mode);
+  gc->enable_limiter(enable_limiter);
+  if (mode == GainControl::Mode::kAdaptiveAnalog) {
+    gc->set_analog_level_limits(analog_level_min, analog_level_max);
+    gc->set_stream_analog_level(stream_analog_level);
+  }
+  gc->set_compression_gain_db(gain);
+  gc->set_target_level_dbfs(target_level_dbfs);
+
+  static_cast<void>(gc->mode());
+  static_cast<void>(gc->analog_level_minimum());
+  static_cast<void>(gc->analog_level_maximum());
+  static_cast<void>(gc->stream_analog_level());
+  static_cast<void>(gc->compression_gain_db());
+  static_cast<void>(gc->stream_is_saturated());
+  static_cast<void>(gc->target_level_dbfs());
+  static_cast<void>(gc->is_limiter_enabled());
+}
+
+void FuzzGainController(test::FuzzDataHelper* fuzz_data, GainControlImpl* gci) {
+  using Rate = ::webrtc::AudioProcessing::NativeRate;
+  const Rate rate_kinds[] = {Rate::kSampleRate16kHz, Rate::kSampleRate32kHz,
+                             Rate::kSampleRate48kHz};
+
+  const auto sample_rate_hz =
+      static_cast<size_t>(fuzz_data->SelectOneOf(rate_kinds));
+  const size_t samples_per_frame = sample_rate_hz / 100;
+  const size_t num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1;
+
+  gci->Initialize(num_channels, sample_rate_hz);
+  FuzzGainControllerConfig(fuzz_data, gci);
+
+  // The audio buffer is used for both capture and render.
+  AudioBuffer audio(sample_rate_hz, num_channels, sample_rate_hz,
+                    num_channels, sample_rate_hz, num_channels);
+
+  std::vector<int16_t> packed_render_audio(samples_per_frame);
+
+  while (fuzz_data->CanReadBytes(1)) {
+    FillAudioBuffer(sample_rate_hz, fuzz_data, &audio);
+
+    const bool stream_has_echo = fuzz_data->ReadOrDefaultValue(true);
+    gci->AnalyzeCaptureAudio(audio);
+    gci->ProcessCaptureAudio(&audio, stream_has_echo);
+
+    FillAudioBuffer(sample_rate_hz, fuzz_data, &audio);
+
+    gci->PackRenderAudioBuffer(audio, &packed_render_audio);
+    gci->ProcessRenderAudio(packed_render_audio);
+  }
+}
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 200000) {
+    return;
+  }
+  test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+  auto gci = std::make_unique<GainControlImpl>();
+  FuzzGainController(&fuzz_data, gci.get());
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc
new file mode 100644
index 0000000000..1db332eeb5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc
@@ -0,0 +1,77 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+#include <limits>
+
+#include "absl/types/optional.h"
+#include "api/audio_codecs/audio_decoder.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+namespace {
+template <typename T, unsigned int B = sizeof(T)>
+bool ParseInt(const uint8_t** data, size_t* remaining_size, T* value) {
+  static_assert(std::numeric_limits<T>::is_integer, "Type must be an integer.");
+  static_assert(sizeof(T) <= sizeof(uint64_t),
+                "Cannot read wider than uint64_t.");
+  static_assert(B <= sizeof(T), "T must be at least B bytes wide.");
+  if (B > *remaining_size)
+    return false;
+  uint64_t val = ByteReader<uint64_t, B>::ReadBigEndian(*data);
+  *data += B;
+  *remaining_size -= B;
+  *value = static_cast<T>(val);
+  return true;
+}
+}  // namespace
+
+// This function reads two bytes from the beginning of `data`, interprets them
+// as the first packet length, and reads this many bytes if available. The
+// payload is inserted into the decoder, and the process continues until no more
+// data is available. Either AudioDecoder::Decode or
+// AudioDecoder::DecodeRedundant is used, depending on the value of
+// `decode_type`.
+void FuzzAudioDecoder(DecoderFunctionType decode_type,
+                      const uint8_t* data,
+                      size_t size,
+                      AudioDecoder* decoder,
+                      int sample_rate_hz,
+                      size_t max_decoded_bytes,
+                      int16_t* decoded) {
+  const uint8_t* data_ptr = data;
+  size_t remaining_size = size;
+  size_t packet_len;
+  constexpr size_t kMaxNumFuzzedPackets = 200;
+  for (size_t num_packets = 0; num_packets < kMaxNumFuzzedPackets;
+       ++num_packets) {
+    if (!(ParseInt<size_t, 2>(&data_ptr, &remaining_size, &packet_len) &&
+          packet_len <= remaining_size)) {
+      break;
+    }
+    AudioDecoder::SpeechType speech_type;
+    switch (decode_type) {
+      case DecoderFunctionType::kNormalDecode:
+        decoder->Decode(data_ptr, packet_len, sample_rate_hz, max_decoded_bytes,
+                        decoded, &speech_type);
+        break;
+      case DecoderFunctionType::kRedundantDecode:
+        decoder->DecodeRedundant(data_ptr, packet_len, sample_rate_hz,
+                                 max_decoded_bytes, decoded, &speech_type);
+        break;
+    }
+    data_ptr += packet_len;
+    remaining_size -= packet_len;
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h
new file mode 100644
index 0000000000..8c5246bb5e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_
+#define TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+namespace webrtc {
+
+class AudioDecoder;
+
+enum class DecoderFunctionType {
+  kNormalDecode,
+  kRedundantDecode,
+};
+
+void FuzzAudioDecoder(DecoderFunctionType decode_type,
+                      const uint8_t* data,
+                      size_t size,
+                      AudioDecoder* decoder,
+                      int sample_rate_hz,
+                      size_t max_decoded_bytes,
+                      int16_t* decoded);
+
+}  // namespace webrtc
+
+#endif  // TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc
new file mode 100644
index 0000000000..08599aa333
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/g722/audio_decoder_g722.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000 || size < 1) {
+    return;
+  }
+
+  std::unique_ptr<AudioDecoder> dec;
+  size_t num_channels;
+  if (data[0] % 2) {
+    dec = std::make_unique<AudioDecoderG722Impl>();
+    num_channels = 1;
+  } else {
+    dec = std::make_unique<AudioDecoderG722StereoImpl>();
+    num_channels = 2;
+  }
+  // Allocate a maximum output size of 100 ms.
+  const int sample_rate_hz = dec->SampleRateHz();
+  const size_t allocated_ouput_size_samples =
+      sample_rate_hz / 10 * num_channels;
+  std::unique_ptr<int16_t[]> output =
+      std::make_unique<int16_t[]>(allocated_ouput_size_samples);
+  FuzzAudioDecoder(
+      DecoderFunctionType::kNormalDecode, data, size, dec.get(), sample_rate_hz,
+      allocated_ouput_size_samples * sizeof(int16_t), output.get());
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc
new file mode 100644
index 0000000000..8548645c63
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc
@@ -0,0 +1,26 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/ilbc/audio_decoder_ilbc.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000) {
+    return;
+  }
+  AudioDecoderIlbcImpl dec;
+  static const int kSampleRateHz = 8000;
+  static const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10;
+  int16_t output[kAllocatedOuputSizeSamples];
+  FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, &dec,
+                   kSampleRateHz, sizeof(output), output);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
new file mode 100644
index 0000000000..474a1cdc43
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
@@ -0,0 +1,61 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "api/audio_codecs/opus/audio_decoder_multi_channel_opus.h"
+#include "api/audio_codecs/opus/audio_decoder_multi_channel_opus_config.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+
+AudioDecoderMultiChannelOpusConfig MakeDecoderConfig(
+    int num_channels,
+    int num_streams,
+    int coupled_streams,
+    std::vector<unsigned char> channel_mapping) {
+  AudioDecoderMultiChannelOpusConfig config;
+  config.num_channels = num_channels;
+  config.num_streams = num_streams;
+  config.coupled_streams = coupled_streams;
+  config.channel_mapping = channel_mapping;
+  return config;
+}
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  const std::vector<AudioDecoderMultiChannelOpusConfig> surround_configs = {
+      MakeDecoderConfig(1, 1, 0, {0}),  // Mono
+
+      MakeDecoderConfig(2, 2, 0, {0, 0}),  // Copy the first (of
+                                           // 2) decoded streams
+                                           // into both output
+                                           // channel 0 and output
+                                           // channel 1. Ignore
+                                           // the 2nd decoded
+                                           // stream.
+
+      MakeDecoderConfig(4, 2, 2, {0, 1, 2, 3}),             // Quad.
+      MakeDecoderConfig(6, 4, 2, {0, 4, 1, 2, 3, 5}),       // 5.1
+      MakeDecoderConfig(8, 5, 3, {0, 6, 1, 2, 3, 4, 5, 7})  // 7.1
+  };
+
+  const auto config = surround_configs[data[0] % surround_configs.size()];
+  RTC_CHECK(config.IsOk());
+  std::unique_ptr<AudioDecoder> dec =
+      AudioDecoderMultiChannelOpus::MakeAudioDecoder(config);
+  RTC_CHECK(dec);
+  const int kSampleRateHz = 48000;
+  const size_t kAllocatedOuputSizeSamples =
+      4 * kSampleRateHz / 10;  // 4x100 ms, 4 times the size of the output array
+                               // for the stereo Opus codec. It should be enough
+                               // for 8 channels.
+  int16_t output[kAllocatedOuputSizeSamples];
+  FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, dec.get(),
+                   kSampleRateHz, sizeof(output), output);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc
new file mode 100644
index 0000000000..a015f98b5b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc
@@ -0,0 +1,24 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/opus/audio_decoder_opus.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  const size_t channels = (size % 2) + 1;  // 1 or 2 channels.
+  AudioDecoderOpusImpl dec(channels);
+  const int kSampleRateHz = 48000;
+  const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10;  // 100 ms.
+  int16_t output[kAllocatedOuputSizeSamples];
+  FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, &dec,
+                   kSampleRateHz, sizeof(output), output);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc
new file mode 100644
index 0000000000..efcba0f35d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc
@@ -0,0 +1,24 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/audio_coding/codecs/opus/audio_decoder_opus.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  const size_t channels = (size % 2) + 1;  // 1 or 2 channels.
+  AudioDecoderOpusImpl dec(channels);
+  const int kSampleRateHz = 48000;
+  const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10;  // 100 ms.
+  int16_t output[kAllocatedOuputSizeSamples];
+  FuzzAudioDecoder(DecoderFunctionType::kRedundantDecode, data, size, &dec,
+                   kSampleRateHz, sizeof(output), output);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc
new file mode 100644
index 0000000000..6e5d6e2190
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/audio_coding/codecs/pcm16b/audio_decoder_pcm16b.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000 || size < 2) {
+    return;
+  }
+
+  int sample_rate_hz;
+  switch (data[0] % 4) {
+    case 0:
+      sample_rate_hz = 8000;
+      break;
+    case 1:
+      sample_rate_hz = 16000;
+      break;
+    case 2:
+      sample_rate_hz = 32000;
+      break;
+    case 3:
+      sample_rate_hz = 48000;
+      break;
+    default:
+      RTC_DCHECK_NOTREACHED();
+      return;
+  }
+  const size_t num_channels = data[1] % 16 + 1;
+
+  // Two first bytes of the data are used. Move forward.
+  data += 2;
+  size -= 2;
+
+  AudioDecoderPcm16B dec(sample_rate_hz, num_channels);
+  // Allocate a maximum output size of 100 ms.
+  const size_t allocated_ouput_size_samples =
+      sample_rate_hz * num_channels / 10;
+  std::unique_ptr<int16_t[]> output =
+      std::make_unique<int16_t[]>(allocated_ouput_size_samples);
+  FuzzAudioDecoder(
+      DecoderFunctionType::kNormalDecode, data, size, &dec, sample_rate_hz,
+      allocated_ouput_size_samples * sizeof(int16_t), output.get());
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc
new file mode 100644
index 0000000000..dbfcaf9976
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc
@@ -0,0 +1,45 @@
+/*
+ *  Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/audio_coding/codecs/g711/audio_decoder_pcm.h"
+#include "test/fuzzers/audio_decoder_fuzzer.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000 || size < 2) {
+    return;
+  }
+
+  const size_t num_channels = data[0] % 16 + 1;
+
+  std::unique_ptr<AudioDecoder> dec;
+  if (data[1] % 2) {
+    dec = std::make_unique<AudioDecoderPcmU>(num_channels);
+  } else {
+    dec = std::make_unique<AudioDecoderPcmA>(num_channels);
+  }
+
+  // Two first bytes of the data are used. Move forward.
+  data += 2;
+  size -= 2;
+
+  // Allocate a maximum output size of 100 ms.
+  const size_t allocated_ouput_size_samples =
+      dec->SampleRateHz() * num_channels / 10;
+  std::unique_ptr<int16_t[]> output =
+      std::make_unique<int16_t[]>(allocated_ouput_size_samples);
+  FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, dec.get(),
+                   dec->SampleRateHz(),
+                   allocated_ouput_size_samples * sizeof(int16_t),
+                   output.get());
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc
new file mode 100644
index 0000000000..837c26df56
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (c) 2020 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/audio_encoder_fuzzer.h"
+
+#include <cstring>
+
+#include "rtc_base/buffer.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+
+// This function reads bytes from `data_view`, interprets them as RTP timestamp
+// and input samples, and sends them for encoding. The process continues until
+// no more data is available.
+void FuzzAudioEncoder(rtc::ArrayView<const uint8_t> data_view,
+                      std::unique_ptr<AudioEncoder> encoder) {
+  test::FuzzDataHelper data(data_view);
+  const size_t block_size_samples =
+      encoder->SampleRateHz() / 100 * encoder->NumChannels();
+  const size_t block_size_bytes = block_size_samples * sizeof(int16_t);
+  if (data_view.size() / block_size_bytes > 1000) {
+    // If the size of the fuzzer data is more than 1000 input blocks (i.e., more
+    // than 10 seconds), then don't fuzz at all for the fear of timing out.
+    return;
+  }
+
+  rtc::BufferT<int16_t> input_aligned(block_size_samples);
+  rtc::Buffer encoded;
+
+  // Each round in the loop below will need one block of samples + a 32-bit
+  // timestamp from the fuzzer input.
+  const size_t bytes_to_read = block_size_bytes + sizeof(uint32_t);
+  while (data.CanReadBytes(bytes_to_read)) {
+    const uint32_t timestamp = data.Read<uint32_t>();
+    auto byte_array = data.ReadByteArray(block_size_bytes);
+    // Align the data by copying to another array.
+    RTC_DCHECK_EQ(input_aligned.size() * sizeof(int16_t),
+                  byte_array.size() * sizeof(uint8_t));
+    memcpy(input_aligned.data(), byte_array.data(), byte_array.size());
+    auto info = encoder->Encode(timestamp, input_aligned, &encoded);
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h
new file mode 100644
index 0000000000..0c879df4d3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h
@@ -0,0 +1,26 @@
+/*
+ *  Copyright (c) 2020 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_
+#define TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_
+
+#include <memory>
+
+#include "api/array_view.h"
+#include "api/audio_codecs/audio_encoder.h"
+
+namespace webrtc {
+
+void FuzzAudioEncoder(rtc::ArrayView<const uint8_t> data_view,
+                      std::unique_ptr<AudioEncoder> encoder);
+
+}  // namespace webrtc
+
+#endif  // TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc
new file mode 100644
index 0000000000..d67e6d6067
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc
@@ -0,0 +1,27 @@
+/*
+ *  Copyright (c) 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "api/audio_codecs/opus/audio_encoder_opus.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/audio_encoder_fuzzer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  AudioEncoderOpus::Config config;
+  config.frame_size_ms = 20;
+  RTC_CHECK(config.IsOk());
+  constexpr int kPayloadType = 100;
+  FuzzAudioEncoder(
+      /*data_view=*/{data, size},
+      /*encoder=*/AudioEncoderOpus::MakeAudioEncoder(config, kPayloadType));
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc
new file mode 100644
index 0000000000..afcb4318f9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc
@@ -0,0 +1,147 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <bitset>
+#include <string>
+
+#include "absl/memory/memory.h"
+#include "api/audio/echo_canceller3_factory.h"
+#include "api/audio/echo_detector_creator.h"
+#include "api/task_queue/default_task_queue_factory.h"
+#include "modules/audio_processing/aec_dump/aec_dump_factory.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "modules/audio_processing/test/audio_processing_builder_for_testing.h"
+#include "rtc_base/arraysize.h"
+#include "rtc_base/numerics/safe_minmax.h"
+#include "rtc_base/task_queue.h"
+#include "system_wrappers/include/field_trial.h"
+#include "test/fuzzers/audio_processing_fuzzer_helper.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+
+const std::string kFieldTrialNames[] = {
+    "WebRTC-Audio-Agc2ForceExtraSaturationMargin",
+    "WebRTC-Audio-Agc2ForceInitialSaturationMargin",
+    "WebRTC-Aec3MinErleDuringOnsetsKillSwitch",
+    "WebRTC-Aec3ShortHeadroomKillSwitch",
+};
+
+rtc::scoped_refptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data,
+                                              std::string* field_trial_string,
+                                              rtc::TaskQueue* worker_queue) {
+  // Parse boolean values for optionally enabling different
+  // configurable public components of APM.
+  bool use_ts = fuzz_data->ReadOrDefaultValue(true);
+  bool use_red = fuzz_data->ReadOrDefaultValue(true);
+  bool use_hpf = fuzz_data->ReadOrDefaultValue(true);
+  bool use_aec3 = fuzz_data->ReadOrDefaultValue(true);
+  bool use_aec = fuzz_data->ReadOrDefaultValue(true);
+  bool use_aecm = fuzz_data->ReadOrDefaultValue(true);
+  bool use_agc = fuzz_data->ReadOrDefaultValue(true);
+  bool use_ns = fuzz_data->ReadOrDefaultValue(true);
+  bool use_agc_limiter = fuzz_data->ReadOrDefaultValue(true);
+  bool use_agc2 = fuzz_data->ReadOrDefaultValue(true);
+  bool use_agc2_adaptive_digital = fuzz_data->ReadOrDefaultValue(true);
+
+  // Read a gain value supported by GainController2::Validate().
+  const float gain_controller2_gain_db =
+      fuzz_data->ReadOrDefaultValue<uint8_t>(0) % 50;
+
+  constexpr size_t kNumFieldTrials = arraysize(kFieldTrialNames);
+  // Verify that the read data type has enough bits to fuzz the field trials.
+  using FieldTrialBitmaskType = uint64_t;
+  static_assert(kNumFieldTrials <= sizeof(FieldTrialBitmaskType) * 8,
+                "FieldTrialBitmaskType is not large enough.");
+  std::bitset<kNumFieldTrials> field_trial_bitmask(
+      fuzz_data->ReadOrDefaultValue<FieldTrialBitmaskType>(0));
+  for (size_t i = 0; i < kNumFieldTrials; ++i) {
+    if (field_trial_bitmask[i]) {
+      *field_trial_string += kFieldTrialNames[i] + "/Enabled/";
+    }
+  }
+  field_trial::InitFieldTrialsFromString(field_trial_string->c_str());
+
+  // Ignore a few bytes. Bytes from this segment will be used for
+  // future config flag changes. We assume 40 bytes is enough for
+  // configuring the APM.
+  constexpr size_t kSizeOfConfigSegment = 40;
+  RTC_DCHECK(kSizeOfConfigSegment >= fuzz_data->BytesRead());
+  static_cast<void>(
+      fuzz_data->ReadByteArray(kSizeOfConfigSegment - fuzz_data->BytesRead()));
+
+  // Filter out incompatible settings that lead to CHECK failures.
+  if ((use_aecm && use_aec) ||          // These settings cause CHECK failure.
+      (use_aecm && use_aec3 && use_ns)  // These settings trigger webrtc:9489.
+  ) {
+    return nullptr;
+  }
+
+  std::unique_ptr<EchoControlFactory> echo_control_factory;
+  if (use_aec3) {
+    echo_control_factory.reset(new EchoCanceller3Factory());
+  }
+
+  webrtc::AudioProcessing::Config apm_config;
+  apm_config.pipeline.multi_channel_render = true;
+  apm_config.pipeline.multi_channel_capture = true;
+  apm_config.echo_canceller.enabled = use_aec || use_aecm;
+  apm_config.echo_canceller.mobile_mode = use_aecm;
+  apm_config.high_pass_filter.enabled = use_hpf;
+  apm_config.gain_controller1.enabled = use_agc;
+  apm_config.gain_controller1.enable_limiter = use_agc_limiter;
+  apm_config.gain_controller2.enabled = use_agc2;
+  apm_config.gain_controller2.fixed_digital.gain_db = gain_controller2_gain_db;
+  apm_config.gain_controller2.adaptive_digital.enabled =
+      use_agc2_adaptive_digital;
+  apm_config.noise_suppression.enabled = use_ns;
+  apm_config.transient_suppression.enabled = use_ts;
+
+  rtc::scoped_refptr<AudioProcessing> apm =
+      AudioProcessingBuilderForTesting()
+          .SetEchoControlFactory(std::move(echo_control_factory))
+          .SetEchoDetector(use_red ? CreateEchoDetector() : nullptr)
+          .SetConfig(apm_config)
+          .Create();
+
+#ifdef WEBRTC_LINUX
+  apm->AttachAecDump(AecDumpFactory::Create("/dev/null", -1, worker_queue));
+#endif
+
+  return apm;
+}
+
+TaskQueueFactory* GetTaskQueueFactory() {
+  static TaskQueueFactory* const factory =
+      CreateDefaultTaskQueueFactory().release();
+  return factory;
+}
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 400000) {
+    return;
+  }
+  test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+  // This string must be in scope during execution, according to documentation
+  // for field_trial.h. Hence it's created here and not in CreateApm.
+  std::string field_trial_string = "";
+
+  rtc::TaskQueue worker_queue(GetTaskQueueFactory()->CreateTaskQueue(
+      "rtc-low-prio", rtc::TaskQueue::Priority::LOW));
+  auto apm = CreateApm(&fuzz_data, &field_trial_string, &worker_queue);
+
+  if (apm) {
+    FuzzAudioProcessing(&fuzz_data, std::move(apm));
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc
new file mode 100644
index 0000000000..5252918d77
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc
@@ -0,0 +1,143 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/audio_processing_fuzzer_helper.h"
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <limits>
+
+#include "api/audio/audio_frame.h"
+#include "modules/audio_processing/include/audio_frame_proxies.h"
+#include "modules/audio_processing/include/audio_processing.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+namespace {
+bool ValidForApm(float x) {
+  return std::isfinite(x) && -1.0f <= x && x <= 1.0f;
+}
+
+void GenerateFloatFrame(test::FuzzDataHelper* fuzz_data,
+                        int input_rate,
+                        int num_channels,
+                        float* const* float_frames) {
+  const int samples_per_input_channel =
+      AudioProcessing::GetFrameSize(input_rate);
+  RTC_DCHECK_LE(samples_per_input_channel, 480);
+  for (int i = 0; i < num_channels; ++i) {
+    std::fill(float_frames[i], float_frames[i] + samples_per_input_channel, 0);
+    const size_t read_bytes = sizeof(float) * samples_per_input_channel;
+    if (fuzz_data->CanReadBytes(read_bytes)) {
+      rtc::ArrayView<const uint8_t> byte_array =
+          fuzz_data->ReadByteArray(read_bytes);
+      memmove(float_frames[i], byte_array.begin(), read_bytes);
+    }
+
+    // Sanitize input.
+    for (int j = 0; j < samples_per_input_channel; ++j) {
+      if (!ValidForApm(float_frames[i][j])) {
+        float_frames[i][j] = 0.f;
+      }
+    }
+  }
+}
+
+void GenerateFixedFrame(test::FuzzDataHelper* fuzz_data,
+                        int input_rate,
+                        int num_channels,
+                        AudioFrame* fixed_frame) {
+  const int samples_per_input_channel =
+      AudioProcessing::GetFrameSize(input_rate);
+
+  fixed_frame->samples_per_channel_ = samples_per_input_channel;
+  fixed_frame->sample_rate_hz_ = input_rate;
+  fixed_frame->num_channels_ = num_channels;
+
+  RTC_DCHECK_LE(samples_per_input_channel * num_channels,
+                AudioFrame::kMaxDataSizeSamples);
+  for (int i = 0; i < samples_per_input_channel * num_channels; ++i) {
+    fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue<int16_t>(0);
+  }
+}
+}  // namespace
+
+void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data,
+                         rtc::scoped_refptr<AudioProcessing> apm) {
+  AudioFrame fixed_frame;
+  // Normal usage is up to 8 channels. Allowing to fuzz one beyond this allows
+  // us to catch implicit assumptions about normal usage.
+  constexpr int kMaxNumChannels = 9;
+  std::array<std::array<float, 480>, kMaxNumChannels> float_frames;
+  std::array<float*, kMaxNumChannels> float_frame_ptrs;
+  for (int i = 0; i < kMaxNumChannels; ++i) {
+    float_frame_ptrs[i] = float_frames[i].data();
+  }
+  float* const* ptr_to_float_frames = &float_frame_ptrs[0];
+
+  constexpr int kSampleRatesHz[] = {8000,  11025, 16000, 22050,
+                                    32000, 44100, 48000};
+
+  // We may run out of fuzz data in the middle of a loop iteration. In
+  // that case, default values will be used for the rest of that
+  // iteration.
+  while (fuzz_data->CanReadBytes(1)) {
+    const bool is_float = fuzz_data->ReadOrDefaultValue(true);
+    // Decide input/output rate for this iteration.
+    const int input_rate = fuzz_data->SelectOneOf(kSampleRatesHz);
+    const int output_rate = fuzz_data->SelectOneOf(kSampleRatesHz);
+
+    const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue<uint8_t>(0);
+    // API call needed for AECM to run.
