diff options
Diffstat (limited to '')
323 files changed, 7273 insertions, 0 deletions
diff --git a/third_party/libwebrtc/test/fuzzers/BUILD.gn b/third_party/libwebrtc/test/fuzzers/BUILD.gn new file mode 100644 index 0000000000..c3576713ab --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/BUILD.gn @@ -0,0 +1,689 @@ +# Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. +# +# Use of this source code is governed by a BSD-style license +# that can be found in the LICENSE file in the root of the source +# tree. An additional intellectual property rights grant can be found +# in the file PATENTS. All contributing project authors may +# be found in the AUTHORS file in the root of the source tree. + +import("//build/config/features.gni") +import("//testing/libfuzzer/fuzzer_test.gni") +import("../../webrtc.gni") + +rtc_library("webrtc_fuzzer_main") { + sources = [ "webrtc_fuzzer_main.cc" ] + deps = [ + "../../rtc_base:logging", + "//testing/libfuzzer:libfuzzer_main", + ] + + # When WebRTC fuzzer tests are built on Chromium bots they need to link + # with Chromium's implementation of metrics, field trial, and system time. + if (build_with_chromium) { + deps += [ + "../../../webrtc_overrides:field_trial", + "../../../webrtc_overrides:metrics", + "../../../webrtc_overrides:system_time", + ] + } +} + +rtc_library("fuzz_data_helper") { + testonly = true + sources = [ + "fuzz_data_helper.cc", + "fuzz_data_helper.h", + ] + deps = [ + "../../api:array_view", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] + visibility = [ ":*" ] # Only targets in this file can depend on this. +} + +set_defaults("webrtc_fuzzer_test") { + configs = rtc_add_configs + absl_deps = [] +} + +template("webrtc_fuzzer_test") { + fuzzer_test(target_name) { + forward_variables_from(invoker, "*") + deps += [ + ":fuzz_data_helper", + ":webrtc_fuzzer_main", + ] + additional_configs = configs + + # If absl_deps is [], no action is needed. If not [], then it needs to be + # converted to //third_party/abseil-cpp:absl when build_with_chromium=true + # otherwise it just needs to be added to deps. + if (absl_deps != []) { + if (!defined(deps)) { + deps = [] + } + if (build_with_chromium) { + deps += [ "//third_party/abseil-cpp:absl" ] + } else { + deps += absl_deps + } + } + + if (!build_with_chromium && is_clang) { + suppressed_configs = [ "//build/config/clang:find_bad_constructs" ] + } + } +} + +webrtc_fuzzer_test("h264_depacketizer_fuzzer") { + sources = [ "h264_depacketizer_fuzzer.cc" ] + deps = [ "../../modules/rtp_rtcp" ] + seed_corpus = "corpora/h264-depacketizer-fuzzer-corpus" +} + +webrtc_fuzzer_test("vp8_depacketizer_fuzzer") { + sources = [ "vp8_depacketizer_fuzzer.cc" ] + deps = [ + "../../api:array_view", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_video_header", + ] +} + +webrtc_fuzzer_test("vp9_depacketizer_fuzzer") { + sources = [ "vp9_depacketizer_fuzzer.cc" ] + deps = [ + "../../api:array_view", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_video_header", + ] +} + +webrtc_fuzzer_test("vp8_qp_parser_fuzzer") { + sources = [ "vp8_qp_parser_fuzzer.cc" ] + deps = [ + "../../modules/video_coding:video_coding_utility", + "../../modules/video_coding/", + ] +} + +webrtc_fuzzer_test("vp9_qp_parser_fuzzer") { + sources = [ "vp9_qp_parser_fuzzer.cc" ] + deps = [ + "../../modules/video_coding:video_coding_utility", + "../../modules/video_coding/", + ] +} + +webrtc_fuzzer_test("h264_bitstream_parser_fuzzer") { + sources = [ "h264_bitstream_parser_fuzzer.cc" ] + deps = [ + "../../common_video", + "../../modules/video_coding/", + ] +} + +webrtc_fuzzer_test("forward_error_correction_fuzzer") { + sources = [ "forward_error_correction_fuzzer.cc" ] + deps = [ + "../../api:scoped_refptr", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:byte_buffer", + ] +} + +webrtc_fuzzer_test("flexfec_header_reader_fuzzer") { + sources = [ "flexfec_header_reader_fuzzer.cc" ] + deps = [ + "../../api:scoped_refptr", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] +} + +webrtc_fuzzer_test("flexfec_sender_fuzzer") { + sources = [ "flexfec_sender_fuzzer.cc" ] + deps = [ + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../system_wrappers", + ] +} + +webrtc_fuzzer_test("ulpfec_header_reader_fuzzer") { + sources = [ "ulpfec_header_reader_fuzzer.cc" ] + deps = [ + "../../api:scoped_refptr", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:fec_test_helper", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] +} + +webrtc_fuzzer_test("ulpfec_generator_fuzzer") { + sources = [ "ulpfec_generator_fuzzer.cc" ] + deps = [ + "../../modules:module_api_public", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:fec_test_helper", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:checks", + "../../rtc_base:copy_on_write_buffer", + "../../system_wrappers", + ] +} + +webrtc_fuzzer_test("ulpfec_receiver_fuzzer") { + sources = [ "ulpfec_receiver_fuzzer.cc" ] + deps = [ + ":fuzz_data_helper", + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] +} + +webrtc_fuzzer_test("flexfec_receiver_fuzzer") { + sources = [ "flexfec_receiver_fuzzer.cc" ] + deps = [ + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] +} + +webrtc_fuzzer_test("rtp_video_frame_assembler_fuzzer") { + sources = [ "rtp_video_frame_assembler_fuzzer.cc" ] + deps = [ + "../../api/video:rtp_video_frame_assembler", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] +} + +webrtc_fuzzer_test("rtcp_receiver_fuzzer") { + sources = [ "rtcp_receiver_fuzzer.cc" ] + deps = [ + "../../modules/rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:checks", + "../../system_wrappers", + ] + seed_corpus = "corpora/rtcp-corpus" +} + +webrtc_fuzzer_test("rtp_packet_fuzzer") { + sources = [ "rtp_packet_fuzzer.cc" ] + deps = [ "../../modules/rtp_rtcp:rtp_rtcp_format" ] + absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ] + seed_corpus = "corpora/rtp-corpus" +} + +webrtc_fuzzer_test("rtp_packetizer_av1_fuzzer") { + sources = [ "rtp_packetizer_av1_fuzzer.cc" ] + deps = [ + "../../api/video:video_frame_type", + "../../modules/rtp_rtcp:rtp_rtcp", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:checks", + ] +} + +webrtc_fuzzer_test("congestion_controller_feedback_fuzzer") { + sources = [ "congestion_controller_feedback_fuzzer.cc" ] + deps = [ + "../../modules/congestion_controller", + "../../modules/pacing", + "../../modules/remote_bitrate_estimator", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/functional:bind_front" ] +} + +rtc_library("audio_decoder_fuzzer") { + testonly = true + sources = [ + "audio_decoder_fuzzer.cc", + "audio_decoder_fuzzer.h", + ] + deps = [ + "../../api/audio_codecs:audio_codecs_api", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:checks", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ] +} + +webrtc_fuzzer_test("audio_decoder_g722_fuzzer") { + sources = [ "audio_decoder_g722_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:g722", + ] +} + +webrtc_fuzzer_test("audio_decoder_ilbc_fuzzer") { + sources = [ "audio_decoder_ilbc_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:ilbc", + ] +} + +webrtc_fuzzer_test("audio_decoder_opus_fuzzer") { + sources = [ "audio_decoder_opus_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:webrtc_opus", + ] +} + +webrtc_fuzzer_test("audio_decoder_opus_redundant_fuzzer") { + sources = [ "audio_decoder_opus_redundant_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:webrtc_opus", + ] +} + +webrtc_fuzzer_test("audio_decoder_multiopus_fuzzer") { + sources = [ "audio_decoder_multistream_opus_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../api/audio_codecs/opus:audio_decoder_multiopus", + "../../api/audio_codecs/opus:audio_decoder_opus_config", + ] +} + +webrtc_fuzzer_test("audio_decoder_pcm_fuzzer") { + sources = [ "audio_decoder_pcm_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:g711", + ] +} + +webrtc_fuzzer_test("audio_decoder_pcm16b_fuzzer") { + sources = [ "audio_decoder_pcm16b_fuzzer.cc" ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:pcm16b", + ] +} + +rtc_library("audio_encoder_fuzzer") { + testonly = true + sources = [ + "audio_encoder_fuzzer.cc", + "audio_encoder_fuzzer.h", + ] + deps = [ + ":fuzz_data_helper", + "../../api:array_view", + "../../api/audio_codecs:audio_codecs_api", + "../../rtc_base:buffer", + "../../rtc_base:checks", + ] +} + +webrtc_fuzzer_test("audio_encoder_opus_fuzzer") { + sources = [ "audio_encoder_opus_fuzzer.cc" ] + deps = [ + ":audio_encoder_fuzzer", + "../../api/audio_codecs/opus:audio_encoder_opus", + "../../rtc_base:checks", + ] +} + +webrtc_fuzzer_test("turn_unwrap_fuzzer") { + sources = [ "turn_unwrap_fuzzer.cc" ] + deps = [ + "../../media", + "../../media:rtc_media_base", + "../../media:turn_utils", + ] +} + +webrtc_fuzzer_test("neteq_rtp_fuzzer") { + sources = [ "neteq_rtp_fuzzer.cc" ] + deps = [ + "../../api:array_view", + "../../api/audio_codecs:builtin_audio_decoder_factory", + "../../modules/audio_coding:neteq", + "../../modules/audio_coding:neteq_test_tools", + "../../modules/audio_coding:neteq_tools_minimal", + "../../modules/audio_coding:pcm16b", + "../../modules/rtp_rtcp:rtp_rtcp_format", + ] +} + +webrtc_fuzzer_test("neteq_signal_fuzzer") { + sources = [ "neteq_signal_fuzzer.cc" ] + deps = [ + "../../api:array_view", + "../../api/audio_codecs:builtin_audio_decoder_factory", + "../../modules/audio_coding:neteq", + "../../modules/audio_coding:neteq_test_tools", + "../../modules/audio_coding:neteq_tools_minimal", + "../../modules/audio_coding:pcm16b", + "../../rtc_base:random", + "../../rtc_base:safe_conversions", + ] +} + +webrtc_fuzzer_test("residual_echo_detector_fuzzer") { + sources = [ "residual_echo_detector_fuzzer.cc" ] + deps = [ + "../../api/audio:echo_detector_creator", + "../../rtc_base:checks", + "../../rtc_base:refcount", + ] +} + +webrtc_fuzzer_test("sdp_parser_fuzzer") { + sources = [ "sdp_parser_fuzzer.cc" ] + deps = [ + "../../api:libjingle_peerconnection_api", + "../../pc:libjingle_peerconnection", + ] + seed_corpus = "corpora/sdp-corpus" +} + +if (!build_with_chromium) { + # This target depends on test infrastructure that can't be built + # with Chromium at the moment. + # TODO(bugs.chromium.org/12534): Make this fuzzer build in Chromium. + + webrtc_fuzzer_test("sdp_integration_fuzzer") { + sources = [ "sdp_integration_fuzzer.cc" ] + deps = [ + "../../api:libjingle_peerconnection_api", + "../../pc:integration_test_helpers", + "../../pc:libjingle_peerconnection", + "../../test:test_support", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/strings" ] + seed_corpus = "corpora/sdp-corpus" + } +} + +webrtc_fuzzer_test("stun_parser_fuzzer") { + sources = [ "stun_parser_fuzzer.cc" ] + deps = [ + "../../api/transport:stun_types", + "../../p2p:rtc_p2p", + ] + seed_corpus = "corpora/stun-corpus" + dict = "corpora/stun.tokens" +} + +webrtc_fuzzer_test("stun_validator_fuzzer") { + sources = [ "stun_validator_fuzzer.cc" ] + deps = [ + "../../api/transport:stun_types", + "../../p2p:rtc_p2p", + ] + seed_corpus = "corpora/stun-corpus" + dict = "corpora/stun.tokens" +} + +webrtc_fuzzer_test("pseudotcp_parser_fuzzer") { + sources = [ "pseudotcp_parser_fuzzer.cc" ] + deps = [ + "../../p2p:rtc_p2p", + "../../rtc_base:threading", + ] +} + +rtc_library("audio_processing_fuzzer_helper") { + testonly = true + sources = [ + "audio_processing_fuzzer_helper.cc", + "audio_processing_fuzzer_helper.h", + ] + deps = [ + ":fuzz_data_helper", + "../../api/audio:audio_frame_api", + "../../modules/audio_processing", + "../../modules/audio_processing:api", + "../../modules/audio_processing:audio_frame_proxies", + "../../rtc_base:checks", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ] +} + +webrtc_fuzzer_test("audio_processing_fuzzer") { + sources = [ "audio_processing_configs_fuzzer.cc" ] + deps = [ + ":audio_processing_fuzzer_helper", + "../../api:scoped_refptr", + "../../api/audio:aec3_factory", + "../../api/audio:echo_detector_creator", + "../../api/task_queue:default_task_queue_factory", + "../../modules/audio_processing", + "../../modules/audio_processing:api", + "../../modules/audio_processing:audio_buffer", + "../../modules/audio_processing:audioproc_test_utils", + "../../modules/audio_processing/aec3", + "../../modules/audio_processing/aec_dump", + "../../modules/audio_processing/aec_dump:aec_dump_impl", + "../../rtc_base:macromagic", + "../../rtc_base:rtc_task_queue", + "../../rtc_base:safe_minmax", + "../../system_wrappers:field_trial", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/memory" ] + seed_corpus = "corpora/audio_processing-corpus" +} + +webrtc_fuzzer_test("audio_processing_sample_rate_fuzzer") { + sources = [ "audio_processing_sample_rate_fuzzer.cc" ] + deps = [ + "../../api:scoped_refptr", + "../../api/audio:audio_frame_api", + "../../modules/audio_processing", + "../../modules/audio_processing:api", + "../../modules/audio_processing:audio_frame_proxies", + "../../modules/audio_processing:audioproc_test_utils", + "../../rtc_base:checks", + "../../rtc_base:macromagic", + "../../rtc_base:safe_minmax", + ] +} + +webrtc_fuzzer_test("agc_fuzzer") { + sources = [ "agc_fuzzer.cc" ] + deps = [ + ":fuzz_data_helper", + "../../modules/audio_processing", + "../../modules/audio_processing:api", + "../../modules/audio_processing:audio_buffer", + "../../rtc_base:macromagic", + "../../rtc_base:safe_minmax", + ] + + seed_corpus = "corpora/agc-corpus" +} + +webrtc_fuzzer_test("aec3_config_json_fuzzer") { + sources = [ "aec3_config_json_fuzzer.cc" ] + deps = [ + ":fuzz_data_helper", + "../../api/audio:aec3_config", + "../../api/audio:aec3_config_json", + ] + dict = "//testing/libfuzzer/fuzzers/dicts/json.dict" + seed_corpus = "corpora/aec3-config-json-corpus" +} + +webrtc_fuzzer_test("aec3_fuzzer") { + defines = [] + if (apm_debug_dump) { + defines += [ "WEBRTC_APM_DEBUG_DUMP=1" ] + } else { + defines += [ "WEBRTC_APM_DEBUG_DUMP=0" ] + } + sources = [ "aec3_fuzzer.cc" ] + deps = [ + ":fuzz_data_helper", + "../../modules/audio_processing:api", + "../../modules/audio_processing:audio_buffer", + "../../modules/audio_processing/aec3", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/types:optional" ] +} + +webrtc_fuzzer_test("comfort_noise_decoder_fuzzer") { + sources = [ "comfort_noise_decoder_fuzzer.cc" ] + deps = [ + "../../api:array_view", + "../../modules/audio_coding:webrtc_cng", + "../../rtc_base:buffer", + ] +} + +webrtc_fuzzer_test("rtp_depacketizer_av1_assemble_frame_fuzzer") { + sources = [ "rtp_depacketizer_av1_assemble_frame_fuzzer.cc" ] + seed_corpus = "corpora/rtp-depacketizer-av1-assemble-frame-corpus" + deps = [ + ":fuzz_data_helper", + "../../api:array_view", + "../../modules/rtp_rtcp", + ] +} + +webrtc_fuzzer_test("rtp_dependency_descriptor_fuzzer") { + sources = [ "rtp_dependency_descriptor_fuzzer.cc" ] + seed_corpus = "corpora/dependency_descriptor-corpus" + deps = [ + "../../api:array_view", + "../../common_video/generic_frame_descriptor", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:checks", + ] +} + +webrtc_fuzzer_test("rtp_video_layers_allocation_fuzzer") { + sources = [ "rtp_video_layers_allocation_fuzzer.cc" ] + seed_corpus = "corpora/video_layers_allocation-corpus" + deps = [ + "../../api:array_view", + "../../api/video:video_layers_allocation", + "../../modules/rtp_rtcp:rtp_rtcp_format", + "../../rtc_base:checks", + ] + + # video_layers_allocation is an rtp header extension and thus can't be longer + # than 255 bytes on the wire. + libfuzzer_options = [ "max_len=255" ] +} + +webrtc_fuzzer_test("rtp_frame_reference_finder_fuzzer") { + sources = [ "rtp_frame_reference_finder_fuzzer.cc" ] + deps = [ + "../../api:rtp_packet_info", + "../../api:scoped_refptr", + "../../modules/video_coding/", + "../../system_wrappers", + ] +} + +webrtc_fuzzer_test("frame_buffer2_fuzzer") { + sources = [ "frame_buffer2_fuzzer.cc" ] + deps = [ + "../../api/task_queue", + "../../modules/video_coding:frame_buffer2", + "../../modules/video_coding/timing:timing_module", + "../../test:scoped_key_value_config", + "../time_controller:time_controller", + ] +} + +webrtc_fuzzer_test("frame_buffer_fuzzer") { + sources = [ "frame_buffer_fuzzer.cc" ] + deps = [ + ":fuzz_data_helper", + "../../api:array_view", + "../../api/video:encoded_frame", + "../../api/video:frame_buffer", + "../../rtc_base:rtc_numerics", + "../../test:scoped_key_value_config", + ] +} + +webrtc_fuzzer_test("field_trial_fuzzer") { + sources = [ "field_trial_fuzzer.cc" ] + deps = [ "../../system_wrappers:field_trial" ] + seed_corpus = "corpora/field_trial-corpus" +} + +webrtc_fuzzer_test("string_to_number_fuzzer") { + sources = [ "string_to_number_fuzzer.cc" ] + deps = [ "../../rtc_base:stringutils" ] + seed_corpus = "corpora/string_to_number-corpus" +} + +webrtc_fuzzer_test("sctp_utils_fuzzer") { + sources = [ "sctp_utils_fuzzer.cc" ] + deps = [ + "../../api:libjingle_peerconnection_api", + "../../pc:libjingle_peerconnection", + "../../pc:sctp_utils", + "../../rtc_base:copy_on_write_buffer", + ] +} + +webrtc_fuzzer_test("dcsctp_socket_fuzzer") { + sources = [ "dcsctp_socket_fuzzer.cc" ] + deps = [ + "../../net/dcsctp/fuzzers:dcsctp_fuzzers", + "../../net/dcsctp/public:socket", + "../../net/dcsctp/public:types", + "../../net/dcsctp/socket:dcsctp_socket", + "../../rtc_base:logging", + ] +} + +webrtc_fuzzer_test("ssl_certificate_fuzzer") { + sources = [ "ssl_certificate_fuzzer.cc" ] + deps = [ + "../:rtp_test_utils", + "../../rtc_base:ssl", + "../../rtc_base:stringutils", + ] +} + +webrtc_fuzzer_test("vp8_replay_fuzzer") { + sources = [ "vp8_replay_fuzzer.cc" ] + deps = [ "utils:rtp_replayer" ] + seed_corpus = "corpora/rtpdump-corpus/vp8" +} + +if (rtc_build_libvpx) { + webrtc_fuzzer_test("vp9_encoder_references_fuzzer") { + sources = [ "vp9_encoder_references_fuzzer.cc" ] + deps = [ + "..:test_support", + "../../api:array_view", + "../../api:field_trials_view", + "../../api/video:video_frame", + "../../api/video_codecs:video_codecs_api", + "../../modules/video_coding:frame_dependencies_calculator", + "../../modules/video_coding:webrtc_libvpx_interface", + "../../modules/video_coding:webrtc_vp9", + "../../rtc_base:safe_compare", + rtc_libvpx_dir, + ] + absl_deps = [ + "//third_party/abseil-cpp/absl/algorithm:container", + "//third_party/abseil-cpp/absl/base:core_headers", + "//third_party/abseil-cpp/absl/container:inlined_vector", + ] + seed_corpus = "corpora/vp9-encoder-references-corpus" + defines = [ "RTC_ENABLE_VP9" ] + } +} + +webrtc_fuzzer_test("vp9_replay_fuzzer") { + sources = [ "vp9_replay_fuzzer.cc" ] + deps = [ "utils:rtp_replayer" ] + seed_corpus = "corpora/rtpdump-corpus/vp9" +} diff --git a/third_party/libwebrtc/test/fuzzers/DEPS b/third_party/libwebrtc/test/fuzzers/DEPS new file mode 100644 index 0000000000..50b1c8adce --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/DEPS @@ -0,0 +1,5 @@ +include_rules = [ + "+audio", + "+pc", + "+net/dcsctp", +] diff --git a/third_party/libwebrtc/test/fuzzers/OWNERS b/third_party/libwebrtc/test/fuzzers/OWNERS new file mode 100644 index 0000000000..3d97816b3b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/OWNERS @@ -0,0 +1,3 @@ +danilchap@webrtc.org +henrik.lundin@webrtc.org +saza@webrtc.org diff --git a/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc new file mode 100644 index 0000000000..626350c52c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/aec3_config_json_fuzzer.cc @@ -0,0 +1,30 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <string> + +#include "api/audio/echo_canceller3_config.h" +#include "api/audio/echo_canceller3_config_json.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000) { + return; + } + std::string config_json(reinterpret_cast<const char*>(data), size); + + EchoCanceller3Config config; + bool success; + Aec3ConfigFromJsonString(config_json, &config, &success); + EchoCanceller3Config::Validate(&config); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc new file mode 100644 index 0000000000..a12ca30f63 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/aec3_fuzzer.cc @@ -0,0 +1,79 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "absl/types/optional.h" +#include "modules/audio_processing/aec3/echo_canceller3.h" +#include "modules/audio_processing/audio_buffer.h" +#include "modules/audio_processing/include/audio_processing.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace { +using SampleRate = ::webrtc::AudioProcessing::NativeRate; + +void PrepareAudioBuffer(int sample_rate_hz, + test::FuzzDataHelper* fuzz_data, + AudioBuffer* buffer) { + float* const* channels = buffer->channels_f(); + for (size_t i = 0; i < buffer->num_channels(); ++i) { + for (size_t j = 0; j < buffer->num_frames(); ++j) { + channels[i][j] = + static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0)); + } + } + if (sample_rate_hz == 32000 || sample_rate_hz == 48000) { + buffer->SplitIntoFrequencyBands(); + } +} + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 200000) { + return; + } + + test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size)); + + constexpr int kSampleRates[] = {16000, 32000, 48000}; + const int sample_rate_hz = + static_cast<size_t>(fuzz_data.SelectOneOf(kSampleRates)); + + constexpr int kMaxNumChannels = 9; + const size_t num_render_channels = + 1 + fuzz_data.ReadOrDefaultValue<uint8_t>(0) % (kMaxNumChannels - 1); + const size_t num_capture_channels = + 1 + fuzz_data.ReadOrDefaultValue<uint8_t>(0) % (kMaxNumChannels - 1); + + EchoCanceller3 aec3(EchoCanceller3Config(), + /*multichannel_config=*/absl::nullopt, sample_rate_hz, + num_render_channels, num_capture_channels); + + AudioBuffer capture_audio(sample_rate_hz, num_capture_channels, + sample_rate_hz, num_capture_channels, + sample_rate_hz, num_capture_channels); + AudioBuffer render_audio(sample_rate_hz, num_render_channels, sample_rate_hz, + num_render_channels, sample_rate_hz, + num_render_channels); + + // Fuzz frames while there is still fuzzer data. + while (fuzz_data.BytesLeft() > 0) { + bool is_capture = fuzz_data.ReadOrDefaultValue(true); + bool level_changed = fuzz_data.ReadOrDefaultValue(true); + if (is_capture) { + PrepareAudioBuffer(sample_rate_hz, &fuzz_data, &capture_audio); + aec3.ProcessCapture(&capture_audio, level_changed); + } else { + PrepareAudioBuffer(sample_rate_hz, &fuzz_data, &render_audio); + aec3.AnalyzeRender(&render_audio); + } + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc new file mode 100644 index 0000000000..597103993e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/agc_fuzzer.cc @@ -0,0 +1,124 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "modules/audio_processing/audio_buffer.h" +#include "modules/audio_processing/gain_control_impl.h" +#include "modules/audio_processing/include/audio_processing.h" +#include "rtc_base/numerics/safe_minmax.h" +#include "rtc_base/thread_annotations.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace { + +void FillAudioBuffer(size_t sample_rate_hz, + test::FuzzDataHelper* fuzz_data, + AudioBuffer* buffer) { + float* const* channels = buffer->channels_f(); + for (size_t i = 0; i < buffer->num_channels(); ++i) { + for (size_t j = 0; j < buffer->num_frames(); ++j) { + channels[i][j] = + static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0)); + } + } + + if (sample_rate_hz != 16000) { + buffer->SplitIntoFrequencyBands(); + } +} + +// This function calls the GainControl functions that are overriden as private +// in GainControlInterface. +void FuzzGainControllerConfig(test::FuzzDataHelper* fuzz_data, + GainControl* gc) { + GainControl::Mode modes[] = {GainControl::Mode::kAdaptiveAnalog, + GainControl::Mode::kAdaptiveDigital, + GainControl::Mode::kFixedDigital}; + GainControl::Mode mode = fuzz_data->SelectOneOf(modes); + const bool enable_limiter = fuzz_data->ReadOrDefaultValue(true); + // The values are capped to comply with the API of webrtc::GainControl. + const int analog_level_min = + rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(0), 0, 65534); + const int analog_level_max = + rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(65535), + analog_level_min + 1, 65535); + const int stream_analog_level = + rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<uint16_t>(30000), + analog_level_min, analog_level_max); + const int gain = + rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(30), -1, 100); + const int target_level_dbfs = + rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(15), -1, 35); + + gc->set_mode(mode); + gc->enable_limiter(enable_limiter); + if (mode == GainControl::Mode::kAdaptiveAnalog) { + gc->set_analog_level_limits(analog_level_min, analog_level_max); + gc->set_stream_analog_level(stream_analog_level); + } + gc->set_compression_gain_db(gain); + gc->set_target_level_dbfs(target_level_dbfs); + + static_cast<void>(gc->mode()); + static_cast<void>(gc->analog_level_minimum()); + static_cast<void>(gc->analog_level_maximum()); + static_cast<void>(gc->stream_analog_level()); + static_cast<void>(gc->compression_gain_db()); + static_cast<void>(gc->stream_is_saturated()); + static_cast<void>(gc->target_level_dbfs()); + static_cast<void>(gc->is_limiter_enabled()); +} + +void FuzzGainController(test::FuzzDataHelper* fuzz_data, GainControlImpl* gci) { + using Rate = ::webrtc::AudioProcessing::NativeRate; + const Rate rate_kinds[] = {Rate::kSampleRate16kHz, Rate::kSampleRate32kHz, + Rate::kSampleRate48kHz}; + + const auto sample_rate_hz = + static_cast<size_t>(fuzz_data->SelectOneOf(rate_kinds)); + const size_t samples_per_frame = sample_rate_hz / 100; + const size_t num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1; + + gci->Initialize(num_channels, sample_rate_hz); + FuzzGainControllerConfig(fuzz_data, gci); + + // The audio buffer is used for both capture and render. + AudioBuffer audio(sample_rate_hz, num_channels, sample_rate_hz, + num_channels, sample_rate_hz, num_channels); + + std::vector<int16_t> packed_render_audio(samples_per_frame); + + while (fuzz_data->CanReadBytes(1)) { + FillAudioBuffer(sample_rate_hz, fuzz_data, &audio); + + const bool stream_has_echo = fuzz_data->ReadOrDefaultValue(true); + gci->AnalyzeCaptureAudio(audio); + gci->ProcessCaptureAudio(&audio, stream_has_echo); + + FillAudioBuffer(sample_rate_hz, fuzz_data, &audio); + + gci->PackRenderAudioBuffer(audio, &packed_render_audio); + gci->ProcessRenderAudio(packed_render_audio); + } +} + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 200000) { + return; + } + test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size)); + auto gci = std::make_unique<GainControlImpl>(); + FuzzGainController(&fuzz_data, gci.get()); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc new file mode 100644 index 0000000000..1db332eeb5 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.cc @@ -0,0 +1,77 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "test/fuzzers/audio_decoder_fuzzer.h" + +#include <limits> + +#include "absl/types/optional.h" +#include "api/audio_codecs/audio_decoder.h" +#include "modules/rtp_rtcp/source/byte_io.h" +#include "rtc_base/checks.h" + +namespace webrtc { +namespace { +template <typename T, unsigned int B = sizeof(T)> +bool ParseInt(const uint8_t** data, size_t* remaining_size, T* value) { + static_assert(std::numeric_limits<T>::is_integer, "Type must be an integer."); + static_assert(sizeof(T) <= sizeof(uint64_t), + "Cannot read wider than uint64_t."); + static_assert(B <= sizeof(T), "T must be at least B bytes wide."); + if (B > *remaining_size) + return false; + uint64_t val = ByteReader<uint64_t, B>::ReadBigEndian(*data); + *data += B; + *remaining_size -= B; + *value = static_cast<T>(val); + return true; +} +} // namespace + +// This function reads two bytes from the beginning of `data`, interprets them +// as the first packet length, and reads this many bytes if available. The +// payload is inserted into the decoder, and the process continues until no more +// data is available. Either AudioDecoder::Decode or +// AudioDecoder::DecodeRedundant is used, depending on the value of +// `decode_type`. +void FuzzAudioDecoder(DecoderFunctionType decode_type, + const uint8_t* data, + size_t size, + AudioDecoder* decoder, + int sample_rate_hz, + size_t max_decoded_bytes, + int16_t* decoded) { + const uint8_t* data_ptr = data; + size_t remaining_size = size; + size_t packet_len; + constexpr size_t kMaxNumFuzzedPackets = 200; + for (size_t num_packets = 0; num_packets < kMaxNumFuzzedPackets; + ++num_packets) { + if (!