+    apm->set_stream_delay_ms(stream_delay);
+
+    const bool key_pressed = fuzz_data->ReadOrDefaultValue(true);
+    apm->set_stream_key_pressed(key_pressed);
+
+    // Make the APM call depending on capture/render mode and float /
+    // fix interface.
+    const bool is_capture = fuzz_data->ReadOrDefaultValue(true);
+
+    // Fill the arrays with audio samples from the data.
+    int apm_return_code = AudioProcessing::Error::kNoError;
+    if (is_float) {
+      const int num_channels =
+          fuzz_data->ReadOrDefaultValue<uint8_t>(1) % kMaxNumChannels;
+
+      GenerateFloatFrame(fuzz_data, input_rate, num_channels,
+                         ptr_to_float_frames);
+      if (is_capture) {
+        apm_return_code = apm->ProcessStream(
+            ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+            StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+      } else {
+        apm_return_code = apm->ProcessReverseStream(
+            ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+            StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+      }
+    } else {
+      const int num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1;
+      GenerateFixedFrame(fuzz_data, input_rate, num_channels, &fixed_frame);
+
+      if (is_capture) {
+        apm_return_code = ProcessAudioFrame(apm.get(), &fixed_frame);
+      } else {
+        apm_return_code = ProcessReverseAudioFrame(apm.get(), &fixed_frame);
+      }
+    }
+
+    // Cover stats gathering code paths.
+    static_cast<void>(apm->GetStatistics(true /*has_remote_tracks*/));
+
+    RTC_DCHECK_NE(apm_return_code, AudioProcessing::kBadDataLengthError);
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h
new file mode 100644
index 0000000000..a604db8cef
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h
@@ -0,0 +1,25 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_
+#define TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_
+
+#include <memory>
+
+#include "modules/audio_processing/include/audio_processing.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+namespace webrtc {
+
+void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data,
+                         rtc::scoped_refptr<AudioProcessing> apm);
+
+}  // namespace webrtc
+
+#endif  // TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc
new file mode 100644
index 0000000000..ca3946988c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc
@@ -0,0 +1,162 @@
+/*
+ *  Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <limits>
+
+#include "modules/audio_processing/include/audio_processing.h"
+#include "modules/audio_processing/test/audio_processing_builder_for_testing.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace {
+constexpr int kMaxNumChannels = 2;
+// APM supported max rate is 384000 Hz, using a limit slightly above lets the
+// fuzzer exercise the handling of too high rates.
+constexpr int kMaxSampleRateHz = 400000;
+constexpr int kMaxSamplesPerChannel = kMaxSampleRateHz / 100;
+
+void GenerateFloatFrame(test::FuzzDataHelper& fuzz_data,
+                        int input_rate,
+                        int num_channels,
+                        float* const* float_frames) {
+  const int samples_per_input_channel =
+      AudioProcessing::GetFrameSize(input_rate);
+  RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel);
+  for (int i = 0; i < num_channels; ++i) {
+    float channel_value;
+    fuzz_data.CopyTo<float>(&channel_value);
+    std::fill(float_frames[i], float_frames[i] + samples_per_input_channel,
+              channel_value);
+  }
+}
+
+void GenerateFixedFrame(test::FuzzDataHelper& fuzz_data,
+                        int input_rate,
+                        int num_channels,
+                        int16_t* fixed_frames) {
+  const int samples_per_input_channel =
+      AudioProcessing::GetFrameSize(input_rate);
+  RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel);
+  // Write interleaved samples.
+  for (int ch = 0; ch < num_channels; ++ch) {
+    const int16_t channel_value = fuzz_data.ReadOrDefaultValue<int16_t>(0);
+    for (int i = ch; i < samples_per_input_channel * num_channels;
+         i += num_channels) {
+      fixed_frames[i] = channel_value;
+    }
+  }
+}
+
+// No-op processor used to influence APM input/output pipeline decisions based
+// on what submodules are present.
+class NoopCustomProcessing : public CustomProcessing {
+ public:
+  NoopCustomProcessing() {}
+  ~NoopCustomProcessing() override {}
+  void Initialize(int sample_rate_hz, int num_channels) override {}
+  void Process(AudioBuffer* audio) override {}
+  std::string ToString() const override { return ""; }
+  void SetRuntimeSetting(AudioProcessing::RuntimeSetting setting) override {}
+};
+}  // namespace
+
+// This fuzzer is directed at fuzzing unexpected input and output sample rates
+// of APM. For example, the sample rate 22050 Hz is processed by APM in frames
+// of floor(22050/100) = 220 samples. This is not exactly 10 ms of audio
+// content, and may break assumptions commonly made on the APM frame size.
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 100) {
+    return;
+  }
+  test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+
+  std::unique_ptr<CustomProcessing> capture_processor =
+      fuzz_data.ReadOrDefaultValue(true)
+          ? std::make_unique<NoopCustomProcessing>()
+          : nullptr;
+  std::unique_ptr<CustomProcessing> render_processor =
+      fuzz_data.ReadOrDefaultValue(true)
+          ? std::make_unique<NoopCustomProcessing>()
+          : nullptr;
+  rtc::scoped_refptr<AudioProcessing> apm =
+      AudioProcessingBuilderForTesting()
+          .SetConfig({.pipeline = {.multi_channel_render = true,
+                                   .multi_channel_capture = true}})
+          .SetCapturePostProcessing(std::move(capture_processor))
+          .SetRenderPreProcessing(std::move(render_processor))
+          .Create();
+  RTC_DCHECK(apm);
+
+  std::array<int16_t, kMaxSamplesPerChannel * kMaxNumChannels> fixed_frame;
+  std::array<std::array<float, kMaxSamplesPerChannel>, kMaxNumChannels>
+      float_frames;
+  std::array<float*, kMaxNumChannels> float_frame_ptrs;
+  for (int i = 0; i < kMaxNumChannels; ++i) {
+    float_frame_ptrs[i] = float_frames[i].data();
+  }
+  float* const* ptr_to_float_frames = &float_frame_ptrs[0];
+
+  // Choose whether to fuzz the float or int16_t interfaces of APM.
+  const bool is_float = fuzz_data.ReadOrDefaultValue(true);
+
+  // We may run out of fuzz data in the middle of a loop iteration. In
+  // that case, default values will be used for the rest of that
+  // iteration.
+  while (fuzz_data.CanReadBytes(1)) {
+    // Decide input/output rate for this iteration.
+    const int input_rate = static_cast<int>(
+        fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz);
+    const int output_rate = static_cast<int>(
+        fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz);
+    const int num_channels = fuzz_data.ReadOrDefaultValue(true) ? 2 : 1;
+
+    // Since render and capture calls have slightly different reinitialization
+    // procedures, we let the fuzzer choose the order.
+    const bool is_capture = fuzz_data.ReadOrDefaultValue(true);
+
+    int apm_return_code = AudioProcessing::Error::kNoError;
+    if (is_float) {
+      GenerateFloatFrame(fuzz_data, input_rate, num_channels,
+                         ptr_to_float_frames);
+
+      if (is_capture) {
+        apm_return_code = apm->ProcessStream(
+            ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+            StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+      } else {
+        apm_return_code = apm->ProcessReverseStream(
+            ptr_to_float_frames, StreamConfig(input_rate, num_channels),
+            StreamConfig(output_rate, num_channels), ptr_to_float_frames);
+      }
+    } else {
+      GenerateFixedFrame(fuzz_data, input_rate, num_channels,
+                         fixed_frame.data());
+
+      if (is_capture) {
+        apm_return_code = apm->ProcessStream(
+            fixed_frame.data(), StreamConfig(input_rate, num_channels),
+            StreamConfig(output_rate, num_channels), fixed_frame.data());
+      } else {
+        apm_return_code = apm->ProcessReverseStream(
+            fixed_frame.data(), StreamConfig(input_rate, num_channels),
+            StreamConfig(output_rate, num_channels), fixed_frame.data());
+      }
+    }
+    // APM may flag an error on unsupported audio formats, but should not crash.
+    RTC_DCHECK(apm_return_code == AudioProcessing::kNoError ||
+               apm_return_code == AudioProcessing::kBadSampleRateError);
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc
new file mode 100644
index 0000000000..7f44af99fb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "api/array_view.h"
+#include "modules/audio_coding/codecs/cng/webrtc_cng.h"
+#include "rtc_base/buffer.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace test {
+namespace {
+
+void FuzzOneInputTest(rtc::ArrayView<const uint8_t> data) {
+  FuzzDataHelper fuzz_data(data);
+  ComfortNoiseDecoder cng_decoder;
+
+  while (1) {
+    if (!fuzz_data.CanReadBytes(1))
+      break;
+    const uint8_t sid_frame_len = fuzz_data.Read<uint8_t>();
+    auto sid_frame = fuzz_data.ReadByteArray(sid_frame_len);
+    if (sid_frame.empty())
+      break;
+    cng_decoder.UpdateSid(sid_frame);
+    if (!fuzz_data.CanReadBytes(3))
+      break;
+    constexpr bool kTrueOrFalse[] = {true, false};
+    const bool new_period = fuzz_data.SelectOneOf(kTrueOrFalse);
+    constexpr size_t kOutputSizes[] = {80, 160, 320, 480};
+    const size_t output_size = fuzz_data.SelectOneOf(kOutputSizes);
+    const size_t num_generate_calls =
+        std::min(fuzz_data.Read<uint8_t>(), static_cast<uint8_t>(17));
+    rtc::BufferT<int16_t> output(output_size);
+    for (size_t i = 0; i < num_generate_calls; ++i) {
+      cng_decoder.Generate(output, new_period);
+    }
+  }
+}
+
+}  // namespace
+}  // namespace test
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 5000) {
+    return;
+  }
+  test::FuzzOneInputTest(rtc::ArrayView<const uint8_t>(data, size));
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json
new file mode 100644
index 0000000000..59b5db9446
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json
@@ -0,0 +1,151 @@
+[
+   {
+      "decoders" : [
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "1"
+               },
+               {
+                  "profile-level-id" : "42001f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 100
+         },
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "0"
+               },
+               {
+                  "profile-level-id" : "42001f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 102
+         },
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "1"
+               },
+               {
+                  "profile-level-id" : "42e01f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 127
+         },
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "0"
+               },
+               {
+                  "profile-level-id" : "42e01f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 125
+         },
+         {
+            "codec_params" : [],
+            "payload_name" : "VP8",
+            "payload_type" : 96
+         },
+         {
+            "codec_params" : [],
+            "payload_name" : "VP9",
+            "payload_type" : 98
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [
+            {
+               "encrypt" : false,
+               "id" : 5,
+               "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+            },
+            {
+               "encrypt" : false,
+               "id" : 3,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time"
+            },
+            {
+               "encrypt" : false,
+               "id" : 6,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay"
+            },
+            {
+               "encrypt" : false,
+               "id" : 7,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type"
+            },
+            {
+               "encrypt" : false,
+               "id" : 8,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing"
+            },
+            {
+               "encrypt" : false,
+               "id" : 4,
+               "uri" : "urn:3gpp:video-orientation"
+            },
+            {
+               "encrypt" : false,
+               "id" : 2,
+               "uri" : "urn:ietf:params:rtp-hdrext:toffset"
+            }
+         ],
+         "local_ssrc" : 1,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : -1,
+         "remb" : true,
+         "remote_ssrc" : 2736493666,
+         "rtcp_mode" : "RtcpMode::kReducedSize",
+         "rtx_payload_types" : [
+            {
+               "97" : 96
+            },
+            {
+               "99" : 98
+            },
+            {
+               "101" : 100
+            },
+            {
+               "107" : 125
+            },
+            {
+               "122" : 127
+            },
+            {
+               "123" : 102
+            }
+         ],
+         "rtx_ssrc" : 885796452,
+         "transport_cc" : true,
+         "ulpfec_payload_type" : -1
+      },
+      "target_delay_ms" : 0
+   }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json
new file mode 100644
index 0000000000..9cb5bd767b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json
@@ -0,0 +1,66 @@
+[
+   {
+      "decoders" : [
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "0"
+               },
+               {
+                  "packetization-mode" : "0"
+               },
+               {
+                  "profile-level-id" : "42001f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 100
+         },
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "1"
+               },
+               {
+                  "profile-level-id" : "42e01f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 102
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [],
+         "local_ssrc" : 1,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : 125,
+         "remb" : true,
+         "remote_ssrc" : 1989790381,
+         "rtcp_mode" : "RtcpMode::kReducedSize",
+         "rtx_payload_types" : [
+            {
+               "101" : 100
+            },
+            {
+               "122" : 125
+            },
+            {
+               "123" : 127
+            }
+         ],
+         "rtx_ssrc" : 1406083315,
+         "transport_cc" : true,
+         "ulpfec_payload_type" : -1
+      },
+      "target_delay_ms" : 0
+   }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json
new file mode 100644
index 0000000000..f3ae6bbafc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json
@@ -0,0 +1,66 @@
+[
+   {
+      "decoders" : [
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "1"
+               },
+               {
+                  "profile-level-id" : "42001f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 100
+         },
+         {
+            "codec_params" : [
+               {
+                  "level-asymmetry-allowed" : "1"
+               },
+               {
+                  "packetization-mode" : "1"
+               },
+               {
+                  "profile-level-id" : "42e01f"
+               }
+            ],
+            "payload_name" : "H264",
+            "payload_type" : 102
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [],
+         "local_ssrc" : 1,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : 125,
+         "remb" : true,
+         "remote_ssrc" : 1989790381,
+         "rtcp_mode" : "RtcpMode::kReducedSize",
+         "rtx_payload_types" : [
+            {
+               "101" : 100
+            },
+            {
+               "122" : 125
+            },
+            {
+               "123" : 127
+            }
+         ],
+         "rtx_ssrc" : 1406083315,
+         "transport_cc" : true,
+         "ulpfec_payload_type" : -1
+      },
+      "target_delay_ms" : 0
+   }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json
new file mode 100644
index 0000000000..0a5eef8b09
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json
@@ -0,0 +1,29 @@
+[{
+      "decoders" : [
+         {
+            "codec_params" : [],
+            "payload_name" : "VP8",
+            "payload_type" : 125
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [],
+         "local_ssrc" : 7331,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : -1,
+         "remb" : true,
+         "remote_ssrc" : 1337,
+         "rtcp_mode" : "RtcpMode::kCompound",
+         "rtx_payload_types" : [],
+         "rtx_ssrc" : 100,
+         "transport_cc" : true,
+         "ulpfec_payload_type" : -1
+      },
+      "target_delay_ms" : 0
+}]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json
new file mode 100644
index 0000000000..3d2b66301d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json
@@ -0,0 +1,73 @@
+[
+   {
+      "decoders" : [
+         {
+            "codec_params" : [],
+            "payload_name" : "VP8",
+            "payload_type" : 96
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [
+            {
+               "encrypt" : false,
+               "id" : 5,
+               "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+            },
+            {
+               "encrypt" : false,
+               "id" : 3,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time"
+            },
+            {
+               "encrypt" : false,
+               "id" : 6,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay"
+            },
+            {
+               "encrypt" : false,
+               "id" : 7,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type"
+            },
+            {
+               "encrypt" : false,
+               "id" : 8,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing"
+            },
+            {
+               "encrypt" : false,
+               "id" : 4,
+               "uri" : "urn:3gpp:video-orientation"
+            },
+            {
+               "encrypt" : false,
+               "id" : 2,
+               "uri" : "urn:ietf:params:rtp-hdrext:toffset"
+            }
+         ],
+         "local_ssrc" : 1,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : -1,
+         "remb" : true,
+         "remote_ssrc" : 2672243158,
+         "rtcp_mode" : "RtcpMode::kReducedSize",
+         "rtx_payload_types" : [
+            {
+               "97" : 96
+            },
+            {
+               "99" : 98
+            }
+         ],
+         "rtx_ssrc" : 1807563126,
+         "transport_cc" : true
+      },
+      "target_delay_ms" : 0
+   }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json
new file mode 100644
index 0000000000..a9c88a2402
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json
@@ -0,0 +1,29 @@
+[{
+      "decoders" : [
+         {
+            "codec_params" : [],
+            "payload_name" : "VP9",
+            "payload_type" : 124
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [],
+         "local_ssrc" : 7331,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : -1,
+         "remb" : true,
+         "remote_ssrc" : 1337,
+         "rtcp_mode" : "RtcpMode::kCompound",
+         "rtx_payload_types" : [],
+         "rtx_ssrc" : 100,
+         "transport_cc" : true,
+         "ulpfec_payload_type" : -1
+      },
+      "target_delay_ms" : 0
+}]
diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json
new file mode 100644
index 0000000000..d089aa8fec
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json
@@ -0,0 +1,79 @@
+[
+   {
+      "decoders" : [
+         {
+            "codec_params" : [],
+            "payload_name" : "VP9",
+            "payload_type" : 98
+         },
+         {
+            "codec_params" : [],
+            "payload_name" : "VP8",
+            "payload_type" : 96
+         }
+      ],
+      "render_delay_ms" : 10,
+      "rtp" : {
+         "extensions" : [
+            {
+               "encrypt" : false,
+               "id" : 5,
+               "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+            },
+            {
+               "encrypt" : false,
+               "id" : 3,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time"
+            },
+            {
+               "encrypt" : false,
+               "id" : 6,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay"
+            },
+            {
+               "encrypt" : false,
+               "id" : 7,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type"
+            },
+            {
+               "encrypt" : false,
+               "id" : 8,
+               "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing"
+            },
+            {
+               "encrypt" : false,
+               "id" : 4,
+               "uri" : "urn:3gpp:video-orientation"
+            },
+            {
+               "encrypt" : false,
+               "id" : 2,
+               "uri" : "urn:ietf:params:rtp-hdrext:toffset"
+            }
+         ],
+         "local_ssrc" : 1,
+         "lntf" : {
+            "enabled": false,
+         },
+         "nack" : {
+            "rtp_history_ms" : 1000
+         },
+         "red_payload_type" : -1,
+         "remb" : true,
+         "remote_ssrc" : 2678204013,
+         "rtcp_mode" : "RtcpMode::kReducedSize",
+         "rtx_payload_types" : [
+            {
+               "97" : 96
+            },
+            {
+               "99" : 98
+            }
+         ],
+         "rtx_ssrc" : 1110725867,
+         "transport_cc" : true,
+         "ulpfec_payload_type" : -1
+      },
+      "target_delay_ms" : 0
+   }
+]
diff --git a/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc
new file mode 100644
index 0000000000..e266b85fa4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "absl/functional/bind_front.h"
+#include "modules/congestion_controller/include/receive_side_congestion_controller.h"
+#include "modules/pacing/packet_router.h"
+#include "modules/remote_bitrate_estimator/include/remote_bitrate_estimator.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  size_t i = 0;
+  if (size < sizeof(int64_t) + sizeof(uint8_t) + sizeof(uint32_t))
+    return;
+  SimulatedClock clock(data[i++]);
+  PacketRouter packet_router;
+  ReceiveSideCongestionController cc(
+      &clock,
+      absl::bind_front(&PacketRouter::SendCombinedRtcpPacket, &packet_router),
+      absl::bind_front(&PacketRouter::SendRemb, &packet_router), nullptr);
+  RTPHeader header;
+  header.ssrc = ByteReader<uint32_t>::ReadBigEndian(&data[i]);
+  i += sizeof(uint32_t);
+  header.extension.hasTransportSequenceNumber = true;
+  int64_t arrival_time_ms = std::min<int64_t>(
+      std::max<int64_t>(ByteReader<int64_t>::ReadBigEndian(&data[i]), 0),
+      std::numeric_limits<int64_t>::max() / 2);
+  i += sizeof(int64_t);
+  const size_t kMinPacketSize =
+      sizeof(size_t) + sizeof(uint16_t) + sizeof(uint8_t);
+  while (i + kMinPacketSize < size) {
+    size_t payload_size = ByteReader<size_t>::ReadBigEndian(&data[i]) % 1500;
+    i += sizeof(size_t);
+    header.extension.transportSequenceNumber =
+        ByteReader<uint16_t>::ReadBigEndian(&data[i]);
+    i += sizeof(uint16_t);
+    cc.OnReceivedPacket(arrival_time_ms, payload_size, header);
+    clock.AdvanceTimeMilliseconds(5);
+    arrival_time_ms += ByteReader<uint8_t>::ReadBigEndian(&data[i]);
+    i += sizeof(uint8_t);
+    cc.MaybeProcess();
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/README b/third_party/libwebrtc/test/fuzzers/corpora/README
new file mode 100644
index 0000000000..cc87025ff6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/README
@@ -0,0 +1,37 @@
+This is a collection of corpora for various WebRTC fuzzers. To use
+them, the gn targets define seed_corpus=$corpus_dir, which causes the
+ClusterFuzz upload bot to bundle $corpus_dir and upload it.
+
+The format is simple: one file per test case. Specific notes are
+included below.
+
+### SDP ###
+This corpus was initially assembled manually from the following
+sources:
+
+  - curl --silent https://www.ietf.org/rfc/rfc4317.txt | grep '^[ a-z]*=[^=]*$' | sed 's/^[[:space:]]*//' | awk -v RS='(^|\n)v=' '/./ {print "v="$0 > NR".sdp"}'
+  - all the SDPs used in the parser unit tests
+  - some manually gathered SDPs from Firefox and Opera
+
+The SDP tokens come from:
+
+ -  grep "^static const " webrtc/api/webrtcsdp.cc | cut -d'=' -f2 | cut -d ';' -f1 | tr -d '"' | tr -d "'" | tr -d ' ' | sort -u | grep -v '^(\n|\r|\r\n)$|^$' | sed -e 's/^/"/' -e 's/$/"/' | tail -n +2
+
+### STUN ###
+This corpus was initially assembled from the STUN unit tests, together
+with a crash that it found relatively quickly.
+
+### RT(C)P ###
+This corpus was initially assembled from the unittests. RTCP was
+minimised first.
+
+There is also rt(c?)p-corpus-with-extra-byte, in which each sample is
+prefixed by the byte 0xff. Some of the rtp fuzzers need to decide
+which header extensions to enable, and the first byte of the fuzz data
+is used for this.
+
+### PseudoTCP ###
+Very small corpus minimised from the unit tests.
+
+### SCTP ###
+This corpus was extracted from a few manually recorder wireshark dumps.