(ParseInt<size_t, 2>(&data_ptr, &remaining_size, &packet_len) && + packet_len <= remaining_size)) { + break; + } + AudioDecoder::SpeechType speech_type; + switch (decode_type) { + case DecoderFunctionType::kNormalDecode: + decoder->Decode(data_ptr, packet_len, sample_rate_hz, max_decoded_bytes, + decoded, &speech_type); + break; + case DecoderFunctionType::kRedundantDecode: + decoder->DecodeRedundant(data_ptr, packet_len, sample_rate_hz, + max_decoded_bytes, decoded, &speech_type); + break; + } + data_ptr += packet_len; + remaining_size -= packet_len; + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h new file mode 100644 index 0000000000..8c5246bb5e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_fuzzer.h @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#ifndef TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_ +#define TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_ + +#include <stddef.h> +#include <stdint.h> + +namespace webrtc { + +class AudioDecoder; + +enum class DecoderFunctionType { + kNormalDecode, + kRedundantDecode, +}; + +void FuzzAudioDecoder(DecoderFunctionType decode_type, + const uint8_t* data, + size_t size, + AudioDecoder* decoder, + int sample_rate_hz, + size_t max_decoded_bytes, + int16_t* decoded); + +} // namespace webrtc + +#endif // TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_ diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc new file mode 100644 index 0000000000..08599aa333 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_g722_fuzzer.cc @@ -0,0 +1,39 @@ +/* + * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "modules/audio_coding/codecs/g722/audio_decoder_g722.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000 || size < 1) { + return; + } + + std::unique_ptr<AudioDecoder> dec; + size_t num_channels; + if (data[0] % 2) { + dec = std::make_unique<AudioDecoderG722Impl>(); + num_channels = 1; + } else { + dec = std::make_unique<AudioDecoderG722StereoImpl>(); + num_channels = 2; + } + // Allocate a maximum output size of 100 ms. + const int sample_rate_hz = dec->SampleRateHz(); + const size_t allocated_ouput_size_samples = + sample_rate_hz / 10 * num_channels; + std::unique_ptr<int16_t[]> output = + std::make_unique<int16_t[]>(allocated_ouput_size_samples); + FuzzAudioDecoder( + DecoderFunctionType::kNormalDecode, data, size, dec.get(), sample_rate_hz, + allocated_ouput_size_samples * sizeof(int16_t), output.get()); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc new file mode 100644 index 0000000000..8548645c63 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc @@ -0,0 +1,26 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "modules/audio_coding/codecs/ilbc/audio_decoder_ilbc.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000) { + return; + } + AudioDecoderIlbcImpl dec; + static const int kSampleRateHz = 8000; + static const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, &dec, + kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc new file mode 100644 index 0000000000..474a1cdc43 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc @@ -0,0 +1,61 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "api/audio_codecs/opus/audio_decoder_multi_channel_opus.h" +#include "api/audio_codecs/opus/audio_decoder_multi_channel_opus_config.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { + +AudioDecoderMultiChannelOpusConfig MakeDecoderConfig( + int num_channels, + int num_streams, + int coupled_streams, + std::vector<unsigned char> channel_mapping) { + AudioDecoderMultiChannelOpusConfig config; + config.num_channels = num_channels; + config.num_streams = num_streams; + config.coupled_streams = coupled_streams; + config.channel_mapping = channel_mapping; + return config; +} + +void FuzzOneInput(const uint8_t* data, size_t size) { + const std::vector<AudioDecoderMultiChannelOpusConfig> surround_configs = { + MakeDecoderConfig(1, 1, 0, {0}), // Mono + + MakeDecoderConfig(2, 2, 0, {0, 0}), // Copy the first (of + // 2) decoded streams + // into both output + // channel 0 and output + // channel 1. Ignore + // the 2nd decoded + // stream. + + MakeDecoderConfig(4, 2, 2, {0, 1, 2, 3}), // Quad. + MakeDecoderConfig(6, 4, 2, {0, 4, 1, 2, 3, 5}), // 5.1 + MakeDecoderConfig(8, 5, 3, {0, 6, 1, 2, 3, 4, 5, 7}) // 7.1 + }; + + const auto config = surround_configs[data[0] % surround_configs.size()]; + RTC_CHECK(config.IsOk()); + std::unique_ptr<AudioDecoder> dec = + AudioDecoderMultiChannelOpus::MakeAudioDecoder(config); + RTC_CHECK(dec); + const int kSampleRateHz = 48000; + const size_t kAllocatedOuputSizeSamples = + 4 * kSampleRateHz / 10; // 4x100 ms, 4 times the size of the output array + // for the stereo Opus codec. It should be enough + // for 8 channels. + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, dec.get(), + kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc new file mode 100644 index 0000000000..a015f98b5b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc @@ -0,0 +1,24 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "modules/audio_coding/codecs/opus/audio_decoder_opus.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + const size_t channels = (size % 2) + 1; // 1 or 2 channels. + AudioDecoderOpusImpl dec(channels); + const int kSampleRateHz = 48000; + const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; // 100 ms. + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, &dec, + kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc new file mode 100644 index 0000000000..efcba0f35d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_opus_redundant_fuzzer.cc @@ -0,0 +1,24 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "modules/audio_coding/codecs/opus/audio_decoder_opus.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + const size_t channels = (size % 2) + 1; // 1 or 2 channels. + AudioDecoderOpusImpl dec(channels); + const int kSampleRateHz = 48000; + const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; // 100 ms. + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(DecoderFunctionType::kRedundantDecode, data, size, &dec, + kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc new file mode 100644 index 0000000000..6e5d6e2190 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm16b_fuzzer.cc @@ -0,0 +1,56 @@ +/* + * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "modules/audio_coding/codecs/pcm16b/audio_decoder_pcm16b.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000 || size < 2) { + return; + } + + int sample_rate_hz; + switch (data[0] % 4) { + case 0: + sample_rate_hz = 8000; + break; + case 1: + sample_rate_hz = 16000; + break; + case 2: + sample_rate_hz = 32000; + break; + case 3: + sample_rate_hz = 48000; + break; + default: + RTC_DCHECK_NOTREACHED(); + return; + } + const size_t num_channels = data[1] % 16 + 1; + + // Two first bytes of the data are used. Move forward. + data += 2; + size -= 2; + + AudioDecoderPcm16B dec(sample_rate_hz, num_channels); + // Allocate a maximum output size of 100 ms. + const size_t allocated_ouput_size_samples = + sample_rate_hz * num_channels / 10; + std::unique_ptr<int16_t[]> output = + std::make_unique<int16_t[]>(allocated_ouput_size_samples); + FuzzAudioDecoder( + DecoderFunctionType::kNormalDecode, data, size, &dec, sample_rate_hz, + allocated_ouput_size_samples * sizeof(int16_t), output.get()); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc new file mode 100644 index 0000000000..dbfcaf9976 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_decoder_pcm_fuzzer.cc @@ -0,0 +1,45 @@ +/* + * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "modules/audio_coding/codecs/g711/audio_decoder_pcm.h" +#include "test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000 || size < 2) { + return; + } + + const size_t num_channels = data[0] % 16 + 1; + + std::unique_ptr<AudioDecoder> dec; + if (data[1] % 2) { + dec = std::make_unique<AudioDecoderPcmU>(num_channels); + } else { + dec = std::make_unique<AudioDecoderPcmA>(num_channels); + } + + // Two first bytes of the data are used. Move forward. + data += 2; + size -= 2; + + // Allocate a maximum output size of 100 ms. + const size_t allocated_ouput_size_samples = + dec->SampleRateHz() * num_channels / 10; + std::unique_ptr<int16_t[]> output = + std::make_unique<int16_t[]>(allocated_ouput_size_samples); + FuzzAudioDecoder(DecoderFunctionType::kNormalDecode, data, size, dec.get(), + dec->SampleRateHz(), + allocated_ouput_size_samples * sizeof(int16_t), + output.get()); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc new file mode 100644 index 0000000000..837c26df56 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.cc @@ -0,0 +1,53 @@ +/* + * Copyright (c) 2020 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "test/fuzzers/audio_encoder_fuzzer.h" + +#include <cstring> + +#include "rtc_base/buffer.h" +#include "rtc_base/checks.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { + +// This function reads bytes from `data_view`, interprets them as RTP timestamp +// and input samples, and sends them for encoding. The process continues until +// no more data is available. +void FuzzAudioEncoder(rtc::ArrayView<const uint8_t> data_view, + std::unique_ptr<AudioEncoder> encoder) { + test::FuzzDataHelper data(data_view); + const size_t block_size_samples = + encoder->SampleRateHz() / 100 * encoder->NumChannels(); + const size_t block_size_bytes = block_size_samples * sizeof(int16_t); + if (data_view.size() / block_size_bytes > 1000) { + // If the size of the fuzzer data is more than 1000 input blocks (i.e., more + // than 10 seconds), then don't fuzz at all for the fear of timing out. + return; + } + + rtc::BufferT<int16_t> input_aligned(block_size_samples); + rtc::Buffer encoded; + + // Each round in the loop below will need one block of samples + a 32-bit + // timestamp from the fuzzer input. + const size_t bytes_to_read = block_size_bytes + sizeof(uint32_t); + while (data.CanReadBytes(bytes_to_read)) { + const uint32_t timestamp = data.Read<uint32_t>(); + auto byte_array = data.ReadByteArray(block_size_bytes); + // Align the data by copying to another array. + RTC_DCHECK_EQ(input_aligned.size() * sizeof(int16_t), + byte_array.size() * sizeof(uint8_t)); + memcpy(input_aligned.data(), byte_array.data(), byte_array.size()); + auto info = encoder->Encode(timestamp, input_aligned, &encoded); + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h new file mode 100644 index 0000000000..0c879df4d3 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_fuzzer.h @@ -0,0 +1,26 @@ +/* + * Copyright (c) 2020 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#ifndef TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_ +#define TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_ + +#include <memory> + +#include "api/array_view.h" +#include "api/audio_codecs/audio_encoder.h" + +namespace webrtc { + +void FuzzAudioEncoder(rtc::ArrayView<const uint8_t> data_view, + std::unique_ptr<AudioEncoder> encoder); + +} // namespace webrtc + +#endif // TEST_FUZZERS_AUDIO_ENCODER_FUZZER_H_ diff --git a/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc new file mode 100644 index 0000000000..d67e6d6067 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_encoder_opus_fuzzer.cc @@ -0,0 +1,27 @@ +/* + * Copyright (c) 2018 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "api/audio_codecs/opus/audio_encoder_opus.h" +#include "rtc_base/checks.h" +#include "test/fuzzers/audio_encoder_fuzzer.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + AudioEncoderOpus::Config config; + config.frame_size_ms = 20; + RTC_CHECK(config.IsOk()); + constexpr int kPayloadType = 100; + FuzzAudioEncoder( + /*data_view=*/{data, size}, + /*encoder=*/AudioEncoderOpus::MakeAudioEncoder(config, kPayloadType)); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc new file mode 100644 index 0000000000..afcb4318f9 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_processing_configs_fuzzer.cc @@ -0,0 +1,147 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <bitset> +#include <string> + +#include "absl/memory/memory.h" +#include "api/audio/echo_canceller3_factory.h" +#include "api/audio/echo_detector_creator.h" +#include "api/task_queue/default_task_queue_factory.h" +#include "modules/audio_processing/aec_dump/aec_dump_factory.h" +#include "modules/audio_processing/include/audio_processing.h" +#include "modules/audio_processing/test/audio_processing_builder_for_testing.h" +#include "rtc_base/arraysize.h" +#include "rtc_base/numerics/safe_minmax.h" +#include "rtc_base/task_queue.h" +#include "system_wrappers/include/field_trial.h" +#include "test/fuzzers/audio_processing_fuzzer_helper.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace { + +const std::string kFieldTrialNames[] = { + "WebRTC-Audio-Agc2ForceExtraSaturationMargin", + "WebRTC-Audio-Agc2ForceInitialSaturationMargin", + "WebRTC-Aec3MinErleDuringOnsetsKillSwitch", + "WebRTC-Aec3ShortHeadroomKillSwitch", +}; + +rtc::scoped_refptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data, + std::string* field_trial_string, + rtc::TaskQueue* worker_queue) { + // Parse boolean values for optionally enabling different + // configurable public components of APM. + bool use_ts = fuzz_data->ReadOrDefaultValue(true); + bool use_red = fuzz_data->ReadOrDefaultValue(true); + bool use_hpf = fuzz_data->ReadOrDefaultValue(true); + bool use_aec3 = fuzz_data->ReadOrDefaultValue(true); + bool use_aec = fuzz_data->ReadOrDefaultValue(true); + bool use_aecm = fuzz_data->ReadOrDefaultValue(true); + bool use_agc = fuzz_data->ReadOrDefaultValue(true); + bool use_ns = fuzz_data->ReadOrDefaultValue(true); + bool use_agc_limiter = fuzz_data->ReadOrDefaultValue(true); + bool use_agc2 = fuzz_data->ReadOrDefaultValue(true); + bool use_agc2_adaptive_digital = fuzz_data->ReadOrDefaultValue(true); + + // Read a gain value supported by GainController2::Validate(). + const float gain_controller2_gain_db = + fuzz_data->ReadOrDefaultValue<uint8_t>(0) % 50; + + constexpr size_t kNumFieldTrials = arraysize(kFieldTrialNames); + // Verify that the read data type has enough bits to fuzz the field trials. + using FieldTrialBitmaskType = uint64_t; + static_assert(kNumFieldTrials <= sizeof(FieldTrialBitmaskType) * 8, + "FieldTrialBitmaskType is not large enough."); + std::bitset<kNumFieldTrials> field_trial_bitmask( + fuzz_data->ReadOrDefaultValue<FieldTrialBitmaskType>(0)); + for (size_t i = 0; i < kNumFieldTrials; ++i) { + if (field_trial_bitmask[i]) { + *field_trial_string += kFieldTrialNames[i] + "/Enabled/"; + } + } + field_trial::InitFieldTrialsFromString(field_trial_string->c_str()); + + // Ignore a few bytes. Bytes from this segment will be used for + // future config flag changes. We assume 40 bytes is enough for + // configuring the APM. + constexpr size_t kSizeOfConfigSegment = 40; + RTC_DCHECK(kSizeOfConfigSegment >= fuzz_data->BytesRead()); + static_cast<void>( + fuzz_data->ReadByteArray(kSizeOfConfigSegment - fuzz_data->BytesRead())); + + // Filter out incompatible settings that lead to CHECK failures. + if ((use_aecm && use_aec) || // These settings cause CHECK failure. + (use_aecm && use_aec3 && use_ns) // These settings trigger webrtc:9489. + ) { + return nullptr; + } + + std::unique_ptr<EchoControlFactory> echo_control_factory; + if (use_aec3) { + echo_control_factory.reset(new EchoCanceller3Factory()); + } + + webrtc::AudioProcessing::Config apm_config; + apm_config.pipeline.multi_channel_render = true; + apm_config.pipeline.multi_channel_capture = true; + apm_config.echo_canceller.enabled = use_aec || use_aecm; + apm_config.echo_canceller.mobile_mode = use_aecm; + apm_config.high_pass_filter.enabled = use_hpf; + apm_config.gain_controller1.enabled = use_agc; + apm_config.gain_controller1.enable_limiter = use_agc_limiter; + apm_config.gain_controller2.enabled = use_agc2; + apm_config.gain_controller2.fixed_digital.gain_db = gain_controller2_gain_db; + apm_config.gain_controller2.adaptive_digital.enabled = + use_agc2_adaptive_digital; + apm_config.noise_suppression.enabled = use_ns; + apm_config.transient_suppression.enabled = use_ts; + + rtc::scoped_refptr<AudioProcessing> apm = + AudioProcessingBuilderForTesting() + .SetEchoControlFactory(std::move(echo_control_factory)) + .SetEchoDetector(use_red ? CreateEchoDetector() : nullptr) + .SetConfig(apm_config) + .Create(); + +#ifdef WEBRTC_LINUX + apm->AttachAecDump(AecDumpFactory::Create("/dev/null", -1, worker_queue)); +#endif + + return apm; +} + +TaskQueueFactory* GetTaskQueueFactory() { + static TaskQueueFactory* const factory = + CreateDefaultTaskQueueFactory().release(); + return factory; +} + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 400000) { + return; + } + test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size)); + // This string must be in scope during execution, according to documentation + // for field_trial.h. Hence it's created here and not in CreateApm. + std::string field_trial_string = ""; + + rtc::TaskQueue worker_queue(GetTaskQueueFactory()->CreateTaskQueue( + "rtc-low-prio", rtc::TaskQueue::Priority::LOW)); + auto apm = CreateApm(&fuzz_data, &field_trial_string, &worker_queue); + + if (apm) { + FuzzAudioProcessing(&fuzz_data, std::move(apm)); + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc new file mode 100644 index 0000000000..5252918d77 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.cc @@ -0,0 +1,143 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "test/fuzzers/audio_processing_fuzzer_helper.h" + +#include <algorithm> +#include <array> +#include <cmath> +#include <limits> + +#include "api/audio/audio_frame.h" +#include "modules/audio_processing/include/audio_frame_proxies.h" +#include "modules/audio_processing/include/audio_processing.h" +#include "rtc_base/checks.h" + +namespace webrtc { +namespace { +bool ValidForApm(float x) { + return std::isfinite(x) && -1.0f <= x && x <= 1.0f; +} + +void GenerateFloatFrame(test::FuzzDataHelper* fuzz_data, + int input_rate, + int num_channels, + float* const* float_frames) { + const int samples_per_input_channel = + AudioProcessing::GetFrameSize(input_rate); + RTC_DCHECK_LE(samples_per_input_channel, 480); + for (int i = 0; i < num_channels; ++i) { + std::fill(float_frames[i], float_frames[i] + samples_per_input_channel, 0); + const size_t read_bytes = sizeof(float) * samples_per_input_channel; + if (fuzz_data->CanReadBytes(read_bytes)) { + rtc::ArrayView<const uint8_t> byte_array = + fuzz_data->ReadByteArray(read_bytes); + memmove(float_frames[i], byte_array.begin(), read_bytes); + } + + // Sanitize input. + for (int j = 0; j < samples_per_input_channel; ++j) { + if (!ValidForApm(float_frames[i][j])) { + float_frames[i][j] = 0.f; + } + } + } +} + +void GenerateFixedFrame(test::FuzzDataHelper* fuzz_data, + int input_rate, + int num_channels, + AudioFrame* fixed_frame) { + const int samples_per_input_channel = + AudioProcessing::GetFrameSize(input_rate); + + fixed_frame->samples_per_channel_ = samples_per_input_channel; + fixed_frame->sample_rate_hz_ = input_rate; + fixed_frame->num_channels_ = num_channels; + + RTC_DCHECK_LE(samples_per_input_channel * num_channels, + AudioFrame::kMaxDataSizeSamples); + for (int i = 0; i < samples_per_input_channel * num_channels; ++i) { + fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue<int16_t>(0); + } +} +} // namespace + +void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data, + rtc::scoped_refptr<AudioProcessing> apm) { + AudioFrame fixed_frame; + // Normal usage is up to 8 channels. Allowing to fuzz one beyond this allows + // us to catch implicit assumptions about normal usage. + constexpr int kMaxNumChannels = 9; + std::array<std::array<float, 480>, kMaxNumChannels> float_frames; + std::array<float*, kMaxNumChannels> float_frame_ptrs; + for (int i = 0; i < kMaxNumChannels; ++i) { + float_frame_ptrs[i] = float_frames[i].data(); + } + float* const* ptr_to_float_frames = &float_frame_ptrs[0]; + + constexpr int kSampleRatesHz[] = {8000, 11025, 16000, 22050, + 32000, 44100, 48000}; + + // We may run out of fuzz data in the middle of a loop iteration. In + // that case, default values will be used for the rest of that + // iteration. + while (fuzz_data->CanReadBytes(1)) { + const bool is_float = fuzz_data->ReadOrDefaultValue(true); + // Decide input/output rate for this iteration. + const int input_rate = fuzz_data->SelectOneOf(kSampleRatesHz); + const int output_rate = fuzz_data->SelectOneOf(kSampleRatesHz); + + const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue<uint8_t>(0); + // API call needed for AECM to run. + apm->set_stream_delay_ms(stream_delay); + + const bool key_pressed = fuzz_data->ReadOrDefaultValue(true); + apm->set_stream_key_pressed(key_pressed); + + // Make the APM call depending on capture/render mode and float / + // fix interface. + const bool is_capture = fuzz_data->ReadOrDefaultValue(true); + + // Fill the arrays with audio samples from the data. + int apm_return_code = AudioProcessing::Error::kNoError; + if (is_float) { + const int num_channels = + fuzz_data->ReadOrDefaultValue<uint8_t>(1) % kMaxNumChannels; + + GenerateFloatFrame(fuzz_data, input_rate, num_channels, + ptr_to_float_frames); + if (is_capture) { + apm_return_code = apm->ProcessStream( + ptr_to_float_frames, StreamConfig(input_rate, num_channels), + StreamConfig(output_rate, num_channels), ptr_to_float_frames); + } else { + apm_return_code = apm->ProcessReverseStream( + ptr_to_float_frames, StreamConfig(input_rate, num_channels), + StreamConfig(output_rate, num_channels), ptr_to_float_frames); + } + } else { + const int num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1; + GenerateFixedFrame(fuzz_data, input_rate, num_channels, &fixed_frame); + + if (is_capture) { + apm_return_code = ProcessAudioFrame(apm.get(), &fixed_frame); + } else { + apm_return_code = ProcessReverseAudioFrame(apm.get(), &fixed_frame); + } + } + + // Cover stats gathering code paths. + static_cast<void>(apm->GetStatistics(true /*has_remote_tracks*/)); + + RTC_DCHECK_NE(apm_return_code, AudioProcessing::kBadDataLengthError); + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h new file mode 100644 index 0000000000..a604db8cef --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_processing_fuzzer_helper.h @@ -0,0 +1,25 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#ifndef TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_ +#define TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_ + +#include <memory> + +#include "modules/audio_processing/include/audio_processing.h" +#include "test/fuzzers/fuzz_data_helper.h" +namespace webrtc { + +void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data, + rtc::scoped_refptr<AudioProcessing> apm); + +} // namespace webrtc + +#endif // TEST_FUZZERS_AUDIO_PROCESSING_FUZZER_HELPER_H_ diff --git a/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc new file mode 100644 index 0000000000..ca3946988c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/audio_processing_sample_rate_fuzzer.cc @@ -0,0 +1,162 @@ +/* + * Copyright (c) 2022 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> +#include <array> +#include <cmath> +#include <limits> + +#include "modules/audio_processing/include/audio_processing.h" +#include "modules/audio_processing/test/audio_processing_builder_for_testing.h" +#include "rtc_base/checks.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace { +constexpr int kMaxNumChannels = 2; +// APM supported max rate is 384000 Hz, using a limit slightly above lets the +// fuzzer exercise the handling of too high rates. +constexpr int kMaxSampleRateHz = 400000; +constexpr int kMaxSamplesPerChannel = kMaxSampleRateHz / 100; + +void GenerateFloatFrame(test::FuzzDataHelper& fuzz_data, + int input_rate, + int num_channels, + float* const* float_frames) { + const int samples_per_input_channel = + AudioProcessing::GetFrameSize(input_rate); + RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel); + for (int i = 0; i < num_channels; ++i) { + float channel_value; + fuzz_data.CopyTo<float>(&channel_value); + std::fill(float_frames[i], float_frames[i] + samples_per_input_channel, + channel_value); + } +} + +void GenerateFixedFrame(test::FuzzDataHelper& fuzz_data, + int input_rate, + int num_channels, + int16_t* fixed_frames) { + const int samples_per_input_channel = + AudioProcessing::GetFrameSize(input_rate); + RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel); + // Write interleaved samples. + for (int ch = 0; ch < num_channels; ++ch) { + const int16_t channel_value = fuzz_data.ReadOrDefaultValue<int16_t>(0); + for (int i = ch; i < samples_per_input_channel * num_channels; + i += num_channels) { + fixed_frames[i] = channel_value; + } + } +} + +// No-op processor used to influence APM input/output pipeline decisions based +// on what submodules are present. +class NoopCustomProcessing : public CustomProcessing { + public: + NoopCustomProcessing() {} + ~NoopCustomProcessing() override {} + void Initialize(int sample_rate_hz, int num_channels) override {} + void Process(AudioBuffer* audio) override {} + std::string ToString() const override { return ""; } + void SetRuntimeSetting(AudioProcessing::RuntimeSetting setting) override {} +}; +} // namespace + +// This fuzzer is directed at fuzzing unexpected input and output sample rates +// of APM. For example, the sample rate 22050 Hz is processed by APM in frames +// of floor(22050/100) = 220 samples. This is not exactly 10 ms of audio +// content, and may break assumptions commonly made on the APM frame size. +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 100) { + return; + } + test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size)); + + std::unique_ptr<CustomProcessing> capture_processor = + fuzz_data.ReadOrDefaultValue(true) + ? std::make_unique<NoopCustomProcessing>() + : nullptr; + std::unique_ptr<CustomProcessing> render_processor = + fuzz_data.ReadOrDefaultValue(true) + ? std::make_unique<NoopCustomProcessing>() + : nullptr; + rtc::scoped_refptr<AudioProcessing> apm = + AudioProcessingBuilderForTesting() + .SetConfig({.pipeline = {.multi_channel_render = true, + .multi_channel_capture = true}}) + .SetCapturePostProcessing(std::move(capture_processor)) + .SetRenderPreProcessing(std::move(render_processor)) + .Create(); + RTC_DCHECK(apm); + + std::array<int16_t, kMaxSamplesPerChannel * kMaxNumChannels> fixed_frame; + std::array<std::array<float, kMaxSamplesPerChannel>, kMaxNumChannels> + float_frames; + std::array<float*, kMaxNumChannels> float_frame_ptrs; + for (int i = 0; i < kMaxNumChannels; ++i) { + float_frame_ptrs[i] = float_frames[i].data(); + } + float* const* ptr_to_float_frames = &float_frame_ptrs[0]; + + // Choose whether to fuzz the float or int16_t interfaces of APM. + const bool is_float = fuzz_data.ReadOrDefaultValue(true); + + // We may run out of fuzz data in the middle of a loop iteration. In + // that case, default values will be used for the rest of that + // iteration. + while (fuzz_data.CanReadBytes(1)) { + // Decide input/output rate for this iteration. + const int input_rate = static_cast<int>( + fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz); + const int output_rate = static_cast<int>( + fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz); + const int num_channels = fuzz_data.ReadOrDefaultValue(true) ? 2 : 1; + + // Since render and capture calls have slightly different reinitialization + // procedures, we let the fuzzer choose the order. + const bool is_capture = fuzz_data.ReadOrDefaultValue(true); + + int apm_return_code = AudioProcessing::Error::kNoError; + if (is_float) { + GenerateFloatFrame(fuzz_data, input_rate, num_channels, + ptr_to_float_frames); + + if (is_capture) { + apm_return_code = apm->ProcessStream( + ptr_to_float_frames, StreamConfig(input_rate, num_channels), + StreamConfig(output_rate, num_channels), ptr_to_float_frames); + } else { + apm_return_code = apm->ProcessReverseStream( + ptr_to_float_frames, StreamConfig(input_rate, num_channels), + StreamConfig(output_rate, num_channels), ptr_to_float_frames); + } + } else { + GenerateFixedFrame(fuzz_data, input_rate, num_channels, + fixed_frame.data()); + + if (is_capture) { + apm_return_code = apm->ProcessStream( + fixed_frame.data(), StreamConfig(input_rate, num_channels), + StreamConfig(output_rate, num_channels), fixed_frame.data()); + } else { + apm_return_code = apm->ProcessReverseStream( + fixed_frame.data(), StreamConfig(input_rate, num_channels), + StreamConfig(output_rate, num_channels), fixed_frame.data()); + } + } + // APM may flag an error on unsupported audio formats, but should not crash. + RTC_DCHECK(apm_return_code == AudioProcessing::kNoError || + apm_return_code == AudioProcessing::kBadSampleRateError); + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc new file mode 100644 index 0000000000..7f44af99fb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/comfort_noise_decoder_fuzzer.cc @@ -0,0 +1,59 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> + +#include "api/array_view.h" +#include "modules/audio_coding/codecs/cng/webrtc_cng.h" +#include "rtc_base/buffer.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace test { +namespace { + +void FuzzOneInputTest(rtc::ArrayView<const uint8_t> data) { + FuzzDataHelper fuzz_data(data); + ComfortNoiseDecoder cng_decoder; + + while (1) { + if (!fuzz_data.CanReadBytes(1)) + break; + const uint8_t sid_frame_len = fuzz_data.Read<uint8_t>(); + auto sid_frame = fuzz_data.ReadByteArray(sid_frame_len); + if (sid_frame.empty()) + break; + cng_decoder.UpdateSid(sid_frame); + if (!fuzz_data.CanReadBytes(3)) + break; + constexpr bool kTrueOrFalse[] = {true, false}; + const bool new_period = fuzz_data.SelectOneOf(kTrueOrFalse); + constexpr size_t kOutputSizes[] = {80, 160, 320, 480}; + const size_t output_size = fuzz_data.SelectOneOf(kOutputSizes); + const size_t num_generate_calls = + std::min(fuzz_data.Read<uint8_t>(), static_cast<uint8_t>(17)); + rtc::BufferT<int16_t> output(output_size); + for (size_t i = 0; i < num_generate_calls; ++i) { + cng_decoder.Generate(output, new_period); + } + } +} + +} // namespace +} // namespace test + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 5000) { + return; + } + test::FuzzOneInputTest(rtc::ArrayView<const uint8_t>(data, size)); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json new file mode 100644 index 0000000000..59b5db9446 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_fec_config.json @@ -0,0 +1,151 @@ +[ + { + "decoders" : [ + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "1" + }, + { + "profile-level-id" : "42001f" + } + ], + "payload_name" : "H264", + "payload_type" : 100 + }, + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "0" + }, + { + "profile-level-id" : "42001f" + } + ], + "payload_name" : "H264", + "payload_type" : 102 + }, + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "1" + }, + { + "profile-level-id" : "42e01f" + } + ], + "payload_name" : "H264", + "payload_type" : 127 + }, + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "0" + }, + { + "profile-level-id" : "42e01f" + } + ], + "payload_name" : "H264", + "payload_type" : 125 + }, + { + "codec_params" : [], + "payload_name" : "VP8", + "payload_type" : 96 + }, + { + "codec_params" : [], + "payload_name" : "VP9", + "payload_type" : 98 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [ + { + "encrypt" : false, + "id" : 5, + "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01" + }, + { + "encrypt" : false, + "id" : 3, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time" + }, + { + "encrypt" : false, + "id" : 6, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay" + }, + { + "encrypt" : false, + "id" : 7, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type" + }, + { + "encrypt" : false, + "id" : 8, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing" + }, + { + "encrypt" : false, + "id" : 4, + "uri" : "urn:3gpp:video-orientation" + }, + { + "encrypt" : false, + "id" : 2, + "uri" : "urn:ietf:params:rtp-hdrext:toffset" + } + ], + "local_ssrc" : 1, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : -1, + "remb" : true, + "remote_ssrc" : 2736493666, + "rtcp_mode" : "RtcpMode::kReducedSize", + "rtx_payload_types" : [ + { + "97" : 96 + }, + { + "99" : 98 + }, + { + "101" : 100 + }, + { + "107" : 125 + }, + { + "122" : 127 + }, + { + "123" : 102 + } + ], + "rtx_ssrc" : 885796452, + "transport_cc" : true, + "ulpfec_payload_type" : -1 + }, + "target_delay_ms" : 0 + } +] diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json new file mode 100644 index 0000000000..9cb5bd767b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_non_interleaved_config.json @@ -0,0 +1,66 @@ +[ + { + "decoders" : [ + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "0" + }, + { + "packetization-mode" : "0" + }, + { + "profile-level-id" : "42001f" + } + ], + "payload_name" : "H264", + "payload_type" : 100 + }, + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "1" + }, + { + "profile-level-id" : "42e01f" + } + ], + "payload_name" : "H264", + "payload_type" : 102 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [], + "local_ssrc" : 1, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : 125, + "remb" : true, + "remote_ssrc" : 1989790381, + "rtcp_mode" : "RtcpMode::kReducedSize", + "rtx_payload_types" : [ + { + "101" : 100 + }, + { + "122" : 125 + }, + { + "123" : 127 + } + ], + "rtx_ssrc" : 1406083315, + "transport_cc" : true, + "ulpfec_payload_type" : -1 + }, + "target_delay_ms" : 0 + } +] diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json new file mode 100644 index 0000000000..f3ae6bbafc --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/h264_single_nal_config.json @@ -0,0 +1,66 @@ +[ + { + "decoders" : [ + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "1" + }, + { + "profile-level-id" : "42001f" + } + ], + "payload_name" : "H264", + "payload_type" : 100 + }, + { + "codec_params" : [ + { + "level-asymmetry-allowed" : "1" + }, + { + "packetization-mode" : "1" + }, + { + "profile-level-id" : "42e01f" + } + ], + "payload_name" : "H264", + "payload_type" : 102 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [], + "local_ssrc" : 1, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : 125, + "remb" : true, + "remote_ssrc" : 1989790381, + "rtcp_mode" : "RtcpMode::kReducedSize", + "rtx_payload_types" : [ + { + "101" : 100 + }, + { + "122" : 125 + }, + { + "123" : 127 + } + ], + "rtx_ssrc" : 1406083315, + "transport_cc" : true, + "ulpfec_payload_type" : -1 + }, + "target_delay_ms" : 0 + } +] diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json new file mode 100644 index 0000000000..0a5eef8b09 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_config.json @@ -0,0 +1,29 @@ +[{ + "decoders" : [ + { + "codec_params" : [], + "payload_name" : "VP8", + "payload_type" : 125 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [], + "local_ssrc" : 7331, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : -1, + "remb" : true, + "remote_ssrc" : 1337, + "rtcp_mode" : "RtcpMode::kCompound", + "rtx_payload_types" : [], + "rtx_ssrc" : 100, + "transport_cc" : true, + "ulpfec_payload_type" : -1 + }, + "target_delay_ms" : 0 +}] diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json new file mode 100644 index 0000000000..3d2b66301d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp8_fec_config.json @@ -0,0 +1,73 @@ +[ + { + "decoders" : [ + { + "codec_params" : [], + "payload_name" : "VP8", + "payload_type" : 96 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [ + { + "encrypt" : false, + "id" : 5, + "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01" + }, + { + "encrypt" : false, + "id" : 3, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time" + }, + { + "encrypt" : false, + "id" : 6, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay" + }, + { + "encrypt" : false, + "id" : 7, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type" + }, + { + "encrypt" : false, + "id" : 8, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing" + }, + { + "encrypt" : false, + "id" : 4, + "uri" : "urn:3gpp:video-orientation" + }, + { + "encrypt" : false, + "id" : 2, + "uri" : "urn:ietf:params:rtp-hdrext:toffset" + } + ], + "local_ssrc" : 1, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : -1, + "remb" : true, + "remote_ssrc" : 2672243158, + "rtcp_mode" : "RtcpMode::kReducedSize", + "rtx_payload_types" : [ + { + "97" : 96 + }, + { + "99" : 98 + } + ], + "rtx_ssrc" : 1807563126, + "transport_cc" : true + }, + "target_delay_ms" : 0 + } +] diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json new file mode 100644 index 0000000000..a9c88a2402 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_config.json @@ -0,0 +1,29 @@ +[{ + "decoders" : [ + { + "codec_params" : [], + "payload_name" : "VP9", + "payload_type" : 124 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [], + "local_ssrc" : 7331, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : -1, + "remb" : true, + "remote_ssrc" : 1337, + "rtcp_mode" : "RtcpMode::kCompound", + "rtx_payload_types" : [], + "rtx_ssrc" : 100, + "transport_cc" : true, + "ulpfec_payload_type" : -1 + }, + "target_delay_ms" : 0 +}] diff --git a/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json new file mode 100644 index 0000000000..d089aa8fec --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/configs/replay_packet_fuzzer/vp9_fec_config.json @@ -0,0 +1,79 @@ +[ + { + "decoders" : [ + { + "codec_params" : [], + "payload_name" : "VP9", + "payload_type" : 98 + }, + { + "codec_params" : [], + "payload_name" : "VP8", + "payload_type" : 96 + } + ], + "render_delay_ms" : 10, + "rtp" : { + "extensions" : [ + { + "encrypt" : false, + "id" : 5, + "uri" : "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01" + }, + { + "encrypt" : false, + "id" : 3, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time" + }, + { + "encrypt" : false, + "id" : 6, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay" + }, + { + "encrypt" : false, + "id" : 7, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-content-type" + }, + { + "encrypt" : false, + "id" : 8, + "uri" : "http://www.webrtc.org/experiments/rtp-hdrext/video-timing" + }, + { + "encrypt" : false, + "id" : 4, + "uri" : "urn:3gpp:video-orientation" + }, + { + "encrypt" : false, + "id" : 2, + "uri" : "urn:ietf:params:rtp-hdrext:toffset" + } + ], + "local_ssrc" : 1, + "lntf" : { + "enabled": false, + }, + "nack" : { + "rtp_history_ms" : 1000 + }, + "red_payload_type" : -1, + "remb" : true, + "remote_ssrc" : 2678204013, + "rtcp_mode" : "RtcpMode::kReducedSize", + "rtx_payload_types" : [ + { + "97" : 96 + }, + { + "99" : 98 + } + ], + "rtx_ssrc" : 1110725867, + "transport_cc" : true, + "ulpfec_payload_type" : -1 + }, + "target_delay_ms" : 0 + } +] diff --git a/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc new file mode 100644 index 0000000000..e266b85fa4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc @@ -0,0 +1,52 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "absl/functional/bind_front.h" +#include "modules/congestion_controller/include/receive_side_congestion_controller.h" +#include "modules/pacing/packet_router.h" +#include "modules/remote_bitrate_estimator/include/remote_bitrate_estimator.h" +#include "modules/rtp_rtcp/source/byte_io.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + size_t i = 0; + if (size < sizeof(int64_t) + sizeof(uint8_t) + sizeof(uint32_t)) + return; + SimulatedClock clock(data[i++]); + PacketRouter packet_router; + ReceiveSideCongestionController cc( + &clock, + absl::bind_front(&PacketRouter::SendCombinedRtcpPacket, &packet_router), + absl::bind_front(&PacketRouter::SendRemb, &packet_router), nullptr); + RTPHeader header; + header.ssrc = ByteReader<uint32_t>::ReadBigEndian(&data[i]); + i += sizeof(uint32_t); + header.extension.hasTransportSequenceNumber = true; + int64_t arrival_time_ms = std::min<int64_t>( + std::max<int64_t>(ByteReader<int64_t>::ReadBigEndian(&data[i]), 0), + std::numeric_limits<int64_t>::max() / 2); + i += sizeof(int64_t); + const size_t kMinPacketSize = + sizeof(size_t) + sizeof(uint16_t) + sizeof(uint8_t); + while (i + kMinPacketSize < size) { + size_t payload_size = ByteReader<size_t>::ReadBigEndian(&data[i]) % 1500; + i += sizeof(size_t); + header.extension.transportSequenceNumber = + ByteReader<uint16_t>::ReadBigEndian(&data[i]); + i += sizeof(uint16_t); + cc.OnReceivedPacket(arrival_time_ms, payload_size, header); + clock.AdvanceTimeMilliseconds(5); + arrival_time_ms += ByteReader<uint8_t>::ReadBigEndian(&data[i]); + i += sizeof(uint8_t); + cc.MaybeProcess(); + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/corpora/README b/third_party/libwebrtc/test/fuzzers/corpora/README new file mode 100644 index 0000000000..cc87025ff6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/README @@ -0,0 +1,37 @@ +This is a collection of corpora for various WebRTC fuzzers. To use +them, the gn targets define seed_corpus=$corpus_dir, which causes the +ClusterFuzz upload bot to bundle $corpus_dir and upload it. + +The format is simple: one file per test case. Specific notes are +included below. + +### SDP ### +This corpus was initially assembled manually from the following +sources: + + - curl --silent https://www.ietf.org/rfc/rfc4317.txt | grep '^[ a-z]*=[^=]*$' | sed 's/^[[:space:]]*//' | awk -v RS='(^|\n)v=' '/./ {print "v="$0 > NR".sdp"}' + - all the SDPs used in the parser unit tests + - some manually gathered SDPs from Firefox and Opera + +The SDP tokens come from: + + - grep "^static const " webrtc/api/webrtcsdp.cc | cut -d'=' -f2 | cut -d ';' -f1 | tr -d '"' | tr -d "'" | tr -d ' ' | sort -u | grep -v '^(\n|\r|\r\n)$|^$' | sed -e 's/^/"/' -e 's/$/"/' | tail -n +2 + +### STUN ### +This corpus was initially assembled from the STUN unit tests, together +with a crash that it found relatively quickly. + +### RT(C)P ### +This corpus was initially assembled from the unittests. RTCP was +minimised first. + +There is also rt(c?)p-corpus-with-extra-byte, in which each sample is +prefixed by the byte 0xff. Some of the rtp fuzzers need to decide +which header extensions to enable, and the first byte of the fuzz data +is used for this. + +### PseudoTCP ### +Very small corpus minimised from the unit tests. + +### SCTP ### +This corpus was extracted from a few manually recorder wireshark dumps. diff --git a/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json b/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json new file mode 100644 index 0000000000..4dcbcee53a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/aec3-config-json-corpus/default.json @@ -0,0 +1 @@ +{"aec3": {"buffering": {"excess_render_detection_interval_blocks": 250,"max_allowed_excess_render_blocks": 8},"delay": {"default_delay": 5,"down_sampling_factor": 4,"num_filters": 5,"delay_headroom_samples": 32,"hysteresis_limit_blocks": 1,"fixed_capture_delay_samples": 0,"delay_estimate_smoothing": 0.7,"delay_candidate_detection_threshold": 0.2,"delay_selection_thresholds": {"initial": 5,"converged": 20},"use_external_delay_estimator": false,"downmix_before_delay_estimation": true,"log_warning_on_delay_changes": false},"filter": {"main": [13,5e-05,0.05,0.001,2,2.00753e+07],"shadow": [13,0.7,2.00753e+07],"main_initial": [12,0.005,0.5,0.001,2,2.00753e+07],"shadow_initial": [12,0.9,2.00753e+07],"config_change_duration_blocks": 250,"initial_state_seconds": 2.5,"conservative_initial_phase": false,"enable_shadow_filter_output_usage": true},"erle": {"min": 1,"max_l": 4,"max_h": 1.5,"onset_detection": true,"num_sections": 1,"clamp_quality_estimate_to_zero": true,"clamp_quality_estimate_to_one": true},"ep_strength": {"default_gain": 1,"default_len": 0.83,"echo_can_saturate": true,"bounded_erl": false},"echo_audibility": {"low_render_limit": 256,"normal_render_limit": 64,"floor_power": 128,"audibility_threshold_lf": 10,"audibility_threshold_mf": 10,"audibility_threshold_hf": 10,"use_stationarity_properties": false,"use_stationarity_properties_at_init": false},"render_levels": {"active_render_limit": 100,"poor_excitation_render_limit": 150,"poor_excitation_render_limit_ds8": 20},"echo_removal_control": {"has_clock_drift": false,"linear_and_stable_echo_path": false},"echo_model": {"noise_floor_hold": 50,"min_noise_floor_power": 1.6384e+06,"stationary_gate_slope": 10,"noise_gate_power": 27509.4,"noise_gate_slope": 0.3,"render_pre_window_size": 1,"render_post_window_size": 1},"suppressor": {"nearend_average_blocks": 4,"normal_tuning": {"mask_lf": [0.3,0.4,0.3],"mask_hf": [0.07,0.1,0.3],"max_inc_factor": 2,"max_dec_factor_lf": 0.25},"nearend_tuning": {"mask_lf": [1.09,1.1,0.3],"mask_hf": [0.1,0.3,0.3],"max_inc_factor": 2,"max_dec_factor_lf": 0.25},"dominant_nearend_detection": {"enr_threshold": 0.25,"enr_exit_threshold": 10,"snr_threshold": 30,"hold_duration": 50,"trigger_threshold": 12,"use_during_initial_phase": 1},"high_bands_suppression": {"enr_threshold": 1,"max_gain_during_echo": 1},"floor_first_increase": 1e-05,"enforce_transparent": false,"enforce_empty_higher_bands": false}}} diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1 Binary files differnew file mode 100644 index 0000000000..cda107c534 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2 Binary files differnew file mode 100644 index 0000000000..bf1a98dccd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-2 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3 Binary files differnew file mode 100644 index 0000000000..f28283502a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-3 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4 b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4 Binary files differnew file mode 100644 index 0000000000..7b5d1cd790 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/agc-corpus/agc-4 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 Binary files differnew file mode 100644 index 0000000000..da32f0c29c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 Binary files differnew file mode 100644 index 0000000000..097af39c3f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 Binary files differnew file mode 100644 index 0000000000..a9f4011d3f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 Binary files differnew file mode 100644 index 0000000000..b4ba1578cd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0 Binary files differnew file mode 100644 index 0000000000..fc56e0e591 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1 Binary files differnew file mode 100644 index 0000000000..b5c147f9f3 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10 Binary files differnew file mode 100644 index 0000000000..ced48741aa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-10 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11 new file mode 100644 index 0000000000..53afe97468 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-11 @@ -0,0 +1 @@ +ÿÿÿÿÿ°Ë±±o
\ No newline at end of file diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12 Binary files differnew file mode 100644 index 0000000000..4d126eacc3 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-12 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13 Binary files differnew file mode 100644 index 0000000000..847e67b79a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-13 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14 Binary files differnew file mode 100644 index 0000000000..f5efdd1317 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-14 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15 Binary files differnew file mode 100644 index 0000000000..830dc8a679 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-15 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16 Binary files differnew file mode 100644 index 0000000000..06017917dc --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-16 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2 Binary files differnew file mode 100644 index 0000000000..43cf72619c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-2 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3 Binary files differnew file mode 100644 index 0000000000..a2e8e0c9ae --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-3 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4 Binary files differnew file mode 100644 index 0000000000..ff5785f0c3 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-4 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5 Binary files differnew file mode 100644 index 0000000000..f1196c98aa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-5 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6 Binary files differnew file mode 100644 index 0000000000..88ce0a1600 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-6 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7 Binary files differnew file mode 100644 index 0000000000..9adb5c2125 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-7 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8 new file mode 100644 index 0000000000..5a8f929a61 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-8 @@ -0,0 +1,2 @@ +ÿÿÿÞ +‚ÿ diff --git a/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9 b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9 Binary files differnew file mode 100644 index 0000000000..bde1b127b3 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/dependency_descriptor-corpus/dependency-descriptor-9 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0 new file mode 100644 index 0000000000..73e1d22f10 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-0 @@ -0,0 +1 @@ +WebRTC-DecoderDataDumpDirectory/Enabled/ diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1 new file mode 100644 index 0000000000..997888a6fd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-1 @@ -0,0 +1 @@ +WebRTC-DecoderDataDumpDirectory/Disabled/ diff --git a/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2 b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2 new file mode 100644 index 0000000000..7e897a418d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/field_trial-corpus/field-trial-2 @@ -0,0 +1 @@ +WebRTC-DecoderDataDumpDirectory/Disabled/WebRTC-IPv6Default/Enabled/ diff --git a/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 Binary files differnew file mode 100644 index 0000000000..dbe089f278 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1 b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1 Binary files differnew file mode 100644 index 0000000000..dcb9c476f0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns Binary files differnew file mode 100644 index 0000000000..6e1789a83b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/1.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns Binary files differnew file mode 100644 index 0000000000..f5fa6f8d17 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/10.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns Binary files differnew file mode 100644 index 0000000000..f72f28c13c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/11.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns Binary files differnew file mode 100644 index 0000000000..9efa76d64a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/12.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns Binary files differnew file mode 100644 index 0000000000..538a5a62dc --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/13.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns Binary files differnew file mode 100644 index 0000000000..d4ce4efea8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/14.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns Binary files differnew file mode 100644 index 0000000000..ff2810565b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/15.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns Binary files differnew file mode 100644 index 0000000000..a1a02d7f8e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/16.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns Binary files differnew file mode 100644 index 0000000000..ba30f7bc2f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/17.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns Binary files differnew file mode 100644 index 0000000000..7cbdd3e7a0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/18.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns Binary files differnew file mode 100644 index 0000000000..f70eaa3ab2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/19.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns Binary files differnew file mode 100644 index 0000000000..7d259c2ea9 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/2.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns Binary files differnew file mode 100644 index 0000000000..6681f943e4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/20.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns Binary files differnew file mode 100644 index 0000000000..3ac4fd6c98 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/3.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns Binary files differnew file mode 100644 index 0000000000..3207842f48 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/4.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns Binary files differnew file mode 100644 index 0000000000..871ea41405 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/5.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns Binary files differnew file mode 100644 index 0000000000..ee2f8eca1c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/6.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns Binary files differnew file mode 100644 index 0000000000..d37b935654 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/7.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns Binary files differnew file mode 100644 index 0000000000..dd2f976afd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/8.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns Binary files differnew file mode 100644 index 0000000000..a01e729342 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/mdns-corpus/9.mdns diff --git a/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511 b/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511 Binary files differnew file mode 100644 index 0000000000..21f5cffa12 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/pseudotcp-corpus/785b96587d0eb44dd5d75b7a886f37e2ac504511 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp Binary files differnew file mode 100644 index 0000000000..802eecf052 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/0.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp Binary files differnew file mode 100644 index 0000000000..c062793b3c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/1.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp Binary files differnew file mode 100644 index 0000000000..fdc7780218 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/10.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp Binary files differnew file mode 100644 index 0000000000..994f721dca --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/11.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp Binary files differnew file mode 100644 index 0000000000..557fe9c23a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/12.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp Binary files differnew file mode 100644 index 0000000000..0f1b1809a7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/13.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp Binary files differnew file mode 100644 index 0000000000..df6bfed86c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/14.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp Binary files differnew file mode 100644 index 0000000000..3b31b3079d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/15.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp Binary files differnew file mode 100644 index 0000000000..0496ddf910 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/16.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp Binary files differnew file mode 100644 index 0000000000..755b7198ba --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/17.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp Binary files differnew file mode 100644 index 0000000000..04fd1e3417 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/18.