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json b/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json
new file mode 100644
index 0000000000..4dcbcee53a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json
@@ -0,0 +1 @@
+{"aec3": {"buffering": {"excess_render_detection_interval_blocks": 250,"max_allowed_excess_render_blocks": 8},"delay": {"default_delay": 5,"down_sampling_factor": 4,"num_filters": 5,"delay_headroom_samples": 32,"hysteresis_limit_blocks": 1,"fixed_capture_delay_samples": 0,"delay_estimate_smoothing": 0.7,"delay_candidate_detection_threshold": 0.2,"delay_selection_thresholds": {"initial": 5,"converged": 20},"use_external_delay_estimator": false,"downmix_before_delay_estimation": true,"log_warning_on_delay_changes": false},"filter": {"main": [13,5e-05,0.05,0.001,2,2.00753e+07],"shadow": [13,0.7,2.00753e+07],"main_initial": [12,0.005,0.5,0.001,2,2.00753e+07],"shadow_initial": [12,0.9,2.00753e+07],"config_change_duration_blocks": 250,"initial_state_seconds": 2.5,"conservative_initial_phase": false,"enable_shadow_filter_output_usage": true},"erle": {"min": 1,"max_l": 4,"max_h": 1.5,"onset_detection": true,"num_sections": 1,"clamp_quality_estimate_to_zero": true,"clamp_quality_estimate_to_one": true},"ep_strength": {"default_gain": 1,"default_len": 0.83,"echo_can_saturate": true,"bounded_erl": false},"echo_audibility": {"low_render_limit": 256,"normal_render_limit": 64,"floor_power": 128,"audibility_threshold_lf": 10,"audibility_threshold_mf": 10,"audibility_threshold_hf": 10,"use_stationarity_properties": false,"use_stationarity_properties_at_init": false},"render_levels": {"active_render_limit": 100,"poor_excitation_render_limit": 150,"poor_excitation_render_limit_ds8": 20},"echo_removal_control": {"has_clock_drift": false,"linear_and_stable_echo_path": false},"echo_model": {"noise_floor_hold": 50,"min_noise_floor_power": 1.6384e+06,"stationary_gate_slope": 10,"noise_gate_power": 27509.4,"noise_gate_slope": 0.3,"render_pre_window_size": 1,"render_post_window_size": 1},"suppressor": {"nearend_average_blocks": 4,"normal_tuning": {"mask_lf": [0.3,0.4,0.3],"mask_hf": [0.07,0.1,0.3],"max_inc_factor": 2,"max_dec_factor_lf": 0.25},"nearend_tuning": {"mask_lf": [1.09,1.1,0.3],"mask_hf": [0.1,0.3,0.3],"max_inc_factor": 2,"max_dec_factor_lf": 0.25},"dominant_nearend_detection": {"enr_threshold": 0.25,"enr_exit_threshold": 10,"snr_threshold": 30,"hold_duration": 50,"trigger_threshold": 12,"use_during_initial_phase": 1},"high_bands_suppression": {"enr_threshold": 1,"max_gain_during_echo": 1},"floor_first_increase": 1e-05,"enforce_transparent": false,"enforce_empty_higher_bands": false}}}
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1
new file mode 100644
index 0000000000..cda107c534
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2
new file mode 100644
index 0000000000..bf1a98dccd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3
new file mode 100644
index 0000000000..f28283502a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4
new file mode 100644
index 0000000000..7b5d1cd790
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0
new file mode 100644
index 0000000000..da32f0c29c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1
new file mode 100644
index 0000000000..097af39c3f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2
new file mode 100644
index 0000000000..a9f4011d3f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3
new file mode 100644
index 0000000000..b4ba1578cd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0
new file mode 100644
index 0000000000..fc56e0e591
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1
new file mode 100644
index 0000000000..b5c147f9f3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10
new file mode 100644
index 0000000000..ced48741aa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11
new file mode 100644
index 0000000000..53afe97468
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11
@@ -0,0 +1 @@
+ÿÿÿÿÿ
°Ë±±o
\ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12
new file mode 100644
index 0000000000..4d126eacc3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13
new file mode 100644
index 0000000000..847e67b79a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14
new file mode 100644
index 0000000000..f5efdd1317
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15
new file mode 100644
index 0000000000..830dc8a679
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16
new file mode 100644
index 0000000000..06017917dc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2
new file mode 100644
index 0000000000..43cf72619c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3
new file mode 100644
index 0000000000..a2e8e0c9ae
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4
new file mode 100644
index 0000000000..ff5785f0c3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5
new file mode 100644
index 0000000000..f1196c98aa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6
new file mode 100644
index 0000000000..88ce0a1600
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7
new file mode 100644
index 0000000000..9adb5c2125
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8
new file mode 100644
index 0000000000..5a8f929a61
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8
@@ -0,0 +1,2 @@
+ÿÿÿÞ
+‚
ÿ
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9
new file mode 100644
index 0000000000..bde1b127b3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0
new file mode 100644
index 0000000000..73e1d22f10
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0
@@ -0,0 +1 @@
+WebRTC-DecoderDataDumpDirectory/Enabled/
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1
new file mode 100644
index 0000000000..997888a6fd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1
@@ -0,0 +1 @@
+WebRTC-DecoderDataDumpDirectory/Disabled/
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2
new file mode 100644
index 0000000000..7e897a418d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2
@@ -0,0 +1 @@
+WebRTC-DecoderDataDumpDirectory/Disabled/WebRTC-IPv6Default/Enabled/
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0
new file mode 100644
index 0000000000..dbe089f278
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1 b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1
new file mode 100644
index 0000000000..dcb9c476f0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns
new file mode 100644
index 0000000000..6e1789a83b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns
new file mode 100644
index 0000000000..f5fa6f8d17
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns
new file mode 100644
index 0000000000..f72f28c13c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns
new file mode 100644
index 0000000000..9efa76d64a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns
new file mode 100644
index 0000000000..538a5a62dc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns
new file mode 100644
index 0000000000..d4ce4efea8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns
new file mode 100644
index 0000000000..ff2810565b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns
new file mode 100644
index 0000000000..a1a02d7f8e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns
new file mode 100644
index 0000000000..ba30f7bc2f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns
new file mode 100644
index 0000000000..7cbdd3e7a0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns
new file mode 100644
index 0000000000..f70eaa3ab2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns
new file mode 100644
index 0000000000..7d259c2ea9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns
new file mode 100644
index 0000000000..6681f943e4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns
new file mode 100644
index 0000000000..3ac4fd6c98
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns
new file mode 100644
index 0000000000..3207842f48
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns
new file mode 100644
index 0000000000..871ea41405
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns
new file mode 100644
index 0000000000..ee2f8eca1c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns
new file mode 100644
index 0000000000..d37b935654
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns
new file mode 100644
index 0000000000..dd2f976afd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns
new file mode 100644
index 0000000000..a01e729342
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511 b/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511
new file mode 100644
index 0000000000..21f5cffa12
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp
new file mode 100644
index 0000000000..802eecf052
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp
new file mode 100644
index 0000000000..c062793b3c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp
new file mode 100644
index 0000000000..fdc7780218
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp
new file mode 100644
index 0000000000..994f721dca
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp
new file mode 100644
index 0000000000..557fe9c23a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp
new file mode 100644
index 0000000000..0f1b1809a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp
new file mode 100644
index 0000000000..df6bfed86c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp
new file mode 100644
index 0000000000..3b31b3079d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp
new file mode 100644
index 0000000000..0496ddf910
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp
new file mode 100644
index 0000000000..755b7198ba
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp
new file mode 100644
index 0000000000..04fd1e3417
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp
new file mode 100644
index 0000000000..8ae9812f10
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp
new file mode 100644
index 0000000000..ba38a0a599
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp
new file mode 100644
index 0000000000..debb7de940
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp
new file mode 100644
index 0000000000..3fcbd405e2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp
new file mode 100644
index 0000000000..3defd8c253
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp
new file mode 100644
index 0000000000..211ccbd5be
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp
new file mode 100644
index 0000000000..8ded9be7fd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp
new file mode 100644
index 0000000000..b5c8146cef
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp
new file mode 100644
index 0000000000..0fd4f25511
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp
new file mode 100644
index 0000000000..2c8bb63c9c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp
new file mode 100644
index 0000000000..6a20bc27d8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp
new file mode 100644
index 0000000000..76fd214197
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp
new file mode 100644
index 0000000000..72307e08bd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp
new file mode 100644
index 0000000000..cfa38faa67
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp
new file mode 100644
index 0000000000..8abf725057
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp
new file mode 100644
index 0000000000..76518c88dd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp
new file mode 100644
index 0000000000..92964965a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp
new file mode 100644
index 0000000000..9045c158b5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp
new file mode 100644
index 0000000000..f86df02448
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp
new file mode 100644
index 0000000000..d274d416a2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp
new file mode 100644
index 0000000000..b4f04f4069
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp
new file mode 100644
index 0000000000..8d65e0ff35
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp
new file mode 100644
index 0000000000..fb969f85f0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp
new file mode 100644
index 0000000000..5170185122
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp
new file mode 100644
index 0000000000..279047c6b2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp
new file mode 100644
index 0000000000..09a8a589bd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp
new file mode 100644
index 0000000000..f727b190a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp
new file mode 100644
index 0000000000..9aab33a48a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp
new file mode 100644
index 0000000000..2eba529c3a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp
new file mode 100644
index 0000000000..50c0beabed
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp
new file mode 100644
index 0000000000..2de424a5d1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp
new file mode 100644
index 0000000000..71d530b41f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp
@@ -0,0 +1 @@
+€
\ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp
new file mode 100644
index 0000000000..665695029a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp
new file mode 100644
index 0000000000..33b0f3d873
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp
new file mode 100644
index 0000000000..46bef3242a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp
new file mode 100644
index 0000000000..5bec125397
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp
new file mode 100644
index 0000000000..ff94fb84b7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp
new file mode 100644
index 0000000000..55cc76cd81
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp
new file mode 100644
index 0000000000..ac11523c94
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp
new file mode 100644
index 0000000000..f3f0bb8fa1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp
new file mode 100644
index 0000000000..f0012f1efa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp
new file mode 100644
index 0000000000..61517f01d8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp
new file mode 100644
index 0000000000..3688310a05
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp
new file mode 100644
index 0000000000..e914f83b16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp
new file mode 100644
index 0000000000..dcad8f6b40
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp
new file mode 100644
index 0000000000..8e999e7832
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp
new file mode 100644
index 0000000000..eb38d237aa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp
new file mode 100644
index 0000000000..6df94b715f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp
new file mode 100644
index 0000000000..a3b2acb3a8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp
new file mode 100644
index 0000000000..4d50c0f4ae
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp
new file mode 100644
index 0000000000..537d10c6ce
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp
new file mode 100644
index 0000000000..f280f3ca09
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp
new file mode 100644
index 0000000000..f8f74e12c6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp
new file mode 100644
index 0000000000..f0ceba83f4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp
new file mode 100644
index 0000000000..7cc07893c3
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0
new file mode 100644
index 0000000000..c93ce82ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1
new file mode 100644
index 0000000000..84834aefea
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2
new file mode 100644
index 0000000000..3a5aedba9b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3
new file mode 100644
index 0000000000..300309ff37
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4
new file mode 100644
index 0000000000..84834aefea
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5
new file mode 100644
index 0000000000..7dd6632007
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6
new file mode 100644
index 0000000000..3a1145cd0f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7
new file mode 100644
index 0000000000..6c4a9feb52
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8
new file mode 100644
index 0000000000..4b069389b1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0
new file mode 100644
index 0000000000..540a770e29
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0
@@ -0,0 +1 @@
+ô0ÿÿÿ¸¸¸
\ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump
new file mode 100644
index 0000000000..328559820d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump
new file mode 100644
index 0000000000..4dc780cd16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin
new file mode 100644
index 0000000000..4374f5aad5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin
new file mode 100644
index 0000000000..1f1d0be301
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin
new file mode 100644
index 0000000000..21a0c22837
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin
new file mode 100644
index 0000000000..fc8600106e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin
new file mode 100644
index 0000000000..bec7b289e7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin
new file mode 100644
index 0000000000..ab98a0a4a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin
new file mode 100644
index 0000000000..59200abe5e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin
new file mode 100644
index 0000000000..cef8cfe929
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin
new file mode 100644
index 0000000000..80438434d0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin
new file mode 100644
index 0000000000..3fb4977d58
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin
new file mode 100644
index 0000000000..74c74f3377
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin
new file mode 100644
index 0000000000..fe4de63863
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin
new file mode 100644
index 0000000000..08494c1515
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp
new file mode 100644
index 0000000000..36319c4476
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp
new file mode 100644
index 0000000000..c3dbce401f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 49174 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp
new file mode 100644
index 0000000000..26d4ff6266
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp
new file mode 100644
index 0000000000..f625e3890c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 49170 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp
new file mode 100644
index 0000000000..c36b9fe6cb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 newhost.biloxi.example.com
+t=0 0
+m=audio 49178 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 49188 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp
new file mode 100644
index 0000000000..26d4ff6266
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp
new file mode 100644
index 0000000000..1d187a0dc5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp
@@ -0,0 +1,10 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=audio 51372 RTP/AVP 97 101
+a=rtpmap:97 iLBC/8000
+a=rtpmap:101 telephone-event/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp
new file mode 100644
index 0000000000..a328d16a16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 0 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=audio 49170 RTP/AVP 97 101
+a=rtpmap:97 iLBC/8000
+a=rtpmap:101 telephone-event/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp
new file mode 100644
index 0000000000..1e0d3f5705
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp
new file mode 100644
index 0000000000..a9a5e12138
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51374 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp
new file mode 100644
index 0000000000..b2c072af1d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp
@@ -0,0 +1,10 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp
new file mode 100644
index 0000000000..28e949133e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51374 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp
new file mode 100644
index 0000000000..36c7d70148
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49172 RTP/AVP 32
+c=IN IP4 otherhost.biloxi.example.com
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp
new file mode 100644
index 0000000000..6cf5dc5894
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp
@@ -0,0 +1,8 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp
new file mode 100644
index 0000000000..ac1ec85b29
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp
@@ -0,0 +1,8 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 placeholder.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp
new file mode 100644
index 0000000000..f0eb0d62a7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp
new file mode 100644
index 0000000000..1e4f3b3e19
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49178 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp
new file mode 100644
index 0000000000..36319c4476
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp
new file mode 100644
index 0000000000..c3dbce401f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 49174 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp
new file mode 100644
index 0000000000..b0142f5dcf
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49170 RTP/AVP 32
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp
new file mode 100644
index 0000000000..0798631d2e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp
@@ -0,0 +1,11 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+a=sendonly
+m=audio 49174 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp
new file mode 100644
index 0000000000..78efdd8fcb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp
new file mode 100644
index 0000000000..6cf5dc5894
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp
@@ -0,0 +1,8 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp
new file mode 100644
index 0000000000..23f462f5a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp
new file mode 100644
index 0000000000..b52b947486
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp
@@ -0,0 +1,11 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 48282 RTP/AVP 98
+c=IN IP4 mediaserver.biloxi.example.com
+a=rtpmap:98 telephone-event/8000
+a=recvonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp
new file mode 100644
index 0000000000..07ad4f8758
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp
@@ -0,0 +1,11 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=audio 49172 RTP/AVP 98
+c=IN IP4 host.atlanta.example.com
+a=rtpmap:98 telephone-event/8000
+a=sendonly
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp
new file mode 100644
index 0000000000..c75c6977bb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp
new file mode 100644
index 0000000000..d05dbd61fd
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp
new file mode 100644
index 0000000000..253ac0705a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49172 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp
new file mode 100644
index 0000000000..57d3203c74
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 49168 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp
new file mode 100644
index 0000000000..26d4ff6266
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp
new file mode 100644
index 0000000000..f625e3890c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 49170 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp
new file mode 100644
index 0000000000..2dda9bb252
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49174 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp
new file mode 100644
index 0000000000..83a2bf9e66
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp
new file mode 100644
index 0000000000..e187d7df7d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp
@@ -0,0 +1,5 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp
new file mode 100644
index 0000000000..9e344f035a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp
@@ -0,0 +1,5 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp
new file mode 100644
index 0000000000..8a63ca0992
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp
new file mode 100644
index 0000000000..66dadbb93f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp
new file mode 100644
index 0000000000..6df76ab942
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 0.0.0.0
+t=0 0
+m=audio 23442 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp
new file mode 100644
index 0000000000..23f462f5a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp
new file mode 100644
index 0000000000..264ab8024f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp
@@ -0,0 +1,10 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0 8
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp
new file mode 100644
index 0000000000..8a63ca0992
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp
new file mode 100644
index 0000000000..23f462f5a6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp
new file mode 100644
index 0000000000..7c1730eb1e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp
@@ -0,0 +1,7 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp
new file mode 100644
index 0000000000..599157691a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 0.0.0.0
+t=0 0
+m=audio 9322 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp
new file mode 100644
index 0000000000..66dadbb93f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp
@@ -0,0 +1,7 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp
new file mode 100644
index 0000000000..bd724c471b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp
@@ -0,0 +1,8 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 97
+a=rtpmap:97 iLBC/8000
+
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp
new file mode 100644
index 0000000000..3f80345e30
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp
@@ -0,0 +1,9 @@
+v=0
+o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 51372 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp
new file mode 100644
index 0000000000..920ad8229e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 0
+a=rtpmap:0 PCMU/8000
+m=video 0 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp
new file mode 100644
index 0000000000..96c4975ec0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp
@@ -0,0 +1,12 @@
+v=0
+o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com
+s=
+c=IN IP4 host.atlanta.example.com
+t=0 0
+m=audio 49170 RTP/AVP 0 8 97
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:97 iLBC/8000
+m=video 51372 RTP/AVP 31 32
+a=rtpmap:31 H261/90000
+a=rtpmap:32 MPV/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp
new file mode 100644
index 0000000000..a9a5e12138
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp
@@ -0,0 +1,9 @@
+v=0
+o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com
+s=
+c=IN IP4 host.biloxi.example.com
+t=0 0
+m=audio 49172 RTP/AVP 99
+a=rtpmap:99 iLBC/8000
+m=video 51374 RTP/AVP 31
+a=rtpmap:31 H261/90000
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp
new file mode 100644
index 0000000000..6d664bc051
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp
@@ -0,0 +1,58 @@
+v=0
+o=mozilla...THIS_IS_SDPARTA-46.0.1 5115930144083302970 0 IN IP4 0.0.0.0
+s=-
+t=0 0
+a=fingerprint:sha-256 24:67:5E:1B:9A:B9:CF:36:C5:30:8F:35:F7:B1:50:66:88:81:92:CB:29:BA:53:A5:02:C8:0A:A5:4E:9C:AE:D9
+a=group:BUNDLE sdparta_0 sdparta_1 sdparta_2
+a=ice-options:trickle
+a=msid-semantic:WMS *
+m=audio 9 UDP/TLS/RTP/SAVPF 109 9 0 8
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=fmtp:109 maxplaybackrate=48000;stereo=1
+a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3
+a=ice-ufrag:3edc9012
+a=mid:sdparta_0
+a=msid:{258e92fb-547c-40ca-92e9-efe0cedb4cba} {bd1fafff-bfd0-40d4-b0a3-2a87cff307ee}
+a=rtcp-mux
+a=rtpmap:109 opus/48000/2
+a=rtpmap:9 G722/8000/1
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=setup:actpass
+a=ssrc:2121669360 cname:{387b0735-bde2-43a4-8484-7f5663b60f24}
+m=video 9 UDP/TLS/RTP/SAVPF 120 126 97
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=fmtp:126 profile-level-id=42e01f;level-asymmetry-allowed=1;packetization-mode=1
+a=fmtp:97 profile-level-id=42e01f;level-asymmetry-allowed=1
+a=fmtp:120 max-fs=12288;max-fr=60
+a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3
+a=ice-ufrag:3edc9012
+a=mid:sdparta_1
+a=msid:{258e92fb-547c-40ca-92e9-efe0cedb4cba} {9e8f5867-a9aa-4489-8bd4-3a8a57a5e592}
+a=rtcp-fb:120 nack
+a=rtcp-fb:120 nack pli
+a=rtcp-fb:120 ccm fir
+a=rtcp-fb:126 nack
+a=rtcp-fb:126 nack pli
+a=rtcp-fb:126 ccm fir
+a=rtcp-fb:97 nack
+a=rtcp-fb:97 nack pli
+a=rtcp-fb:97 ccm fir
+a=rtcp-mux
+a=rtpmap:120 VP8/90000
+a=rtpmap:126 H264/90000
+a=rtpmap:97 H264/90000
+a=setup:actpass
+a=ssrc:2158832026 cname:{387b0735-bde2-43a4-8484-7f5663b60f24}
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3
+a=ice-ufrag:3edc9012
+a=mid:sdparta_2
+a=sctpmap:5000 webrtc-datachannel 256
+a=setup:actpass
+a=ssrc:2670959794 cname:{387b0735-bde2-43a4-8484-7f5663b60f24}
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp
new file mode 100644
index 0000000000..07806eb225
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp
@@ -0,0 +1,43 @@
+v=0
+o=mozilla...THIS_IS_SDPARTA-46.0.1 3068771576687940834 0 IN IP4 0.0.0.0
+s=-
+t=0 0
+a=fingerprint:sha-256 AD:87:B3:11:E4:E2:BA:EF:D2:3F:2E:AC:24:57:8E:DC:1F:67:41:29:44:C4:96:E3:62:90:CC:90:59:CA:2C:84
+a=group:BUNDLE sdparta_0 sdparta_1 sdparta_2
+a=ice-options:trickle
+a=msid-semantic:WMS *
+m=audio 9 UDP/TLS/RTP/SAVPF 109
+c=IN IP4 0.0.0.0
+a=recvonly
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=fmtp:109 maxplaybackrate=48000;stereo=1
+a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5
+a=ice-ufrag:a539544b
+a=mid:sdparta_0
+a=rtcp-mux
+a=rtpmap:109 opus/48000/2
+a=setup:active
+a=ssrc:600995474 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a}
+m=video 9 UDP/TLS/RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=recvonly
+a=fmtp:120 max-fs=12288;max-fr=60
+a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5
+a=ice-ufrag:a539544b
+a=mid:sdparta_1
+a=rtcp-fb:120 nack
+a=rtcp-fb:120 nack pli
+a=rtcp-fb:120 ccm fir
+a=rtcp-mux
+a=rtpmap:120 VP8/90000
+a=setup:active
+a=ssrc:3480150809 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a}
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+a=sendrecv
+a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5
+a=ice-ufrag:a539544b
+a=mid:sdparta_2
+a=sctpmap:5000 webrtc-datachannel 256
+a=setup:active
+a=ssrc:3021788991 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a}
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp
new file mode 100644
index 0000000000..42d15e81f4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp
@@ -0,0 +1,85 @@