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp Binary files differnew file mode 100644 index 0000000000..8ae9812f10 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/19.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp Binary files differnew file mode 100644 index 0000000000..ba38a0a599 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/2.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp Binary files differnew file mode 100644 index 0000000000..debb7de940 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/20.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp Binary files differnew file mode 100644 index 0000000000..3fcbd405e2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/21.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp Binary files differnew file mode 100644 index 0000000000..3defd8c253 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/22.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp Binary files differnew file mode 100644 index 0000000000..211ccbd5be --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/23.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp Binary files differnew file mode 100644 index 0000000000..8ded9be7fd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/24.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp Binary files differnew file mode 100644 index 0000000000..b5c8146cef --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/25.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp Binary files differnew file mode 100644 index 0000000000..0fd4f25511 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/26.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp Binary files differnew file mode 100644 index 0000000000..2c8bb63c9c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/27.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp Binary files differnew file mode 100644 index 0000000000..6a20bc27d8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/28.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp Binary files differnew file mode 100644 index 0000000000..76fd214197 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/29.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp Binary files differnew file mode 100644 index 0000000000..72307e08bd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/3.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp Binary files differnew file mode 100644 index 0000000000..cfa38faa67 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/30.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp Binary files differnew file mode 100644 index 0000000000..8abf725057 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/31.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp Binary files differnew file mode 100644 index 0000000000..76518c88dd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/32.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp Binary files differnew file mode 100644 index 0000000000..92964965a6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/33.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp Binary files differnew file mode 100644 index 0000000000..9045c158b5 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/34.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp Binary files differnew file mode 100644 index 0000000000..f86df02448 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/35.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp Binary files differnew file mode 100644 index 0000000000..d274d416a2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/36.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp Binary files differnew file mode 100644 index 0000000000..b4f04f4069 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/37.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp Binary files differnew file mode 100644 index 0000000000..8d65e0ff35 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/38.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp Binary files differnew file mode 100644 index 0000000000..fb969f85f0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/39.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp Binary files differnew file mode 100644 index 0000000000..5170185122 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/4.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp Binary files differnew file mode 100644 index 0000000000..279047c6b2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/40.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp Binary files differnew file mode 100644 index 0000000000..09a8a589bd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/41.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp Binary files differnew file mode 100644 index 0000000000..f727b190a7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/42.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp Binary files differnew file mode 100644 index 0000000000..9aab33a48a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/43.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp Binary files differnew file mode 100644 index 0000000000..2eba529c3a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/44.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp Binary files differnew file mode 100644 index 0000000000..50c0beabed --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/45.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp Binary files differnew file mode 100644 index 0000000000..2de424a5d1 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/46.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp new file mode 100644 index 0000000000..71d530b41f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/47.rtcp @@ -0,0 +1 @@ +€
\ No newline at end of file diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp Binary files differnew file mode 100644 index 0000000000..665695029a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/48.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp Binary files differnew file mode 100644 index 0000000000..33b0f3d873 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/49.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp Binary files differnew file mode 100644 index 0000000000..46bef3242a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/5.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp Binary files differnew file mode 100644 index 0000000000..5bec125397 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/50.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp Binary files differnew file mode 100644 index 0000000000..ff94fb84b7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/51.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp Binary files differnew file mode 100644 index 0000000000..55cc76cd81 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/52.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp Binary files differnew file mode 100644 index 0000000000..ac11523c94 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/53.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp Binary files differnew file mode 100644 index 0000000000..f3f0bb8fa1 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/54.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp new file mode 100644 index 0000000000..e69de29bb2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/55.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp Binary files differnew file mode 100644 index 0000000000..f0012f1efa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/56.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp Binary files differnew file mode 100644 index 0000000000..61517f01d8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/57.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp Binary files differnew file mode 100644 index 0000000000..3688310a05 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/58.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp Binary files differnew file mode 100644 index 0000000000..e914f83b16 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/59.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp Binary files differnew file mode 100644 index 0000000000..dcad8f6b40 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/6.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp Binary files differnew file mode 100644 index 0000000000..8e999e7832 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/60.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp Binary files differnew file mode 100644 index 0000000000..eb38d237aa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/61.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp Binary files differnew file mode 100644 index 0000000000..6df94b715f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/62.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp Binary files differnew file mode 100644 index 0000000000..a3b2acb3a8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/63.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp Binary files differnew file mode 100644 index 0000000000..4d50c0f4ae --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/64.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp Binary files differnew file mode 100644 index 0000000000..537d10c6ce --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/65.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp Binary files differnew file mode 100644 index 0000000000..f280f3ca09 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/66.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp Binary files differnew file mode 100644 index 0000000000..f8f74e12c6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/7.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp Binary files differnew file mode 100644 index 0000000000..f0ceba83f4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/8.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp Binary files differnew file mode 100644 index 0000000000..7cc07893c3 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtcp-corpus/9.rtcp diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0 Binary files differnew file mode 100644 index 0000000000..c93ce82ec0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1 Binary files differnew file mode 100644 index 0000000000..84834aefea --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2 Binary files differnew file mode 100644 index 0000000000..3a5aedba9b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-2 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3 Binary files differnew file mode 100644 index 0000000000..300309ff37 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-3 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4 Binary files differnew file mode 100644 index 0000000000..84834aefea --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-4 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5 Binary files differnew file mode 100644 index 0000000000..7dd6632007 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-5 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6 Binary files differnew file mode 100644 index 0000000000..3a1145cd0f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-6 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7 Binary files differnew file mode 100644 index 0000000000..6c4a9feb52 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-7 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8 Binary files differnew file mode 100644 index 0000000000..4b069389b1 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-corpus/rtp-8 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 b/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 new file mode 100644 index 0000000000..540a770e29 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtp-depacketizer-av1-assemble-frame-corpus/av1-assemble-frame-0 @@ -0,0 +1 @@ +ô0ÿÿÿ¸¸¸
\ No newline at end of file diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump Binary files differnew file mode 100644 index 0000000000..328559820d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp8/vp8.rtpdump diff --git a/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump Binary files differnew file mode 100644 index 0000000000..4dc780cd16 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/rtpdump-corpus/vp9/vp9.rtpdump diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin Binary files differnew file mode 100644 index 0000000000..4374f5aad5 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-ack-sack.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin Binary files differnew file mode 100644 index 0000000000..1f1d0be301 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data-data.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin Binary files differnew file mode 100644 index 0000000000..21a0c22837 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data-data.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin Binary files differnew file mode 100644 index 0000000000..fc8600106e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/cookie-echo-data.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin Binary files differnew file mode 100644 index 0000000000..bec7b289e7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/data-fragment1.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin Binary files differnew file mode 100644 index 0000000000..ab98a0a4a7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/forward-tsn.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin Binary files differnew file mode 100644 index 0000000000..59200abe5e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat-ack.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin Binary files differnew file mode 100644 index 0000000000..cef8cfe929 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/heartbeat.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin Binary files differnew file mode 100644 index 0000000000..80438434d0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init-ack.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin Binary files differnew file mode 100644 index 0000000000..3fb4977d58 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/init.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin Binary files differnew file mode 100644 index 0000000000..74c74f3377 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/re-config.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin Binary files differnew file mode 100644 index 0000000000..fe4de63863 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-data.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin Binary files differnew file mode 100644 index 0000000000..08494c1515 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sctp-packet-corpus/sack-gap-ack-1.bin diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp new file mode 100644 index 0000000000..36319c4476 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/10.sdp @@ -0,0 +1,11 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:97 iLBC/8000 +m=audio 49172 RTP/AVP 98 +a=rtpmap:98 telephone-event/8000 +a=sendonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp new file mode 100644 index 0000000000..c3dbce401f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/11.sdp @@ -0,0 +1,10 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=audio 49174 RTP/AVP 98 +a=rtpmap:98 telephone-event/8000 +a=recvonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp new file mode 100644 index 0000000000..26d4ff6266 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/12.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp new file mode 100644 index 0000000000..f625e3890c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/13.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49174 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 49170 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp new file mode 100644 index 0000000000..c36b9fe6cb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/14.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 newhost.biloxi.example.com +t=0 0 +m=audio 49178 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 49188 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp new file mode 100644 index 0000000000..26d4ff6266 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/15.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp new file mode 100644 index 0000000000..1d187a0dc5 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/16.sdp @@ -0,0 +1,10 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=audio 51372 RTP/AVP 97 101 +a=rtpmap:97 iLBC/8000 +a=rtpmap:101 telephone-event/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp new file mode 100644 index 0000000000..a328d16a16 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/17.sdp @@ -0,0 +1,10 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 0 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=audio 49170 RTP/AVP 97 101 +a=rtpmap:97 iLBC/8000 +a=rtpmap:101 telephone-event/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp new file mode 100644 index 0000000000..1e0d3f5705 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/18.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 99 +a=rtpmap:99 iLBC/8000 +m=video 51372 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp new file mode 100644 index 0000000000..a9a5e12138 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/19.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 99 +a=rtpmap:99 iLBC/8000 +m=video 51374 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp new file mode 100644 index 0000000000..96c4975ec0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/2.sdp @@ -0,0 +1,12 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 8 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 32 +a=rtpmap:31 H261/90000 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp new file mode 100644 index 0000000000..b2c072af1d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/20.sdp @@ -0,0 +1,10 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 99 +a=rtpmap:99 iLBC/8000 +m=video 51372 RTP/AVP 31 32 +a=rtpmap:31 H261/90000 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp new file mode 100644 index 0000000000..28e949133e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/21.sdp @@ -0,0 +1,10 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 99 +a=rtpmap:99 iLBC/8000 +m=video 51374 RTP/AVP 31 32 +a=rtpmap:31 H261/90000 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp new file mode 100644 index 0000000000..96c4975ec0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/22.sdp @@ -0,0 +1,12 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 8 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 32 +a=rtpmap:31 H261/90000 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp new file mode 100644 index 0000000000..36c7d70148 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/23.sdp @@ -0,0 +1,10 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49174 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=video 49172 RTP/AVP 32 +c=IN IP4 otherhost.biloxi.example.com +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp new file mode 100644 index 0000000000..6cf5dc5894 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/24.sdp @@ -0,0 +1,8 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp new file mode 100644 index 0000000000..ac1ec85b29 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/25.sdp @@ -0,0 +1,8 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 placeholder.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +a=sendonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp new file mode 100644 index 0000000000..f0eb0d62a7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/26.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp new file mode 100644 index 0000000000..1e4f3b3e19 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/27.sdp @@ -0,0 +1,7 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49178 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp new file mode 100644 index 0000000000..36319c4476 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/28.sdp @@ -0,0 +1,11 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:97 iLBC/8000 +m=audio 49172 RTP/AVP 98 +a=rtpmap:98 telephone-event/8000 +a=sendonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp new file mode 100644 index 0000000000..c3dbce401f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/29.sdp @@ -0,0 +1,10 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=audio 49174 RTP/AVP 98 +a=rtpmap:98 telephone-event/8000 +a=recvonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp new file mode 100644 index 0000000000..b0142f5dcf --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/3.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49174 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=video 49170 RTP/AVP 32 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp new file mode 100644 index 0000000000..0798631d2e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/30.sdp @@ -0,0 +1,11 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +a=sendonly +m=audio 49174 RTP/AVP 98 +a=rtpmap:98 telephone-event/8000 +a=recvonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp new file mode 100644 index 0000000000..78efdd8fcb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/31.sdp @@ -0,0 +1,11 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:97 iLBC/8000 +m=audio 49172 RTP/AVP 98 +a=rtpmap:98 telephone-event/8000 +a=sendonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp new file mode 100644 index 0000000000..6cf5dc5894 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/32.sdp @@ -0,0 +1,8 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp new file mode 100644 index 0000000000..23f462f5a6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/33.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp new file mode 100644 index 0000000000..b52b947486 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/34.sdp @@ -0,0 +1,11 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=audio 48282 RTP/AVP 98 +c=IN IP4 mediaserver.biloxi.example.com +a=rtpmap:98 telephone-event/8000 +a=recvonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp new file mode 100644 index 0000000000..07ad4f8758 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/35.sdp @@ -0,0 +1,11 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=audio 49172 RTP/AVP 98 +c=IN IP4 host.atlanta.example.com +a=rtpmap:98 telephone-event/8000 +a=sendonly diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp new file mode 100644 index 0000000000..c75c6977bb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/36.sdp @@ -0,0 +1,7 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp new file mode 100644 index 0000000000..d05dbd61fd --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/37.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp new file mode 100644 index 0000000000..253ac0705a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/38.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=video 49172 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp new file mode 100644 index 0000000000..57d3203c74 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/39.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=video 49168 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp new file mode 100644 index 0000000000..96c4975ec0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/4.sdp @@ -0,0 +1,12 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 8 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 32 +a=rtpmap:31 H261/90000 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp new file mode 100644 index 0000000000..26d4ff6266 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/40.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp new file mode 100644 index 0000000000..f625e3890c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/41.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49174 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 49170 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp new file mode 100644 index 0000000000..2dda9bb252 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/42.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49174 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 0 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp new file mode 100644 index 0000000000..83a2bf9e66 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/43.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 +m=video 0 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp new file mode 100644 index 0000000000..e187d7df7d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/44.sdp @@ -0,0 +1,5 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp new file mode 100644 index 0000000000..9e344f035a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/45.sdp @@ -0,0 +1,5 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp new file mode 100644 index 0000000000..8a63ca0992 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/46.sdp @@ -0,0 +1,7 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp new file mode 100644 index 0000000000..66dadbb93f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/47.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp new file mode 100644 index 0000000000..6df76ab942 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/48.sdp @@ -0,0 +1,7 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 0.0.0.0 +t=0 0 +m=audio 23442 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp new file mode 100644 index 0000000000..23f462f5a6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/49.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp new file mode 100644 index 0000000000..264ab8024f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/5.sdp @@ -0,0 +1,10 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 0 8 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +m=video 0 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp new file mode 100644 index 0000000000..8a63ca0992 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/50.sdp @@ -0,0 +1,7 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp new file mode 100644 index 0000000000..23f462f5a6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/51.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp new file mode 100644 index 0000000000..7c1730eb1e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/52.sdp @@ -0,0 +1,7 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp new file mode 100644 index 0000000000..599157691a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/53.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 0.0.0.0 +t=0 0 +m=audio 9322 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp new file mode 100644 index 0000000000..66dadbb93f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/54.sdp @@ -0,0 +1,7 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp new file mode 100644 index 0000000000..bd724c471b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/55.sdp @@ -0,0 +1,8 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 97 +a=rtpmap:97 iLBC/8000 + diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp new file mode 100644 index 0000000000..3f80345e30 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/6.sdp @@ -0,0 +1,9 @@ +v=0 +o=alice 2890844526 2890844527 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 51372 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=video 0 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp new file mode 100644 index 0000000000..920ad8229e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/7.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844565 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 0 +a=rtpmap:0 PCMU/8000 +m=video 0 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp new file mode 100644 index 0000000000..96c4975ec0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/8.sdp @@ -0,0 +1,12 @@ +v=0 +o=alice 2890844526 2890844526 IN IP4 host.atlanta.example.com +s= +c=IN IP4 host.atlanta.example.com +t=0 0 +m=audio 49170 RTP/AVP 0 8 97 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=rtpmap:97 iLBC/8000 +m=video 51372 RTP/AVP 31 32 +a=rtpmap:31 H261/90000 +a=rtpmap:32 MPV/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp new file mode 100644 index 0000000000..a9a5e12138 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/9.sdp @@ -0,0 +1,9 @@ +v=0 +o=bob 2808844564 2808844564 IN IP4 host.biloxi.example.com +s= +c=IN IP4 host.biloxi.example.com +t=0 0 +m=audio 49172 RTP/AVP 99 +a=rtpmap:99 iLBC/8000 +m=video 51374 RTP/AVP 31 +a=rtpmap:31 H261/90000 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp new file mode 100644 index 0000000000..6d664bc051 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-1.sdp @@ -0,0 +1,58 @@ +v=0 +o=mozilla...THIS_IS_SDPARTA-46.0.1 5115930144083302970 0 IN IP4 0.0.0.0 +s=- +t=0 0 +a=fingerprint:sha-256 24:67:5E:1B:9A:B9:CF:36:C5:30:8F:35:F7:B1:50:66:88:81:92:CB:29:BA:53:A5:02:C8:0A:A5:4E:9C:AE:D9 +a=group:BUNDLE sdparta_0 sdparta_1 sdparta_2 +a=ice-options:trickle +a=msid-semantic:WMS * +m=audio 9 UDP/TLS/RTP/SAVPF 109 9 0 8 +c=IN IP4 0.0.0.0 +a=sendrecv +a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level +a=fmtp:109 maxplaybackrate=48000;stereo=1 +a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3 +a=ice-ufrag:3edc9012 +a=mid:sdparta_0 +a=msid:{258e92fb-547c-40ca-92e9-efe0cedb4cba} {bd1fafff-bfd0-40d4-b0a3-2a87cff307ee} +a=rtcp-mux +a=rtpmap:109 opus/48000/2 +a=rtpmap:9 G722/8000/1 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=setup:actpass +a=ssrc:2121669360 cname:{387b0735-bde2-43a4-8484-7f5663b60f24} +m=video 9 UDP/TLS/RTP/SAVPF 120 126 97 +c=IN IP4 0.0.0.0 +a=sendrecv +a=fmtp:126 profile-level-id=42e01f;level-asymmetry-allowed=1;packetization-mode=1 +a=fmtp:97 profile-level-id=42e01f;level-asymmetry-allowed=1 +a=fmtp:120 max-fs=12288;max-fr=60 +a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3 +a=ice-ufrag:3edc9012 +a=mid:sdparta_1 +a=msid:{258e92fb-547c-40ca-92e9-efe0cedb4cba} {9e8f5867-a9aa-4489-8bd4-3a8a57a5e592} +a=rtcp-fb:120 nack +a=rtcp-fb:120 nack pli +a=rtcp-fb:120 ccm fir +a=rtcp-fb:126 nack +a=rtcp-fb:126 nack pli +a=rtcp-fb:126 ccm fir +a=rtcp-fb:97 nack +a=rtcp-fb:97 nack pli +a=rtcp-fb:97 ccm fir +a=rtcp-mux +a=rtpmap:120 VP8/90000 +a=rtpmap:126 H264/90000 +a=rtpmap:97 H264/90000 +a=setup:actpass +a=ssrc:2158832026 cname:{387b0735-bde2-43a4-8484-7f5663b60f24} +m=application 9 DTLS/SCTP 5000 +c=IN IP4 0.0.0.0 +a=sendrecv +a=ice-pwd:b9f3911b591ae61e2d7f6af0531fd2a3 +a=ice-ufrag:3edc9012 +a=mid:sdparta_2 +a=sctpmap:5000 webrtc-datachannel 256 +a=setup:actpass +a=ssrc:2670959794 cname:{387b0735-bde2-43a4-8484-7f5663b60f24} diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp new file mode 100644 index 0000000000..07806eb225 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/firefox-2.sdp @@ -0,0 +1,43 @@ +v=0 +o=mozilla...THIS_IS_SDPARTA-46.0.1 3068771576687940834 0 IN IP4 0.0.0.0 +s=- +t=0 0 +a=fingerprint:sha-256 AD:87:B3:11:E4:E2:BA:EF:D2:3F:2E:AC:24:57:8E:DC:1F:67:41:29:44:C4:96:E3:62:90:CC:90:59:CA:2C:84 +a=group:BUNDLE sdparta_0 sdparta_1 sdparta_2 +a=ice-options:trickle +a=msid-semantic:WMS * +m=audio 9 UDP/TLS/RTP/SAVPF 109 +c=IN IP4 0.0.0.0 +a=recvonly +a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level +a=fmtp:109 maxplaybackrate=48000;stereo=1 +a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5 +a=ice-ufrag:a539544b +a=mid:sdparta_0 +a=rtcp-mux +a=rtpmap:109 opus/48000/2 +a=setup:active +a=ssrc:600995474 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a} +m=video 9 UDP/TLS/RTP/SAVPF 120 +c=IN IP4 0.0.0.0 +a=recvonly +a=fmtp:120 max-fs=12288;max-fr=60 +a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5 +a=ice-ufrag:a539544b +a=mid:sdparta_1 +a=rtcp-fb:120 nack +a=rtcp-fb:120 nack pli +a=rtcp-fb:120 ccm fir +a=rtcp-mux +a=rtpmap:120 VP8/90000 +a=setup:active +a=ssrc:3480150809 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a} +m=application 9 DTLS/SCTP 5000 +c=IN IP4 0.0.0.0 +a=sendrecv +a=ice-pwd:ff4c4dc6fe92e1f22d2c10352d8967d5 +a=ice-ufrag:a539544b +a=mid:sdparta_2 +a=sctpmap:5000 webrtc-datachannel 256 +a=setup:active +a=ssrc:3021788991 cname:{5b598a29-a81b-4ffe-a2c5-507778057e7a} diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp new file mode 100644 index 0000000000..42d15e81f4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-1.sdp @@ -0,0 +1,85 @@ +v=0 +o=- 1656229333038673902 2 IN IP4 127.0.0.1 +s=- +t=0 0 +a=group:BUNDLE audio video data +a=msid-semantic: WMS Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 +m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 126 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:1Jyk4q3nLIL5NiMx +a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH +a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA +a=setup:actpass +a=mid:audio +a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level +a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time +a=sendrecv +a=rtcp-mux +a=rtpmap:111 opus/48000/2 +a=rtcp-fb:111 transport-cc +a=fmtp:111 minptime=10; useinbandfec=1 +a=rtpmap:103 ISAC/16000 +a=rtpmap:104 ISAC/32000 +a=rtpmap:9 G722/8000 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=rtpmap:106 CN/32000 +a=rtpmap:105 CN/16000 +a=rtpmap:13 CN/8000 +a=rtpmap:126 telephone-event/8000 +a=maxptime:60 +a=ssrc:2233075910 cname:VhHMGYCjn4alR9zP +a=ssrc:2233075910 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 689d3496-0896-4d52-bce6-8e90512a368b +a=ssrc:2233075910 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 +a=ssrc:2233075910 label:689d3496-0896-4d52-bce6-8e90512a368b +m=video 9 UDP/TLS/RTP/SAVPF 100 101 116 117 96 97 98 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:1Jyk4q3nLIL5NiMx +a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH +a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA +a=setup:actpass +a=mid:video +a=extmap:2 urn:ietf:params:rtp-hdrext:toffset +a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time +a=extmap:4 urn:3gpp:video-orientation +a=sendrecv +a=rtcp-mux +a=rtpmap:100 VP8/90000 +a=rtcp-fb:100 ccm fir +a=rtcp-fb:100 nack +a=rtcp-fb:100 nack pli +a=rtcp-fb:100 goog-remb +a=rtcp-fb:100 transport-cc +a=rtpmap:101 VP9/90000 +a=rtcp-fb:101 ccm fir +a=rtcp-fb:101 nack +a=rtcp-fb:101 nack pli +a=rtcp-fb:101 goog-remb +a=rtcp-fb:101 transport-cc +a=rtpmap:116 red/90000 +a=rtpmap:117 ulpfec/90000 +a=rtpmap:96 rtx/90000 +a=fmtp:96 apt=100 +a=rtpmap:97 rtx/90000 +a=fmtp:97 apt=101 +a=rtpmap:98 rtx/90000 +a=fmtp:98 apt=116 +a=ssrc-group:FID 50498894 2399294607 +a=ssrc:50498894 cname:VhHMGYCjn4alR9zP +a=ssrc:50498894 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 1aef96f4-fc4c-4f86-98f3-0fbf4f625f70 +a=ssrc:50498894 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 +a=ssrc:50498894 label:1aef96f4-fc4c-4f86-98f3-0fbf4f625f70 +a=ssrc:2399294607 cname:VhHMGYCjn4alR9zP +a=ssrc:2399294607 msid:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 1aef96f4-fc4c-4f86-98f3-0fbf4f625f70 +a=ssrc:2399294607 mslabel:Ppsa09YmDLBombOh5e8HqfqxEIPF69a46Hd4 +a=ssrc:2399294607 label:1aef96f4-fc4c-4f86-98f3-0fbf4f625f70 +m=application 9 DTLS/SCTP 5000 +c=IN IP4 0.0.0.0 +a=ice-ufrag:1Jyk4q3nLIL5NiMx +a=ice-pwd:GL8/iarMqPIhImfnsG2dyXlH +a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA +a=setup:actpass +a=mid:data +a=sctpmap:5000 webrtc-datachannel 1024 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp new file mode 100644 index 0000000000..6ed4e3b4a8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/opera-2.sdp @@ -0,0 +1,73 @@ +v=0 +o=- 2013283641453412290 2 IN IP4 127.0.0.1 +s=- +t=0 0 +a=group:BUNDLE audio video data +a=msid-semantic: WMS +m=audio 9 UDP/TLS/RTP/SAVPF 111 103 104 9 0 8 106 105 13 126 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:YVa3KTlFDCwsfPOQ +a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa +a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA +a=setup:active +a=mid:audio +a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level +a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time +a=recvonly +a=rtcp-mux +a=rtpmap:111 opus/48000/2 +a=rtcp-fb:111 transport-cc +a=fmtp:111 minptime=10; useinbandfec=1 +a=rtpmap:103 ISAC/16000 +a=rtpmap:104 ISAC/32000 +a=rtpmap:9 G722/8000 +a=rtpmap:0 PCMU/8000 +a=rtpmap:8 PCMA/8000 +a=rtpmap:106 CN/32000 +a=rtpmap:105 CN/16000 +a=rtpmap:13 CN/8000 +a=rtpmap:126 telephone-event/8000 +a=maxptime:60 +m=video 9 UDP/TLS/RTP/SAVPF 100 101 116 117 96 97 98 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:YVa3KTlFDCwsfPOQ +a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa +a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA +a=setup:active +a=mid:video +a=extmap:2 urn:ietf:params:rtp-hdrext:toffset +a=extmap:3 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time +a=extmap:4 urn:3gpp:video-orientation +a=recvonly +a=rtcp-mux +a=rtpmap:100 VP8/90000 +a=rtcp-fb:100 ccm fir +a=rtcp-fb:100 nack +a=rtcp-fb:100 nack pli +a=rtcp-fb:100 goog-remb +a=rtcp-fb:100 transport-cc +a=rtpmap:101 VP9/90000 +a=rtcp-fb:101 ccm fir +a=rtcp-fb:101 nack +a=rtcp-fb:101 nack pli +a=rtcp-fb:101 goog-remb +a=rtcp-fb:101 transport-cc +a=rtpmap:116 red/90000 +a=rtpmap:117 ulpfec/90000 +a=rtpmap:96 rtx/90000 +a=fmtp:96 apt=100 +a=rtpmap:97 rtx/90000 +a=fmtp:97 apt=101 +a=rtpmap:98 rtx/90000 +a=fmtp:98 apt=116 +m=application 9 DTLS/SCTP 5000 +c=IN IP4 0.0.0.0 +b=AS:30 +a=ice-ufrag:YVa3KTlFDCwsfPOQ +a=ice-pwd:ByUn1Od88VokVM0rtQ/bbeZa +a=fingerprint:sha-256 5A:16:96:94:B2:AC:60:27:64:C5:FE:46:6C:02:C0:CD:49:E3:E2:0B:5B:C9:D4:86:C4:B3:A4:F2:23:80:7A:DA +a=setup:active +a=mid:data +a=sctpmap:5000 webrtc-datachannel 1024 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp new file mode 100644 index 0000000000..e7a219812b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.1.sdp @@ -0,0 +1,41 @@ +v=0 +o=- 367669362084170381 2 IN IP4 127.0.0.1 +s=- +t=0 0 +a=group:BUNDLE 0 +a=msid-semantic: WMS VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 +m=video 9 UDP/TLS/RTP/SAVPF 96 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:OLwt +a=ice-pwd:kjGBqIFYs8UqCyfmJ7nEJw/Q +a=ice-options:trickle +a=fingerprint:sha-256 B4:AB:3E:01:90:D1:FC:22:8F:05:6A:01:76:B6:C5:0D:45:88:1A:E1:99:AF:18:43:E6:18:BB:D0:92:51:9B:0E +a=setup:actpass +a=mid:0 +a=extmap:14 urn:ietf:params:rtp-hdrext:toffset +a=extmap:13 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time +a=extmap:12 urn:3gpp:video-orientation +a=extmap:2 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 +a=extmap:11 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay +a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type +a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing +a=extmap:8 http://tools.ietf.org/html/draft-ietf-avtext-framemarking-07 +a=extmap:9 http://www.webrtc.org/experiments/rtp-hdrext/color-space +a=extmap:3 urn:ietf:params:rtp-hdrext:sdes:mid +a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id +a=extmap:5 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id +a=sendrecv +a=msid:VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 a8c06601-e9ed-4312-a7d4-283e078c5966 +a=rtcp-mux +a=rtcp-rsize +a=rtpmap:96 VP8/90000 +a=rtcp-fb:96 goog-remb +a=rtcp-fb:96 transport-cc +a=rtcp-fb:96 ccm fir +a=rtcp-fb:96 nack +a=rtcp-fb:96 nack pli +a=rid:f send +a=rid:h send +a=rid:q send +a=simulcast:send f;h;q diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp new file mode 100644 index 0000000000..52879f9e66 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/simulcast.2.sdp @@ -0,0 +1,41 @@ +v=0 +o=- 367669362084170381 2 IN IP4 127.0.0.1 +s=- +t=0 0 +a=group:BUNDLE 0 +a=msid-semantic: WMS VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 +m=video 9 UDP/TLS/RTP/SAVPF 96 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:OLwt +a=ice-pwd:kjGBqIFYs8UqCyfmJ7nEJw/Q +a=ice-options:trickle +a=fingerprint:sha-256 B4:AB:3E:01:90:D1:FC:22:8F:05:6A:01:76:B6:C5:0D:45:88:1A:E1:99:AF:18:43:E6:18:BB:D0:92:51:9B:0E +a=setup:actpass +a=mid:0 +a=extmap:14 urn:ietf:params:rtp-hdrext:toffset +a=extmap:13 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time +a=extmap:12 urn:3gpp:video-orientation +a=extmap:2 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01 +a=extmap:11 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay +a=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type +a=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing +a=extmap:8 http://tools.ietf.org/html/draft-ietf-avtext-framemarking-07 +a=extmap:9 http://www.webrtc.org/experiments/rtp-hdrext/color-space +a=extmap:3 urn:ietf:params:rtp-hdrext:sdes:mid +a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id +a=extmap:5 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id +a=sendrecv +a=msid:VfhSdt9LWGwoduWpoASvxGyAGEQFAkQe1hT1 a8c06601-e9ed-4312-a7d4-283e078c5966 +a=rtcp-mux +a=rtcp-rsize +a=rtpmap:96 VP8/90000 +a=rtcp-fb:96 goog-remb +a=rtcp-fb:96 transport-cc +a=rtcp-fb:96 ccm fir +a=rtcp-fb:96 nack +a=rtcp-fb:96 nack pli +a=rid:f recv +a=rid:h recv +a=rid:q recv +a=simulcast:recv f;h;q diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp new file mode 100644 index 0000000000..ce349ac30f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-1.sdp @@ -0,0 +1,52 @@ +v=0 +o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1 +s=- +t=0 0 +a=msid-semantic: WMS local_stream_1 +m=audio 2345 RTP/SAVPF 111 103 104 +c=IN IP4 74.125.127.126 +a=rtcp:2347 IN IP4 74.125.127.126 +a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2 +a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2 +a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2 +a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2 +a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2 +a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2 +a=ice-ufrag:ufrag_voice +a=ice-pwd:pwd_voice +a=mid:audio_content_name +a=sendrecv +a=rtcp-mux +a=rtcp-rsize +a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params +a=rtpmap:111 opus/48000/2 +a=rtpmap:103 ISAC/16000 +a=rtpmap:104 ISAC/32000 +a=ssrc:1 cname:stream_1_cname +a=ssrc:1 msid:local_stream_1 audio_track_id_1 +a=ssrc:1 mslabel:local_stream_1 +a=ssrc:1 label:audio_track_id_1 +m=video 3457 RTP/SAVPF 120 +c=IN IP4 74.125.224.39 +a=rtcp:3456 IN IP4 74.125.224.39 +a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2 +a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2 +a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2 +a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2 +a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2 +a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2 +a=ice-ufrag:ufrag_video +a=ice-pwd:pwd_video +a=mid:video_content_name +a=sendrecv +a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32 +a=rtpmap:120 VP8/90000 +a=ssrc-group:FEC 2 3 +a=ssrc:2 cname:stream_1_cname +a=ssrc:2 msid:local_stream_1 video_track_id_1 +a=ssrc:2 mslabel:local_stream_1 +a=ssrc:2 label:video_track_id_1 +a=ssrc:3 cname:stream_1_cname +a=ssrc:3 msid:local_stream_1 video_track_id_1 +a=ssrc:3 mslabel:local_stream_1 +a=ssrc:3 label:video_track_id_1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp new file mode 100644 index 0000000000..a35392513f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-2.sdp @@ -0,0 +1,40 @@ +v=0 +o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1 +s=- +t=0 0 +a=msid-semantic: WMS local_stream_1 +m=audio 9 RTP/SAVPF 111 103 104 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:ufrag_voice +a=ice-pwd:pwd_voice +a=mid:audio_content_name +a=sendrecv +a=rtcp-mux +a=rtcp-rsize +a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params +a=rtpmap:111 opus/48000/2 +a=rtpmap:103 ISAC/16000 +a=rtpmap:104 ISAC/32000 +a=ssrc:1 cname:stream_1_cname +a=ssrc:1 msid:local_stream_1 audio_track_id_1 +a=ssrc:1 mslabel:local_stream_1 +a=ssrc:1 label:audio_track_id_1 +m=video 9 RTP/SAVPF 120 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:ufrag_video +a=ice-pwd:pwd_video +a=mid:video_content_name +a=sendrecv +a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32 +a=rtpmap:120 VP8/90000 +a=ssrc-group:FEC 2 3 +a=ssrc:2 cname:stream_1_cname +a=ssrc:2 msid:local_stream_1 video_track_id_1 +a=ssrc:2 mslabel:local_stream_1 +a=ssrc:2 label:video_track_id_1 +a=ssrc:3 cname:stream_1_cname +a=ssrc:3 msid:local_stream_1 video_track_id_1 +a=ssrc:3 mslabel:local_stream_1 +a=ssrc:3 label:video_track_id_1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp new file mode 100644 index 0000000000..50f8e55ef7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-3.sdp @@ -0,0 +1,13 @@ +m=application 9 RTP/SAVPF 101 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:ufrag_data +a=ice-pwd:pwd_data +a=mid:data_content_name +a=sendrecv +a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:FvLcvU2P3ZWmQxgPAgcDu7Zl9vftYElFOjEzhWs5 +a=rtpmap:101 google-data/90000 +a=ssrc:10 cname:data_channel_cname +a=ssrc:10 msid:data_channel data_channeld0 +a=ssrc:10 mslabel:data_channel +a=ssrc:10 label:data_channeld0 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp new file mode 100644 index 0000000000..709db42c00 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-4.sdp @@ -0,0 +1,11 @@ +v=0 +o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1 +s=- +t=0 0 +a=msid-semantic: WMS +m=audio 9 RTP/SAVPF 111 103 104 +c=IN IP4 0.0.0.0 +a=x-google-flag:conference +m=video 9 RTP/SAVPF 120 +c=IN IP4 0.0.0.0 +a=x-google-flag:conference diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp new file mode 100644 index 0000000000..c440386062 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-5.sdp @@ -0,0 +1,5 @@ +v=0 +o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1 +s=- +t=0 0 +a=msid-semantic: WMS local_stream diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp new file mode 100644 index 0000000000..e07b5647bf --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-6.sdp @@ -0,0 +1,12 @@ +m=audio 9 RTP/SAVPF 111 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:ufrag_voice +a=ice-pwd:pwd_voice +a=mid:audio_content_name +a=sendrecv +a=rtpmap:111 opus/48000/2 +a=ssrc:1 cname:stream_1_cname +a=ssrc:1 msid:local_stream audio_track_id_1 +a=ssrc:1 mslabel:local_stream +a=ssrc:1 label:audio_track_id_1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp new file mode 100644 index 0000000000..8bdacc2baa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-7.sdp @@ -0,0 +1,12 @@ +m=video 9 RTP/SAVPF 120 +c=IN IP4 0.0.0.0 +a=rtcp:9 IN IP4 0.0.0.0 +a=ice-ufrag:ufrag_video +a=ice-pwd:pwd_video +a=mid:video_content_name +a=sendrecv +a=rtpmap:120 VP8/90000 +a=ssrc:2 cname:stream_1_cname +a=ssrc:2 msid:local_stream video_track_id_1 +a=ssrc:2 mslabel:local_stream +a=ssrc:2 label:video_track_id_1 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp new file mode 100644 index 0000000000..9688fc46a2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-8.sdp @@ -0,0 +1,64 @@ +v=0 +o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1 +s=- +t=0 0 +a=msid-semantic: WMS local_stream_1 local_stream_2 +m=audio 2345 RTP/SAVPF 111 103 104 +c=IN IP4 74.125.127.126 +a=rtcp:2347 IN IP4 74.125.127.126 +a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2 +a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2 +a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2 +a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2 +a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2 +a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2 +a=ice-ufrag:ufrag_voice +a=ice-pwd:pwd_voice +a=mid:audio_content_name +a=sendrecv +a=rtcp-mux +a=rtcp-rsize +a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params +a=rtpmap:111 opus/48000/2 +a=rtpmap:103 ISAC/16000 +a=rtpmap:104 ISAC/32000 +a=ssrc:1 cname:stream_1_cname +a=ssrc:1 msid:local_stream_1 audio_track_id_1 +a=ssrc:1 mslabel:local_stream_1 +a=ssrc:1 label:audio_track_id_1 +a=ssrc:4 cname:stream_2_cname +a=ssrc:4 msid:local_stream_2 audio_track_id_2 +a=ssrc:4 mslabel:local_stream_2 +a=ssrc:4 label:audio_track_id_2 +m=video 3457 RTP/SAVPF 120 +c=IN IP4 74.125.224.39 +a=rtcp:3456 IN IP4 74.125.224.39 +a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2 +a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2 +a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2 +a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2 +a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2 +a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2 +a=ice-ufrag:ufrag_video +a=ice-pwd:pwd_video +a=mid:video_content_name +a=sendrecv +a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32 +a=rtpmap:120 VP8/90000 +a=ssrc-group:FEC 2 3 +a=ssrc:2 cname:stream_1_cname +a=ssrc:2 msid:local_stream_1 video_track_id_1 +a=ssrc:2 mslabel:local_stream_1 +a=ssrc:2 label:video_track_id_1 +a=ssrc:3 cname:stream_1_cname +a=ssrc:3 msid:local_stream_1 video_track_id_1 +a=ssrc:3 mslabel:local_stream_1 +a=ssrc:3 label:video_track_id_1 +a=ssrc:5 cname:stream_2_cname +a=ssrc:5 msid:local_stream_2 video_track_id_2 +a=ssrc:5 mslabel:local_stream_2 +a=ssrc:5 label:video_track_id_2 +a=ssrc:6 cname:stream_2_cname +a=ssrc:6 msid:local_stream_2 video_track_id_3 +a=ssrc:6 mslabel:local_stream_2 +a=ssrc:6 label:video_track_id_3 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp new file mode 100644 index 0000000000..8c7c4c7c3d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp-corpus/unittest-9.sdp @@ -0,0 +1,66 @@ +v=0 +o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1 +s=- +t=0 0 +a=msid-semantic: WMS local_stream_1 local_stream_2 +m=audio 2345 RTP/SAVPF 111 103 104 +c=IN IP4 74.125.127.126 +a=rtcp:2347 IN IP4 74.125.127.126 +a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1234 typ host generation 2 +a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1235 typ host generation 2 +a=candidate:a0+B/2 1 udp 2130706432 ::1 1238 typ host generation 2 +a=candidate:a0+B/2 2 udp 2130706432 ::1 1239 typ host generation 2 +a=candidate:a0+B/3 1 udp 2130706432 74.125.127.126 2345 typ srflx raddr 192.168.1.5 rport 2346 generation 2 +a=candidate:a0+B/3 2 udp 2130706432 74.125.127.126 2347 typ srflx raddr 192.168.1.5 rport 2348 generation 2 +a=ice-ufrag:ufrag_voice +a=ice-pwd:pwd_voice +a=mid:audio_content_name +a=msid:local_stream_1 audio_track_id_1 +a=sendrecv +a=rtcp-mux +a=rtcp-rsize +a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:NzB4d1BINUAvLEw6UzF3WSJ+PSdFcGdUJShpX1Zj|2^20|1:32 dummy_session_params +a=rtpmap:111 opus/48000/2 +a=rtpmap:103 ISAC/16000 +a=rtpmap:104 ISAC/32000 +a=ssrc:1 cname:stream_1_cname +a=ssrc:1 msid:local_stream_1 audio_track_id_1 +a=ssrc:1 mslabel:local_stream_1 +a=ssrc:1 label:audio_track_id_1 +a=ssrc:4 cname:stream_2_cname +a=ssrc:4 msid:local_stream_2 audio_track_id_2 +a=ssrc:4 mslabel:local_stream_2 +a=ssrc:4 label:audio_track_id_2 +m=video 3457 RTP/SAVPF 120 +c=IN IP4 74.125.224.39 +a=rtcp:3456 IN IP4 74.125.224.39 +a=candidate:a0+B/1 2 udp 2130706432 192.168.1.5 1236 typ host generation 2 +a=candidate:a0+B/1 1 udp 2130706432 192.168.1.5 1237 typ host generation 2 +a=candidate:a0+B/2 2 udp 2130706432 ::1 1240 typ host generation 2 +a=candidate:a0+B/2 1 udp 2130706432 ::1 1241 typ host generation 2 +a=candidate:a0+B/4 2 udp 2130706432 74.125.224.39 3456 typ relay generation 2 +a=candidate:a0+B/4 1 udp 2130706432 74.125.224.39 3457 typ relay generation 2 +a=ice-ufrag:ufrag_video +a=ice-pwd:pwd_video +a=mid:video_content_name +a=msid:local_stream_1 video_track_id_1 +a=sendrecv +a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0RmdmcmVCspeEc3QGZiNWpVLFJhQX1cfHAwJSoj|2^20|1:32 +a=rtpmap:120 VP8/90000 +a=ssrc-group:FEC 2 3 +a=ssrc:2 cname:stream_1_cname +a=ssrc:2 msid:local_stream_1 video_track_id_1 +a=ssrc:2 mslabel:local_stream_1 +a=ssrc:2 label:video_track_id_1 +a=ssrc:3 cname:stream_1_cname +a=ssrc:3 msid:local_stream_1 video_track_id_1 +a=ssrc:3 mslabel:local_stream_1 +a=ssrc:3 label:video_track_id_1 +a=ssrc:5 cname:stream_2_cname +a=ssrc:5 msid:local_stream_2 video_track_id_2 +a=ssrc:5 mslabel:local_stream_2 +a=ssrc:5 label:video_track_id_2 +a=ssrc:6 cname:stream_2_cname +a=ssrc:6 msid:local_stream_2 video_track_id_3 +a=ssrc:6 mslabel:local_stream_2 +a=ssrc:6 label:video_track_id_3 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens b/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens new file mode 100644 index 0000000000..ddfdad5811 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/sdp.tokens @@ -0,0 +1,56 @@ +"0.0.0.0" +"127.0.0.1" +"application" +"audio" +"candidate" +"cname" +"conference" +"crypto" +"default" +"extmap" +"fingerprint" +"fmtp" +"generation" +"group" +"host" +"ice-lite" +"ice-options" +"ice-pwd" +"ice-ufrag" +"inactive" +"IP4" +"IP6" +"ISAC" +"label" +"mid" +"msid" +"msid-semantic" +"mslabel" +"network-cost" +"network-id" +"prflx" +"pwd" +"raddr" +"recvonly" +"relay" +"rport" +"rtcp" +"rtcp-fb" +"rtcp-mux" +"rtcp-rsize" +"rtpmap" +"sctpmap" +"sctp-port" +"sendonly" +"sendrecv" +"setup" +"srflx" +"ssrc" +"ssrc-group" +"tcptype" +"typ" +"ufrag" +"video" +"webrtc-datachannel" +"WMS" +"x-google-flag"
\ No newline at end of file diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0 new file mode 100644 index 0000000000..fbfcbf9105 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/0 @@ -0,0 +1 @@ +90742757 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1 new file mode 100644 index 0000000000..587611a1d6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/1 @@ -0,0 +1 @@ +27.70727677 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2 new file mode 100644 index 0000000000..45a4fb75db --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/2 @@ -0,0 +1 @@ +8 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3 new file mode 100644 index 0000000000..a0a162047c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/3 @@ -0,0 +1 @@ +0.0001 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4 new file mode 100644 index 0000000000..da24ab1137 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/4 @@ -0,0 +1 @@ +27277272727272727272 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5 b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5 new file mode 100644 index 0000000000..575c0a830c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/string_to_number-corpus/5 @@ -0,0 +1 @@ +999999999999999999999999999999999999999999999999999999999999999999999999999999 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun Binary files differnew file mode 100644 index 0000000000..205997706f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/0.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun Binary files differnew file mode 100644 index 0000000000..1f82c03ffa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/1.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun Binary files differnew file mode 100644 index 0000000000..a6b06b2be8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/10.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun Binary files differnew file mode 100644 index 0000000000..1f82c03ffa --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/11.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun Binary files differnew file mode 100644 index 0000000000..cb91baa250 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/12.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun Binary files differnew file mode 100644 index 0000000000..63298fce7d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/13.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun Binary files differnew file mode 100644 index 0000000000..31f9f732d4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/14.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun Binary files differnew file mode 100644 index 0000000000..3d15a67193 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/15.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun Binary files differnew file mode 100644 index 0000000000..8ccf0af26d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/16.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun Binary files differnew file mode 100644 index 0000000000..9c3efa0b80 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/17.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun Binary files differnew file mode 100644 index 0000000000..50fe614adb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/2.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun Binary files differnew file mode 100644 index 0000000000..50fe614adb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/3.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun Binary files differnew file mode 100644 index 0000000000..a6b06b2be8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/4.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun Binary files differnew file mode 100644 index 0000000000..c0a79fa7ab --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/5.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun Binary files differnew file mode 100644 index 0000000000..1f43a4787d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/6.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun Binary files differnew file mode 100644 index 0000000000..f5e824a68d --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/7.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun Binary files differnew file mode 100644 index 0000000000..99f4e3bcf8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/8.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun Binary files differnew file mode 100644 index 0000000000..cbbcab4e74 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/9.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun Binary files differnew file mode 100644 index 0000000000..5428c38d75 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun-corpus/validator-crash-1.stun diff --git a/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens b/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens new file mode 100644 index 0000000000..e01130f12e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/stun.tokens @@ -0,0 +1,2 @@ +"2112A442" +"12214A24" diff --git a/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0 b/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0 new file mode 100644 index 0000000000..1b6fdf78f6 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/video_layers_allocation-corpus/vla-0 @@ -0,0 +1 @@ +@2?ÿÿ