+v=0
+o=- 1656229333038673902 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE audio video data
+a=msid-semantic: WMS Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 126
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:1Jyk4q3nLIL5NiMx
+a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:actpass
+a=mid:audio
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=sendrecv
+a=rtcp-mux
+a=rtpmap:111 opus/48000/2
+a=rtcp-fb:111 transport-cc
+a=fmtp:111 minptime=10; useinbandfec=1
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=rtpmap:9 G722/8000
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:106 CN/32000
+a=rtpmap:105 CN/16000
+a=rtpmap:13 CN/8000
+a=rtpmap:126 telephone-event/8000
+a=maxptime:60
+a=ssrc:2233075910 cname:VhHMGYCjn4alR9zP
+a=ssrc:2233075910 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 689d3496-0896-4d52-bce6-8e90512a368b
+a=ssrc:2233075910 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+a=ssrc:2233075910 label:689d3496-0896-4d52-bce6-8e90512a368b
+m=video 9 UDP/TLS/RTP/SAVPF 100 101 116 117 96 97 98
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:1Jyk4q3nLIL5NiMx
+a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:actpass
+a=mid:video
+a=extmap:2 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:4 urn:3gpp:video-orientation
+a=sendrecv
+a=rtcp-mux
+a=rtpmap:100 VP8/90000
+a=rtcp-fb:100 ccm fir
+a=rtcp-fb:100 nack
+a=rtcp-fb:100 nack pli
+a=rtcp-fb:100 goog-remb
+a=rtcp-fb:100 transport-cc
+a=rtpmap:101 VP9/90000
+a=rtcp-fb:101 ccm fir
+a=rtcp-fb:101 nack
+a=rtcp-fb:101 nack pli
+a=rtcp-fb:101 goog-remb
+a=rtcp-fb:101 transport-cc
+a=rtpmap:116 red/90000
+a=rtpmap:117 ulpfec/90000
+a=rtpmap:96 rtx/90000
+a=fmtp:96 apt=100
+a=rtpmap:97 rtx/90000
+a=fmtp:97 apt=101
+a=rtpmap:98 rtx/90000
+a=fmtp:98 apt=116
+a=ssrc-group:FID 50498894 2399294607
+a=ssrc:50498894 cname:VhHMGYCjn4alR9zP
+a=ssrc:50498894 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+a=ssrc:50498894 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+a=ssrc:50498894 label:1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+a=ssrc:2399294607 cname:VhHMGYCjn4alR9zP
+a=ssrc:2399294607 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+a=ssrc:2399294607 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4
+a=ssrc:2399294607 label:1aef96f4-fc4c-4f86-98f3-0fbf4f625f70
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+a=ice-ufrag:1Jyk4q3nLIL5NiMx
+a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:actpass
+a=mid:data
+a=sctpmap:5000 webrtc-datachannel 1024
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp
new file mode 100644
index 0000000000..6ed4e3b4a8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp
@@ -0,0 +1,73 @@
+v=0
+o=- 2013283641453412290 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE audio video data
+a=msid-semantic: WMS
+m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 126
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:YVa3KTlFDCwsfPOQ
+a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:active
+a=mid:audio
+a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=recvonly
+a=rtcp-mux
+a=rtpmap:111 opus/48000/2
+a=rtcp-fb:111 transport-cc
+a=fmtp:111 minptime=10; useinbandfec=1
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=rtpmap:9 G722/8000
+a=rtpmap:0 PCMU/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:106 CN/32000
+a=rtpmap:105 CN/16000
+a=rtpmap:13 CN/8000
+a=rtpmap:126 telephone-event/8000
+a=maxptime:60
+m=video 9 UDP/TLS/RTP/SAVPF 100 101 116 117 96 97 98
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:YVa3KTlFDCwsfPOQ
+a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:active
+a=mid:video
+a=extmap:2 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:4 urn:3gpp:video-orientation
+a=recvonly
+a=rtcp-mux
+a=rtpmap:100 VP8/90000
+a=rtcp-fb:100 ccm fir
+a=rtcp-fb:100 nack
+a=rtcp-fb:100 nack pli
+a=rtcp-fb:100 goog-remb
+a=rtcp-fb:100 transport-cc
+a=rtpmap:101 VP9/90000
+a=rtcp-fb:101 ccm fir
+a=rtcp-fb:101 nack
+a=rtcp-fb:101 nack pli
+a=rtcp-fb:101 goog-remb
+a=rtcp-fb:101 transport-cc
+a=rtpmap:116 red/90000
+a=rtpmap:117 ulpfec/90000
+a=rtpmap:96 rtx/90000
+a=fmtp:96 apt=100
+a=rtpmap:97 rtx/90000
+a=fmtp:97 apt=101
+a=rtpmap:98 rtx/90000
+a=fmtp:98 apt=116
+m=application 9 DTLS/SCTP 5000
+c=IN IP4 0.0.0.0
+b=AS:30
+a=ice-ufrag:YVa3KTlFDCwsfPOQ
+a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa
+a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA
+a=setup:active
+a=mid:data
+a=sctpmap:5000 webrtc-datachannel 1024
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp
new file mode 100644
index 0000000000..e7a219812b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp
@@ -0,0 +1,41 @@
+v=0
+o=- 367669362084170381 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE 0
+a=msid-semantic: WMS VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1
+m=video 9 UDP/TLS/RTP/SAVPF 96
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:OLwt
+a=ice-pwd:kjGBqIFYs8UqCyfmJ7nEJw/Q
+a=ice-options:trickle
+a=fingerprint:sha-256 B4:AB:3E:01:90:D1:FC:22:8F:05:6A:01:76:B6:C5:0D:45:88:1A:E1:99:AF:18:43:E6:18:BB:D0:92:51:9B:0E
+a=setup:actpass
+a=mid:0
+a=extmap:14 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:13 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:12 urn:3gpp:video-orientation
+a=extmap:2 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
+a=extmap:11 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
+a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
+a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing
+a=extmap:8 http://tools.ietf.org/html/draft-ietf-avtext-framemarking-07
+a=extmap:9 http://www.webrtc.org/experiments/rtp-hdrext/color-space
+a=extmap:3 urn:ietf:params:rtp-hdrext:sdes:mid
+a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
+a=extmap:5 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
+a=sendrecv
+a=msid:VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 a8c06601-e9ed-4312-a7d4-283e078c5966
+a=rtcp-mux
+a=rtcp-rsize
+a=rtpmap:96 VP8/90000
+a=rtcp-fb:96 goog-remb
+a=rtcp-fb:96 transport-cc
+a=rtcp-fb:96 ccm fir
+a=rtcp-fb:96 nack
+a=rtcp-fb:96 nack pli
+a=rid:f send
+a=rid:h send
+a=rid:q send
+a=simulcast:send f;h;q
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp
new file mode 100644
index 0000000000..52879f9e66
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp
@@ -0,0 +1,41 @@
+v=0
+o=- 367669362084170381 2 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=group:BUNDLE 0
+a=msid-semantic: WMS VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1
+m=video 9 UDP/TLS/RTP/SAVPF 96
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:OLwt
+a=ice-pwd:kjGBqIFYs8UqCyfmJ7nEJw/Q
+a=ice-options:trickle
+a=fingerprint:sha-256 B4:AB:3E:01:90:D1:FC:22:8F:05:6A:01:76:B6:C5:0D:45:88:1A:E1:99:AF:18:43:E6:18:BB:D0:92:51:9B:0E
+a=setup:actpass
+a=mid:0
+a=extmap:14 urn:ietf:params:rtp-hdrext:toffset
+a=extmap:13 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
+a=extmap:12 urn:3gpp:video-orientation
+a=extmap:2 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
+a=extmap:11 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
+a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
+a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing
+a=extmap:8 http://tools.ietf.org/html/draft-ietf-avtext-framemarking-07
+a=extmap:9 http://www.webrtc.org/experiments/rtp-hdrext/color-space
+a=extmap:3 urn:ietf:params:rtp-hdrext:sdes:mid
+a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
+a=extmap:5 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
+a=sendrecv
+a=msid:VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 a8c06601-e9ed-4312-a7d4-283e078c5966
+a=rtcp-mux
+a=rtcp-rsize
+a=rtpmap:96 VP8/90000
+a=rtcp-fb:96 goog-remb
+a=rtcp-fb:96 transport-cc
+a=rtcp-fb:96 ccm fir
+a=rtcp-fb:96 nack
+a=rtcp-fb:96 nack pli
+a=rid:f recv
+a=rid:h recv
+a=rid:q recv
+a=simulcast:recv f;h;q
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp
new file mode 100644
index 0000000000..ce349ac30f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp
@@ -0,0 +1,52 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1
+m=audio 2345 RTP/SAVPF 111 103 104
+c=IN IP4 74.125.127.126
+a=rtcp:2347 IN IP4 74.125.127.126
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2
+a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2
+a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+m=video 3457 RTP/SAVPF 120
+c=IN IP4 74.125.224.39
+a=rtcp:3456 IN IP4 74.125.224.39
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2
+a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2
+a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp
new file mode 100644
index 0000000000..a35392513f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp
@@ -0,0 +1,40 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1
+m=audio 9 RTP/SAVPF 111 103 104
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+m=video 9 RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp
new file mode 100644
index 0000000000..50f8e55ef7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp
@@ -0,0 +1,13 @@
+m=application 9 RTP/SAVPF 101
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_data
+a=ice-pwd:pwd_data
+a=mid:data_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:FvLcvU2P3ZWmQxgPAgcDu7Zl9vftYElFOjEzhWs5
+a=rtpmap:101 google-data/90000
+a=ssrc:10 cname:data_channel_cname
+a=ssrc:10 msid:data_channel data_channeld0
+a=ssrc:10 mslabel:data_channel
+a=ssrc:10 label:data_channeld0
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp
new file mode 100644
index 0000000000..709db42c00
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp
@@ -0,0 +1,11 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS
+m=audio 9 RTP/SAVPF 111 103 104
+c=IN IP4 0.0.0.0
+a=x-google-flag:conference
+m=video 9 RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=x-google-flag:conference
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp
new file mode 100644
index 0000000000..c440386062
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp
@@ -0,0 +1,5 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp
new file mode 100644
index 0000000000..e07b5647bf
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp
@@ -0,0 +1,12 @@
+m=audio 9 RTP/SAVPF 111
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtpmap:111 opus/48000/2
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream audio_track_id_1
+a=ssrc:1 mslabel:local_stream
+a=ssrc:1 label:audio_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp
new file mode 100644
index 0000000000..8bdacc2baa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp
@@ -0,0 +1,12 @@
+m=video 9 RTP/SAVPF 120
+c=IN IP4 0.0.0.0
+a=rtcp:9 IN IP4 0.0.0.0
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=rtpmap:120 VP8/90000
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream video_track_id_1
+a=ssrc:2 mslabel:local_stream
+a=ssrc:2 label:video_track_id_1
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp
new file mode 100644
index 0000000000..9688fc46a2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp
@@ -0,0 +1,64 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1 local_stream_2
+m=audio 2345 RTP/SAVPF 111 103 104
+c=IN IP4 74.125.127.126
+a=rtcp:2347 IN IP4 74.125.127.126
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2
+a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2
+a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+a=ssrc:4 cname:stream_2_cname
+a=ssrc:4 msid:local_stream_2 audio_track_id_2
+a=ssrc:4 mslabel:local_stream_2
+a=ssrc:4 label:audio_track_id_2
+m=video 3457 RTP/SAVPF 120
+c=IN IP4 74.125.224.39
+a=rtcp:3456 IN IP4 74.125.224.39
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2
+a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2
+a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
+a=ssrc:5 cname:stream_2_cname
+a=ssrc:5 msid:local_stream_2 video_track_id_2
+a=ssrc:5 mslabel:local_stream_2
+a=ssrc:5 label:video_track_id_2
+a=ssrc:6 cname:stream_2_cname
+a=ssrc:6 msid:local_stream_2 video_track_id_3
+a=ssrc:6 mslabel:local_stream_2
+a=ssrc:6 label:video_track_id_3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp
new file mode 100644
index 0000000000..8c7c4c7c3d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp
@@ -0,0 +1,66 @@
+v=0
+o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1
+s=-
+t=0 0
+a=msid-semantic: WMS local_stream_1 local_stream_2
+m=audio 2345 RTP/SAVPF 111 103 104
+c=IN IP4 74.125.127.126
+a=rtcp:2347 IN IP4 74.125.127.126
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2
+a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2
+a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2
+a=ice-ufrag:ufrag_voice
+a=ice-pwd:pwd_voice
+a=mid:audio_content_name
+a=msid:local_stream_1 audio_track_id_1
+a=sendrecv
+a=rtcp-mux
+a=rtcp-rsize
+a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params
+a=rtpmap:111 opus/48000/2
+a=rtpmap:103 ISAC/16000
+a=rtpmap:104 ISAC/32000
+a=ssrc:1 cname:stream_1_cname
+a=ssrc:1 msid:local_stream_1 audio_track_id_1
+a=ssrc:1 mslabel:local_stream_1
+a=ssrc:1 label:audio_track_id_1
+a=ssrc:4 cname:stream_2_cname
+a=ssrc:4 msid:local_stream_2 audio_track_id_2
+a=ssrc:4 mslabel:local_stream_2
+a=ssrc:4 label:audio_track_id_2
+m=video 3457 RTP/SAVPF 120
+c=IN IP4 74.125.224.39
+a=rtcp:3456 IN IP4 74.125.224.39
+a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2
+a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2
+a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2
+a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2
+a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2
+a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2
+a=ice-ufrag:ufrag_video
+a=ice-pwd:pwd_video
+a=mid:video_content_name
+a=msid:local_stream_1 video_track_id_1
+a=sendrecv
+a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32
+a=rtpmap:120 VP8/90000
+a=ssrc-group:FEC 2 3
+a=ssrc:2 cname:stream_1_cname
+a=ssrc:2 msid:local_stream_1 video_track_id_1
+a=ssrc:2 mslabel:local_stream_1
+a=ssrc:2 label:video_track_id_1
+a=ssrc:3 cname:stream_1_cname
+a=ssrc:3 msid:local_stream_1 video_track_id_1
+a=ssrc:3 mslabel:local_stream_1
+a=ssrc:3 label:video_track_id_1
+a=ssrc:5 cname:stream_2_cname
+a=ssrc:5 msid:local_stream_2 video_track_id_2
+a=ssrc:5 mslabel:local_stream_2
+a=ssrc:5 label:video_track_id_2
+a=ssrc:6 cname:stream_2_cname
+a=ssrc:6 msid:local_stream_2 video_track_id_3
+a=ssrc:6 mslabel:local_stream_2
+a=ssrc:6 label:video_track_id_3
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens b/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens
new file mode 100644
index 0000000000..ddfdad5811
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens
@@ -0,0 +1,56 @@
+"0.0.0.0"
+"127.0.0.1"
+"application"
+"audio"
+"candidate"
+"cname"
+"conference"
+"crypto"
+"default"
+"extmap"
+"fingerprint"
+"fmtp"
+"generation"
+"group"
+"host"
+"ice-lite"
+"ice-options"
+"ice-pwd"
+"ice-ufrag"
+"inactive"
+"IP4"
+"IP6"
+"ISAC"
+"label"
+"mid"
+"msid"
+"msid-semantic"
+"mslabel"
+"network-cost"
+"network-id"
+"prflx"
+"pwd"
+"raddr"
+"recvonly"
+"relay"
+"rport"
+"rtcp"
+"rtcp-fb"
+"rtcp-mux"
+"rtcp-rsize"
+"rtpmap"
+"sctpmap"
+"sctp-port"
+"sendonly"
+"sendrecv"
+"setup"
+"srflx"
+"ssrc"
+"ssrc-group"
+"tcptype"
+"typ"
+"ufrag"
+"video"
+"webrtc-datachannel"
+"WMS"
+"x-google-flag"
\ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0
new file mode 100644
index 0000000000..fbfcbf9105
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0
@@ -0,0 +1 @@
+90742757
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1
new file mode 100644
index 0000000000..587611a1d6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1
@@ -0,0 +1 @@
+27.70727677
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2
new file mode 100644
index 0000000000..45a4fb75db
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2
@@ -0,0 +1 @@
+8
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3
new file mode 100644
index 0000000000..a0a162047c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3
@@ -0,0 +1 @@
+0.0001
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4
new file mode 100644
index 0000000000..da24ab1137
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4
@@ -0,0 +1 @@
+27277272727272727272
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5
new file mode 100644
index 0000000000..575c0a830c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5
@@ -0,0 +1 @@
+999999999999999999999999999999999999999999999999999999999999999999999999999999
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun
new file mode 100644
index 0000000000..205997706f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun
new file mode 100644
index 0000000000..1f82c03ffa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun
new file mode 100644
index 0000000000..a6b06b2be8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun
new file mode 100644
index 0000000000..1f82c03ffa
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun
new file mode 100644
index 0000000000..cb91baa250
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun
new file mode 100644
index 0000000000..63298fce7d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun
new file mode 100644
index 0000000000..31f9f732d4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun
new file mode 100644
index 0000000000..3d15a67193
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun
new file mode 100644
index 0000000000..8ccf0af26d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun
new file mode 100644
index 0000000000..9c3efa0b80
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun
new file mode 100644
index 0000000000..50fe614adb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun
new file mode 100644
index 0000000000..50fe614adb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun
new file mode 100644
index 0000000000..a6b06b2be8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun
new file mode 100644
index 0000000000..c0a79fa7ab
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun
new file mode 100644
index 0000000000..1f43a4787d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun
new file mode 100644
index 0000000000..f5e824a68d
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun
new file mode 100644
index 0000000000..99f4e3bcf8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun
new file mode 100644
index 0000000000..cbbcab4e74
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun
new file mode 100644
index 0000000000..5428c38d75
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens b/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens
new file mode 100644
index 0000000000..e01130f12e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens
@@ -0,0 +1,2 @@
+"2112A442"
+"12214A24"
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0 b/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0
new file mode 100644
index 0000000000..1b6fdf78f6
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0
@@ -0,0 +1 @@
+
@2
?ÿÿ
\ No newline at end of file
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2 b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2
new file mode 100644
index 0000000000..febe4ad130
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682 b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682
new file mode 100644
index 0000000000..fc538ac83f
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682
diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f
new file mode 100644
index 0000000000..1bd09373c8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f
diff --git a/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc
new file mode 100644
index 0000000000..2fc3fe10f1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc
@@ -0,0 +1,29 @@
+/*
+ *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "net/dcsctp/packet/chunk/chunk.h"
+#include "net/dcsctp/packet/sctp_packet.h"
+
+namespace webrtc {
+using dcsctp::SctpPacket;
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  absl::optional<SctpPacket> c =
+      SctpPacket::Parse(rtc::ArrayView<const uint8_t>(data, size),
+                        /*disable_checksum_verification=*/true);
+
+  if (!c.has_value()) {
+    return;
+  }
+
+  for (const SctpPacket::ChunkDescriptor& desc : c->descriptors()) {
+    dcsctp::DebugConvertChunkToString(desc.data);
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc
new file mode 100644
index 0000000000..390cbb7f6c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc
@@ -0,0 +1,28 @@
+/*
+ *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "net/dcsctp/fuzzers/dcsctp_fuzzers.h"
+#include "net/dcsctp/public/dcsctp_message.h"
+#include "net/dcsctp/public/dcsctp_options.h"
+#include "net/dcsctp/public/dcsctp_socket.h"
+#include "net/dcsctp/socket/dcsctp_socket.h"
+#include "rtc_base/logging.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  dcsctp::dcsctp_fuzzers::FuzzerCallbacks cb;
+  dcsctp::DcSctpOptions options;
+  options.disable_checksum_verification = true;
+  dcsctp::DcSctpSocket socket("A", cb, nullptr, options);
+
+  dcsctp::dcsctp_fuzzers::FuzzSocket(socket, cb,
+                                     rtc::ArrayView<const uint8_t>(data, size));
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc
new file mode 100644
index 0000000000..74fe65ce56
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc
@@ -0,0 +1,26 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "system_wrappers/include/field_trial.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  std::string field_trial(reinterpret_cast<const char*>(data), size);
+  field_trial::InitFieldTrialsFromString(field_trial.c_str());
+  field_trial::FindFullName(field_trial);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc
new file mode 100644
index 0000000000..854cc8b811
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "api/scoped_refptr.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/flexfec_header_reader_writer.h"
+#include "modules/rtp_rtcp/source/forward_error_correction.h"
+
+namespace webrtc {
+
+using Packet = ForwardErrorCorrection::Packet;
+using ReceivedFecPacket = ForwardErrorCorrection::ReceivedFecPacket;
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  ReceivedFecPacket packet;
+  packet.pkt = rtc::scoped_refptr<Packet>(new Packet());
+  const size_t packet_size =
+      std::min(size, static_cast<size_t>(IP_PACKET_SIZE));
+  packet.pkt->data.SetSize(packet_size);
+  packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE);
+  memcpy(packet.pkt->data.MutableData(), data, packet_size);
+
+  FlexfecHeaderReader flexfec_reader;
+  flexfec_reader.ReadFecHeader(&packet);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
new file mode 100644
index 0000000000..67d603d3fc
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "modules/rtp_rtcp/include/flexfec_receiver.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+
+namespace webrtc {
+
+namespace {
+class DummyCallback : public RecoveredPacketReceiver {
+  void OnRecoveredPacket(const RtpPacketReceived& packet) override {}
+};
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  constexpr size_t kMinDataNeeded = 12;
+  if (size < kMinDataNeeded || size > 2000) {
+    return;
+  }
+
+  uint32_t flexfec_ssrc;
+  memcpy(&flexfec_ssrc, data + 0, 4);
+  uint16_t flexfec_seq_num;
+  memcpy(&flexfec_seq_num, data + 4, 2);
+  uint32_t media_ssrc;
+  memcpy(&media_ssrc, data + 6, 4);
+  uint16_t media_seq_num;
+  memcpy(&media_seq_num, data + 10, 2);
+
+  DummyCallback callback;
+  FlexfecReceiver receiver(flexfec_ssrc, media_ssrc, &callback);
+
+  std::unique_ptr<uint8_t[]> packet;
+  size_t packet_length;
+  size_t i = kMinDataNeeded;
+  while (i < size) {
+    packet_length = kRtpHeaderSize + data[i++];
+    packet = std::unique_ptr<uint8_t[]>(new uint8_t[packet_length]);
+    if (i + packet_length >= size) {
+      break;
+    }
+    memcpy(packet.get(), data + i, packet_length);
+    i += packet_length;
+    if (i < size && data[i++] % 2 == 0) {
+      // Simulate FlexFEC packet.
+      ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, flexfec_seq_num++);
+      ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, flexfec_ssrc);
+    } else {
+      // Simulate media packet.
+      ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, media_seq_num++);
+      ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, media_ssrc);
+    }
+    RtpPacketReceived parsed_packet;
+    if (parsed_packet.Parse(packet.get(), packet_length)) {
+      receiver.OnRtpPacket(parsed_packet);
+    }
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc
new file mode 100644
index 0000000000..8ddd1c0fe0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc
@@ -0,0 +1,67 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/rtp_rtcp/include/flexfec_sender.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/rtp_packet_to_send.h"
+#include "system_wrappers/include/clock.h"
+
+namespace webrtc {
+
+namespace {
+
+constexpr int kFlexfecPayloadType = 123;
+constexpr uint32_t kMediaSsrc = 1234;
+constexpr uint32_t kFlexfecSsrc = 5678;
+const char kNoMid[] = "";
+const std::vector<RtpExtension> kNoRtpHeaderExtensions;
+const std::vector<RtpExtensionSize> kNoRtpHeaderExtensionSizes;
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  size_t i = 0;
+  if (size < 5 || size > 200) {
+    return;
+  }
+  SimulatedClock clock(1 + data[i++]);
+  FlexfecSender sender(kFlexfecPayloadType, kFlexfecSsrc, kMediaSsrc, kNoMid,
+                       kNoRtpHeaderExtensions, kNoRtpHeaderExtensionSizes,
+                       nullptr /* rtp_state */, &clock);
+  FecProtectionParams params = {
+      data[i++], static_cast<int>(data[i++] % 100),
+      data[i++] <= 127 ? kFecMaskRandom : kFecMaskBursty};
+  sender.SetProtectionParameters(params, params);
+  uint16_t seq_num = data[i++];
+
+  while (i + 1 < size) {
+    // Everything past the base RTP header (12 bytes) is payload,
+    // from the perspective of FlexFEC.
+    size_t payload_size = data[i++];
+    if (i + kRtpHeaderSize + payload_size >= size)
+      break;
+    std::unique_ptr<uint8_t[]> packet(
+        new uint8_t[kRtpHeaderSize + payload_size]);
+    memcpy(packet.get(), &data[i], kRtpHeaderSize + payload_size);
+    i += kRtpHeaderSize + payload_size;
+    ByteWriter<uint16_t>::WriteBigEndian(&packet[2], seq_num++);
+    ByteWriter<uint32_t>::WriteBigEndian(&packet[8], kMediaSsrc);
+    RtpPacketToSend rtp_packet(nullptr);
+    if (!rtp_packet.Parse(packet.get(), kRtpHeaderSize + payload_size))
+      break;
+    sender.AddPacketAndGenerateFec(rtp_packet);
+    sender.GetFecPackets();
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc
new file mode 100644
index 0000000000..04a459bc71
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc
@@ -0,0 +1,119 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "api/scoped_refptr.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/forward_error_correction.h"
+#include "rtc_base/byte_buffer.h"
+
+namespace webrtc {
+
+namespace {
+constexpr uint32_t kMediaSsrc = 100200300;
+constexpr uint32_t kFecSsrc = 111222333;
+
+constexpr size_t kPacketSize = 50;
+constexpr size_t kMaxPacketsInBuffer = 48;
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 5000) {
+    return;
+  }
+  // Object under test.
+  std::unique_ptr<ForwardErrorCorrection> fec =
+      ForwardErrorCorrection::CreateFlexfec(kFecSsrc, kMediaSsrc);
+
+  // Entropy from fuzzer.
+  rtc::ByteBufferReader fuzz_buffer(reinterpret_cast<const char*>(data), size);
+
+  // Initial stream state.
+  uint16_t media_seqnum;
+  if (!fuzz_buffer.ReadUInt16(&media_seqnum))
+    return;
+  const uint16_t original_media_seqnum = media_seqnum;
+  uint16_t fec_seqnum;
+  if (!fuzz_buffer.ReadUInt16(&fec_seqnum))
+    return;
+
+  // Existing packets in the packet buffer.
+  ForwardErrorCorrection::RecoveredPacketList recovered_packets;
+  uint8_t num_existing_recovered_packets;
+  if (!fuzz_buffer.ReadUInt8(&num_existing_recovered_packets))
+    return;
+  for (size_t i = 0; i < num_existing_recovered_packets % kMaxPacketsInBuffer;
+       ++i) {
+    ForwardErrorCorrection::RecoveredPacket* recovered_packet =
+        new ForwardErrorCorrection::RecoveredPacket();
+    recovered_packet->pkt = rtc::scoped_refptr<ForwardErrorCorrection::Packet>(
+        new ForwardErrorCorrection::Packet());
+    recovered_packet->pkt->data.SetSize(kPacketSize);
+    memset(recovered_packet->pkt->data.MutableData(), 0, kPacketSize);
+    recovered_packet->ssrc = kMediaSsrc;
+    recovered_packet->seq_num = media_seqnum++;
+    recovered_packets.emplace_back(recovered_packet);
+  }
+
+  // New packets received from the network.
+  ForwardErrorCorrection::ReceivedPacket received_packet;
+  received_packet.pkt = rtc::scoped_refptr<ForwardErrorCorrection::Packet>(
+      new ForwardErrorCorrection::Packet());
+  received_packet.pkt->data.SetSize(kPacketSize);
+  received_packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE);
+  uint8_t* packet_buffer = received_packet.pkt->data.MutableData();
+  uint8_t reordering;
+  uint16_t seq_num_diff;
+  uint8_t packet_type;
+  uint8_t packet_loss;
+  while (true) {
+    if (!fuzz_buffer.ReadBytes(reinterpret_cast<char*>(packet_buffer),
+                               kPacketSize)) {
+      return;
+    }
+    if (!fuzz_buffer.ReadUInt8(&reordering))
+      return;
+    if (!fuzz_buffer.ReadUInt16(&seq_num_diff))
+      return;
+    if (!fuzz_buffer.ReadUInt8(&packet_type))
+      return;
+    if (!fuzz_buffer.ReadUInt8(&packet_loss))
+      return;
+
+    if (reordering % 10 != 0)
+      seq_num_diff = 0;
+
+    if (packet_type % 2 == 0) {
+      received_packet.is_fec = true;
+      received_packet.ssrc = kFecSsrc;
+      received_packet.seq_num = seq_num_diff + fec_seqnum++;
+
+      // Overwrite parts of the FlexFEC header for fuzzing efficiency.
+      packet_buffer[0] = 0;                                       // R, F bits.
+      ByteWriter<uint8_t>::WriteBigEndian(&packet_buffer[8], 1);  // SSRCCount.
+      ByteWriter<uint32_t>::WriteBigEndian(&packet_buffer[12],
+                                           kMediaSsrc);  // SSRC_i.
+      ByteWriter<uint16_t>::WriteBigEndian(
+          &packet_buffer[16], original_media_seqnum);  // SN base_i.
+    } else {
+      received_packet.is_fec = false;
+      received_packet.ssrc = kMediaSsrc;
+      received_packet.seq_num = seq_num_diff + media_seqnum++;
+    }
+
+    if (packet_loss % 10 == 0)
+      continue;
+
+    fec->DecodeFec(received_packet, &recovered_packets);
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc
new file mode 100644
index 0000000000..ec1bbbb4c1
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc
@@ -0,0 +1,116 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "api/task_queue/task_queue_base.h"
+#include "modules/video_coding/frame_buffer2.h"
+#include "modules/video_coding/timing/timing.h"
+#include "test/scoped_key_value_config.h"
+#include "test/time_controller/simulated_time_controller.h"
+
+namespace webrtc {
+
+namespace {
+
+// When DataReader runs out of data provided in the constructor it will
+// just set/return 0 instead.