\ No newline at end of file diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2 b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2 Binary files differnew file mode 100644 index 0000000000..febe4ad130 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/0cee4d5fd2905dc1fb2979f10a9724265b7075e2 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682 b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682 Binary files differnew file mode 100644 index 0000000000..fc538ac83f --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a1c75436e1872a23391d58316d88c45da0fb7682 diff --git a/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f Binary files differnew file mode 100644 index 0000000000..1bd09373c8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/corpora/vp9-encoder-references-corpus/a8b3fb7be82395c9462684c766841d668dc0029f diff --git a/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc new file mode 100644 index 0000000000..2fc3fe10f1 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/dcsctp_packet_fuzzer.cc @@ -0,0 +1,29 @@ +/* + * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "net/dcsctp/packet/chunk/chunk.h" +#include "net/dcsctp/packet/sctp_packet.h" + +namespace webrtc { +using dcsctp::SctpPacket; + +void FuzzOneInput(const uint8_t* data, size_t size) { + absl::optional<SctpPacket> c = + SctpPacket::Parse(rtc::ArrayView<const uint8_t>(data, size), + /*disable_checksum_verification=*/true); + + if (!c.has_value()) { + return; + } + + for (const SctpPacket::ChunkDescriptor& desc : c->descriptors()) { + dcsctp::DebugConvertChunkToString(desc.data); + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc new file mode 100644 index 0000000000..390cbb7f6c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/dcsctp_socket_fuzzer.cc @@ -0,0 +1,28 @@ +/* + * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "net/dcsctp/fuzzers/dcsctp_fuzzers.h" +#include "net/dcsctp/public/dcsctp_message.h" +#include "net/dcsctp/public/dcsctp_options.h" +#include "net/dcsctp/public/dcsctp_socket.h" +#include "net/dcsctp/socket/dcsctp_socket.h" +#include "rtc_base/logging.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + dcsctp::dcsctp_fuzzers::FuzzerCallbacks cb; + dcsctp::DcSctpOptions options; + options.disable_checksum_verification = true; + dcsctp::DcSctpSocket socket("A", cb, nullptr, options); + + dcsctp::dcsctp_fuzzers::FuzzSocket(socket, cb, + rtc::ArrayView<const uint8_t>(data, size)); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc new file mode 100644 index 0000000000..74fe65ce56 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/field_trial_fuzzer.cc @@ -0,0 +1,26 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include <string> + +#include "system_wrappers/include/field_trial.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + std::string field_trial(reinterpret_cast<const char*>(data), size); + field_trial::InitFieldTrialsFromString(field_trial.c_str()); + field_trial::FindFullName(field_trial); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc new file mode 100644 index 0000000000..854cc8b811 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/flexfec_header_reader_fuzzer.cc @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> + +#include "api/scoped_refptr.h" +#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h" +#include "modules/rtp_rtcp/source/flexfec_header_reader_writer.h" +#include "modules/rtp_rtcp/source/forward_error_correction.h" + +namespace webrtc { + +using Packet = ForwardErrorCorrection::Packet; +using ReceivedFecPacket = ForwardErrorCorrection::ReceivedFecPacket; + +void FuzzOneInput(const uint8_t* data, size_t size) { + ReceivedFecPacket packet; + packet.pkt = rtc::scoped_refptr<Packet>(new Packet()); + const size_t packet_size = + std::min(size, static_cast<size_t>(IP_PACKET_SIZE)); + packet.pkt->data.SetSize(packet_size); + packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE); + memcpy(packet.pkt->data.MutableData(), data, packet_size); + + FlexfecHeaderReader flexfec_reader; + flexfec_reader.ReadFecHeader(&packet); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc new file mode 100644 index 0000000000..67d603d3fc --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/flexfec_receiver_fuzzer.cc @@ -0,0 +1,71 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> + +#include "modules/rtp_rtcp/include/flexfec_receiver.h" +#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h" +#include "modules/rtp_rtcp/source/byte_io.h" +#include "modules/rtp_rtcp/source/rtp_packet_received.h" + +namespace webrtc { + +namespace { +class DummyCallback : public RecoveredPacketReceiver { + void OnRecoveredPacket(const RtpPacketReceived& packet) override {} +}; +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + constexpr size_t kMinDataNeeded = 12; + if (size < kMinDataNeeded || size > 2000) { + return; + } + + uint32_t flexfec_ssrc; + memcpy(&flexfec_ssrc, data + 0, 4); + uint16_t flexfec_seq_num; + memcpy(&flexfec_seq_num, data + 4, 2); + uint32_t media_ssrc; + memcpy(&media_ssrc, data + 6, 4); + uint16_t media_seq_num; + memcpy(&media_seq_num, data + 10, 2); + + DummyCallback callback; + FlexfecReceiver receiver(flexfec_ssrc, media_ssrc, &callback); + + std::unique_ptr<uint8_t[]> packet; + size_t packet_length; + size_t i = kMinDataNeeded; + while (i < size) { + packet_length = kRtpHeaderSize + data[i++]; + packet = std::unique_ptr<uint8_t[]>(new uint8_t[packet_length]); + if (i + packet_length >= size) { + break; + } + memcpy(packet.get(), data + i, packet_length); + i += packet_length; + if (i < size && data[i++] % 2 == 0) { + // Simulate FlexFEC packet. + ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, flexfec_seq_num++); + ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, flexfec_ssrc); + } else { + // Simulate media packet. + ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, media_seq_num++); + ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, media_ssrc); + } + RtpPacketReceived parsed_packet; + if (parsed_packet.Parse(packet.get(), packet_length)) { + receiver.OnRtpPacket(parsed_packet); + } + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc new file mode 100644 index 0000000000..8ddd1c0fe0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/flexfec_sender_fuzzer.cc @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "modules/rtp_rtcp/include/flexfec_sender.h" +#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h" +#include "modules/rtp_rtcp/source/byte_io.h" +#include "modules/rtp_rtcp/source/rtp_packet_to_send.h" +#include "system_wrappers/include/clock.h" + +namespace webrtc { + +namespace { + +constexpr int kFlexfecPayloadType = 123; +constexpr uint32_t kMediaSsrc = 1234; +constexpr uint32_t kFlexfecSsrc = 5678; +const char kNoMid[] = ""; +const std::vector<RtpExtension> kNoRtpHeaderExtensions; +const std::vector<RtpExtensionSize> kNoRtpHeaderExtensionSizes; + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + size_t i = 0; + if (size < 5 || size > 200) { + return; + } + SimulatedClock clock(1 + data[i++]); + FlexfecSender sender(kFlexfecPayloadType, kFlexfecSsrc, kMediaSsrc, kNoMid, + kNoRtpHeaderExtensions, kNoRtpHeaderExtensionSizes, + nullptr /* rtp_state */, &clock); + FecProtectionParams params = { + data[i++], static_cast<int>(data[i++] % 100), + data[i++] <= 127 ? kFecMaskRandom : kFecMaskBursty}; + sender.SetProtectionParameters(params, params); + uint16_t seq_num = data[i++]; + + while (i + 1 < size) { + // Everything past the base RTP header (12 bytes) is payload, + // from the perspective of FlexFEC. + size_t payload_size = data[i++]; + if (i + kRtpHeaderSize + payload_size >= size) + break; + std::unique_ptr<uint8_t[]> packet( + new uint8_t[kRtpHeaderSize + payload_size]); + memcpy(packet.get(), &data[i], kRtpHeaderSize + payload_size); + i += kRtpHeaderSize + payload_size; + ByteWriter<uint16_t>::WriteBigEndian(&packet[2], seq_num++); + ByteWriter<uint32_t>::WriteBigEndian(&packet[8], kMediaSsrc); + RtpPacketToSend rtp_packet(nullptr); + if (!rtp_packet.Parse(packet.get(), kRtpHeaderSize + payload_size)) + break; + sender.AddPacketAndGenerateFec(rtp_packet); + sender.GetFecPackets(); + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc new file mode 100644 index 0000000000..04a459bc71 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/forward_error_correction_fuzzer.cc @@ -0,0 +1,119 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "api/scoped_refptr.h" +#include "modules/rtp_rtcp/source/byte_io.h" +#include "modules/rtp_rtcp/source/forward_error_correction.h" +#include "rtc_base/byte_buffer.h" + +namespace webrtc { + +namespace { +constexpr uint32_t kMediaSsrc = 100200300; +constexpr uint32_t kFecSsrc = 111222333; + +constexpr size_t kPacketSize = 50; +constexpr size_t kMaxPacketsInBuffer = 48; +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 5000) { + return; + } + // Object under test. + std::unique_ptr<ForwardErrorCorrection> fec = + ForwardErrorCorrection::CreateFlexfec(kFecSsrc, kMediaSsrc); + + // Entropy from fuzzer. + rtc::ByteBufferReader fuzz_buffer(reinterpret_cast<const char*>(data), size); + + // Initial stream state. + uint16_t media_seqnum; + if (!fuzz_buffer.ReadUInt16(&media_seqnum)) + return; + const uint16_t original_media_seqnum = media_seqnum; + uint16_t fec_seqnum; + if (!fuzz_buffer.ReadUInt16(&fec_seqnum)) + return; + + // Existing packets in the packet buffer. + ForwardErrorCorrection::RecoveredPacketList recovered_packets; + uint8_t num_existing_recovered_packets; + if (!fuzz_buffer.ReadUInt8(&num_existing_recovered_packets)) + return; + for (size_t i = 0; i < num_existing_recovered_packets % kMaxPacketsInBuffer; + ++i) { + ForwardErrorCorrection::RecoveredPacket* recovered_packet = + new ForwardErrorCorrection::RecoveredPacket(); + recovered_packet->pkt = rtc::scoped_refptr<ForwardErrorCorrection::Packet>( + new ForwardErrorCorrection::Packet()); + recovered_packet->pkt->data.SetSize(kPacketSize); + memset(recovered_packet->pkt->data.MutableData(), 0, kPacketSize); + recovered_packet->ssrc = kMediaSsrc; + recovered_packet->seq_num = media_seqnum++; + recovered_packets.emplace_back(recovered_packet); + } + + // New packets received from the network. + ForwardErrorCorrection::ReceivedPacket received_packet; + received_packet.pkt = rtc::scoped_refptr<ForwardErrorCorrection::Packet>( + new ForwardErrorCorrection::Packet()); + received_packet.pkt->data.SetSize(kPacketSize); + received_packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE); + uint8_t* packet_buffer = received_packet.pkt->data.MutableData(); + uint8_t reordering; + uint16_t seq_num_diff; + uint8_t packet_type; + uint8_t packet_loss; + while (true) { + if (!fuzz_buffer.ReadBytes(reinterpret_cast<char*>(packet_buffer), + kPacketSize)) { + return; + } + if (!fuzz_buffer.ReadUInt8(&reordering)) + return; + if (!fuzz_buffer.ReadUInt16(&seq_num_diff)) + return; + if (!fuzz_buffer.ReadUInt8(&packet_type)) + return; + if (!fuzz_buffer.ReadUInt8(&packet_loss)) + return; + + if (reordering % 10 != 0) + seq_num_diff = 0; + + if (packet_type % 2 == 0) { + received_packet.is_fec = true; + received_packet.ssrc = kFecSsrc; + received_packet.seq_num = seq_num_diff + fec_seqnum++; + + // Overwrite parts of the FlexFEC header for fuzzing efficiency. + packet_buffer[0] = 0; // R, F bits. + ByteWriter<uint8_t>::WriteBigEndian(&packet_buffer[8], 1); // SSRCCount. + ByteWriter<uint32_t>::WriteBigEndian(&packet_buffer[12], + kMediaSsrc); // SSRC_i. + ByteWriter<uint16_t>::WriteBigEndian( + &packet_buffer[16], original_media_seqnum); // SN base_i. + } else { + received_packet.is_fec = false; + received_packet.ssrc = kMediaSsrc; + received_packet.seq_num = seq_num_diff + media_seqnum++; + } + + if (packet_loss % 10 == 0) + continue; + + fec->DecodeFec(received_packet, &recovered_packets); + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc new file mode 100644 index 0000000000..ec1bbbb4c1 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/frame_buffer2_fuzzer.cc @@ -0,0 +1,116 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "api/task_queue/task_queue_base.h" +#include "modules/video_coding/frame_buffer2.h" +#include "modules/video_coding/timing/timing.h" +#include "test/scoped_key_value_config.h" +#include "test/time_controller/simulated_time_controller.h" + +namespace webrtc { + +namespace { + +// When DataReader runs out of data provided in the constructor it will +// just set/return 0 instead. +struct DataReader { + DataReader(const uint8_t* data, size_t size) : data_(data), size_(size) {} + + void CopyTo(void* destination, size_t dest_size) { + memset(destination, 0, dest_size); + + size_t bytes_to_copy = std::min(size_ - offset_, dest_size); + memcpy(destination, data_ + offset_, bytes_to_copy); + offset_ += bytes_to_copy; + } + + template <typename T> + T GetNum() { + T res; + if (offset_ + sizeof(res) < size_) { + memcpy(&res, data_ + offset_, sizeof(res)); + offset_ += sizeof(res); + return res; + } + + offset_ = size_; + return T(0); + } + + bool MoreToRead() { return offset_ < size_; } + + const uint8_t* const data_; + size_t size_; + size_t offset_ = 0; +}; + +class FuzzyFrameObject : public EncodedFrame { + public: + FuzzyFrameObject() {} + ~FuzzyFrameObject() {} + + int64_t ReceivedTime() const override { return 0; } + int64_t RenderTime() const override { return _renderTimeMs; } +}; +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000) { + return; + } + DataReader reader(data, size); + GlobalSimulatedTimeController time_controller(Timestamp::Seconds(0)); + std::unique_ptr<TaskQueueBase, TaskQueueDeleter> task_queue = + time_controller.GetTaskQueueFactory()->CreateTaskQueue( + "time_tq", TaskQueueFactory::Priority::NORMAL); + test::ScopedKeyValueConfig field_trials; + VCMTiming timing(time_controller.GetClock(), field_trials); + video_coding::FrameBuffer frame_buffer(time_controller.GetClock(), &timing, + field_trials); + + bool next_frame_task_running = false; + + while (reader.MoreToRead()) { + if (reader.GetNum<uint8_t>() % 2) { + std::unique_ptr<FuzzyFrameObject> frame(new FuzzyFrameObject()); + frame->SetId(reader.GetNum<int64_t>()); + frame->SetSpatialIndex(reader.GetNum<uint8_t>() % 5); + frame->SetTimestamp(reader.GetNum<uint32_t>()); + frame->num_references = + reader.GetNum<uint8_t>() % EncodedFrame::kMaxFrameReferences; + + for (size_t r = 0; r < frame->num_references; ++r) + frame->references[r] = reader.GetNum<int64_t>(); + + frame_buffer.InsertFrame(std::move(frame)); + } else { + if (!next_frame_task_running) { + next_frame_task_running = true; + bool keyframe_required = reader.GetNum<uint8_t>() % 2; + int max_wait_time_ms = reader.GetNum<uint8_t>(); + task_queue->PostTask([&task_queue, &frame_buffer, + &next_frame_task_running, keyframe_required, + max_wait_time_ms] { + frame_buffer.NextFrame( + max_wait_time_ms, keyframe_required, task_queue.get(), + [&next_frame_task_running](std::unique_ptr<EncodedFrame> frame) { + next_frame_task_running = false; + }); + }); + } + } + + time_controller.AdvanceTime(TimeDelta::Millis(reader.GetNum<uint8_t>())); + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc new file mode 100644 index 0000000000..e58d5e9f98 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/frame_buffer_fuzzer.cc @@ -0,0 +1,87 @@ +/* + * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "api/array_view.h" +#include "api/video/encoded_frame.h" +#include "api/video/frame_buffer.h" +#include "rtc_base/numerics/sequence_number_unwrapper.h" +#include "test/fuzzers/fuzz_data_helper.h" +#include "test/scoped_key_value_config.h" + +namespace webrtc { +namespace { +class FuzzyFrameObject : public EncodedFrame { + public: + int64_t ReceivedTime() const override { return 0; } + int64_t RenderTime() const override { return 0; } +}; + +constexpr int kFrameIdLength = 1 << 15; + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 10000) { + return; + } + + test::ScopedKeyValueConfig field_trials; + FrameBuffer buffer(/*max_frame_slots=*/100, /*max_decode_history=*/1000, + field_trials); + test::FuzzDataHelper helper(rtc::MakeArrayView(data, size)); + SeqNumUnwrapper<uint16_t, kFrameIdLength> unwrapper; + + while (helper.BytesLeft() > 0) { + int action = helper.ReadOrDefaultValue<uint8_t>(0) % 6; + + switch (action) { + case 0: { + buffer.LastContinuousFrameId(); + break; + } + case 1: { + buffer.LastContinuousTemporalUnitFrameId(); + break; + } + case 2: { + buffer.DecodableTemporalUnitsInfo(); + break; + } + case 3: { + buffer.ExtractNextDecodableTemporalUnit(); + break; + } + case 4: { + buffer.DropNextDecodableTemporalUnit(); + break; + } + case 5: { + auto frame = std::make_unique<FuzzyFrameObject>(); + frame->SetTimestamp(helper.ReadOrDefaultValue<uint32_t>(0)); + int64_t wire_id = + helper.ReadOrDefaultValue<uint16_t>(0) & (kFrameIdLength - 1); + frame->SetId(unwrapper.Unwrap(wire_id)); + frame->is_last_spatial_layer = helper.ReadOrDefaultValue<bool>(false); + + frame->num_references = helper.ReadOrDefaultValue<uint8_t>(0) % + EncodedFrame::kMaxFrameReferences; + + for (uint8_t i = 0; i < frame->num_references; ++i) { + frame->references[i] = helper.ReadOrDefaultValue<int64_t>(0); + } + + buffer.InsertFrame(std::move(frame)); + break; + } + } + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc new file mode 100644 index 0000000000..866f7bc4b8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.cc @@ -0,0 +1,20 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace test { + +FuzzDataHelper::FuzzDataHelper(rtc::ArrayView<const uint8_t> data) + : data_(data) {} + +} // namespace test +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h new file mode 100644 index 0000000000..cedc31d0a4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/fuzz_data_helper.h @@ -0,0 +1,105 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#ifndef TEST_FUZZERS_FUZZ_DATA_HELPER_H_ +#define TEST_FUZZERS_FUZZ_DATA_HELPER_H_ + +#include <limits> + +#include "api/array_view.h" +#include "modules/rtp_rtcp/source/byte_io.h" + +namespace webrtc { +namespace test { + +// Helper class to take care of the fuzzer input, read from it, and keep track +// of when the end of the data has been reached. +class FuzzDataHelper { + public: + explicit FuzzDataHelper(rtc::ArrayView<const uint8_t> data); + + // Returns true if n bytes can be read. + bool CanReadBytes(size_t n) const { return data_ix_ + n <= data_.size(); } + + // Reads and returns data of type T. + template <typename T> + T Read() { + RTC_CHECK(CanReadBytes(sizeof(T))); + T x = ByteReader<T>::ReadLittleEndian(&data_[data_ix_]); + data_ix_ += sizeof(T); + return x; + } + + // Reads and returns data of type T. Returns default_value if not enough + // fuzzer input remains to read a T. + template <typename T> + T ReadOrDefaultValue(T default_value) { + if (!CanReadBytes(sizeof(T))) { + return default_value; + } + return Read<T>(); + } + + // Like ReadOrDefaultValue, but replaces the value 0 with default_value. + template <typename T> + T ReadOrDefaultValueNotZero(T default_value) { + static_assert(std::is_integral<T>::value, ""); + T x = ReadOrDefaultValue(default_value); + return x == 0 ? default_value : x; + } + + // Returns one of the elements from the provided input array. The selection + // is based on the fuzzer input data. If not enough fuzzer data is available, + // the method will return the first element in the input array. The reason for + // not flagging this as an error is to allow the method to be called from + // class constructors, and in constructors we typically do not handle + // errors. The code will work anyway, and the fuzzer will likely see that + // providing more data will actually make this method return something else. + template <typename T, size_t N> + T SelectOneOf(const T (&select_from)[N]) { + static_assert(N <= std::numeric_limits<uint8_t>::max(), ""); + // Read an index between 0 and select_from.size() - 1 from the fuzzer data. + uint8_t index = ReadOrDefaultValue<uint8_t>(0) % N; + return select_from[index]; + } + + rtc::ArrayView<const uint8_t> ReadByteArray(size_t bytes) { + if (!CanReadBytes(bytes)) { + return rtc::ArrayView<const uint8_t>(nullptr, 0); + } + const size_t index_to_return = data_ix_; + data_ix_ += bytes; + return data_.subview(index_to_return, bytes); + } + + // If sizeof(T) > BytesLeft then the remaining bytes will be used and the rest + // of the object will be zero initialized. + template <typename T> + void CopyTo(T* object) { + memset(object, 0, sizeof(T)); + + size_t bytes_to_copy = std::min(BytesLeft(), sizeof(T)); + memcpy(object, data_.data() + data_ix_, bytes_to_copy); + data_ix_ += bytes_to_copy; + } + + size_t BytesRead() const { return data_ix_; } + + size_t BytesLeft() const { return data_.size() - data_ix_; } + + private: + rtc::ArrayView<const uint8_t> data_; + size_t data_ix_ = 0; +}; + +} // namespace test +} // namespace webrtc + +#endif // TEST_FUZZERS_FUZZ_DATA_HELPER_H_ diff --git a/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc new file mode 100644 index 0000000000..cd1128c0b4 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/h264_bitstream_parser_fuzzer.cc @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include <stdint.h> + +#include "common_video/h264/h264_bitstream_parser.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + H264BitstreamParser h264_bitstream_parser; + h264_bitstream_parser.ParseBitstream( + rtc::ArrayView<const uint8_t>(data, size)); + h264_bitstream_parser.GetLastSliceQp(); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc new file mode 100644 index 0000000000..97127228ed --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/h264_depacketizer_fuzzer.cc @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "modules/rtp_rtcp/source/video_rtp_depacketizer_h264.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 200000) + return; + VideoRtpDepacketizerH264 depacketizer; + depacketizer.Parse(rtc::CopyOnWriteBuffer(data, size)); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc new file mode 100644 index 0000000000..348c84f040 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/neteq_rtp_fuzzer.cc @@ -0,0 +1,184 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> +#include <cmath> +#include <cstring> +#include <memory> +#include <vector> + +#include "api/array_view.h" +#include "api/audio_codecs/builtin_audio_decoder_factory.h" +#include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h" +#include "modules/audio_coding/neteq/tools/audio_checksum.h" +#include "modules/audio_coding/neteq/tools/encode_neteq_input.h" +#include "modules/audio_coding/neteq/tools/neteq_test.h" +#include "modules/rtp_rtcp/source/byte_io.h" + +namespace webrtc { +namespace test { +namespace { +constexpr int kPayloadType = 95; + +class SineGenerator : public EncodeNetEqInput::Generator { + public: + explicit SineGenerator(int sample_rate_hz) + : sample_rate_hz_(sample_rate_hz) {} + + rtc::ArrayView<const int16_t> Generate(size_t num_samples) override { + if (samples_.size() < num_samples) { + samples_.resize(num_samples); + } + + rtc::ArrayView<int16_t> output(samples_.data(), num_samples); + for (auto& x : output) { + x = static_cast<int16_t>(2000.0 * std::sin(phase_)); + phase_ += 2 * kPi * kFreqHz / sample_rate_hz_; + } + return output; + } + + private: + static constexpr int kFreqHz = 300; // The sinewave frequency. + const int sample_rate_hz_; + const double kPi = std::acos(-1); + std::vector<int16_t> samples_; + double phase_ = 0.0; +}; + +class FuzzRtpInput : public NetEqInput { + public: + explicit FuzzRtpInput(rtc::ArrayView<const uint8_t> data) : data_(data) { + AudioEncoderPcm16B::Config config; + config.payload_type = kPayloadType; + config.sample_rate_hz = 32000; + std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config)); + std::unique_ptr<EncodeNetEqInput::Generator> generator( + new SineGenerator(config.sample_rate_hz)); + input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder), + std::numeric_limits<int64_t>::max())); + packet_ = input_->PopPacket(); + FuzzHeader(); + MaybeFuzzPayload(); + } + + absl::optional<int64_t> NextPacketTime() const override { + return packet_->time_ms; + } + + absl::optional<int64_t> NextOutputEventTime() const override { + return input_->NextOutputEventTime(); + } + + std::unique_ptr<PacketData> PopPacket() override { + RTC_DCHECK(packet_); + std::unique_ptr<PacketData> packet_to_return = std::move(packet_); + packet_ = input_->PopPacket(); + FuzzHeader(); + MaybeFuzzPayload(); + return packet_to_return; + } + + void AdvanceOutputEvent() override { return input_->AdvanceOutputEvent(); } + + bool ended() const override { return ended_; } + + absl::optional<RTPHeader> NextHeader() const override { + RTC_DCHECK(packet_); + return packet_->header; + } + + private: + void FuzzHeader() { + constexpr size_t kNumBytesToFuzz = 11; + if (data_ix_ + kNumBytesToFuzz > data_.size()) { + ended_ = true; + return; + } + RTC_DCHECK(packet_); + const size_t start_ix = data_ix_; + packet_->header.payloadType = + ByteReader<uint8_t>::ReadLittleEndian(&data_[data_ix_]); + packet_->header.payloadType &= 0x7F; + data_ix_ += sizeof(uint8_t); + packet_->header.sequenceNumber = + ByteReader<uint16_t>::ReadLittleEndian(&data_[data_ix_]); + data_ix_ += sizeof(uint16_t); + packet_->header.timestamp = + ByteReader<uint32_t>::ReadLittleEndian(&data_[data_ix_]); + data_ix_ += sizeof(uint32_t); + packet_->header.ssrc = + ByteReader<uint32_t>::ReadLittleEndian(&data_[data_ix_]); + data_ix_ += sizeof(uint32_t); + RTC_CHECK_EQ(data_ix_ - start_ix, kNumBytesToFuzz); + } + + void MaybeFuzzPayload() { + // Read one byte of fuzz data to determine how many payload bytes to fuzz. + if (data_ix_ + 1 > data_.size()) { + ended_ = true; + return; + } + size_t bytes_to_fuzz = data_[data_ix_++]; + + // Restrict number of bytes to fuzz to 16; a reasonably low number enough to + // cover a few RED headers. Also don't write outside the payload length. + bytes_to_fuzz = std::min(bytes_to_fuzz % 16, packet_->payload.size()); + + if (bytes_to_fuzz == 0) + return; + + if (data_ix_ + bytes_to_fuzz > data_.size()) { + ended_ = true; + return; + } + + std::memcpy(packet_->payload.data(), &data_[data_ix_], bytes_to_fuzz); + data_ix_ += bytes_to_fuzz; + } + + bool ended_ = false; + rtc::ArrayView<const uint8_t> data_; + size_t data_ix_ = 0; + std::unique_ptr<EncodeNetEqInput> input_; + std::unique_ptr<PacketData> packet_; +}; +} // namespace + +void FuzzOneInputTest(const uint8_t* data, size_t size) { + std::unique_ptr<FuzzRtpInput> input( + new FuzzRtpInput(rtc::ArrayView<const uint8_t>(data, size))); + std::unique_ptr<AudioChecksum> output(new AudioChecksum); + NetEqTest::Callbacks callbacks; + NetEq::Config config; + auto codecs = NetEqTest::StandardDecoderMap(); + // kPayloadType is the payload type that will be used for encoding. Verify + // that it is included in the standard decoder map, and that it points to the + // expected decoder type. + const auto it = codecs.find(kPayloadType); + RTC_CHECK(it != codecs.end()); + RTC_CHECK(it->second == SdpAudioFormat("L16", 32000, 1)); + + NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs, + /*text_log=*/nullptr, /*neteq_factory=*/nullptr, + std::move(input), std::move(output), callbacks); + test.Run(); +} + +} // namespace test + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 70000) { + return; + } + test::FuzzOneInputTest(data, size); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc new file mode 100644 index 0000000000..8653f137a2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/neteq_signal_fuzzer.cc @@ -0,0 +1,201 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <cmath> +#include <limits> +#include <memory> +#include <vector> + +#include "api/array_view.h" +#include "api/audio_codecs/builtin_audio_decoder_factory.h" +#include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h" +#include "modules/audio_coding/neteq/tools/audio_checksum.h" +#include "modules/audio_coding/neteq/tools/encode_neteq_input.h" +#include "modules/audio_coding/neteq/tools/neteq_test.h" +#include "rtc_base/numerics/safe_conversions.h" +#include "rtc_base/random.