+struct DataReader {
+  DataReader(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+
+  void CopyTo(void* destination, size_t dest_size) {
+    memset(destination, 0, dest_size);
+
+    size_t bytes_to_copy = std::min(size_ - offset_, dest_size);
+    memcpy(destination, data_ + offset_, bytes_to_copy);
+    offset_ += bytes_to_copy;
+  }
+
+  template <typename T>
+  T GetNum() {
+    T res;
+    if (offset_ + sizeof(res) < size_) {
+      memcpy(&res, data_ + offset_, sizeof(res));
+      offset_ += sizeof(res);
+      return res;
+    }
+
+    offset_ = size_;
+    return T(0);
+  }
+
+  bool MoreToRead() { return offset_ < size_; }
+
+  const uint8_t* const data_;
+  size_t size_;
+  size_t offset_ = 0;
+};
+
+class FuzzyFrameObject : public EncodedFrame {
+ public:
+  FuzzyFrameObject() {}
+  ~FuzzyFrameObject() {}
+
+  int64_t ReceivedTime() const override { return 0; }
+  int64_t RenderTime() const override { return _renderTimeMs; }
+};
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000) {
+    return;
+  }
+  DataReader reader(data, size);
+  GlobalSimulatedTimeController time_controller(Timestamp::Seconds(0));
+  std::unique_ptr<TaskQueueBase, TaskQueueDeleter> task_queue =
+      time_controller.GetTaskQueueFactory()->CreateTaskQueue(
+          "time_tq", TaskQueueFactory::Priority::NORMAL);
+  test::ScopedKeyValueConfig field_trials;
+  VCMTiming timing(time_controller.GetClock(), field_trials);
+  video_coding::FrameBuffer frame_buffer(time_controller.GetClock(), &timing,
+                                         field_trials);
+
+  bool next_frame_task_running = false;
+
+  while (reader.MoreToRead()) {
+    if (reader.GetNum<uint8_t>() % 2) {
+      std::unique_ptr<FuzzyFrameObject> frame(new FuzzyFrameObject());
+      frame->SetId(reader.GetNum<int64_t>());
+      frame->SetSpatialIndex(reader.GetNum<uint8_t>() % 5);
+      frame->SetTimestamp(reader.GetNum<uint32_t>());
+      frame->num_references =
+          reader.GetNum<uint8_t>() % EncodedFrame::kMaxFrameReferences;
+
+      for (size_t r = 0; r < frame->num_references; ++r)
+        frame->references[r] = reader.GetNum<int64_t>();
+
+      frame_buffer.InsertFrame(std::move(frame));
+    } else {
+      if (!next_frame_task_running) {
+        next_frame_task_running = true;
+        bool keyframe_required = reader.GetNum<uint8_t>() % 2;
+        int max_wait_time_ms = reader.GetNum<uint8_t>();
+        task_queue->PostTask([&task_queue, &frame_buffer,
+                              &next_frame_task_running, keyframe_required,
+                              max_wait_time_ms] {
+          frame_buffer.NextFrame(
+              max_wait_time_ms, keyframe_required, task_queue.get(),
+              [&next_frame_task_running](std::unique_ptr<EncodedFrame> frame) {
+                next_frame_task_running = false;
+              });
+        });
+      }
+    }
+
+    time_controller.AdvanceTime(TimeDelta::Millis(reader.GetNum<uint8_t>()));
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc
new file mode 100644
index 0000000000..e58d5e9f98
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc
@@ -0,0 +1,87 @@
+/*
+ *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "api/array_view.h"
+#include "api/video/encoded_frame.h"
+#include "api/video/frame_buffer.h"
+#include "rtc_base/numerics/sequence_number_unwrapper.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+#include "test/scoped_key_value_config.h"
+
+namespace webrtc {
+namespace {
+class FuzzyFrameObject : public EncodedFrame {
+ public:
+  int64_t ReceivedTime() const override { return 0; }
+  int64_t RenderTime() const override { return 0; }
+};
+
+constexpr int kFrameIdLength = 1 << 15;
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 10000) {
+    return;
+  }
+
+  test::ScopedKeyValueConfig field_trials;
+  FrameBuffer buffer(/*max_frame_slots=*/100, /*max_decode_history=*/1000,
+                     field_trials);
+  test::FuzzDataHelper helper(rtc::MakeArrayView(data, size));
+  SeqNumUnwrapper<uint16_t, kFrameIdLength> unwrapper;
+
+  while (helper.BytesLeft() > 0) {
+    int action = helper.ReadOrDefaultValue<uint8_t>(0) % 6;
+
+    switch (action) {
+      case 0: {
+        buffer.LastContinuousFrameId();
+        break;
+      }
+      case 1: {
+        buffer.LastContinuousTemporalUnitFrameId();
+        break;
+      }
+      case 2: {
+        buffer.DecodableTemporalUnitsInfo();
+        break;
+      }
+      case 3: {
+        buffer.ExtractNextDecodableTemporalUnit();
+        break;
+      }
+      case 4: {
+        buffer.DropNextDecodableTemporalUnit();
+        break;
+      }
+      case 5: {
+        auto frame = std::make_unique<FuzzyFrameObject>();
+        frame->SetTimestamp(helper.ReadOrDefaultValue<uint32_t>(0));
+        int64_t wire_id =
+            helper.ReadOrDefaultValue<uint16_t>(0) & (kFrameIdLength - 1);
+        frame->SetId(unwrapper.Unwrap(wire_id));
+        frame->is_last_spatial_layer = helper.ReadOrDefaultValue<bool>(false);
+
+        frame->num_references = helper.ReadOrDefaultValue<uint8_t>(0) %
+                                EncodedFrame::kMaxFrameReferences;
+
+        for (uint8_t i = 0; i < frame->num_references; ++i) {
+          frame->references[i] = helper.ReadOrDefaultValue<int64_t>(0);
+        }
+
+        buffer.InsertFrame(std::move(frame));
+        break;
+      }
+    }
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc
new file mode 100644
index 0000000000..866f7bc4b8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc
@@ -0,0 +1,20 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace test {
+
+FuzzDataHelper::FuzzDataHelper(rtc::ArrayView<const uint8_t> data)
+    : data_(data) {}
+
+}  // namespace test
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h
new file mode 100644
index 0000000000..cedc31d0a4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h
@@ -0,0 +1,105 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_FUZZ_DATA_HELPER_H_
+#define TEST_FUZZERS_FUZZ_DATA_HELPER_H_
+
+#include <limits>
+
+#include "api/array_view.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+namespace test {
+
+// Helper class to take care of the fuzzer input, read from it, and keep track
+// of when the end of the data has been reached.
+class FuzzDataHelper {
+ public:
+  explicit FuzzDataHelper(rtc::ArrayView<const uint8_t> data);
+
+  // Returns true if n bytes can be read.
+  bool CanReadBytes(size_t n) const { return data_ix_ + n <= data_.size(); }
+
+  // Reads and returns data of type T.
+  template <typename T>
+  T Read() {
+    RTC_CHECK(CanReadBytes(sizeof(T)));
+    T x = ByteReader<T>::ReadLittleEndian(&data_[data_ix_]);
+    data_ix_ += sizeof(T);
+    return x;
+  }
+
+  // Reads and returns data of type T. Returns default_value if not enough
+  // fuzzer input remains to read a T.
+  template <typename T>
+  T ReadOrDefaultValue(T default_value) {
+    if (!CanReadBytes(sizeof(T))) {
+      return default_value;
+    }
+    return Read<T>();
+  }
+
+  // Like ReadOrDefaultValue, but replaces the value 0 with default_value.
+  template <typename T>
+  T ReadOrDefaultValueNotZero(T default_value) {
+    static_assert(std::is_integral<T>::value, "");
+    T x = ReadOrDefaultValue(default_value);
+    return x == 0 ? default_value : x;
+  }
+
+  // Returns one of the elements from the provided input array. The selection
+  // is based on the fuzzer input data. If not enough fuzzer data is available,
+  // the method will return the first element in the input array. The reason for
+  // not flagging this as an error is to allow the method to be called from
+  // class constructors, and in constructors we typically do not handle
+  // errors. The code will work anyway, and the fuzzer will likely see that
+  // providing more data will actually make this method return something else.
+  template <typename T, size_t N>
+  T SelectOneOf(const T (&select_from)[N]) {
+    static_assert(N <= std::numeric_limits<uint8_t>::max(), "");
+    // Read an index between 0 and select_from.size() - 1 from the fuzzer data.
+    uint8_t index = ReadOrDefaultValue<uint8_t>(0) % N;
+    return select_from[index];
+  }
+
+  rtc::ArrayView<const uint8_t> ReadByteArray(size_t bytes) {
+    if (!CanReadBytes(bytes)) {
+      return rtc::ArrayView<const uint8_t>(nullptr, 0);
+    }
+    const size_t index_to_return = data_ix_;
+    data_ix_ += bytes;
+    return data_.subview(index_to_return, bytes);
+  }
+
+  // If sizeof(T) > BytesLeft then the remaining bytes will be used and the rest
+  // of the object will be zero initialized.
+  template <typename T>
+  void CopyTo(T* object) {
+    memset(object, 0, sizeof(T));
+
+    size_t bytes_to_copy = std::min(BytesLeft(), sizeof(T));
+    memcpy(object, data_.data() + data_ix_, bytes_to_copy);
+    data_ix_ += bytes_to_copy;
+  }
+
+  size_t BytesRead() const { return data_ix_; }
+
+  size_t BytesLeft() const { return data_.size() - data_ix_; }
+
+ private:
+  rtc::ArrayView<const uint8_t> data_;
+  size_t data_ix_ = 0;
+};
+
+}  // namespace test
+}  // namespace webrtc
+
+#endif  // TEST_FUZZERS_FUZZ_DATA_HELPER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc
new file mode 100644
index 0000000000..cd1128c0b4
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc
@@ -0,0 +1,21 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include <stdint.h>
+
+#include "common_video/h264/h264_bitstream_parser.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  H264BitstreamParser h264_bitstream_parser;
+  h264_bitstream_parser.ParseBitstream(
+      rtc::ArrayView<const uint8_t>(data, size));
+  h264_bitstream_parser.GetLastSliceQp();
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc
new file mode 100644
index 0000000000..97127228ed
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc
@@ -0,0 +1,19 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_h264.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 200000)
+    return;
+  VideoRtpDepacketizerH264 depacketizer;
+  depacketizer.Parse(rtc::CopyOnWriteBuffer(data, size));
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc
new file mode 100644
index 0000000000..348c84f040
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc
@@ -0,0 +1,184 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <cmath>
+#include <cstring>
+#include <memory>
+#include <vector>
+
+#include "api/array_view.h"
+#include "api/audio_codecs/builtin_audio_decoder_factory.h"
+#include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h"
+#include "modules/audio_coding/neteq/tools/audio_checksum.h"
+#include "modules/audio_coding/neteq/tools/encode_neteq_input.h"
+#include "modules/audio_coding/neteq/tools/neteq_test.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+namespace test {
+namespace {
+constexpr int kPayloadType = 95;
+
+class SineGenerator : public EncodeNetEqInput::Generator {
+ public:
+  explicit SineGenerator(int sample_rate_hz)
+      : sample_rate_hz_(sample_rate_hz) {}
+
+  rtc::ArrayView<const int16_t> Generate(size_t num_samples) override {
+    if (samples_.size() < num_samples) {
+      samples_.resize(num_samples);
+    }
+
+    rtc::ArrayView<int16_t> output(samples_.data(), num_samples);
+    for (auto& x : output) {
+      x = static_cast<int16_t>(2000.0 * std::sin(phase_));
+      phase_ += 2 * kPi * kFreqHz / sample_rate_hz_;
+    }
+    return output;
+  }
+
+ private:
+  static constexpr int kFreqHz = 300;  // The sinewave frequency.
+  const int sample_rate_hz_;
+  const double kPi = std::acos(-1);
+  std::vector<int16_t> samples_;
+  double phase_ = 0.0;
+};
+
+class FuzzRtpInput : public NetEqInput {
+ public:
+  explicit FuzzRtpInput(rtc::ArrayView<const uint8_t> data) : data_(data) {
+    AudioEncoderPcm16B::Config config;
+    config.payload_type = kPayloadType;
+    config.sample_rate_hz = 32000;
+    std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config));
+    std::unique_ptr<EncodeNetEqInput::Generator> generator(
+        new SineGenerator(config.sample_rate_hz));
+    input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder),
+                                      std::numeric_limits<int64_t>::max()));
+    packet_ = input_->PopPacket();
+    FuzzHeader();
+    MaybeFuzzPayload();
+  }
+
+  absl::optional<int64_t> NextPacketTime() const override {
+    return packet_->time_ms;
+  }
+
+  absl::optional<int64_t> NextOutputEventTime() const override {
+    return input_->NextOutputEventTime();
+  }
+
+  std::unique_ptr<PacketData> PopPacket() override {
+    RTC_DCHECK(packet_);
+    std::unique_ptr<PacketData> packet_to_return = std::move(packet_);
+    packet_ = input_->PopPacket();
+    FuzzHeader();
+    MaybeFuzzPayload();
+    return packet_to_return;
+  }
+
+  void AdvanceOutputEvent() override { return input_->AdvanceOutputEvent(); }
+
+  bool ended() const override { return ended_; }
+
+  absl::optional<RTPHeader> NextHeader() const override {
+    RTC_DCHECK(packet_);
+    return packet_->header;
+  }
+
+ private:
+  void FuzzHeader() {
+    constexpr size_t kNumBytesToFuzz = 11;
+    if (data_ix_ + kNumBytesToFuzz > data_.size()) {
+      ended_ = true;
+      return;
+    }
+    RTC_DCHECK(packet_);
+    const size_t start_ix = data_ix_;
+    packet_->header.payloadType =
+        ByteReader<uint8_t>::ReadLittleEndian(&data_[data_ix_]);
+    packet_->header.payloadType &= 0x7F;
+    data_ix_ += sizeof(uint8_t);
+    packet_->header.sequenceNumber =
+        ByteReader<uint16_t>::ReadLittleEndian(&data_[data_ix_]);
+    data_ix_ += sizeof(uint16_t);
+    packet_->header.timestamp =
+        ByteReader<uint32_t>::ReadLittleEndian(&data_[data_ix_]);
+    data_ix_ += sizeof(uint32_t);
+    packet_->header.ssrc =
+        ByteReader<uint32_t>::ReadLittleEndian(&data_[data_ix_]);
+    data_ix_ += sizeof(uint32_t);
+    RTC_CHECK_EQ(data_ix_ - start_ix, kNumBytesToFuzz);
+  }
+
+  void MaybeFuzzPayload() {
+    // Read one byte of fuzz data to determine how many payload bytes to fuzz.
+    if (data_ix_ + 1 > data_.size()) {
+      ended_ = true;
+      return;
+    }
+    size_t bytes_to_fuzz = data_[data_ix_++];
+
+    // Restrict number of bytes to fuzz to 16; a reasonably low number enough to
+    // cover a few RED headers. Also don't write outside the payload length.
+    bytes_to_fuzz = std::min(bytes_to_fuzz % 16, packet_->payload.size());
+
+    if (bytes_to_fuzz == 0)
+      return;
+
+    if (data_ix_ + bytes_to_fuzz > data_.size()) {
+      ended_ = true;
+      return;
+    }
+
+    std::memcpy(packet_->payload.data(), &data_[data_ix_], bytes_to_fuzz);
+    data_ix_ += bytes_to_fuzz;
+  }
+
+  bool ended_ = false;
+  rtc::ArrayView<const uint8_t> data_;
+  size_t data_ix_ = 0;
+  std::unique_ptr<EncodeNetEqInput> input_;
+  std::unique_ptr<PacketData> packet_;
+};
+}  // namespace
+
+void FuzzOneInputTest(const uint8_t* data, size_t size) {
+  std::unique_ptr<FuzzRtpInput> input(
+      new FuzzRtpInput(rtc::ArrayView<const uint8_t>(data, size)));
+  std::unique_ptr<AudioChecksum> output(new AudioChecksum);
+  NetEqTest::Callbacks callbacks;
+  NetEq::Config config;
+  auto codecs = NetEqTest::StandardDecoderMap();
+  // kPayloadType is the payload type that will be used for encoding. Verify
+  // that it is included in the standard decoder map, and that it points to the
+  // expected decoder type.
+  const auto it = codecs.find(kPayloadType);
+  RTC_CHECK(it != codecs.end());
+  RTC_CHECK(it->second == SdpAudioFormat("L16", 32000, 1));
+
+  NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs,
+                 /*text_log=*/nullptr, /*neteq_factory=*/nullptr,
+                 std::move(input), std::move(output), callbacks);
+  test.Run();
+}
+
+}  // namespace test
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 70000) {
+    return;
+  }
+  test::FuzzOneInputTest(data, size);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc
new file mode 100644
index 0000000000..8653f137a2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc
@@ -0,0 +1,201 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <cmath>
+#include <limits>
+#include <memory>
+#include <vector>
+
+#include "api/array_view.h"
+#include "api/audio_codecs/builtin_audio_decoder_factory.h"
+#include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h"
+#include "modules/audio_coding/neteq/tools/audio_checksum.h"
+#include "modules/audio_coding/neteq/tools/encode_neteq_input.h"
+#include "modules/audio_coding/neteq/tools/neteq_test.h"
+#include "rtc_base/numerics/safe_conversions.h"
+#include "rtc_base/random.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+namespace test {
+namespace {
+// Generate a mixture of sine wave and gaussian noise.
+class SineAndNoiseGenerator : public EncodeNetEqInput::Generator {
+ public:
+  // The noise generator is seeded with a value from the fuzzer data, but 0 is
+  // avoided (since it is not allowed by the Random class).
+  SineAndNoiseGenerator(int sample_rate_hz, FuzzDataHelper* fuzz_data)
+      : sample_rate_hz_(sample_rate_hz),
+        fuzz_data_(*fuzz_data),
+        noise_generator_(fuzz_data_.ReadOrDefaultValueNotZero<uint64_t>(1)) {}
+
+  // Generates num_samples of the sine-gaussian mixture.
+  rtc::ArrayView<const int16_t> Generate(size_t num_samples) override {
+    if (samples_.size() < num_samples) {
+      samples_.resize(num_samples);
+    }
+
+    rtc::ArrayView<int16_t> output(samples_.data(), num_samples);
+    // Randomize an amplitude between 0 and 32768; use 65000/2 if we are out of
+    // fuzzer data.
+    const float amplitude = fuzz_data_.ReadOrDefaultValue<uint16_t>(65000) / 2;
+    // Randomize a noise standard deviation between 0 and 1999.
+    const float noise_std = fuzz_data_.ReadOrDefaultValue<uint16_t>(0) % 2000;
+    for (auto& x : output) {
+      x = rtc::saturated_cast<int16_t>(amplitude * std::sin(phase_) +
+                                       noise_generator_.Gaussian(0, noise_std));
+      phase_ += 2 * kPi * kFreqHz / sample_rate_hz_;
+    }
+    return output;
+  }
+
+ private:
+  static constexpr int kFreqHz = 300;  // The sinewave frequency.
+  const int sample_rate_hz_;
+  const double kPi = std::acos(-1);
+  std::vector<int16_t> samples_;
+  double phase_ = 0.0;
+  FuzzDataHelper& fuzz_data_;
+  Random noise_generator_;
+};
+
+class FuzzSignalInput : public NetEqInput {
+ public:
+  explicit FuzzSignalInput(FuzzDataHelper* fuzz_data,
+                           int sample_rate,
+                           uint8_t payload_type)
+      : fuzz_data_(*fuzz_data) {
+    AudioEncoderPcm16B::Config config;
+    config.payload_type = payload_type;
+    config.sample_rate_hz = sample_rate;
+    std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config));
+    std::unique_ptr<EncodeNetEqInput::Generator> generator(
+        new SineAndNoiseGenerator(config.sample_rate_hz, fuzz_data));
+    input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder),
+                                      std::numeric_limits<int64_t>::max()));
+    packet_ = input_->PopPacket();
+
+    // Select an output event period. This is how long time we wait between each
+    // call to NetEq::GetAudio. 10 ms is nominal, 9 and 11 ms will both lead to
+    // clock drift (in different directions).
+    constexpr int output_event_periods[] = {9, 10, 11};
+    output_event_period_ms_ = fuzz_data_.SelectOneOf(output_event_periods);
+  }
+
+  absl::optional<int64_t> NextPacketTime() const override {
+    return packet_->time_ms;
+  }
+
+  absl::optional<int64_t> NextOutputEventTime() const override {
+    return next_output_event_ms_;
+  }
+
+  std::unique_ptr<PacketData> PopPacket() override {
+    RTC_DCHECK(packet_);
+    std::unique_ptr<PacketData> packet_to_return = std::move(packet_);
+    do {
+      packet_ = input_->PopPacket();
+      // If the next value from the fuzzer input is 0, the packet is discarded
+      // and the next one is pulled from the source.
+    } while (fuzz_data_.CanReadBytes(1) && fuzz_data_.Read<uint8_t>() == 0);
+    if (fuzz_data_.CanReadBytes(1)) {
+      // Generate jitter by setting an offset for the arrival time.
+      const int8_t arrival_time_offset_ms = fuzz_data_.Read<int8_t>();
+      // The arrival time can not be before the previous packets.
+      packet_->time_ms = std::max(packet_to_return->time_ms,
+                                  packet_->time_ms + arrival_time_offset_ms);
+    } else {
+      // Mark that we are at the end of the test. However, the current packet is
+      // still valid (but it may not have been fuzzed as expected).
+      ended_ = true;
+    }
+    return packet_to_return;
+  }
+
+  void AdvanceOutputEvent() override {
+    next_output_event_ms_ += output_event_period_ms_;
+  }
+
+  bool ended() const override { return ended_; }
+
+  absl::optional<RTPHeader> NextHeader() const override {
+    RTC_DCHECK(packet_);
+    return packet_->header;
+  }
+
+ private:
+  bool ended_ = false;
+  FuzzDataHelper& fuzz_data_;
+  std::unique_ptr<EncodeNetEqInput> input_;
+  std::unique_ptr<PacketData> packet_;
+  int64_t next_output_event_ms_ = 0;
+  int64_t output_event_period_ms_ = 10;
+};
+
+template <class T>
+bool MapHas(const std::map<int, T>& m, int key, const T& value) {
+  const auto it = m.find(key);
+  return (it != m.end() && it->second == value);
+}
+
+}  // namespace
+
+void FuzzOneInputTest(const uint8_t* data, size_t size) {
+  if (size < 1 || size > 65000) {
+    return;
+  }
+
+  FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
+
+  // Allowed sample rates and payload types used in the test.
+  std::pair<int, uint8_t> rate_types[] = {
+      {8000, 93}, {16000, 94}, {32000, 95}, {48000, 96}};
+  const auto rate_type = fuzz_data.SelectOneOf(rate_types);
+  const int sample_rate = rate_type.first;
+  const uint8_t payload_type = rate_type.second;
+
+  // Set up the input signal generator.
+  std::unique_ptr<FuzzSignalInput> input(
+      new FuzzSignalInput(&fuzz_data, sample_rate, payload_type));
+
+  // Output sink for the test.
+  std::unique_ptr<AudioChecksum> output(new AudioChecksum);
+
+  // Configure NetEq and the NetEqTest object.
+  NetEqTest::Callbacks callbacks;
+  NetEq::Config config;
+  config.enable_post_decode_vad = true;
+  config.enable_fast_accelerate = true;
+  auto codecs = NetEqTest::StandardDecoderMap();
+  // rate_types contains the payload types that will be used for encoding.
+  // Verify that they all are included in the standard decoder map, and that
+  // they point to the expected decoder types.
+  RTC_CHECK(
+      MapHas(codecs, rate_types[0].second, SdpAudioFormat("l16", 8000, 1)));
+  RTC_CHECK(
+      MapHas(codecs, rate_types[1].second, SdpAudioFormat("l16", 16000, 1)));
+  RTC_CHECK(
+      MapHas(codecs, rate_types[2].second, SdpAudioFormat("l16", 32000, 1)));
+  RTC_CHECK(
+      MapHas(codecs, rate_types[3].second, SdpAudioFormat("l16", 48000, 1)));
+
+  NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs,
+                 /*text_log=*/nullptr, /*neteq_factory=*/nullptr,
+                 std::move(input), std::move(output), callbacks);
+  test.Run();
+}
+
+}  // namespace test
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  test::FuzzOneInputTest(data, size);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc
new file mode 100644
index 0000000000..78ddf0e455
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc
@@ -0,0 +1,47 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "p2p/base/pseudo_tcp.h"
+#include "rtc_base/thread.h"
+
+namespace webrtc {
+class FakeIPseudoTcpNotify : public cricket::IPseudoTcpNotify {
+ public:
+  void OnTcpOpen(cricket::PseudoTcp* tcp) {}
+  void OnTcpReadable(cricket::PseudoTcp* tcp) {}
+  void OnTcpWriteable(cricket::PseudoTcp* tcp) {}
+  void OnTcpClosed(cricket::PseudoTcp* tcp, uint32_t error) {}
+
+  cricket::IPseudoTcpNotify::WriteResult TcpWritePacket(cricket::PseudoTcp* tcp,
+                                                        const char* buffer,
+                                                        size_t len) {
+    return cricket::IPseudoTcpNotify::WriteResult::WR_SUCCESS;
+  }
+};
+
+struct Environment {
+  explicit Environment(cricket::IPseudoTcpNotify* notifier)
+      : ptcp(notifier, 0) {}
+
+  // We need the thread to avoid some uninteresting crashes, since the
+  // production code expects there to be a thread object available.
+  rtc::AutoThread thread;
+  cricket::PseudoTcp ptcp;
+};
+
+Environment* env = new Environment(new FakeIPseudoTcpNotify());
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  env->ptcp.NotifyPacket(reinterpret_cast<const char*>(data), size);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc
new file mode 100644
index 0000000000..0efe81f220
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc
@@ -0,0 +1,66 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <math.h>
+#include <string.h>
+
+#include <algorithm>
+#include <bitset>
+#include <vector>
+
+#include "api/audio/echo_detector_creator.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  // Number of times to update the echo detector.
+  constexpr size_t kNrOfUpdates = 7;
+  // Each round of updates requires a call to both AnalyzeRender and
+  // AnalyzeCapture, so the amount of needed input bytes doubles. Also, two
+  // bytes are used to set the call order.
+  constexpr size_t kNrOfNeededInputBytes = 2 * kNrOfUpdates * sizeof(float) + 2;
+  // The maximum audio energy that an audio frame can have is equal to the
+  // number of samples in the frame multiplied by 2^30. We use a single sample
+  // to represent an audio frame in this test, so it should have a maximum value
+  // equal to the square root of that value.
+  const float maxFuzzedValue = sqrtf(20 * 48) * 32768;
+  if (size < kNrOfNeededInputBytes) {
+    return;
+  }
+  size_t read_idx = 0;
+  // Use the first two bytes to choose the call order.
+  uint16_t call_order_int;
+  memcpy(&call_order_int, &data[read_idx], 2);
+  read_idx += 2;
+  std::bitset<16> call_order(call_order_int);
+
+  rtc::scoped_refptr<EchoDetector> echo_detector = CreateEchoDetector();
+  std::vector<float> input(1);
+  // Call AnalyzeCaptureAudio once to prevent the flushing of the buffer.
+  echo_detector->AnalyzeCaptureAudio(input);
+  for (size_t i = 0; i < 2 * kNrOfUpdates; ++i) {
+    // Convert 4 input bytes to a float.
+    RTC_DCHECK_LE(read_idx + sizeof(float), size);
+    memcpy(input.data(), &data[read_idx], sizeof(float));
+    read_idx += sizeof(float);
+    if (!isfinite(input[0]) || fabs(input[0]) > maxFuzzedValue) {
+      // Ignore infinity, nan values and values that are unrealistically large.