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +namespace test { +namespace { +// Generate a mixture of sine wave and gaussian noise. +class SineAndNoiseGenerator : public EncodeNetEqInput::Generator { + public: + // The noise generator is seeded with a value from the fuzzer data, but 0 is + // avoided (since it is not allowed by the Random class). + SineAndNoiseGenerator(int sample_rate_hz, FuzzDataHelper* fuzz_data) + : sample_rate_hz_(sample_rate_hz), + fuzz_data_(*fuzz_data), + noise_generator_(fuzz_data_.ReadOrDefaultValueNotZero<uint64_t>(1)) {} + + // Generates num_samples of the sine-gaussian mixture. + rtc::ArrayView<const int16_t> Generate(size_t num_samples) override { + if (samples_.size() < num_samples) { + samples_.resize(num_samples); + } + + rtc::ArrayView<int16_t> output(samples_.data(), num_samples); + // Randomize an amplitude between 0 and 32768; use 65000/2 if we are out of + // fuzzer data. + const float amplitude = fuzz_data_.ReadOrDefaultValue<uint16_t>(65000) / 2; + // Randomize a noise standard deviation between 0 and 1999. + const float noise_std = fuzz_data_.ReadOrDefaultValue<uint16_t>(0) % 2000; + for (auto& x : output) { + x = rtc::saturated_cast<int16_t>(amplitude * std::sin(phase_) + + noise_generator_.Gaussian(0, noise_std)); + phase_ += 2 * kPi * kFreqHz / sample_rate_hz_; + } + return output; + } + + private: + static constexpr int kFreqHz = 300; // The sinewave frequency. + const int sample_rate_hz_; + const double kPi = std::acos(-1); + std::vector<int16_t> samples_; + double phase_ = 0.0; + FuzzDataHelper& fuzz_data_; + Random noise_generator_; +}; + +class FuzzSignalInput : public NetEqInput { + public: + explicit FuzzSignalInput(FuzzDataHelper* fuzz_data, + int sample_rate, + uint8_t payload_type) + : fuzz_data_(*fuzz_data) { + AudioEncoderPcm16B::Config config; + config.payload_type = payload_type; + config.sample_rate_hz = sample_rate; + std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config)); + std::unique_ptr<EncodeNetEqInput::Generator> generator( + new SineAndNoiseGenerator(config.sample_rate_hz, fuzz_data)); + input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder), + std::numeric_limits<int64_t>::max())); + packet_ = input_->PopPacket(); + + // Select an output event period. This is how long time we wait between each + // call to NetEq::GetAudio. 10 ms is nominal, 9 and 11 ms will both lead to + // clock drift (in different directions). + constexpr int output_event_periods[] = {9, 10, 11}; + output_event_period_ms_ = fuzz_data_.SelectOneOf(output_event_periods); + } + + absl::optional<int64_t> NextPacketTime() const override { + return packet_->time_ms; + } + + absl::optional<int64_t> NextOutputEventTime() const override { + return next_output_event_ms_; + } + + std::unique_ptr<PacketData> PopPacket() override { + RTC_DCHECK(packet_); + std::unique_ptr<PacketData> packet_to_return = std::move(packet_); + do { + packet_ = input_->PopPacket(); + // If the next value from the fuzzer input is 0, the packet is discarded + // and the next one is pulled from the source. + } while (fuzz_data_.CanReadBytes(1) && fuzz_data_.Read<uint8_t>() == 0); + if (fuzz_data_.CanReadBytes(1)) { + // Generate jitter by setting an offset for the arrival time. + const int8_t arrival_time_offset_ms = fuzz_data_.Read<int8_t>(); + // The arrival time can not be before the previous packets. + packet_->time_ms = std::max(packet_to_return->time_ms, + packet_->time_ms + arrival_time_offset_ms); + } else { + // Mark that we are at the end of the test. However, the current packet is + // still valid (but it may not have been fuzzed as expected). + ended_ = true; + } + return packet_to_return; + } + + void AdvanceOutputEvent() override { + next_output_event_ms_ += output_event_period_ms_; + } + + bool ended() const override { return ended_; } + + absl::optional<RTPHeader> NextHeader() const override { + RTC_DCHECK(packet_); + return packet_->header; + } + + private: + bool ended_ = false; + FuzzDataHelper& fuzz_data_; + std::unique_ptr<EncodeNetEqInput> input_; + std::unique_ptr<PacketData> packet_; + int64_t next_output_event_ms_ = 0; + int64_t output_event_period_ms_ = 10; +}; + +template <class T> +bool MapHas(const std::map<int, T>& m, int key, const T& value) { + const auto it = m.find(key); + return (it != m.end() && it->second == value); +} + +} // namespace + +void FuzzOneInputTest(const uint8_t* data, size_t size) { + if (size < 1 || size > 65000) { + return; + } + + FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size)); + + // Allowed sample rates and payload types used in the test. + std::pair<int, uint8_t> rate_types[] = { + {8000, 93}, {16000, 94}, {32000, 95}, {48000, 96}}; + const auto rate_type = fuzz_data.SelectOneOf(rate_types); + const int sample_rate = rate_type.first; + const uint8_t payload_type = rate_type.second; + + // Set up the input signal generator. + std::unique_ptr<FuzzSignalInput> input( + new FuzzSignalInput(&fuzz_data, sample_rate, payload_type)); + + // Output sink for the test. + std::unique_ptr<AudioChecksum> output(new AudioChecksum); + + // Configure NetEq and the NetEqTest object. + NetEqTest::Callbacks callbacks; + NetEq::Config config; + config.enable_post_decode_vad = true; + config.enable_fast_accelerate = true; + auto codecs = NetEqTest::StandardDecoderMap(); + // rate_types contains the payload types that will be used for encoding. + // Verify that they all are included in the standard decoder map, and that + // they point to the expected decoder types. + RTC_CHECK( + MapHas(codecs, rate_types[0].second, SdpAudioFormat("l16", 8000, 1))); + RTC_CHECK( + MapHas(codecs, rate_types[1].second, SdpAudioFormat("l16", 16000, 1))); + RTC_CHECK( + MapHas(codecs, rate_types[2].second, SdpAudioFormat("l16", 32000, 1))); + RTC_CHECK( + MapHas(codecs, rate_types[3].second, SdpAudioFormat("l16", 48000, 1))); + + NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs, + /*text_log=*/nullptr, /*neteq_factory=*/nullptr, + std::move(input), std::move(output), callbacks); + test.Run(); +} + +} // namespace test + +void FuzzOneInput(const uint8_t* data, size_t size) { + test::FuzzOneInputTest(data, size); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc new file mode 100644 index 0000000000..78ddf0e455 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc @@ -0,0 +1,47 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include "p2p/base/pseudo_tcp.h" +#include "rtc_base/thread.h" + +namespace webrtc { +class FakeIPseudoTcpNotify : public cricket::IPseudoTcpNotify { + public: + void OnTcpOpen(cricket::PseudoTcp* tcp) {} + void OnTcpReadable(cricket::PseudoTcp* tcp) {} + void OnTcpWriteable(cricket::PseudoTcp* tcp) {} + void OnTcpClosed(cricket::PseudoTcp* tcp, uint32_t error) {} + + cricket::IPseudoTcpNotify::WriteResult TcpWritePacket(cricket::PseudoTcp* tcp, + const char* buffer, + size_t len) { + return cricket::IPseudoTcpNotify::WriteResult::WR_SUCCESS; + } +}; + +struct Environment { + explicit Environment(cricket::IPseudoTcpNotify* notifier) + : ptcp(notifier, 0) {} + + // We need the thread to avoid some uninteresting crashes, since the + // production code expects there to be a thread object available. + rtc::AutoThread thread; + cricket::PseudoTcp ptcp; +}; + +Environment* env = new Environment(new FakeIPseudoTcpNotify()); + +void FuzzOneInput(const uint8_t* data, size_t size) { + env->ptcp.NotifyPacket(reinterpret_cast<const char*>(data), size); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc new file mode 100644 index 0000000000..0efe81f220 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/residual_echo_detector_fuzzer.cc @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <math.h> +#include <string.h> + +#include <algorithm> +#include <bitset> +#include <vector> + +#include "api/audio/echo_detector_creator.h" +#include "rtc_base/checks.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + // Number of times to update the echo detector. + constexpr size_t kNrOfUpdates = 7; + // Each round of updates requires a call to both AnalyzeRender and + // AnalyzeCapture, so the amount of needed input bytes doubles. Also, two + // bytes are used to set the call order. + constexpr size_t kNrOfNeededInputBytes = 2 * kNrOfUpdates * sizeof(float) + 2; + // The maximum audio energy that an audio frame can have is equal to the + // number of samples in the frame multiplied by 2^30. We use a single sample + // to represent an audio frame in this test, so it should have a maximum value + // equal to the square root of that value. + const float maxFuzzedValue = sqrtf(20 * 48) * 32768; + if (size < kNrOfNeededInputBytes) { + return; + } + size_t read_idx = 0; + // Use the first two bytes to choose the call order. + uint16_t call_order_int; + memcpy(&call_order_int, &data[read_idx], 2); + read_idx += 2; + std::bitset<16> call_order(call_order_int); + + rtc::scoped_refptr<EchoDetector> echo_detector = CreateEchoDetector(); + std::vector<float> input(1); + // Call AnalyzeCaptureAudio once to prevent the flushing of the buffer. + echo_detector->AnalyzeCaptureAudio(input); + for (size_t i = 0; i < 2 * kNrOfUpdates; ++i) { + // Convert 4 input bytes to a float. + RTC_DCHECK_LE(read_idx + sizeof(float), size); + memcpy(input.data(), &data[read_idx], sizeof(float)); + read_idx += sizeof(float); + if (!isfinite(input[0]) || fabs(input[0]) > maxFuzzedValue) { + // Ignore infinity, nan values and values that are unrealistically large. + continue; + } + if (call_order[i]) { + echo_detector->AnalyzeRenderAudio(input); + } else { + echo_detector->AnalyzeCaptureAudio(input); + } + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc new file mode 100644 index 0000000000..8bad9e456a --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtcp_receiver_fuzzer.cc @@ -0,0 +1,52 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "modules/rtp_rtcp/source/rtcp_packet/tmmb_item.h" +#include "modules/rtp_rtcp/source/rtcp_receiver.h" +#include "modules/rtp_rtcp/source/rtp_rtcp_interface.h" +#include "rtc_base/checks.h" +#include "system_wrappers/include/clock.h" + +namespace webrtc { +namespace { + +constexpr int kRtcpIntervalMs = 1000; + +// RTCP is typically sent over UDP, which has a maximum payload length +// of 65535 bytes. We err on the side of caution and check a bit above that. +constexpr size_t kMaxInputLenBytes = 66000; + +class NullModuleRtpRtcp : public RTCPReceiver::ModuleRtpRtcp { + public: + void SetTmmbn(std::vector<rtcp::TmmbItem>) override {} + void OnRequestSendReport() override {} + void OnReceivedNack(const std::vector<uint16_t>&) override {} + void OnReceivedRtcpReportBlocks(const ReportBlockList&) override {} +}; + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > kMaxInputLenBytes) { + return; + } + + NullModuleRtpRtcp rtp_rtcp_module; + SimulatedClock clock(1234); + + RtpRtcpInterface::Configuration config; + config.clock = &clock; + config.rtcp_report_interval_ms = kRtcpIntervalMs; + config.local_media_ssrc = 1; + + RTCPReceiver receiver(config, &rtp_rtcp_module); + + receiver.IncomingPacket(data, size); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc new file mode 100644 index 0000000000..168e7b606b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc @@ -0,0 +1,39 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "modules/rtp_rtcp/source/video_rtp_depacketizer_av1.h" + +#include <stddef.h> +#include <stdint.h> + +#include <vector> + +#include "api/array_view.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + std::vector<rtc::ArrayView<const uint8_t>> rtp_payloads; + + // Convert plain array of bytes into array of array bytes. + test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size)); + while (fuzz_input.CanReadBytes(sizeof(uint16_t))) { + // In practice one rtp payload can be up to ~1200 - 1500 bytes. Majority + // of the payload is just copied. To make fuzzing more efficient limit the + // size of rtp payload to realistic value. + uint16_t next_size = fuzz_input.Read<uint16_t>() % 1200; + if (next_size > fuzz_input.BytesLeft()) { + next_size = fuzz_input.BytesLeft(); + } + rtp_payloads.push_back(fuzz_input.ReadByteArray(next_size)); + } + // Run code under test. + VideoRtpDepacketizerAv1().AssembleFrame(rtp_payloads); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc new file mode 100644 index 0000000000..82404f7264 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_dependency_descriptor_fuzzer.cc @@ -0,0 +1,94 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> +#include <cstddef> +#include <cstdint> +#include <memory> +#include <utility> + +#include "api/array_view.h" +#include "common_video/generic_frame_descriptor/generic_frame_info.h" +#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h" +#include "rtc_base/checks.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + FrameDependencyStructure structure1; + // nullptr during 1st while loop, after that should point to structure1. + const FrameDependencyStructure* structure1_ptr = nullptr; + std::unique_ptr<const FrameDependencyStructure> structure2; + + test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size)); + while (fuzz_data.CanReadBytes(1)) { + // Treat next byte as size of the next extension. That aligns how + // two-byte rtp header extension sizes are written. + size_t next_size = fuzz_data.Read<uint8_t>(); + auto raw = + fuzz_data.ReadByteArray(std::min(next_size, fuzz_data.BytesLeft())); + + // Read the random input. + DependencyDescriptor descriptor1; + if (!RtpDependencyDescriptorExtension::Parse(raw, structure1_ptr, + &descriptor1)) { + // Ignore invalid buffer and move on. + continue; + } + if (descriptor1.attached_structure) { + structure1 = *descriptor1.attached_structure; + structure1_ptr = &structure1; + } + RTC_CHECK(structure1_ptr); + + // Write parsed descriptor back into raw buffer. + size_t value_size = + RtpDependencyDescriptorExtension::ValueSize(structure1, descriptor1); + // Check `writer` use minimal number of bytes to pack the descriptor by + // checking it doesn't use more than reader consumed. + RTC_CHECK_LE(value_size, raw.size()); + uint8_t some_memory[256]; + // That should be true because value_size <= next_size < 256 + RTC_CHECK_LT(value_size, 256); + rtc::ArrayView<uint8_t> write_buffer(some_memory, value_size); + RTC_CHECK(RtpDependencyDescriptorExtension::Write(write_buffer, structure1, + descriptor1)); + + // Parse what Write assembled. + // Unlike random input that should always succeed. + DependencyDescriptor descriptor2; + RTC_CHECK(RtpDependencyDescriptorExtension::Parse( + write_buffer, structure2.get(), &descriptor2)); + // Check descriptor1 and descriptor2 have same values. + RTC_CHECK_EQ(descriptor1.first_packet_in_frame, + descriptor2.first_packet_in_frame); + RTC_CHECK_EQ(descriptor1.last_packet_in_frame, + descriptor2.last_packet_in_frame); + RTC_CHECK_EQ(descriptor1.attached_structure != nullptr, + descriptor2.attached_structure != nullptr); + // Using value_or would miss invalid corner case when one value is nullopt + // while another one is 0, but for other errors would produce much nicer + // error message than using RTC_CHECK(optional1 == optional2); + // If logger would support pretty printing optional values, value_or can be + // removed. + RTC_CHECK_EQ(descriptor1.active_decode_targets_bitmask.value_or(0), + descriptor2.active_decode_targets_bitmask.value_or(0)); + RTC_CHECK_EQ(descriptor1.frame_number, descriptor2.frame_number); + RTC_CHECK(descriptor1.resolution == descriptor2.resolution); + RTC_CHECK(descriptor1.frame_dependencies == descriptor2.frame_dependencies); + + if (descriptor2.attached_structure) { + structure2 = std::move(descriptor2.attached_structure); + } + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc new file mode 100644 index 0000000000..fdb4aa5f3c --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_frame_reference_finder_fuzzer.cc @@ -0,0 +1,154 @@ +/* + * Copyright (c) 2018 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "api/rtp_packet_infos.h" +#include "modules/video_coding/frame_object.h" +#include "modules/video_coding/rtp_frame_reference_finder.h" + +namespace webrtc { + +namespace { +class DataReader { + public: + DataReader(const uint8_t* data, size_t size) : data_(data), size_(size) {} + + template <typename T> + void CopyTo(T* object) { + static_assert(std::is_pod<T>(), ""); + uint8_t* destination = reinterpret_cast<uint8_t*>(object); + size_t object_size = sizeof(T); + size_t num_bytes = std::min(size_ - offset_, object_size); + memcpy(destination, data_ + offset_, num_bytes); + offset_ += num_bytes; + + // If we did not have enough data, fill the rest with 0. + object_size -= num_bytes; + memset(destination + num_bytes, 0, object_size); + } + + template <typename T> + T GetNum() { + T res; + if (offset_ + sizeof(res) < size_) { + memcpy(&res, data_ + offset_, sizeof(res)); + offset_ += sizeof(res); + return res; + } + + offset_ = size_; + return T(0); + } + + bool MoreToRead() { return offset_ < size_; } + + private: + const uint8_t* data_; + size_t size_; + size_t offset_ = 0; +}; + +absl::optional<RTPVideoHeader::GenericDescriptorInfo> +GenerateGenericFrameDependencies(DataReader* reader) { + absl::optional<RTPVideoHeader::GenericDescriptorInfo> result; + uint8_t flags = reader->GetNum<uint8_t>(); + if (flags & 0b1000'0000) { + // i.e. with 50% chance there are no generic dependencies. + // in such case codec-specfic code path of the RtpFrameReferenceFinder will + // be validated. + return result; + } + + result.emplace(); + result->frame_id = reader->GetNum<int32_t>(); + result->spatial_index = (flags & 0b0111'0000) >> 4; + result->temporal_index = (flags & 0b0000'1110) >> 1; + + // Larger than supported by the RtpFrameReferenceFinder. + int num_diffs = (reader->GetNum<uint8_t>() % 16); + for (int i = 0; i < num_diffs; ++i) { + result->dependencies.push_back(result->frame_id - + (reader->GetNum<uint16_t>() % (1 << 14))); + } + + return result; +} +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + DataReader reader(data, size); + RtpFrameReferenceFinder reference_finder; + + auto codec = static_cast<VideoCodecType>(reader.GetNum<uint8_t>() % 5); + + while (reader.MoreToRead()) { + uint16_t first_seq_num = reader.GetNum<uint16_t>(); + uint16_t last_seq_num = reader.GetNum<uint16_t>(); + bool marker_bit = reader.GetNum<uint8_t>(); + + RTPVideoHeader video_header; + switch (reader.GetNum<uint8_t>() % 3) { + case 0: + video_header.frame_type = VideoFrameType::kEmptyFrame; + break; + case 1: + video_header.frame_type = VideoFrameType::kVideoFrameKey; + break; + case 2: + video_header.frame_type = VideoFrameType::kVideoFrameDelta; + break; + } + + switch (codec) { + case kVideoCodecVP8: + reader.CopyTo( + &video_header.video_type_header.emplace<RTPVideoHeaderVP8>()); + break; + case kVideoCodecVP9: + reader.CopyTo( + &video_header.video_type_header.emplace<RTPVideoHeaderVP9>()); + break; + case kVideoCodecH264: + reader.CopyTo( + &video_header.video_type_header.emplace<RTPVideoHeaderH264>()); + break; + default: + break; + } + + video_header.generic = GenerateGenericFrameDependencies(&reader); + + // clang-format off + auto frame = std::make_unique<RtpFrameObject>( + first_seq_num, + last_seq_num, + marker_bit, + /*times_nacked=*/0, + /*first_packet_received_time=*/0, + /*last_packet_received_time=*/0, + /*rtp_timestamp=*/0, + /*ntp_time_ms=*/0, + VideoSendTiming(), + /*payload_type=*/0, + codec, + kVideoRotation_0, + VideoContentType::UNSPECIFIED, + video_header, + /*color_space=*/absl::nullopt, + RtpPacketInfos(), + EncodedImageBuffer::Create(/*size=*/0)); + // clang-format on + + reference_finder.ManageFrame(std::move(frame)); + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc new file mode 100644 index 0000000000..5d117529bb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_packet_fuzzer.cc @@ -0,0 +1,182 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <bitset> +#include <vector> + +#include "absl/types/optional.h" +#include "modules/rtp_rtcp/include/rtp_header_extension_map.h" +#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h" +#include "modules/rtp_rtcp/source/rtp_header_extensions.h" +#include "modules/rtp_rtcp/source/rtp_packet_received.h" +#include "modules/rtp_rtcp/source/rtp_video_layers_allocation_extension.h" + +namespace webrtc { +// We decide which header extensions to register by reading four bytes +// from the beginning of `data` and interpreting it as a bitmask over +// the RTPExtensionType enum. This assert ensures four bytes are enough. +static_assert(kRtpExtensionNumberOfExtensions <= 32, + "Insufficient bits read to configure all header extensions. Add " + "an extra byte and update the switches."); + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size <= 4) + return; + + // Don't use the configuration byte as part of the packet. + std::bitset<32> extensionMask(*reinterpret_cast<const uint32_t*>(data)); + data += 4; + size -= 4; + + RtpPacketReceived::ExtensionManager extensions(/*extmap_allow_mixed=*/true); + // Start at local_id = 1 since 0 is an invalid extension id. + int local_id = 1; + // Skip i = 0 since it maps to kRtpExtensionNone. + for (int i = 1; i < kRtpExtensionNumberOfExtensions; i++) { + RTPExtensionType extension_type = static_cast<RTPExtensionType>(i); + if (extensionMask[i]) { + // Extensions are registered with an ID, which you signal to the + // peer so they know what to expect. This code only cares about + // parsing so the value of the ID isn't relevant. + extensions.RegisterByType(local_id++, extension_type); + } + } + + RtpPacketReceived packet(&extensions); + packet.Parse(data, size); + + // Call packet accessors because they have extra checks. + packet.Marker(); + packet.PayloadType(); + packet.SequenceNumber(); + packet.Timestamp(); + packet.Ssrc(); + packet.Csrcs(); + + // Each extension has its own getter. It is supported behaviour to + // call GetExtension on an extension which was not registered, so we + // don't check the bitmask here. + for (int i = 0; i < kRtpExtensionNumberOfExtensions; i++) { + switch (static_cast<RTPExtensionType>(i)) { + case kRtpExtensionNone: + case kRtpExtensionNumberOfExtensions: + break; + case kRtpExtensionTransmissionTimeOffset: + int32_t offset; + packet.GetExtension<TransmissionOffset>(&offset); + break; + case kRtpExtensionAudioLevel: + bool voice_activity; + uint8_t audio_level; + packet.GetExtension<AudioLevel>(&voice_activity, &audio_level); + break; +#if !defined(WEBRTC_MOZILLA_BUILD) + case kRtpExtensionCsrcAudioLevel: { + std::vector<uint8_t> audio_levels; + packet.GetExtension<CsrcAudioLevel>(&audio_levels); + break; + } +#endif + case kRtpExtensionAbsoluteSendTime: + uint32_t sendtime; + packet.GetExtension<AbsoluteSendTime>(&sendtime); + break; + case kRtpExtensionAbsoluteCaptureTime: { + AbsoluteCaptureTime extension; + packet.GetExtension<AbsoluteCaptureTimeExtension>(&extension); + break; + } + case kRtpExtensionVideoRotation: + uint8_t rotation; + packet.GetExtension<VideoOrientation>(&rotation); + break; + case kRtpExtensionTransportSequenceNumber: + uint16_t seqnum; + packet.GetExtension<TransportSequenceNumber>(&seqnum); + break; + case kRtpExtensionTransportSequenceNumber02: { + uint16_t seqnum; + absl::optional<FeedbackRequest> feedback_request; + packet.GetExtension<TransportSequenceNumberV2>(&seqnum, + &feedback_request); + break; + } + case kRtpExtensionPlayoutDelay: { + VideoPlayoutDelay playout; + packet.GetExtension<PlayoutDelayLimits>(&playout); + break; + } + case kRtpExtensionVideoContentType: + VideoContentType content_type; + packet.GetExtension<VideoContentTypeExtension>(&content_type); + break; + case kRtpExtensionVideoTiming: { + VideoSendTiming timing; + packet.GetExtension<VideoTimingExtension>(&timing); + break; + } + case kRtpExtensionRtpStreamId: { + std::string rsid; + packet.GetExtension<RtpStreamId>(&rsid); + break; + } + case kRtpExtensionRepairedRtpStreamId: { + std::string rsid; + packet.GetExtension<RepairedRtpStreamId>(&rsid); + break; + } + case kRtpExtensionMid: { + std::string mid; + packet.GetExtension<RtpMid>(&mid); + break; + } + case kRtpExtensionGenericFrameDescriptor: { + RtpGenericFrameDescriptor descriptor; + packet.GetExtension<RtpGenericFrameDescriptorExtension00>(&descriptor); + break; + } + case kRtpExtensionColorSpace: { + ColorSpace color_space; + packet.GetExtension<ColorSpaceExtension>(&color_space); + break; + } + case kRtpExtensionInbandComfortNoise: { + absl::optional<uint8_t> noise_level; + packet.GetExtension<InbandComfortNoiseExtension>(&noise_level); + break; + } + case kRtpExtensionVideoLayersAllocation: { + VideoLayersAllocation allocation; + packet.GetExtension<RtpVideoLayersAllocationExtension>(&allocation); + break; + } + case kRtpExtensionVideoFrameTrackingId: { + uint16_t tracking_id; + packet.GetExtension<VideoFrameTrackingIdExtension>(&tracking_id); + break; + } + case kRtpExtensionDependencyDescriptor: + // This extension requires state to read and so complicated that + // deserves own fuzzer. + break; +#if defined(WEBRTC_MOZILLA_BUILD) + case kRtpExtensionCsrcAudioLevel: { + CsrcAudioLevelList levels; + packet.GetExtension<CsrcAudioLevel>(&levels); + break; + } +#endif + } + } + + // Check that zero-ing mutable extensions wouldn't cause any problems. + packet.ZeroMutableExtensions(); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc new file mode 100644 index 0000000000..e5550c1279 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_packetizer_av1_fuzzer.cc @@ -0,0 +1,71 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include <stddef.h> +#include <stdint.h> + +#include "api/video/video_frame_type.h" +#include "modules/rtp_rtcp/source/rtp_format.h" +#include "modules/rtp_rtcp/source/rtp_packet_to_send.h" +#include "modules/rtp_rtcp/source/rtp_packetizer_av1.h" +#include "rtc_base/checks.