+      continue;
+    }
+    if (call_order[i]) {
+      echo_detector->AnalyzeRenderAudio(input);
+    } else {
+      echo_detector->AnalyzeCaptureAudio(input);
+    }
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc
new file mode 100644
index 0000000000..8bad9e456a
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/rtp_rtcp/source/rtcp_packet/tmmb_item.h"
+#include "modules/rtp_rtcp/source/rtcp_receiver.h"
+#include "modules/rtp_rtcp/source/rtp_rtcp_interface.h"
+#include "rtc_base/checks.h"
+#include "system_wrappers/include/clock.h"
+
+namespace webrtc {
+namespace {
+
+constexpr int kRtcpIntervalMs = 1000;
+
+// RTCP is typically sent over UDP, which has a maximum payload length
+// of 65535 bytes. We err on the side of caution and check a bit above that.
+constexpr size_t kMaxInputLenBytes = 66000;
+
+class NullModuleRtpRtcp : public RTCPReceiver::ModuleRtpRtcp {
+ public:
+  void SetTmmbn(std::vector<rtcp::TmmbItem>) override {}
+  void OnRequestSendReport() override {}
+  void OnReceivedNack(const std::vector<uint16_t>&) override {}
+  void OnReceivedRtcpReportBlocks(const ReportBlockList&) override {}
+};
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > kMaxInputLenBytes) {
+    return;
+  }
+
+  NullModuleRtpRtcp rtp_rtcp_module;
+  SimulatedClock clock(1234);
+
+  RtpRtcpInterface::Configuration config;
+  config.clock = &clock;
+  config.rtcp_report_interval_ms = kRtcpIntervalMs;
+  config.local_media_ssrc = 1;
+
+  RTCPReceiver receiver(config, &rtp_rtcp_module);
+
+  receiver.IncomingPacket(data, size);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc
new file mode 100644
index 0000000000..168e7b606b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_av1.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <vector>
+
+#include "api/array_view.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  std::vector<rtc::ArrayView<const uint8_t>> rtp_payloads;
+
+  // Convert plain array of bytes into array of array bytes.
+  test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size));
+  while (fuzz_input.CanReadBytes(sizeof(uint16_t))) {
+    // In practice one rtp payload can be up to ~1200 - 1500 bytes. Majority
+    // of the payload is just copied. To make fuzzing more efficient limit the
+    // size of rtp payload to realistic value.
+    uint16_t next_size = fuzz_input.Read<uint16_t>() % 1200;
+    if (next_size > fuzz_input.BytesLeft()) {
+      next_size = fuzz_input.BytesLeft();
+    }
+    rtp_payloads.push_back(fuzz_input.ReadByteArray(next_size));
+  }
+  // Run code under test.
+  VideoRtpDepacketizerAv1().AssembleFrame(rtp_payloads);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc
new file mode 100644
index 0000000000..82404f7264
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc
@@ -0,0 +1,94 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <utility>
+
+#include "api/array_view.h"
+#include "common_video/generic_frame_descriptor/generic_frame_info.h"
+#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  FrameDependencyStructure structure1;
+  // nullptr during 1st while loop, after that should point to structure1.
+  const FrameDependencyStructure* structure1_ptr = nullptr;
+  std::unique_ptr<const FrameDependencyStructure> structure2;
+
+  test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size));
+  while (fuzz_data.CanReadBytes(1)) {
+    // Treat next byte as size of the next extension. That aligns how
+    // two-byte rtp header extension sizes are written.
+    size_t next_size = fuzz_data.Read<uint8_t>();
+    auto raw =
+        fuzz_data.ReadByteArray(std::min(next_size, fuzz_data.BytesLeft()));
+
+    // Read the random input.
+    DependencyDescriptor descriptor1;
+    if (!RtpDependencyDescriptorExtension::Parse(raw, structure1_ptr,
+                                                 &descriptor1)) {
+      // Ignore invalid buffer and move on.
+      continue;
+    }
+    if (descriptor1.attached_structure) {
+      structure1 = *descriptor1.attached_structure;
+      structure1_ptr = &structure1;
+    }
+    RTC_CHECK(structure1_ptr);
+
+    // Write parsed descriptor back into raw buffer.
+    size_t value_size =
+        RtpDependencyDescriptorExtension::ValueSize(structure1, descriptor1);
+    // Check `writer` use minimal number of bytes to pack the descriptor by
+    // checking it doesn't use more than reader consumed.
+    RTC_CHECK_LE(value_size, raw.size());
+    uint8_t some_memory[256];
+    // That should be true because value_size <= next_size < 256
+    RTC_CHECK_LT(value_size, 256);
+    rtc::ArrayView<uint8_t> write_buffer(some_memory, value_size);
+    RTC_CHECK(RtpDependencyDescriptorExtension::Write(write_buffer, structure1,
+                                                      descriptor1));
+
+    // Parse what Write assembled.
+    // Unlike random input that should always succeed.
+    DependencyDescriptor descriptor2;
+    RTC_CHECK(RtpDependencyDescriptorExtension::Parse(
+        write_buffer, structure2.get(), &descriptor2));
+    // Check descriptor1 and descriptor2 have same values.
+    RTC_CHECK_EQ(descriptor1.first_packet_in_frame,
+                 descriptor2.first_packet_in_frame);
+    RTC_CHECK_EQ(descriptor1.last_packet_in_frame,
+                 descriptor2.last_packet_in_frame);
+    RTC_CHECK_EQ(descriptor1.attached_structure != nullptr,
+                 descriptor2.attached_structure != nullptr);
+    // Using value_or would miss invalid corner case when one value is nullopt
+    // while another one is 0, but for other errors would produce much nicer
+    // error message than using RTC_CHECK(optional1 == optional2);
+    // If logger would support pretty printing optional values, value_or can be
+    // removed.
+    RTC_CHECK_EQ(descriptor1.active_decode_targets_bitmask.value_or(0),
+                 descriptor2.active_decode_targets_bitmask.value_or(0));
+    RTC_CHECK_EQ(descriptor1.frame_number, descriptor2.frame_number);
+    RTC_CHECK(descriptor1.resolution == descriptor2.resolution);
+    RTC_CHECK(descriptor1.frame_dependencies == descriptor2.frame_dependencies);
+
+    if (descriptor2.attached_structure) {
+      structure2 = std::move(descriptor2.attached_structure);
+    }
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc
new file mode 100644
index 0000000000..fdb4aa5f3c
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc
@@ -0,0 +1,154 @@
+/*
+ *  Copyright (c) 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "api/rtp_packet_infos.h"
+#include "modules/video_coding/frame_object.h"
+#include "modules/video_coding/rtp_frame_reference_finder.h"
+
+namespace webrtc {
+
+namespace {
+class DataReader {
+ public:
+  DataReader(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+
+  template <typename T>
+  void CopyTo(T* object) {
+    static_assert(std::is_pod<T>(), "");
+    uint8_t* destination = reinterpret_cast<uint8_t*>(object);
+    size_t object_size = sizeof(T);
+    size_t num_bytes = std::min(size_ - offset_, object_size);
+    memcpy(destination, data_ + offset_, num_bytes);
+    offset_ += num_bytes;
+
+    // If we did not have enough data, fill the rest with 0.
+    object_size -= num_bytes;
+    memset(destination + num_bytes, 0, object_size);
+  }
+
+  template <typename T>
+  T GetNum() {
+    T res;
+    if (offset_ + sizeof(res) < size_) {
+      memcpy(&res, data_ + offset_, sizeof(res));
+      offset_ += sizeof(res);
+      return res;
+    }
+
+    offset_ = size_;
+    return T(0);
+  }
+
+  bool MoreToRead() { return offset_ < size_; }
+
+ private:
+  const uint8_t* data_;
+  size_t size_;
+  size_t offset_ = 0;
+};
+
+absl::optional<RTPVideoHeader::GenericDescriptorInfo>
+GenerateGenericFrameDependencies(DataReader* reader) {
+  absl::optional<RTPVideoHeader::GenericDescriptorInfo> result;
+  uint8_t flags = reader->GetNum<uint8_t>();
+  if (flags & 0b1000'0000) {
+    // i.e. with 50% chance there are no generic dependencies.
+    // in such case codec-specfic code path of the RtpFrameReferenceFinder will
+    // be validated.
+    return result;
+  }
+
+  result.emplace();
+  result->frame_id = reader->GetNum<int32_t>();
+  result->spatial_index = (flags & 0b0111'0000) >> 4;
+  result->temporal_index = (flags & 0b0000'1110) >> 1;
+
+  // Larger than supported by the RtpFrameReferenceFinder.
+  int num_diffs = (reader->GetNum<uint8_t>() % 16);
+  for (int i = 0; i < num_diffs; ++i) {
+    result->dependencies.push_back(result->frame_id -
+                                   (reader->GetNum<uint16_t>() % (1 << 14)));
+  }
+
+  return result;
+}
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  DataReader reader(data, size);
+  RtpFrameReferenceFinder reference_finder;
+
+  auto codec = static_cast<VideoCodecType>(reader.GetNum<uint8_t>() % 5);
+
+  while (reader.MoreToRead()) {
+    uint16_t first_seq_num = reader.GetNum<uint16_t>();
+    uint16_t last_seq_num = reader.GetNum<uint16_t>();
+    bool marker_bit = reader.GetNum<uint8_t>();
+
+    RTPVideoHeader video_header;
+    switch (reader.GetNum<uint8_t>() % 3) {
+      case 0:
+        video_header.frame_type = VideoFrameType::kEmptyFrame;
+        break;
+      case 1:
+        video_header.frame_type = VideoFrameType::kVideoFrameKey;
+        break;
+      case 2:
+        video_header.frame_type = VideoFrameType::kVideoFrameDelta;
+        break;
+    }
+
+    switch (codec) {
+      case kVideoCodecVP8:
+        reader.CopyTo(
+            &video_header.video_type_header.emplace<RTPVideoHeaderVP8>());
+        break;
+      case kVideoCodecVP9:
+        reader.CopyTo(
+            &video_header.video_type_header.emplace<RTPVideoHeaderVP9>());
+        break;
+      case kVideoCodecH264:
+        reader.CopyTo(
+            &video_header.video_type_header.emplace<RTPVideoHeaderH264>());
+        break;
+      default:
+        break;
+    }
+
+    video_header.generic = GenerateGenericFrameDependencies(&reader);
+
+    // clang-format off
+    auto frame = std::make_unique<RtpFrameObject>(
+        first_seq_num,
+        last_seq_num,
+        marker_bit,
+        /*times_nacked=*/0,
+        /*first_packet_received_time=*/0,
+        /*last_packet_received_time=*/0,
+        /*rtp_timestamp=*/0,
+        /*ntp_time_ms=*/0,
+        VideoSendTiming(),
+        /*payload_type=*/0,
+        codec,
+        kVideoRotation_0,
+        VideoContentType::UNSPECIFIED,
+        video_header,
+        /*color_space=*/absl::nullopt,
+        RtpPacketInfos(),
+        EncodedImageBuffer::Create(/*size=*/0));
+    // clang-format on
+
+    reference_finder.ManageFrame(std::move(frame));
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc
new file mode 100644
index 0000000000..5d117529bb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc
@@ -0,0 +1,182 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <bitset>
+#include <vector>
+
+#include "absl/types/optional.h"
+#include "modules/rtp_rtcp/include/rtp_header_extension_map.h"
+#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h"
+#include "modules/rtp_rtcp/source/rtp_header_extensions.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+#include "modules/rtp_rtcp/source/rtp_video_layers_allocation_extension.h"
+
+namespace webrtc {
+// We decide which header extensions to register by reading four bytes
+// from the beginning of `data` and interpreting it as a bitmask over
+// the RTPExtensionType enum. This assert ensures four bytes are enough.
+static_assert(kRtpExtensionNumberOfExtensions <= 32,
+              "Insufficient bits read to configure all header extensions. Add "
+              "an extra byte and update the switches.");
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size <= 4)
+    return;
+
+  // Don't use the configuration byte as part of the packet.
+  std::bitset<32> extensionMask(*reinterpret_cast<const uint32_t*>(data));
+  data += 4;
+  size -= 4;
+
+  RtpPacketReceived::ExtensionManager extensions(/*extmap_allow_mixed=*/true);
+  // Start at local_id = 1 since 0 is an invalid extension id.
+  int local_id = 1;
+  // Skip i = 0 since it maps to kRtpExtensionNone.
+  for (int i = 1; i < kRtpExtensionNumberOfExtensions; i++) {
+    RTPExtensionType extension_type = static_cast<RTPExtensionType>(i);
+    if (extensionMask[i]) {
+      // Extensions are registered with an ID, which you signal to the
+      // peer so they know what to expect. This code only cares about
+      // parsing so the value of the ID isn't relevant.
+      extensions.RegisterByType(local_id++, extension_type);
+    }
+  }
+
+  RtpPacketReceived packet(&extensions);
+  packet.Parse(data, size);
+
+  // Call packet accessors because they have extra checks.
+  packet.Marker();
+  packet.PayloadType();
+  packet.SequenceNumber();
+  packet.Timestamp();
+  packet.Ssrc();
+  packet.Csrcs();
+
+  // Each extension has its own getter. It is supported behaviour to
+  // call GetExtension on an extension which was not registered, so we
+  // don't check the bitmask here.
+  for (int i = 0; i < kRtpExtensionNumberOfExtensions; i++) {
+    switch (static_cast<RTPExtensionType>(i)) {
+      case kRtpExtensionNone:
+      case kRtpExtensionNumberOfExtensions:
+        break;
+      case kRtpExtensionTransmissionTimeOffset:
+        int32_t offset;
+        packet.GetExtension<TransmissionOffset>(&offset);
+        break;
+      case kRtpExtensionAudioLevel:
+        bool voice_activity;
+        uint8_t audio_level;
+        packet.GetExtension<AudioLevel>(&voice_activity, &audio_level);
+        break;
+#if !defined(WEBRTC_MOZILLA_BUILD)
+      case kRtpExtensionCsrcAudioLevel: {
+        std::vector<uint8_t> audio_levels;
+        packet.GetExtension<CsrcAudioLevel>(&audio_levels);
+        break;
+      }
+#endif
+      case kRtpExtensionAbsoluteSendTime:
+        uint32_t sendtime;
+        packet.GetExtension<AbsoluteSendTime>(&sendtime);
+        break;
+      case kRtpExtensionAbsoluteCaptureTime: {
+        AbsoluteCaptureTime extension;
+        packet.GetExtension<AbsoluteCaptureTimeExtension>(&extension);
+        break;
+      }
+      case kRtpExtensionVideoRotation:
+        uint8_t rotation;
+        packet.GetExtension<VideoOrientation>(&rotation);
+        break;
+      case kRtpExtensionTransportSequenceNumber:
+        uint16_t seqnum;
+        packet.GetExtension<TransportSequenceNumber>(&seqnum);
+        break;
+      case kRtpExtensionTransportSequenceNumber02: {
+        uint16_t seqnum;
+        absl::optional<FeedbackRequest> feedback_request;
+        packet.GetExtension<TransportSequenceNumberV2>(&seqnum,
+                                                       &feedback_request);
+        break;
+      }
+      case kRtpExtensionPlayoutDelay: {
+        VideoPlayoutDelay playout;
+        packet.GetExtension<PlayoutDelayLimits>(&playout);
+        break;
+      }
+      case kRtpExtensionVideoContentType:
+        VideoContentType content_type;
+        packet.GetExtension<VideoContentTypeExtension>(&content_type);
+        break;
+      case kRtpExtensionVideoTiming: {
+        VideoSendTiming timing;
+        packet.GetExtension<VideoTimingExtension>(&timing);
+        break;
+      }
+      case kRtpExtensionRtpStreamId: {
+        std::string rsid;
+        packet.GetExtension<RtpStreamId>(&rsid);
+        break;
+      }
+      case kRtpExtensionRepairedRtpStreamId: {
+        std::string rsid;
+        packet.GetExtension<RepairedRtpStreamId>(&rsid);
+        break;
+      }
+      case kRtpExtensionMid: {
+        std::string mid;
+        packet.GetExtension<RtpMid>(&mid);
+        break;
+      }
+      case kRtpExtensionGenericFrameDescriptor: {
+        RtpGenericFrameDescriptor descriptor;
+        packet.GetExtension<RtpGenericFrameDescriptorExtension00>(&descriptor);
+        break;
+      }
+      case kRtpExtensionColorSpace: {
+        ColorSpace color_space;
+        packet.GetExtension<ColorSpaceExtension>(&color_space);
+        break;
+      }
+      case kRtpExtensionInbandComfortNoise: {
+        absl::optional<uint8_t> noise_level;
+        packet.GetExtension<InbandComfortNoiseExtension>(&noise_level);
+        break;
+      }
+      case kRtpExtensionVideoLayersAllocation: {
+        VideoLayersAllocation allocation;
+        packet.GetExtension<RtpVideoLayersAllocationExtension>(&allocation);
+        break;
+      }
+      case kRtpExtensionVideoFrameTrackingId: {
+        uint16_t tracking_id;
+        packet.GetExtension<VideoFrameTrackingIdExtension>(&tracking_id);
+        break;
+      }
+      case kRtpExtensionDependencyDescriptor:
+        // This extension requires state to read and so complicated that
+        // deserves own fuzzer.
+        break;
+#if defined(WEBRTC_MOZILLA_BUILD)
+      case kRtpExtensionCsrcAudioLevel: {
+        CsrcAudioLevelList levels;
+        packet.GetExtension<CsrcAudioLevel>(&levels);
+        break;
+      }
+#endif
+    }
+  }
+
+  // Check that zero-ing mutable extensions wouldn't cause any problems.
+  packet.ZeroMutableExtensions();
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc
new file mode 100644
index 0000000000..e5550c1279
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/video/video_frame_type.h"
+#include "modules/rtp_rtcp/source/rtp_format.h"
+#include "modules/rtp_rtcp/source/rtp_packet_to_send.h"
+#include "modules/rtp_rtcp/source/rtp_packetizer_av1.h"
+#include "rtc_base/checks.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size));
+
+  RtpPacketizer::PayloadSizeLimits limits;
+  limits.max_payload_len = 1200;
+  // Read uint8_t to be sure reduction_lens are much smaller than
+  // max_payload_len and thus limits structure is valid.
+  limits.first_packet_reduction_len = fuzz_input.ReadOrDefaultValue<uint8_t>(0);
+  limits.last_packet_reduction_len = fuzz_input.ReadOrDefaultValue<uint8_t>(0);
+  limits.single_packet_reduction_len =
+      fuzz_input.ReadOrDefaultValue<uint8_t>(0);
+  const VideoFrameType kFrameTypes[] = {VideoFrameType::kVideoFrameKey,
+                                        VideoFrameType::kVideoFrameDelta};
+  VideoFrameType frame_type = fuzz_input.SelectOneOf(kFrameTypes);
+
+  // Main function under test: RtpPacketizerAv1's constructor.
+  RtpPacketizerAv1 packetizer(fuzz_input.ReadByteArray(fuzz_input.BytesLeft()),
+                              limits, frame_type,
+                              /*is_last_frame_in_picture=*/true);
+
+  size_t num_packets = packetizer.NumPackets();
+  if (num_packets == 0) {
+    return;
+  }
+  // When packetization was successful, validate NextPacket function too.
+  // While at it, check that packets respect the payload size limits.
+  RtpPacketToSend rtp_packet(nullptr);
+  // Single packet.
+  if (num_packets == 1) {
+    RTC_CHECK(packetizer.NextPacket(&rtp_packet));
+    RTC_CHECK_LE(rtp_packet.payload_size(),
+                 limits.max_payload_len - limits.single_packet_reduction_len);
+    return;
+  }
+  // First packet.
+  RTC_CHECK(packetizer.NextPacket(&rtp_packet));
+  RTC_CHECK_LE(rtp_packet.payload_size(),
+               limits.max_payload_len - limits.first_packet_reduction_len);
+  // Middle packets.
+  for (size_t i = 1; i < num_packets - 1; ++i) {
+    RTC_CHECK(packetizer.NextPacket(&rtp_packet))
+        << "Failed to get packet#" << i;
+    RTC_CHECK_LE(rtp_packet.payload_size(), limits.max_payload_len)
+        << "Packet #" << i << " exceeds it's limit";
+  }
+  // Last packet.
+  RTC_CHECK(packetizer.NextPacket(&rtp_packet));
+  RTC_CHECK_LE(rtp_packet.payload_size(),
+               limits.max_payload_len - limits.last_packet_reduction_len);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc
new file mode 100644
index 0000000000..6ab6b9a905
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (c) 2023 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+
+#include "api/video/rtp_video_frame_assembler.h"
+#include "modules/rtp_rtcp/include/rtp_header_extension_map.h"
+#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h"
+#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size == 0) {
+    return;
+  }
+  RtpHeaderExtensionMap extensions;
+  extensions.Register<RtpDependencyDescriptorExtension>(1);
+  extensions.Register<RtpGenericFrameDescriptorExtension00>(2);
+  RtpPacketReceived rtp_packet(&extensions);
+
+  RtpVideoFrameAssembler assembler(
+      static_cast<RtpVideoFrameAssembler::PayloadFormat>(data[0] % 6));
+
+  for (size_t i = 1; i < size;) {
+    size_t packet_size = std::min<size_t>(size - i, 300);
+    if (rtp_packet.Parse(data + i, packet_size)) {
+      assembler.InsertPacket(rtp_packet);
+    }
+    i += packet_size;
+  }
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc
new file mode 100644
index 0000000000..ae8b8728fb
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc
@@ -0,0 +1,64 @@
+/*
+ *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+
+#include "api/array_view.h"
+#include "api/video/video_layers_allocation.h"
+#include "modules/rtp_rtcp/source/rtp_video_layers_allocation_extension.h"
+#include "rtc_base/checks.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  // Video layers allocation is an rtp header extension.
+  // Per https://datatracker.ietf.org/doc/html/rfc8285#section-4.3
+  // rtp header extension uses up to one byte to store the size, i.e.
+  // maximum size of any rtp header extension is 255 bytes.
+  constexpr int kMaxSize = std::numeric_limits<uint8_t>::max();
+  if (size > kMaxSize) {
+    return;
+  }
+  auto raw = rtc::MakeArrayView(data, size);
+
+  VideoLayersAllocation allocation1;
+  if (!RtpVideoLayersAllocationExtension::Parse(raw, &allocation1)) {
+    // Ignore invalid buffer and move on.
+    return;
+  }
+
+  // Write parsed allocation back into raw buffer.
+  size_t value_size = RtpVideoLayersAllocationExtension::ValueSize(allocation1);
+  // Check `writer` use minimal number of bytes to pack the extension by
+  // checking it doesn't use more than reader consumed.
+  RTC_CHECK_LE(value_size, raw.size());
+  uint8_t some_memory[kMaxSize];
+  RTC_CHECK_LE(value_size, kMaxSize);
+  rtc::ArrayView<uint8_t> write_buffer(some_memory, value_size);
+  RTC_CHECK(
+      RtpVideoLayersAllocationExtension::Write(write_buffer, allocation1));
+
+  // Parse what Write assembled.
+  // Unlike random input that should always succeed.
+  VideoLayersAllocation allocation2;
+  RTC_CHECK(
+      RtpVideoLayersAllocationExtension::Parse(write_buffer, &allocation2));
+
+  RTC_CHECK_EQ(allocation1.rtp_stream_index, allocation2.rtp_stream_index);
+  RTC_CHECK_EQ(allocation1.resolution_and_frame_rate_is_valid,
+               allocation2.resolution_and_frame_rate_is_valid);
+  RTC_CHECK_EQ(allocation1.active_spatial_layers.size(),
+               allocation2.active_spatial_layers.size());
+  RTC_CHECK(allocation1 == allocation2);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc
new file mode 100644
index 0000000000..249707514e
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc
@@ -0,0 +1,31 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "api/data_channel_interface.h"
+#include "pc/sctp_utils.h"
+#include "rtc_base/copy_on_write_buffer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  rtc::CopyOnWriteBuffer payload(data, size);
+  std::string label;
+  DataChannelInit config;
+  IsOpenMessage(payload);
+  ParseDataChannelOpenMessage(payload, &label, &config);
+  ParseDataChannelOpenAckMessage(payload);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc
new file mode 100644
index 0000000000..ece4b50505
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc
@@ -0,0 +1,66 @@
+/*
+ *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "absl/strings/string_view.h"
+#include "pc/test/integration_test_helpers.h"
+
+namespace webrtc {
+
+class FuzzerTest : public PeerConnectionIntegrationBaseTest {
+ public:
+  FuzzerTest()
+      : PeerConnectionIntegrationBaseTest(SdpSemantics::kUnifiedPlan) {}
+
+  void RunNegotiateCycle(absl::string_view message) {
+    CreatePeerConnectionWrappers();
+    // Note - we do not do test.ConnectFakeSignaling(); all signals
+    // generated are discarded.
+
+    auto srd_observer =
+        rtc::make_ref_counted<FakeSetRemoteDescriptionObserver>();
+
+    SdpParseError error;
+    std::unique_ptr<SessionDescriptionInterface> sdp(
+        CreateSessionDescription("offer", std::string(message), &error));
+    caller()->pc()->SetRemoteDescription(std::move(sdp), srd_observer);
+    // Wait a short time for observer to be called. Timeout is short
+    // because the fuzzer should be trying many branches.
+    EXPECT_TRUE_WAIT(srd_observer->called(), 100);
+
+    // If set-remote-description was successful, try to answer.
+    auto sld_observer =
+        rtc::make_ref_counted<FakeSetLocalDescriptionObserver>();
+    if (srd_observer->error().ok()) {
+      caller()->pc()->SetLocalDescription(sld_observer);
+      EXPECT_TRUE_WAIT(sld_observer->called(), 100);
+    }
+    // If there is an EXPECT failure, die here.
+    RTC_CHECK(!HasFailure());
+  }
+
+  // This test isn't using the test definition macros, so we have to
+  // define the TestBody() function, even though we don't need it.
+  void TestBody() override {}
+};
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 16384) {
+    return;
+  }
+
+  FuzzerTest test;
+  test.RunNegotiateCycle(
+      absl::string_view(reinterpret_cast<const char*>(data), size));
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc
new file mode 100644
index 0000000000..c85eab4047
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc
@@ -0,0 +1,28 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/jsep_session_description.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size > 16384) {
+    return;
+  }
+  std::string message(reinterpret_cast<const char*>(data), size);
+  webrtc::SdpParseError error;
+
+  std::unique_ptr<webrtc::SessionDescriptionInterface> sdp(
+      CreateSessionDescription("offer", message, &error));
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc
new file mode 100644
index 0000000000..4bab5c8f02
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc
@@ -0,0 +1,49 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "rtc_base/message_digest.h"
+#include "rtc_base/ssl_certificate.h"
+#include "rtc_base/string_encode.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  std::string pem_certificate(reinterpret_cast<const char*>(data), size);
+
+  std::unique_ptr<rtc::SSLCertificate> cert =
+      rtc::SSLCertificate::FromPEMString(pem_certificate);
+
+  if (cert == nullptr) {
+    return;
+  }
+
+  cert->Clone();
+  cert->GetStats();
+  cert->ToPEMString();
+  cert->CertificateExpirationTime();
+
+  std::string algorithm;
+  cert->GetSignatureDigestAlgorithm(&algorithm);
+
+  unsigned char digest[rtc::MessageDigest::kMaxSize];
+  size_t digest_len;
+  cert->ComputeDigest(algorithm, digest, rtc::MessageDigest::kMaxSize,
+                      &digest_len);
+
+  rtc::Buffer der_buffer;
+  cert->ToDER(&der_buffer);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc
new file mode 100644
index 0000000000..28b36a73ce
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc
@@ -0,0 +1,35 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "rtc_base/string_to_number.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  std::string number_to_parse(reinterpret_cast<const char*>(data), size);
+  rtc::StringToNumber<int8_t>(number_to_parse);
+  rtc::StringToNumber<int16_t>(number_to_parse);
+  rtc::StringToNumber<int32_t>(number_to_parse);
+  rtc::StringToNumber<int64_t>(number_to_parse);
+  rtc::StringToNumber<uint8_t>(number_to_parse);
+  rtc::StringToNumber<uint16_t>(number_to_parse);
+  rtc::StringToNumber<uint32_t>(number_to_parse);
+  rtc::StringToNumber<uint64_t>(number_to_parse);
+  rtc::StringToNumber<float>(number_to_parse);
+  rtc::StringToNumber<double>(number_to_parse);
+  rtc::StringToNumber<long double>(number_to_parse);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc
new file mode 100644
index 0000000000..6ca9eac8b2
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc
@@ -0,0 +1,29 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/transport/stun.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  const char* message = reinterpret_cast<const char*>(data);
+
+  // Normally we'd check the integrity first, but those checks are
+  // fuzzed separately in stun_validator_fuzzer.cc. We still want to
+  // fuzz this target since the integrity checks could be forged by a
+  // malicious adversary who receives a call.
+  std::unique_ptr<cricket::IceMessage> stun_msg(new cricket::IceMessage());
+  rtc::ByteBufferReader buf(message, size);
+  stun_msg->Read(&buf);
+  stun_msg->ValidateMessageIntegrity("");
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc
new file mode 100644
index 0000000000..421638db1b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc
@@ -0,0 +1,23 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "api/transport/stun.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  const char* message = reinterpret_cast<const char*>(data);
+
+  cricket::StunMessage::ValidateFingerprint(message, size);
+  cricket::StunMessage::ValidateMessageIntegrityForTesting(message, size, "");
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc
new file mode 100644
index 0000000000..47ee7fd205
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc
@@ -0,0 +1,22 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "media/base/turn_utils.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  size_t content_position;
+  size_t content_size;
+  cricket::UnwrapTurnPacket(data, size, &content_position, &content_size);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc
new file mode 100644
index 0000000000..43d9450918
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <memory>
+
+#include "modules/include/module_common_types_public.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/fec_test_helper.h"
+#include "modules/rtp_rtcp/source/ulpfec_generator.h"
+#include "rtc_base/checks.h"
+#include "rtc_base/copy_on_write_buffer.h"
+#include "system_wrappers/include/clock.h"
+
+namespace webrtc {
+
+namespace {
+constexpr uint8_t kFecPayloadType = 96;
+constexpr uint8_t kRedPayloadType = 97;
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  SimulatedClock clock(1);
+  UlpfecGenerator generator(kRedPayloadType, kFecPayloadType, &clock);
+  size_t i = 0;
+  if (size < 4)
+    return;
+  FecProtectionParams params = {
+      data[i++] % 128, static_cast<int>(data[i++] % 10), kFecMaskBursty};
+  generator.SetProtectionParameters(params, params);
+  uint16_t seq_num = data[i++];
+  uint16_t prev_seq_num = 0;
+  while (i + 3 < size) {
+    size_t rtp_header_length = data[i++] % 10 + 12;
+    size_t payload_size = data[i++] % 10;
+    if (i + payload_size + rtp_header_length + 2 > size)
+      break;
+    rtc::CopyOnWriteBuffer packet(&data[i], payload_size + rtp_header_length);
+    packet.EnsureCapacity(IP_PACKET_SIZE);
+    // Write a valid parsable header (version = 2, no padding, no extensions,
+    // no CSRCs).
+    ByteWriter<uint8_t>::WriteBigEndian(packet.MutableData(), 2 << 6);
+    // Make sure sequence numbers are increasing.
+    ByteWriter<uint16_t>::WriteBigEndian(packet.MutableData() + 2, seq_num++);
+    i += payload_size + rtp_header_length;
+    const bool protect = data[i++] % 2 == 1;
+
+    // Check the sequence numbers are monotonic. In rare case the packets number
+    // may loop around and in the same FEC-protected group the packet sequence
+    // number became out of order.
+    if (protect && IsNewerSequenceNumber(seq_num, prev_seq_num) &&
+        seq_num < prev_seq_num + kUlpfecMaxMediaPackets) {
+      RtpPacketToSend rtp_packet(nullptr);
+      // Check that we actually have a parsable packet, we want to fuzz FEC
+      // logic, not RTP header parsing.
+      RTC_CHECK(rtp_packet.Parse(packet));
+      generator.AddPacketAndGenerateFec(rtp_packet);
+      prev_seq_num = seq_num;
+    }
+
+    generator.GetFecPackets();
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc
new file mode 100644
index 0000000000..243cb4ed70
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "api/scoped_refptr.h"
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/forward_error_correction.h"
+#include "modules/rtp_rtcp/source/ulpfec_header_reader_writer.h"
+
+namespace webrtc {
+
+using Packet = ForwardErrorCorrection::Packet;
+using ReceivedFecPacket = ForwardErrorCorrection::ReceivedFecPacket;
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  ReceivedFecPacket packet;
+  packet.pkt = rtc::scoped_refptr<Packet>(new Packet());
+  const size_t packet_size =
+      std::min(size, static_cast<size_t>(IP_PACKET_SIZE));
+  packet.pkt->data.SetSize(packet_size);
+  packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE);
+  memcpy(packet.pkt->data.MutableData(), data, packet_size);
+
+  UlpfecHeaderReader ulpfec_reader;
+  ulpfec_reader.ReadFecHeader(&packet);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc
new file mode 100644
index 0000000000..0a29ba3259
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "modules/rtp_rtcp/source/byte_io.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+#include "modules/rtp_rtcp/source/ulpfec_receiver.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+namespace webrtc {
+
+namespace {
+class DummyCallback : public RecoveredPacketReceiver {
+  void OnRecoveredPacket(const RtpPacketReceived& packet) override {}
+};
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  constexpr size_t kMinDataNeeded = 12;
+  if (size < kMinDataNeeded || size > 2000) {
+    return;
+  }
+
+  uint32_t ulpfec_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 0);
+  uint16_t ulpfec_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 4);
+  uint32_t media_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 6);
+  uint16_t media_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 10);
+
+  DummyCallback callback;
+  UlpfecReceiver receiver(ulpfec_ssrc, 0, &callback, Clock::GetRealTimeClock());
+
+  test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size));
+  while (fuzz_data.CanReadBytes(kMinDataNeeded)) {
+    size_t packet_length = kRtpHeaderSize + fuzz_data.Read<uint8_t>();
+    auto raw_packet = fuzz_data.ReadByteArray(packet_length);
+
+    RtpPacketReceived parsed_packet;
+    if (!parsed_packet.Parse(raw_packet))
+      continue;
+
+    // Overwrite the fields for the sequence number and SSRC with
+    // consistent values for either a received UlpFEC packet or received media
+    // packet. (We're still relying on libfuzzer to manage to generate packet
+    // headers that interact together; this just ensures that we have two
+    // consistent streams).
+    if (fuzz_data.ReadOrDefaultValue<uint8_t>(0) % 2 == 0) {
+      // Simulate UlpFEC packet.
+      parsed_packet.SetSequenceNumber(ulpfec_seq_num++);
+      parsed_packet.SetSsrc(ulpfec_ssrc);
+    } else {
+      // Simulate media packet.
+      parsed_packet.SetSequenceNumber(media_seq_num++);
+      parsed_packet.SetSsrc(media_ssrc);
+    }
+
+    receiver.AddReceivedRedPacket(parsed_packet);
+  }
+
+  receiver.ProcessReceivedFec();
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn b/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn
new file mode 100644
index 0000000000..c5744fc33b
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn
@@ -0,0 +1,47 @@
+# Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+#
+# Use of this source code is governed by a BSD-style license
+# that can be found in the LICENSE file in the root of the source
+# tree. An additional intellectual property rights grant can be found
+# in the file PATENTS.  All contributing project authors may
+# be found in the AUTHORS file in the root of the source tree.
+
+import("../../../webrtc.gni")
+
+rtc_library("rtp_replayer") {
+  testonly = true
+  sources = [
+    "rtp_replayer.cc",
+    "rtp_replayer.h",
+  ]
+  deps = [
+    "../../../api/rtc_event_log",
+    "../../../api/task_queue:default_task_queue_factory",
+    "../../../api/test/video:function_video_factory",
+    "../../../api/transport:field_trial_based_config",
+    "../../../api/units:timestamp",
+    "../../../api/video_codecs:video_codecs_api",
+    "../../../call",
+    "../../../call:call_interfaces",
+    "../../../common_video",
+    "../../../media:rtc_internal_video_codecs",
+    "../../../modules/rtp_rtcp:rtp_rtcp_format",
+    "../../../rtc_base:checks",
+    "../../../rtc_base:rtc_base_tests_utils",
+    "../../../rtc_base:rtc_json",
+    "../../../rtc_base:timeutils",
+    "../../../system_wrappers",
+    "../../../test:call_config_utils",
+    "../../../test:encoder_settings",
+    "../../../test:fake_video_codecs",
+    "../../../test:null_transport",
+    "../../../test:rtp_test_utils",
+    "../../../test:run_loop",
+    "../../../test:run_test",
+    "../../../test:run_test_interface",
+    "../../../test:test_renderer",
+    "../../../test:test_support",
+    "../../../test:video_test_common",
+  ]
+  absl_deps = [ "//third_party/abseil-cpp/absl/memory:memory" ]
+}
diff --git a/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc
new file mode 100644
index 0000000000..12743d89d9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc
@@ -0,0 +1,200 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "test/fuzzers/utils/rtp_replayer.h"
+
+#include <algorithm>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "absl/memory/memory.h"
+#include "api/task_queue/default_task_queue_factory.h"
+#include "api/transport/field_trial_based_config.h"
+#include "api/units/timestamp.h"
+#include "modules/rtp_rtcp/source/rtp_packet.h"
+#include "modules/rtp_rtcp/source/rtp_packet_received.h"
+#include "rtc_base/strings/json.h"
+#include "system_wrappers/include/clock.h"
+#include "test/call_config_utils.h"
+#include "test/encoder_settings.h"
+#include "test/fake_decoder.h"
+#include "test/rtp_file_reader.h"
+#include "test/run_loop.h"
+
+namespace webrtc {
+namespace test {
+
+void RtpReplayer::Replay(const std::string& replay_config_filepath,
+                         const uint8_t* rtp_dump_data,
+                         size_t rtp_dump_size) {
+  auto stream_state = std::make_unique<StreamState>();
+  std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs =
+      ReadConfigFromFile(replay_config_filepath, &(stream_state->transport));
+  return Replay(std::move(stream_state), std::move(receive_stream_configs),
+                rtp_dump_data, rtp_dump_size);
+}
+
+void RtpReplayer::Replay(
+    std::unique_ptr<StreamState> stream_state,
+    std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs,
+    const uint8_t* rtp_dump_data,
+    size_t rtp_dump_size) {
+  RunLoop loop;
+  rtc::ScopedBaseFakeClock fake_clock;
+
+  // Work around: webrtc calls webrtc::Random(clock.TimeInMicroseconds())
+  // everywhere and Random expects non-zero seed. Let's set the clock non-zero
+  // to make them happy.
+  fake_clock.SetTime(webrtc::Timestamp::Millis(1));
+
+  // Attempt to create an RtpReader from the input file.
+  auto rtp_reader = CreateRtpReader(rtp_dump_data, rtp_dump_size);
+  if (rtp_reader == nullptr) {
+    RTC_LOG(LS_ERROR) << "Failed to create the rtp_reader";
+    return;
+  }
+
+  RtpHeaderExtensionMap extensions(/*extmap_allow_mixed=*/true);
+  // Skip i = 0 since it maps to kRtpExtensionNone.
+  for (int i = 1; i < kRtpExtensionNumberOfExtensions; i++) {
+    RTPExtensionType extension_type = static_cast<RTPExtensionType>(i);
+    // Extensions are registered with an ID, which you signal to the
+    // peer so they know what to expect. This code only cares about
+    // parsing so the value of the ID isn't relevant.
+    extensions.RegisterByType(i, extension_type);
+  }
+
+  // Setup the video streams based on the configuration.
+  webrtc::RtcEventLogNull event_log;
+  std::unique_ptr<TaskQueueFactory> task_queue_factory =
+      CreateDefaultTaskQueueFactory();
+  Call::Config call_config(&event_log);
+  call_config.task_queue_factory = task_queue_factory.get();
+  FieldTrialBasedConfig field_trials;
+  call_config.trials = &field_trials;
+  std::unique_ptr<Call> call(Call::Create(call_config));
+  SetupVideoStreams(&receive_stream_configs, stream_state.get(), call.get());
+
+  // Start replaying the provided stream now that it has been configured.
+  for (const auto& receive_stream : stream_state->receive_streams) {
+    receive_stream->Start();
+  }
+
+  ReplayPackets(&fake_clock, call.get(), rtp_reader.get(), extensions);
+
+  for (const auto& receive_stream : stream_state->receive_streams) {
+    call->DestroyVideoReceiveStream(receive_stream);
+  }
+}
+
+std::vector<VideoReceiveStreamInterface::Config>
+RtpReplayer::ReadConfigFromFile(const std::string& replay_config,
+                                Transport* transport) {
+  Json::CharReaderBuilder factory;
+  std::unique_ptr<Json::CharReader> json_reader =
+      absl::WrapUnique(factory.newCharReader());
+  Json::Value json_configs;
+  Json::String errors;
+  if (!json_reader->parse(replay_config.data(),
+                          replay_config.data() + replay_config.length(),
+                          &json_configs, &errors)) {
+    RTC_LOG(LS_ERROR)
+        << "Error parsing JSON replay configuration for the fuzzer: " << errors;
+    return {};
+  }
+
+  std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs;
+  receive_stream_configs.reserve(json_configs.size());
+  for (const auto& json : json_configs) {
+    receive_stream_configs.push_back(
+        ParseVideoReceiveStreamJsonConfig(transport, json));
+  }
+  return receive_stream_configs;
+}
+
+void RtpReplayer::SetupVideoStreams(
+    std::vector<VideoReceiveStreamInterface::Config>* receive_stream_configs,
+    StreamState* stream_state,
+    Call* call) {
+  stream_state->decoder_factory = std::make_unique<InternalDecoderFactory>();
+  for (auto& receive_config : *receive_stream_configs) {
+    // Attach the decoder for the corresponding payload type in the config.
+    for (auto& decoder : receive_config.decoders) {
+      decoder = test::CreateMatchingDecoder(decoder.payload_type,
+                                            decoder.video_format.name);
+    }
+
+    // Create the window to display the rendered video.
+    stream_state->sinks.emplace_back(
+        test::VideoRenderer::Create("Fuzzing WebRTC Video Config", 640, 480));
+    // Create a receive stream for this config.
+    receive_config.renderer = stream_state->sinks.back().get();
+    receive_config.decoder_factory = stream_state->decoder_factory.get();
+    stream_state->receive_streams.emplace_back(
+        call->CreateVideoReceiveStream(std::move(receive_config)));
+  }
+}
+
+std::unique_ptr<test::RtpFileReader> RtpReplayer::CreateRtpReader(
+    const uint8_t* rtp_dump_data,
+    size_t rtp_dump_size) {
+  std::unique_ptr<test::RtpFileReader> rtp_reader(test::RtpFileReader::Create(
+      test::RtpFileReader::kRtpDump, rtp_dump_data, rtp_dump_size, {}));
+  if (!rtp_reader) {
+    RTC_LOG(LS_ERROR) << "Unable to open input file with any supported format";
+    return nullptr;
+  }
+  return rtp_reader;
+}
+
+void RtpReplayer::ReplayPackets(
+    rtc::FakeClock* clock,
+    Call* call,
+    test::RtpFileReader* rtp_reader,
+    const RtpPacketReceived::ExtensionManager& extensions) {
+  int64_t replay_start_ms = -1;
+
+  while (true) {
+    int64_t now_ms = rtc::TimeMillis();
+    if (replay_start_ms == -1) {
+      replay_start_ms = now_ms;
+    }
+
+    test::RtpPacket packet;
+    if (!rtp_reader->NextPacket(&packet)) {
+      break;
+    }
+
+    int64_t deliver_in_ms = replay_start_ms + packet.time_ms - now_ms;
+    if (deliver_in_ms > 0) {
+      // StatsCounter::ReportMetricToAggregatedCounter is O(elapsed time).
+      // Set an upper limit to prevent waste time.
+      clock->AdvanceTime(webrtc::TimeDelta::Millis(
+          std::min(deliver_in_ms, static_cast<int64_t>(100))));
+    }
+
+    RtpPacketReceived received_packet(
+        &extensions, Timestamp::Micros(clock->TimeNanos() / 1000));
+    if (!received_packet.Parse(packet.data, packet.length)) {
+      RTC_LOG(LS_ERROR) << "Packet error, corrupt packets or incorrect setup?";
+      break;
+    }
+
+    call->Receiver()->DeliverRtpPacket(
+        MediaType::VIDEO, std::move(received_packet),
+        [&](const RtpPacketReceived& parsed_packet) {
+          RTC_LOG(LS_ERROR) << "Unknown SSRC: " << parsed_packet.Ssrc();
+          return false;
+        });
+  }
+}
+}  // namespace test
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h
new file mode 100644
index 0000000000..ae94a640a5
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h
@@ -0,0 +1,92 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef TEST_FUZZERS_UTILS_RTP_REPLAYER_H_
+#define TEST_FUZZERS_UTILS_RTP_REPLAYER_H_
+
+#include <stdio.h>
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "api/rtc_event_log/rtc_event_log.h"
+#include "api/test/video/function_video_decoder_factory.h"
+#include "api/video_codecs/video_decoder.h"
+#include "call/call.h"
+#include "media/engine/internal_decoder_factory.h"
+#include "rtc_base/fake_clock.h"
+#include "rtc_base/time_utils.h"
+#include "test/null_transport.h"
+#include "test/rtp_file_reader.h"
+#include "test/test_video_capturer.h"
+#include "test/video_renderer.h"
+
+namespace webrtc {
+namespace test {
+
+// The RtpReplayer is a utility for fuzzing the RTP/RTCP receiver stack in
+// WebRTC. It achieves this by accepting a set of Receiver configurations and
+// an RtpDump (consisting of both RTP and RTCP packets). The `rtp_dump` is
+// passed in as a buffer to allow simple mutation fuzzing directly on the dump.
+class RtpReplayer final {
+ public:
+  // Holds all the important stream information required to emulate the WebRTC
+  // rtp receival code path.
+  struct StreamState {
+    test::NullTransport transport;
+    std::vector<std::unique_ptr<rtc::VideoSinkInterface<VideoFrame>>> sinks;
+    std::vector<VideoReceiveStreamInterface*> receive_streams;
+    std::unique_ptr<VideoDecoderFactory> decoder_factory;
+  };
+
+  // Construct an RtpReplayer from a JSON replay configuration file.
+  static void Replay(const std::string& replay_config_filepath,
+                     const uint8_t* rtp_dump_data,
+                     size_t rtp_dump_size);
+
+  // Construct an RtpReplayer from  a set of
+  // VideoReceiveStreamInterface::Configs. Note the stream_state.transport must
+  // be set for each receiver stream.
+  static void Replay(
+      std::unique_ptr<StreamState> stream_state,
+      std::vector<VideoReceiveStreamInterface::Config> receive_stream_config,
+      const uint8_t* rtp_dump_data,
+      size_t rtp_dump_size);
+
+ private:
+  // Reads the replay configuration from Json.
+  static std::vector<VideoReceiveStreamInterface::Config> ReadConfigFromFile(
+      const std::string& replay_config,
+      Transport* transport);
+
+  // Configures the stream state based on the receiver configurations.
+  static void SetupVideoStreams(
+      std::vector<VideoReceiveStreamInterface::Config>* receive_stream_configs,
+      StreamState* stream_state,
+      Call* call);
+
+  // Creates a new RtpReader which can read the RtpDump
+  static std::unique_ptr<test::RtpFileReader> CreateRtpReader(
+      const uint8_t* rtp_dump_data,
+      size_t rtp_dump_size);
+
+  // Replays each packet to from the RtpDump.
+  static void ReplayPackets(rtc::FakeClock* clock,
+                            Call* call,
+                            test::RtpFileReader* rtp_reader,
+                            const RtpHeaderExtensionMap& extensions);
+};  // class RtpReplayer
+
+}  // namespace test
+}  // namespace webrtc
+
+#endif  // TEST_FUZZERS_UTILS_RTP_REPLAYER_H_
diff --git a/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc
new file mode 100644
index 0000000000..1691b55cc0
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc
@@ -0,0 +1,20 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "api/array_view.h"
+#include "modules/rtp_rtcp/source/rtp_video_header.h"
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_vp8.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  RTPVideoHeader video_header;
+  VideoRtpDepacketizerVp8::ParseRtpPayload(rtc::MakeArrayView(data, size),
+                                           &video_header);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc
new file mode 100644
index 0000000000..2ecfd820c8
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc
@@ -0,0 +1,17 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "modules/video_coding/utility/vp8_header_parser.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  int qp;
+  vp8::GetQp(data, size, &qp);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc
new file mode 100644
index 0000000000..819b9626f9
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+
+#include "test/fuzzers/utils/rtp_replayer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  auto stream_state = std::make_unique<test::RtpReplayer::StreamState>();
+  VideoReceiveStreamInterface::Config vp8_config(&(stream_state->transport));
+
+  VideoReceiveStreamInterface::Decoder vp8_decoder;
+  vp8_decoder.video_format = SdpVideoFormat("VP8");
+  vp8_decoder.payload_type = 125;
+  vp8_config.decoders.push_back(std::move(vp8_decoder));
+
+  vp8_config.rtp.local_ssrc = 7731;
+  vp8_config.rtp.remote_ssrc = 1337;
+  vp8_config.rtp.rtx_ssrc = 100;
+  vp8_config.rtp.nack.rtp_history_ms = 1000;
+  vp8_config.rtp.lntf.enabled = true;
+
+  std::vector<VideoReceiveStreamInterface::Config> replay_configs;
+  replay_configs.push_back(std::move(vp8_config));
+
+  test::RtpReplayer::Replay(std::move(stream_state), std::move(replay_configs),
+                            data, size);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc
new file mode 100644
index 0000000000..ae36a94931
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc
@@ -0,0 +1,20 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+#include "api/array_view.h"
+#include "modules/rtp_rtcp/source/rtp_video_header.h"
+#include "modules/rtp_rtcp/source/video_rtp_depacketizer_vp9.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  RTPVideoHeader video_header;
+  VideoRtpDepacketizerVp9::ParseRtpPayload(rtc::MakeArrayView(data, size),
+                                           &video_header);
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc
new file mode 100644
index 0000000000..09848ae4de
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc
@@ -0,0 +1,624 @@
+/*
+ *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stdint.h>
+
+#include "absl/algorithm/container.h"
+#include "absl/base/macros.h"
+#include "absl/container/inlined_vector.h"
+#include "api/array_view.h"
+#include "api/field_trials_view.h"
+#include "api/video/video_frame.h"
+#include "api/video_codecs/video_codec.h"
+#include "api/video_codecs/video_encoder.h"
+#include "modules/video_coding/codecs/interface/libvpx_interface.h"
+#include "modules/video_coding/codecs/vp9/libvpx_vp9_encoder.h"
+#include "modules/video_coding/frame_dependencies_calculator.h"
+#include "rtc_base/numerics/safe_compare.h"
+#include "test/fuzzers/fuzz_data_helper.h"
+
+// Fuzzer simulates various svc configurations and libvpx encoder dropping
+// layer frames.
+// Validates vp9 encoder wrapper produces consistent frame references.
+namespace webrtc {
+namespace {
+
+using test::FuzzDataHelper;
+
+constexpr int kBitrateEnabledBps = 100'000;
+
+class FrameValidator : public EncodedImageCallback {
+ public:
+  ~FrameValidator() override = default;
+
+  Result OnEncodedImage(const EncodedImage& encoded_image,
+                        const CodecSpecificInfo* codec_specific_info) override {
+    RTC_CHECK(codec_specific_info);
+    RTC_CHECK_EQ(codec_specific_info->codecType, kVideoCodecVP9);
+    if (codec_specific_info->codecSpecific.VP9.first_frame_in_picture) {
+      ++picture_id_;
+    }
+    int64_t frame_id = frame_id_++;
+    LayerFrame& layer_frame = frames_[frame_id % kMaxFrameHistorySize];
+    layer_frame.picture_id = picture_id_;
+    layer_frame.spatial_id = encoded_image.SpatialIndex().value_or(0);
+    layer_frame.frame_id = frame_id;
+    layer_frame.temporal_id =
+        codec_specific_info->codecSpecific.VP9.temporal_idx;
+    if (layer_frame.temporal_id == kNoTemporalIdx) {
+      layer_frame.temporal_id = 0;
+    }
+    layer_frame.vp9_non_ref_for_inter_layer_pred =
+        codec_specific_info->codecSpecific.VP9.non_ref_for_inter_layer_pred;
+    CheckVp9References(layer_frame, codec_specific_info->codecSpecific.VP9);
+
+    if (codec_specific_info->generic_frame_info.has_value()) {
+      absl::InlinedVector<int64_t, 5> frame_dependencies =
+          dependencies_calculator_.FromBuffersUsage(
+              frame_id,
+              codec_specific_info->generic_frame_info->encoder_buffers);
+
+      CheckGenericReferences(frame_dependencies,
+                             *codec_specific_info->generic_frame_info);
+      CheckGenericAndCodecSpecificReferencesAreConsistent(
+          frame_dependencies, *codec_specific_info, layer_frame);
+    }
+
+    return Result(Result::OK);
+  }
+
+ private:
+  // With 4 spatial layers and patterns up to 8 pictures, it should be enough to
+  // keep the last 32 frames to validate dependencies.
+  static constexpr size_t kMaxFrameHistorySize = 32;
+  struct LayerFrame {
+    int64_t frame_id;
+    int64_t picture_id;
+    int spatial_id;
+    int temporal_id;
+    bool vp9_non_ref_for_inter_layer_pred;
+  };
+
+  void CheckVp9References(const LayerFrame& layer_frame,
+                          const CodecSpecificInfoVP9& vp9_info) {
+    if (layer_frame.frame_id == 0) {
+      RTC_CHECK(!vp9_info.inter_layer_predicted);
+    } else {
+      const LayerFrame& previous_frame = Frame(layer_frame.frame_id - 1);
+      if (vp9_info.inter_layer_predicted) {
+        RTC_CHECK(!previous_frame.vp9_non_ref_for_inter_layer_pred);
+        RTC_CHECK_EQ(layer_frame.picture_id, previous_frame.picture_id);
+      }
+      if (previous_frame.picture_id == layer_frame.picture_id) {
+        RTC_CHECK_GT(layer_frame.spatial_id, previous_frame.spatial_id);
+        // The check below would fail for temporal shift structures. Remove it
+        // or move it to !flexible_mode section when vp9 encoder starts
+        // supporting such structures.
+        RTC_CHECK_EQ(layer_frame.temporal_id, previous_frame.temporal_id);
+      }
+    }
+    if (!vp9_info.flexible_mode) {
+      if (vp9_info.gof.num_frames_in_gof > 0) {
+        gof_.CopyGofInfoVP9(vp9_info.gof);
+      }
+      RTC_CHECK_EQ(gof_.temporal_idx[vp9_info.gof_idx],
+                   layer_frame.temporal_id);
+    }
+  }
+
+  void CheckGenericReferences(rtc::ArrayView<const int64_t> frame_dependencies,
+                              const GenericFrameInfo& generic_info) const {
+    for (int64_t dependency_frame_id : frame_dependencies) {
+      RTC_CHECK_GE(dependency_frame_id, 0);
+      const LayerFrame& dependency = Frame(dependency_frame_id);
+      RTC_CHECK_GE(generic_info.spatial_id, dependency.spatial_id);
+      RTC_CHECK_GE(generic_info.temporal_id, dependency.temporal_id);
+    }
+  }
+
+  void CheckGenericAndCodecSpecificReferencesAreConsistent(
+      rtc::ArrayView<const int64_t> frame_dependencies,
+      const CodecSpecificInfo& info,
+      const LayerFrame& layer_frame) const {
+    const CodecSpecificInfoVP9& vp9_info = info.codecSpecific.VP9;
+    const GenericFrameInfo& generic_info = *info.generic_frame_info;
+
+    RTC_CHECK_EQ(generic_info.spatial_id, layer_frame.spatial_id);
+    RTC_CHECK_EQ(generic_info.temporal_id, layer_frame.temporal_id);
+    auto picture_id_diffs =
+        rtc::MakeArrayView(vp9_info.p_diff, vp9_info.num_ref_pics);
+    RTC_CHECK_EQ(
+        frame_dependencies.size(),
+        picture_id_diffs.size() + (vp9_info.inter_layer_predicted ? 1 : 0));
+    for (int64_t dependency_frame_id : frame_dependencies) {
+      RTC_CHECK_GE(dependency_frame_id, 0);
+      const LayerFrame& dependency = Frame(dependency_frame_id);
+      if (dependency.spatial_id != layer_frame.spatial_id) {
+        RTC_CHECK(vp9_info.inter_layer_predicted);
+        RTC_CHECK_EQ(layer_frame.picture_id, dependency.picture_id);
+        RTC_CHECK_GT(layer_frame.spatial_id, dependency.spatial_id);
+      } else {
+        RTC_CHECK(vp9_info.inter_pic_predicted);
+        RTC_CHECK_EQ(layer_frame.spatial_id, dependency.spatial_id);
+        RTC_CHECK(absl::c_linear_search(
+            picture_id_diffs, layer_frame.picture_id - dependency.picture_id));
+      }
+    }
+  }
+
+  const LayerFrame& Frame(int64_t frame_id) const {
+    auto& frame = frames_[frame_id % kMaxFrameHistorySize];
+    RTC_CHECK_EQ(frame.frame_id, frame_id);
+    return frame;
+  }
+
+  GofInfoVP9 gof_;
+  int64_t frame_id_ = 0;
+  int64_t picture_id_ = 1;
+  FrameDependenciesCalculator dependencies_calculator_;
+  LayerFrame frames_[kMaxFrameHistorySize];
+};
+
+class FieldTrials : public FieldTrialsView {
+ public:
+  explicit FieldTrials(FuzzDataHelper& config)
+      : flags_(config.ReadOrDefaultValue<uint8_t>(0)) {}
+
+  ~FieldTrials() override = default;
+  std::string Lookup(absl::string_view key) const override {
+    static constexpr absl::string_view kBinaryFieldTrials[] = {
+        "WebRTC-Vp9ExternalRefCtrl",
+        "WebRTC-Vp9IssueKeyFrameOnLayerDeactivation",
+    };
+    for (size_t i = 0; i < ABSL_ARRAYSIZE(kBinaryFieldTrials); ++i) {
+      if (key == kBinaryFieldTrials[i]) {
+        return (flags_ & (1u << i)) ? "Enabled" : "Disabled";
+      }
+    }
+
+    // Ignore following field trials.
+    if (key == "WebRTC-CongestionWindow" ||
+        key == "WebRTC-UseBaseHeavyVP8TL3RateAllocation" ||
+        key == "WebRTC-SimulcastUpswitchHysteresisPercent" ||
+        key == "WebRTC-SimulcastScreenshareUpswitchHysteresisPercent" ||
+        key == "WebRTC-VideoRateControl" ||
+        key == "WebRTC-VP9-PerformanceFlags" ||
+        key == "WebRTC-VP9VariableFramerateScreenshare" ||
+        key == "WebRTC-VP9QualityScaler") {
+      return "";
+    }
+    // Crash when using unexpected field trial to decide if it should be fuzzed
+    // or have a constant value.
+    RTC_CHECK(false) << "Unfuzzed field trial " << key << "\n";
+  }
+
+ private:
+  const uint8_t flags_;
+};
+
+VideoCodec CodecSettings(FuzzDataHelper& rng) {
+  uint16_t config = rng.ReadOrDefaultValue<uint16_t>(0);
+  // Test up to to 4 spatial and 4 temporal layers.
+  int num_spatial_layers = 1 + (config & 0b11);
+  int num_temporal_layers = 1 + ((config >> 2) & 0b11);
+
+  VideoCodec codec_settings = {};
+  codec_settings.codecType = kVideoCodecVP9;
+  codec_settings.maxFramerate = 30;
+  codec_settings.width = 320 << (num_spatial_layers - 1);
+  codec_settings.height = 180 << (num_spatial_layers - 1);
+  if (num_spatial_layers > 1) {
+    for (int sid = 0; sid < num_spatial_layers; ++sid) {
+      SpatialLayer& spatial_layer = codec_settings.spatialLayers[sid];
+      codec_settings.width = 320 << sid;
+      codec_settings.height = 180 << sid;
+      spatial_layer.width = codec_settings.width;
+      spatial_layer.height = codec_settings.height;
+      spatial_layer.targetBitrate = kBitrateEnabledBps * num_temporal_layers;
+      spatial_layer.maxFramerate = codec_settings.maxFramerate;
+      spatial_layer.numberOfTemporalLayers = num_temporal_layers;
+    }
+  }
+  codec_settings.VP9()->numberOfSpatialLayers = num_spatial_layers;
+  codec_settings.VP9()->numberOfTemporalLayers = num_temporal_layers;
+  int inter_layer_pred = (config >> 4) & 0b11;
+  // There are only 3 valid values.
+  codec_settings.VP9()->interLayerPred = static_cast<InterLayerPredMode>(
+      inter_layer_pred < 3 ? inter_layer_pred : 0);
+  codec_settings.VP9()->flexibleMode = (config & (1u << 6)) != 0;
+  codec_settings.SetFrameDropEnabled((config & (1u << 7)) != 0);
+  codec_settings.mode = VideoCodecMode::kRealtimeVideo;
+  return codec_settings;
+}
+
+VideoEncoder::Settings EncoderSettings() {
+  return VideoEncoder::Settings(VideoEncoder::Capabilities(false),
+                                /*number_of_cores=*/1,
+                                /*max_payload_size=*/0);
+}
+
+bool IsSupported(int num_spatial_layers,
+                 int num_temporal_layers,
+                 const VideoBitrateAllocation& allocation) {
+  // VP9 encoder doesn't support certain configurations.
+  // BitrateAllocator shouldn't produce them.
+  if (allocation.get_sum_bps() == 0) {
+    // Ignore allocation that turns off all the layers.
+    // In such a case it is up to upper layer code not to call Encode.
+    return false;
+  }
+
+  for (int tid = 0; tid < num_temporal_layers; ++tid) {
+    int min_enabled_spatial_id = -1;
+    int max_enabled_spatial_id = -1;
+    int num_enabled_spatial_layers = 0;
+    for (int sid = 0; sid < num_spatial_layers; ++sid) {
+      if (allocation.GetBitrate(sid, tid) > 0) {
+        if (min_enabled_spatial_id == -1) {
+          min_enabled_spatial_id = sid;
+        }
+        max_enabled_spatial_id = sid;
+        ++num_enabled_spatial_layers;
+      }
+    }
+    if (num_enabled_spatial_layers == 0) {
+      // Each temporal layer should be enabled because skipping a full frame is
+      // not supported in non-flexible mode.
+      return false;
+    }
+    if (max_enabled_spatial_id - min_enabled_spatial_id + 1 !=
+        num_enabled_spatial_layers) {
+      // To avoid odd spatial dependencies, there should be no gaps in active
+      // spatial layers.
+      return false;
+    }
+  }
+
+  return true;
+}
+
+struct LibvpxState {
+  LibvpxState() {
+    pkt.kind = VPX_CODEC_CX_FRAME_PKT;
+    pkt.data.frame.buf = pkt_buffer;
+    pkt.data.frame.sz = ABSL_ARRAYSIZE(pkt_buffer);
+    layer_id.spatial_layer_id = -1;
+  }
+
+  uint8_t pkt_buffer[1000] = {};
+  vpx_codec_enc_cfg_t config = {};
+  vpx_codec_priv_output_cx_pkt_cb_pair_t callback = {};
+  vpx_image_t img = {};
+  vpx_svc_ref_frame_config_t ref_config = {};
+  vpx_svc_layer_id_t layer_id = {};
+  vpx_svc_frame_drop_t frame_drop = {};
+  vpx_codec_cx_pkt pkt = {};
+};
+
+class StubLibvpx : public LibvpxInterface {
+ public:
+  explicit StubLibvpx(LibvpxState* state) : state_(state) { RTC_CHECK(state_); }
+
+  vpx_codec_err_t codec_enc_config_default(vpx_codec_iface_t* iface,
+                                           vpx_codec_enc_cfg_t* cfg,
+                                           unsigned int usage) const override {
+    state_->config = *cfg;
+    return VPX_CODEC_OK;
+  }
+
+  vpx_codec_err_t codec_enc_init(vpx_codec_ctx_t* ctx,
+                                 vpx_codec_iface_t* iface,
+                                 const vpx_codec_enc_cfg_t* cfg,
+                                 vpx_codec_flags_t flags) const override {
+    RTC_CHECK(ctx);
+    ctx->err = VPX_CODEC_OK;
+    return VPX_CODEC_OK;
+  }
+
+  vpx_image_t* img_wrap(vpx_image_t* img,
+                        vpx_img_fmt_t fmt,
+                        unsigned int d_w,
+                        unsigned int d_h,
+                        unsigned int stride_align,
+                        unsigned char* img_data) const override {
+    state_->img.fmt = fmt;
+    state_->img.d_w = d_w;
+    state_->img.d_h = d_h;
+    return &state_->img;
+  }
+
+  vpx_codec_err_t codec_encode(vpx_codec_ctx_t* ctx,
+                               const vpx_image_t* img,
+                               vpx_codec_pts_t pts,
+                               uint64_t duration,
+                               vpx_enc_frame_flags_t flags,
+                               uint64_t deadline) const override {
+    if (flags & VPX_EFLAG_FORCE_KF) {
+      state_->pkt.data.frame.flags = VPX_FRAME_IS_KEY;
+    } else {
+      state_->pkt.data.frame.flags = 0;
+    }
+    state_->pkt.data.frame.duration = duration;
+    return VPX_CODEC_OK;
+  }
+
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                void* param) const override {
+    if (ctrl_id == VP9E_REGISTER_CX_CALLBACK) {
+      state_->callback =
+          *reinterpret_cast<vpx_codec_priv_output_cx_pkt_cb_pair_t*>(param);
+    }
+    return VPX_CODEC_OK;
+  }
+
+  vpx_codec_err_t codec_control(
+      vpx_codec_ctx_t* ctx,
+      vp8e_enc_control_id ctrl_id,
+      vpx_svc_ref_frame_config_t* param) const override {
+    switch (ctrl_id) {
+      case VP9E_SET_SVC_REF_FRAME_CONFIG:
+        state_->ref_config = *param;
+        break;
+      case VP9E_GET_SVC_REF_FRAME_CONFIG:
+        *param = state_->ref_config;
+        break;
+      default:
+        break;
+    }
+    return VPX_CODEC_OK;
+  }
+
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_svc_layer_id_t* param) const override {
+    switch (ctrl_id) {
+      case VP9E_SET_SVC_LAYER_ID:
+        state_->layer_id = *param;
+        break;
+      case VP9E_GET_SVC_LAYER_ID:
+        *param = state_->layer_id;
+        break;
+      default:
+        break;
+    }
+    return VPX_CODEC_OK;
+  }
+
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_svc_frame_drop_t* param) const override {
+    if (ctrl_id == VP9E_SET_SVC_FRAME_DROP_LAYER) {
+      state_->frame_drop = *param;
+    }
+    return VPX_CODEC_OK;
+  }
+
+  vpx_codec_err_t codec_enc_config_set(
+      vpx_codec_ctx_t* ctx,
+      const vpx_codec_enc_cfg_t* cfg) const override {
+    state_->config = *cfg;
+    return VPX_CODEC_OK;
+  }
+
+  vpx_image_t* img_alloc(vpx_image_t* img,
+                         vpx_img_fmt_t fmt,
+                         unsigned int d_w,
+                         unsigned int d_h,
+                         unsigned int align) const override {
+    return nullptr;
+  }
+  void img_free(vpx_image_t* img) const override {}
+  vpx_codec_err_t codec_enc_init_multi(vpx_codec_ctx_t* ctx,
+                                       vpx_codec_iface_t* iface,
+                                       vpx_codec_enc_cfg_t* cfg,
+                                       int num_enc,
+                                       vpx_codec_flags_t flags,
+                                       vpx_rational_t* dsf) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_destroy(vpx_codec_ctx_t* ctx) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                uint32_t param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                int param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                int* param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_roi_map* param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_active_map* param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_scaling_mode* param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_svc_extra_cfg_t* param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(
+      vpx_codec_ctx_t* ctx,
+      vp8e_enc_control_id ctrl_id,
+      vpx_svc_spatial_layer_sync_t* param) const override {
+    return VPX_CODEC_OK;
+  }
+  vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx,
+                                vp8e_enc_control_id ctrl_id,
+                                vpx_rc_funcs_t* param) const override {
+    return VPX_CODEC_OK;
+  }
+  const vpx_codec_cx_pkt_t* codec_get_cx_data(
+      vpx_codec_ctx_t* ctx,
+      vpx_codec_iter_t* iter) const override {
+    return nullptr;
+  }
+  const char* codec_error_detail(vpx_codec_ctx_t* ctx) const override {
+    return nullptr;
+  }
+  const char* codec_error(vpx_codec_ctx_t* ctx) const override {
+    return nullptr;
+  }
+  const char* codec_err_to_string(vpx_codec_err_t err) const override {
+    return nullptr;
+  }
+
+ private:
+  LibvpxState* const state_;
+};
+
+enum Actions {
+  kEncode,
+  kSetRates,
+};
+
+// When a layer frame is marked for drop, drops all layer frames from that
+// pictures with larger spatial ids.
+constexpr bool DropAbove(uint8_t layers_mask, int sid) {
+  uint8_t full_mask = (uint8_t{1} << (sid + 1)) - 1;
+  return (layers_mask & full_mask) != full_mask;
+}
+// inline unittests
+static_assert(DropAbove(0b1011, /*sid=*/0) == false, "");
+static_assert(DropAbove(0b1011, /*sid=*/1) == false, "");
+static_assert(DropAbove(0b1011, /*sid=*/2) == true, "");
+static_assert(DropAbove(0b1011, /*sid=*/3) == true, "");
+
+// When a layer frame is marked for drop, drops all layer frames from that
+// pictures with smaller spatial ids.
+constexpr bool DropBelow(uint8_t layers_mask, int sid, int num_layers) {
+  return (layers_mask >> sid) != (1 << (num_layers - sid)) - 1;
+}
+// inline unittests
+static_assert(DropBelow(0b1101, /*sid=*/0, 4) == true, "");
+static_assert(DropBelow(0b1101, /*sid=*/1, 4) == true, "");
+static_assert(DropBelow(0b1101, /*sid=*/2, 4) == false, "");
+static_assert(DropBelow(0b1101, /*sid=*/3, 4) == false, "");
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  FuzzDataHelper helper(rtc::MakeArrayView(data, size));
+
+  FrameValidator validator;
+  FieldTrials field_trials(helper);
+  // Setup call callbacks for the fake
+  LibvpxState state;
+
+  // Initialize encoder
+  LibvpxVp9Encoder encoder(cricket::VideoCodec(),
+                           std::make_unique<StubLibvpx>(&state), field_trials);
+  VideoCodec codec = CodecSettings(helper);
+  if (encoder.InitEncode(&codec, EncoderSettings()) != WEBRTC_VIDEO_CODEC_OK) {
+    return;
+  }
+  RTC_CHECK_EQ(encoder.RegisterEncodeCompleteCallback(&validator),
+               WEBRTC_VIDEO_CODEC_OK);
+  {
+    // Enable all the layers initially. Encoder doesn't support producing
+    // frames when no layers are enabled.
+    LibvpxVp9Encoder::RateControlParameters parameters;
+    parameters.framerate_fps = 30.0;
+    for (int sid = 0; sid < codec.VP9()->numberOfSpatialLayers; ++sid) {
+      for (int tid = 0; tid < codec.VP9()->numberOfTemporalLayers; ++tid) {
+        parameters.bitrate.SetBitrate(sid, tid, kBitrateEnabledBps);
+      }
+    }
+    encoder.SetRates(parameters);
+  }
+
+  std::vector<VideoFrameType> frame_types(1);
+  VideoFrame fake_image = VideoFrame::Builder()
+                              .set_video_frame_buffer(I420Buffer::Create(
+                                  int{codec.width}, int{codec.height}))
+                              .build();
+
+  // Start producing frames at random.
+  while (helper.CanReadBytes(1)) {
+    uint8_t action = helper.Read<uint8_t>();
+    switch (action & 0b11) {
+      case kEncode: {
+        // bitmask of the action: SSSS-K00, where
+        // four S bit indicate which spatial layers should be produced,
+        // K bit indicates if frame should be a key frame.
+        frame_types[0] = (action & 0b100) ? VideoFrameType::kVideoFrameKey
+                                          : VideoFrameType::kVideoFrameDelta;
+        encoder.Encode(fake_image, &frame_types);
+        uint8_t encode_spatial_layers = (action >> 4);
+        for (size_t sid = 0; sid < state.config.ss_number_layers; ++sid) {
+          if (state.config.ss_target_bitrate[sid] == 0) {
+            // Don't encode disabled spatial layers.
+            continue;
+          }
+          bool drop = true;
+          switch (state.frame_drop.framedrop_mode) {
+            case FULL_SUPERFRAME_DROP:
+              drop = encode_spatial_layers == 0;
+              break;
+            case LAYER_DROP:
+              drop = (encode_spatial_layers & (1 << sid)) == 0;
+              break;
+            case CONSTRAINED_LAYER_DROP:
+              drop = DropBelow(encode_spatial_layers, sid,
+                               state.config.ss_number_layers);
+              break;
+            case CONSTRAINED_FROM_ABOVE_DROP:
+              drop = DropAbove(encode_spatial_layers, sid);
+              break;
+          }
+          if (!drop) {
+            state.layer_id.spatial_layer_id = sid;
+            state.callback.output_cx_pkt(&state.pkt, state.callback.user_priv);
+          }
+        }
+      } break;
+      case kSetRates: {
+        // bitmask of the action: (S2)(S1)(S0)01,
+        // where Sx is number of temporal layers to enable for spatial layer x
+        // In pariculat Sx = 0 indicates spatial layer x should be disabled.
+        LibvpxVp9Encoder::RateControlParameters parameters;
+        parameters.framerate_fps = 30.0;
+        for (int sid = 0; sid < codec.VP9()->numberOfSpatialLayers; ++sid) {
+          int temporal_layers = (action >> ((1 + sid) * 2)) & 0b11;
+          for (int tid = 0; tid < temporal_layers; ++tid) {
+            parameters.bitrate.SetBitrate(sid, tid, kBitrateEnabledBps);
+          }
+        }
+        if (IsSupported(codec.VP9()->numberOfSpatialLayers,
+                        codec.VP9()->numberOfTemporalLayers,
+                        parameters.bitrate)) {
+          encoder.SetRates(parameters);
+        }
+      } break;
+      default:
+        // Unspecificed values are noop.
+        break;
+    }
+  }
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc
new file mode 100644
index 0000000000..80dfe15b16
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc
@@ -0,0 +1,17 @@
+/*
+ *  Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "modules/video_coding/utility/vp9_uncompressed_header_parser.h"
+
+namespace webrtc {
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  ParseUncompressedVp9Header(rtc::MakeArrayView(data, size));
+}
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc
new file mode 100644
index 0000000000..fc10d9ffc7
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (c) 2019 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+
+#include "test/fuzzers/utils/rtp_replayer.h"
+
+namespace webrtc {
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  auto stream_state = std::make_unique<test::RtpReplayer::StreamState>();
+  VideoReceiveStreamInterface::Config vp9_config(&(stream_state->transport));
+
+  VideoReceiveStreamInterface::Decoder vp9_decoder;
+  vp9_decoder.video_format = SdpVideoFormat("VP9");
+  vp9_decoder.payload_type = 124;
+  vp9_config.decoders.push_back(std::move(vp9_decoder));
+
+  vp9_config.rtp.local_ssrc = 7731;
+  vp9_config.rtp.remote_ssrc = 1337;
+  vp9_config.rtp.rtx_ssrc = 100;
+  vp9_config.rtp.nack.rtp_history_ms = 1000;
+
+  std::vector<VideoReceiveStreamInterface::Config> replay_configs;
+  replay_configs.push_back(std::move(vp9_config));
+
+  test::RtpReplayer::Replay(std::move(stream_state), std::move(replay_configs),
+                            data, size);
+}
+
+}  // namespace webrtc
diff --git a/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc b/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc
new file mode 100644
index 0000000000..a52dd231be
--- /dev/null
+++ b/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+// This file is intended to provide a common interface for fuzzing functions.
+// It's intended to set sane defaults, such as removing logging for further
+// fuzzing efficiency.
+
+#include "rtc_base/logging.h"
+
+namespace {
+bool g_initialized = false;
+void InitializeWebRtcFuzzDefaults() {
+  if (g_initialized)
+    return;
+
+// Remove default logging to prevent huge slowdowns.
+// TODO(pbos): Disable in Chromium: http://crbug.com/561667
+#if !defined(WEBRTC_CHROMIUM_BUILD)
+  rtc::LogMessage::LogToDebug(rtc::LS_NONE);
+#endif  // !defined(WEBRTC_CHROMIUM_BUILD)
+
+  g_initialized = true;
+}
+}  // namespace
+
+namespace webrtc {
+extern void FuzzOneInput(const uint8_t* data, size_t size);
+}  // namespace webrtc
+
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size) {
+  InitializeWebRtcFuzzDefaults();
+  webrtc::FuzzOneInput(data, size);
+  return 0;
+}