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size)); + + RtpPacketizer::PayloadSizeLimits limits; + limits.max_payload_len = 1200; + // Read uint8_t to be sure reduction_lens are much smaller than + // max_payload_len and thus limits structure is valid. + limits.first_packet_reduction_len = fuzz_input.ReadOrDefaultValue<uint8_t>(0); + limits.last_packet_reduction_len = fuzz_input.ReadOrDefaultValue<uint8_t>(0); + limits.single_packet_reduction_len = + fuzz_input.ReadOrDefaultValue<uint8_t>(0); + const VideoFrameType kFrameTypes[] = {VideoFrameType::kVideoFrameKey, + VideoFrameType::kVideoFrameDelta}; + VideoFrameType frame_type = fuzz_input.SelectOneOf(kFrameTypes); + + // Main function under test: RtpPacketizerAv1's constructor. + RtpPacketizerAv1 packetizer(fuzz_input.ReadByteArray(fuzz_input.BytesLeft()), + limits, frame_type, + /*is_last_frame_in_picture=*/true); + + size_t num_packets = packetizer.NumPackets(); + if (num_packets == 0) { + return; + } + // When packetization was successful, validate NextPacket function too. + // While at it, check that packets respect the payload size limits. + RtpPacketToSend rtp_packet(nullptr); + // Single packet. + if (num_packets == 1) { + RTC_CHECK(packetizer.NextPacket(&rtp_packet)); + RTC_CHECK_LE(rtp_packet.payload_size(), + limits.max_payload_len - limits.single_packet_reduction_len); + return; + } + // First packet. + RTC_CHECK(packetizer.NextPacket(&rtp_packet)); + RTC_CHECK_LE(rtp_packet.payload_size(), + limits.max_payload_len - limits.first_packet_reduction_len); + // Middle packets. + for (size_t i = 1; i < num_packets - 1; ++i) { + RTC_CHECK(packetizer.NextPacket(&rtp_packet)) + << "Failed to get packet#" << i; + RTC_CHECK_LE(rtp_packet.payload_size(), limits.max_payload_len) + << "Packet #" << i << " exceeds it's limit"; + } + // Last packet. + RTC_CHECK(packetizer.NextPacket(&rtp_packet)); + RTC_CHECK_LE(rtp_packet.payload_size(), + limits.max_payload_len - limits.last_packet_reduction_len); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc new file mode 100644 index 0000000000..6ab6b9a905 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_video_frame_assembler_fuzzer.cc @@ -0,0 +1,44 @@ +/* + * Copyright (c) 2023 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> +#include <cstddef> +#include <cstdint> + +#include "api/video/rtp_video_frame_assembler.h" +#include "modules/rtp_rtcp/include/rtp_header_extension_map.h" +#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h" +#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h" +#include "modules/rtp_rtcp/source/rtp_packet_received.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size == 0) { + return; + } + RtpHeaderExtensionMap extensions; + extensions.Register<RtpDependencyDescriptorExtension>(1); + extensions.Register<RtpGenericFrameDescriptorExtension00>(2); + RtpPacketReceived rtp_packet(&extensions); + + RtpVideoFrameAssembler assembler( + static_cast<RtpVideoFrameAssembler::PayloadFormat>(data[0] % 6)); + + for (size_t i = 1; i < size;) { + size_t packet_size = std::min<size_t>(size - i, 300); + if (rtp_packet.Parse(data + i, packet_size)) { + assembler.InsertPacket(rtp_packet); + } + i += packet_size; + } +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc new file mode 100644 index 0000000000..ae8b8728fb --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/rtp_video_layers_allocation_fuzzer.cc @@ -0,0 +1,64 @@ +/* + * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <cstddef> +#include <cstdint> +#include <limits> + +#include "api/array_view.h" +#include "api/video/video_layers_allocation.h" +#include "modules/rtp_rtcp/source/rtp_video_layers_allocation_extension.h" +#include "rtc_base/checks.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + // Video layers allocation is an rtp header extension. + // Per https://datatracker.ietf.org/doc/html/rfc8285#section-4.3 + // rtp header extension uses up to one byte to store the size, i.e. + // maximum size of any rtp header extension is 255 bytes. + constexpr int kMaxSize = std::numeric_limits<uint8_t>::max(); + if (size > kMaxSize) { + return; + } + auto raw = rtc::MakeArrayView(data, size); + + VideoLayersAllocation allocation1; + if (!RtpVideoLayersAllocationExtension::Parse(raw, &allocation1)) { + // Ignore invalid buffer and move on. + return; + } + + // Write parsed allocation back into raw buffer. + size_t value_size = RtpVideoLayersAllocationExtension::ValueSize(allocation1); + // Check `writer` use minimal number of bytes to pack the extension by + // checking it doesn't use more than reader consumed. + RTC_CHECK_LE(value_size, raw.size()); + uint8_t some_memory[kMaxSize]; + RTC_CHECK_LE(value_size, kMaxSize); + rtc::ArrayView<uint8_t> write_buffer(some_memory, value_size); + RTC_CHECK( + RtpVideoLayersAllocationExtension::Write(write_buffer, allocation1)); + + // Parse what Write assembled. + // Unlike random input that should always succeed. + VideoLayersAllocation allocation2; + RTC_CHECK( + RtpVideoLayersAllocationExtension::Parse(write_buffer, &allocation2)); + + RTC_CHECK_EQ(allocation1.rtp_stream_index, allocation2.rtp_stream_index); + RTC_CHECK_EQ(allocation1.resolution_and_frame_rate_is_valid, + allocation2.resolution_and_frame_rate_is_valid); + RTC_CHECK_EQ(allocation1.active_spatial_layers.size(), + allocation2.active_spatial_layers.size()); + RTC_CHECK(allocation1 == allocation2); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc new file mode 100644 index 0000000000..249707514e --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/sctp_utils_fuzzer.cc @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include <string> + +#include "api/data_channel_interface.h" +#include "pc/sctp_utils.h" +#include "rtc_base/copy_on_write_buffer.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + rtc::CopyOnWriteBuffer payload(data, size); + std::string label; + DataChannelInit config; + IsOpenMessage(payload); + ParseDataChannelOpenMessage(payload, &label, &config); + ParseDataChannelOpenAckMessage(payload); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc new file mode 100644 index 0000000000..ece4b50505 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/sdp_integration_fuzzer.cc @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include "absl/strings/string_view.h" +#include "pc/test/integration_test_helpers.h" + +namespace webrtc { + +class FuzzerTest : public PeerConnectionIntegrationBaseTest { + public: + FuzzerTest() + : PeerConnectionIntegrationBaseTest(SdpSemantics::kUnifiedPlan) {} + + void RunNegotiateCycle(absl::string_view message) { + CreatePeerConnectionWrappers(); + // Note - we do not do test.ConnectFakeSignaling(); all signals + // generated are discarded. + + auto srd_observer = + rtc::make_ref_counted<FakeSetRemoteDescriptionObserver>(); + + SdpParseError error; + std::unique_ptr<SessionDescriptionInterface> sdp( + CreateSessionDescription("offer", std::string(message), &error)); + caller()->pc()->SetRemoteDescription(std::move(sdp), srd_observer); + // Wait a short time for observer to be called. Timeout is short + // because the fuzzer should be trying many branches. + EXPECT_TRUE_WAIT(srd_observer->called(), 100); + + // If set-remote-description was successful, try to answer. + auto sld_observer = + rtc::make_ref_counted<FakeSetLocalDescriptionObserver>(); + if (srd_observer->error().ok()) { + caller()->pc()->SetLocalDescription(sld_observer); + EXPECT_TRUE_WAIT(sld_observer->called(), 100); + } + // If there is an EXPECT failure, die here. + RTC_CHECK(!HasFailure()); + } + + // This test isn't using the test definition macros, so we have to + // define the TestBody() function, even though we don't need it. + void TestBody() override {} +}; + +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 16384) { + return; + } + + FuzzerTest test; + test.RunNegotiateCycle( + absl::string_view(reinterpret_cast<const char*>(data), size)); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc new file mode 100644 index 0000000000..c85eab4047 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/sdp_parser_fuzzer.cc @@ -0,0 +1,28 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include "api/jsep_session_description.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + if (size > 16384) { + return; + } + std::string message(reinterpret_cast<const char*>(data), size); + webrtc::SdpParseError error; + + std::unique_ptr<webrtc::SessionDescriptionInterface> sdp( + CreateSessionDescription("offer", message, &error)); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc new file mode 100644 index 0000000000..4bab5c8f02 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/ssl_certificate_fuzzer.cc @@ -0,0 +1,49 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include <string> + +#include "rtc_base/message_digest.h" +#include "rtc_base/ssl_certificate.h" +#include "rtc_base/string_encode.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + std::string pem_certificate(reinterpret_cast<const char*>(data), size); + + std::unique_ptr<rtc::SSLCertificate> cert = + rtc::SSLCertificate::FromPEMString(pem_certificate); + + if (cert == nullptr) { + return; + } + + cert->Clone(); + cert->GetStats(); + cert->ToPEMString(); + cert->CertificateExpirationTime(); + + std::string algorithm; + cert->GetSignatureDigestAlgorithm(&algorithm); + + unsigned char digest[rtc::MessageDigest::kMaxSize]; + size_t digest_len; + cert->ComputeDigest(algorithm, digest, rtc::MessageDigest::kMaxSize, + &digest_len); + + rtc::Buffer der_buffer; + cert->ToDER(&der_buffer); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc new file mode 100644 index 0000000000..28b36a73ce --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/string_to_number_fuzzer.cc @@ -0,0 +1,35 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include <string> + +#include "rtc_base/string_to_number.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + std::string number_to_parse(reinterpret_cast<const char*>(data), size); + rtc::StringToNumber<int8_t>(number_to_parse); + rtc::StringToNumber<int16_t>(number_to_parse); + rtc::StringToNumber<int32_t>(number_to_parse); + rtc::StringToNumber<int64_t>(number_to_parse); + rtc::StringToNumber<uint8_t>(number_to_parse); + rtc::StringToNumber<uint16_t>(number_to_parse); + rtc::StringToNumber<uint32_t>(number_to_parse); + rtc::StringToNumber<uint64_t>(number_to_parse); + rtc::StringToNumber<float>(number_to_parse); + rtc::StringToNumber<double>(number_to_parse); + rtc::StringToNumber<long double>(number_to_parse); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc new file mode 100644 index 0000000000..6ca9eac8b2 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/stun_parser_fuzzer.cc @@ -0,0 +1,29 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include "api/transport/stun.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + const char* message = reinterpret_cast<const char*>(data); + + // Normally we'd check the integrity first, but those checks are + // fuzzed separately in stun_validator_fuzzer.cc. We still want to + // fuzz this target since the integrity checks could be forged by a + // malicious adversary who receives a call. + std::unique_ptr<cricket::IceMessage> stun_msg(new cricket::IceMessage()); + rtc::ByteBufferReader buf(message, size); + stun_msg->Read(&buf); + stun_msg->ValidateMessageIntegrity(""); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc new file mode 100644 index 0000000000..421638db1b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/stun_validator_fuzzer.cc @@ -0,0 +1,23 @@ +/* + * Copyright (c) 2016 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include "api/transport/stun.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + const char* message = reinterpret_cast<const char*>(data); + + cricket::StunMessage::ValidateFingerprint(message, size); + cricket::StunMessage::ValidateMessageIntegrityForTesting(message, size, ""); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc new file mode 100644 index 0000000000..47ee7fd205 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/turn_unwrap_fuzzer.cc @@ -0,0 +1,22 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include "media/base/turn_utils.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + size_t content_position; + size_t content_size; + cricket::UnwrapTurnPacket(data, size, &content_position, &content_size); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc new file mode 100644 index 0000000000..43d9450918 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/ulpfec_generator_fuzzer.cc @@ -0,0 +1,70 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <memory> + +#include "modules/include/module_common_types_public.h" +#include "modules/rtp_rtcp/source/byte_io.h" +#include "modules/rtp_rtcp/source/fec_test_helper.h" +#include "modules/rtp_rtcp/source/ulpfec_generator.h" +#include "rtc_base/checks.h" +#include "rtc_base/copy_on_write_buffer.h" +#include "system_wrappers/include/clock.h" + +namespace webrtc { + +namespace { +constexpr uint8_t kFecPayloadType = 96; +constexpr uint8_t kRedPayloadType = 97; +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + SimulatedClock clock(1); + UlpfecGenerator generator(kRedPayloadType, kFecPayloadType, &clock); + size_t i = 0; + if (size < 4) + return; + FecProtectionParams params = { + data[i++] % 128, static_cast<int>(data[i++] % 10), kFecMaskBursty}; + generator.SetProtectionParameters(params, params); + uint16_t seq_num = data[i++]; + uint16_t prev_seq_num = 0; + while (i + 3 < size) { + size_t rtp_header_length = data[i++] % 10 + 12; + size_t payload_size = data[i++] % 10; + if (i + payload_size + rtp_header_length + 2 > size) + break; + rtc::CopyOnWriteBuffer packet(&data[i], payload_size + rtp_header_length); + packet.EnsureCapacity(IP_PACKET_SIZE); + // Write a valid parsable header (version = 2, no padding, no extensions, + // no CSRCs). + ByteWriter<uint8_t>::WriteBigEndian(packet.MutableData(), 2 << 6); + // Make sure sequence numbers are increasing. + ByteWriter<uint16_t>::WriteBigEndian(packet.MutableData() + 2, seq_num++); + i += payload_size + rtp_header_length; + const bool protect = data[i++] % 2 == 1; + + // Check the sequence numbers are monotonic. In rare case the packets number + // may loop around and in the same FEC-protected group the packet sequence + // number became out of order. + if (protect && IsNewerSequenceNumber(seq_num, prev_seq_num) && + seq_num < prev_seq_num + kUlpfecMaxMediaPackets) { + RtpPacketToSend rtp_packet(nullptr); + // Check that we actually have a parsable packet, we want to fuzz FEC + // logic, not RTP header parsing. + RTC_CHECK(rtp_packet.Parse(packet)); + generator.AddPacketAndGenerateFec(rtp_packet); + prev_seq_num = seq_num; + } + + generator.GetFecPackets(); + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc new file mode 100644 index 0000000000..243cb4ed70 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/ulpfec_header_reader_fuzzer.cc @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> + +#include "api/scoped_refptr.h" +#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h" +#include "modules/rtp_rtcp/source/forward_error_correction.h" +#include "modules/rtp_rtcp/source/ulpfec_header_reader_writer.h" + +namespace webrtc { + +using Packet = ForwardErrorCorrection::Packet; +using ReceivedFecPacket = ForwardErrorCorrection::ReceivedFecPacket; + +void FuzzOneInput(const uint8_t* data, size_t size) { + ReceivedFecPacket packet; + packet.pkt = rtc::scoped_refptr<Packet>(new Packet()); + const size_t packet_size = + std::min(size, static_cast<size_t>(IP_PACKET_SIZE)); + packet.pkt->data.SetSize(packet_size); + packet.pkt->data.EnsureCapacity(IP_PACKET_SIZE); + memcpy(packet.pkt->data.MutableData(), data, packet_size); + + UlpfecHeaderReader ulpfec_reader; + ulpfec_reader.ReadFecHeader(&packet); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc new file mode 100644 index 0000000000..0a29ba3259 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/ulpfec_receiver_fuzzer.cc @@ -0,0 +1,71 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <algorithm> + +#include "modules/rtp_rtcp/include/rtp_rtcp_defines.h" +#include "modules/rtp_rtcp/source/byte_io.h" +#include "modules/rtp_rtcp/source/rtp_packet_received.h" +#include "modules/rtp_rtcp/source/ulpfec_receiver.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { + +namespace { +class DummyCallback : public RecoveredPacketReceiver { + void OnRecoveredPacket(const RtpPacketReceived& packet) override {} +}; +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + constexpr size_t kMinDataNeeded = 12; + if (size < kMinDataNeeded || size > 2000) { + return; + } + + uint32_t ulpfec_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 0); + uint16_t ulpfec_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 4); + uint32_t media_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 6); + uint16_t media_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 10); + + DummyCallback callback; + UlpfecReceiver receiver(ulpfec_ssrc, 0, &callback, Clock::GetRealTimeClock()); + + test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size)); + while (fuzz_data.CanReadBytes(kMinDataNeeded)) { + size_t packet_length = kRtpHeaderSize + fuzz_data.Read<uint8_t>(); + auto raw_packet = fuzz_data.ReadByteArray(packet_length); + + RtpPacketReceived parsed_packet; + if (!parsed_packet.Parse(raw_packet)) + continue; + + // Overwrite the fields for the sequence number and SSRC with + // consistent values for either a received UlpFEC packet or received media + // packet. (We're still relying on libfuzzer to manage to generate packet + // headers that interact together; this just ensures that we have two + // consistent streams). + if (fuzz_data.ReadOrDefaultValue<uint8_t>(0) % 2 == 0) { + // Simulate UlpFEC packet. + parsed_packet.SetSequenceNumber(ulpfec_seq_num++); + parsed_packet.SetSsrc(ulpfec_ssrc); + } else { + // Simulate media packet. + parsed_packet.SetSequenceNumber(media_seq_num++); + parsed_packet.SetSsrc(media_ssrc); + } + + receiver.AddReceivedRedPacket(parsed_packet); + } + + receiver.ProcessReceivedFec(); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn b/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn new file mode 100644 index 0000000000..c5744fc33b --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/utils/BUILD.gn @@ -0,0 +1,47 @@ +# Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. +# +# Use of this source code is governed by a BSD-style license +# that can be found in the LICENSE file in the root of the source +# tree. An additional intellectual property rights grant can be found +# in the file PATENTS. All contributing project authors may +# be found in the AUTHORS file in the root of the source tree. + +import("../../../webrtc.gni") + +rtc_library("rtp_replayer") { + testonly = true + sources = [ + "rtp_replayer.cc", + "rtp_replayer.h", + ] + deps = [ + "../../../api/rtc_event_log", + "../../../api/task_queue:default_task_queue_factory", + "../../../api/test/video:function_video_factory", + "../../../api/transport:field_trial_based_config", + "../../../api/units:timestamp", + "../../../api/video_codecs:video_codecs_api", + "../../../call", + "../../../call:call_interfaces", + "../../../common_video", + "../../../media:rtc_internal_video_codecs", + "../../../modules/rtp_rtcp:rtp_rtcp_format", + "../../../rtc_base:checks", + "../../../rtc_base:rtc_base_tests_utils", + "../../../rtc_base:rtc_json", + "../../../rtc_base:timeutils", + "../../../system_wrappers", + "../../../test:call_config_utils", + "../../../test:encoder_settings", + "../../../test:fake_video_codecs", + "../../../test:null_transport", + "../../../test:rtp_test_utils", + "../../../test:run_loop", + "../../../test:run_test", + "../../../test:run_test_interface", + "../../../test:test_renderer", + "../../../test:test_support", + "../../../test:video_test_common", + ] + absl_deps = [ "//third_party/abseil-cpp/absl/memory:memory" ] +} diff --git a/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc new file mode 100644 index 0000000000..12743d89d9 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.cc @@ -0,0 +1,200 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "test/fuzzers/utils/rtp_replayer.h" + +#include <algorithm> +#include <memory> +#include <string> +#include <utility> + +#include "absl/memory/memory.h" +#include "api/task_queue/default_task_queue_factory.h" +#include "api/transport/field_trial_based_config.h" +#include "api/units/timestamp.h" +#include "modules/rtp_rtcp/source/rtp_packet.h" +#include "modules/rtp_rtcp/source/rtp_packet_received.h" +#include "rtc_base/strings/json.h" +#include "system_wrappers/include/clock.h" +#include "test/call_config_utils.h" +#include "test/encoder_settings.h" +#include "test/fake_decoder.h" +#include "test/rtp_file_reader.h" +#include "test/run_loop.h" + +namespace webrtc { +namespace test { + +void RtpReplayer::Replay(const std::string& replay_config_filepath, + const uint8_t* rtp_dump_data, + size_t rtp_dump_size) { + auto stream_state = std::make_unique<StreamState>(); + std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs = + ReadConfigFromFile(replay_config_filepath, &(stream_state->transport)); + return Replay(std::move(stream_state), std::move(receive_stream_configs), + rtp_dump_data, rtp_dump_size); +} + +void RtpReplayer::Replay( + std::unique_ptr<StreamState> stream_state, + std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs, + const uint8_t* rtp_dump_data, + size_t rtp_dump_size) { + RunLoop loop; + rtc::ScopedBaseFakeClock fake_clock; + + // Work around: webrtc calls webrtc::Random(clock.TimeInMicroseconds()) + // everywhere and Random expects non-zero seed. Let's set the clock non-zero + // to make them happy. + fake_clock.SetTime(webrtc::Timestamp::Millis(1)); + + // Attempt to create an RtpReader from the input file. + auto rtp_reader = CreateRtpReader(rtp_dump_data, rtp_dump_size); + if (rtp_reader == nullptr) { + RTC_LOG(LS_ERROR) << "Failed to create the rtp_reader"; + return; + } + + RtpHeaderExtensionMap extensions(/*extmap_allow_mixed=*/true); + // Skip i = 0 since it maps to kRtpExtensionNone. + for (int i = 1; i < kRtpExtensionNumberOfExtensions; i++) { + RTPExtensionType extension_type = static_cast<RTPExtensionType>(i); + // Extensions are registered with an ID, which you signal to the + // peer so they know what to expect. This code only cares about + // parsing so the value of the ID isn't relevant. + extensions.RegisterByType(i, extension_type); + } + + // Setup the video streams based on the configuration. + webrtc::RtcEventLogNull event_log; + std::unique_ptr<TaskQueueFactory> task_queue_factory = + CreateDefaultTaskQueueFactory(); + Call::Config call_config(&event_log); + call_config.task_queue_factory = task_queue_factory.get(); + FieldTrialBasedConfig field_trials; + call_config.trials = &field_trials; + std::unique_ptr<Call> call(Call::Create(call_config)); + SetupVideoStreams(&receive_stream_configs, stream_state.get(), call.get()); + + // Start replaying the provided stream now that it has been configured. + for (const auto& receive_stream : stream_state->receive_streams) { + receive_stream->Start(); + } + + ReplayPackets(&fake_clock, call.get(), rtp_reader.get(), extensions); + + for (const auto& receive_stream : stream_state->receive_streams) { + call->DestroyVideoReceiveStream(receive_stream); + } +} + +std::vector<VideoReceiveStreamInterface::Config> +RtpReplayer::ReadConfigFromFile(const std::string& replay_config, + Transport* transport) { + Json::CharReaderBuilder factory; + std::unique_ptr<Json::CharReader> json_reader = + absl::WrapUnique(factory.newCharReader()); + Json::Value json_configs; + Json::String errors; + if (!json_reader->parse(replay_config.data(), + replay_config.data() + replay_config.length(), + &json_configs, &errors)) { + RTC_LOG(LS_ERROR) + << "Error parsing JSON replay configuration for the fuzzer: " << errors; + return {}; + } + + std::vector<VideoReceiveStreamInterface::Config> receive_stream_configs; + receive_stream_configs.reserve(json_configs.size()); + for (const auto& json : json_configs) { + receive_stream_configs.push_back( + ParseVideoReceiveStreamJsonConfig(transport, json)); + } + return receive_stream_configs; +} + +void RtpReplayer::SetupVideoStreams( + std::vector<VideoReceiveStreamInterface::Config>* receive_stream_configs, + StreamState* stream_state, + Call* call) { + stream_state->decoder_factory = std::make_unique<InternalDecoderFactory>(); + for (auto& receive_config : *receive_stream_configs) { + // Attach the decoder for the corresponding payload type in the config. + for (auto& decoder : receive_config.decoders) { + decoder = test::CreateMatchingDecoder(decoder.payload_type, + decoder.video_format.name); + } + + // Create the window to display the rendered video. + stream_state->sinks.emplace_back( + test::VideoRenderer::Create("Fuzzing WebRTC Video Config", 640, 480)); + // Create a receive stream for this config. + receive_config.renderer = stream_state->sinks.back().get(); + receive_config.decoder_factory = stream_state->decoder_factory.get(); + stream_state->receive_streams.emplace_back( + call->CreateVideoReceiveStream(std::move(receive_config))); + } +} + +std::unique_ptr<test::RtpFileReader> RtpReplayer::CreateRtpReader( + const uint8_t* rtp_dump_data, + size_t rtp_dump_size) { + std::unique_ptr<test::RtpFileReader> rtp_reader(test::RtpFileReader::Create( + test::RtpFileReader::kRtpDump, rtp_dump_data, rtp_dump_size, {})); + if (!rtp_reader) { + RTC_LOG(LS_ERROR) << "Unable to open input file with any supported format"; + return nullptr; + } + return rtp_reader; +} + +void RtpReplayer::ReplayPackets( + rtc::FakeClock* clock, + Call* call, + test::RtpFileReader* rtp_reader, + const RtpPacketReceived::ExtensionManager& extensions) { + int64_t replay_start_ms = -1; + + while (true) { + int64_t now_ms = rtc::TimeMillis(); + if (replay_start_ms == -1) { + replay_start_ms = now_ms; + } + + test::RtpPacket packet; + if (!rtp_reader->NextPacket(&packet)) { + break; + } + + int64_t deliver_in_ms = replay_start_ms + packet.time_ms - now_ms; + if (deliver_in_ms > 0) { + // StatsCounter::ReportMetricToAggregatedCounter is O(elapsed time). + // Set an upper limit to prevent waste time. + clock->AdvanceTime(webrtc::TimeDelta::Millis( + std::min(deliver_in_ms, static_cast<int64_t>(100)))); + } + + RtpPacketReceived received_packet( + &extensions, Timestamp::Micros(clock->TimeNanos() / 1000)); + if (!received_packet.Parse(packet.data, packet.length)) { + RTC_LOG(LS_ERROR) << "Packet error, corrupt packets or incorrect setup?"; + break; + } + + call->Receiver()->DeliverRtpPacket( + MediaType::VIDEO, std::move(received_packet), + [&](const RtpPacketReceived& parsed_packet) { + RTC_LOG(LS_ERROR) << "Unknown SSRC: " << parsed_packet.Ssrc(); + return false; + }); + } +} +} // namespace test +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h new file mode 100644 index 0000000000..ae94a640a5 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/utils/rtp_replayer.h @@ -0,0 +1,92 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#ifndef TEST_FUZZERS_UTILS_RTP_REPLAYER_H_ +#define TEST_FUZZERS_UTILS_RTP_REPLAYER_H_ + +#include <stdio.h> + +#include <map> +#include <memory> +#include <string> +#include <vector> + +#include "api/rtc_event_log/rtc_event_log.h" +#include "api/test/video/function_video_decoder_factory.h" +#include "api/video_codecs/video_decoder.h" +#include "call/call.h" +#include "media/engine/internal_decoder_factory.h" +#include "rtc_base/fake_clock.h" +#include "rtc_base/time_utils.h" +#include "test/null_transport.h" +#include "test/rtp_file_reader.h" +#include "test/test_video_capturer.h" +#include "test/video_renderer.h" + +namespace webrtc { +namespace test { + +// The RtpReplayer is a utility for fuzzing the RTP/RTCP receiver stack in +// WebRTC. It achieves this by accepting a set of Receiver configurations and +// an RtpDump (consisting of both RTP and RTCP packets). The `rtp_dump` is +// passed in as a buffer to allow simple mutation fuzzing directly on the dump. +class RtpReplayer final { + public: + // Holds all the important stream information required to emulate the WebRTC + // rtp receival code path. + struct StreamState { + test::NullTransport transport; + std::vector<std::unique_ptr<rtc::VideoSinkInterface<VideoFrame>>> sinks; + std::vector<VideoReceiveStreamInterface*> receive_streams; + std::unique_ptr<VideoDecoderFactory> decoder_factory; + }; + + // Construct an RtpReplayer from a JSON replay configuration file. + static void Replay(const std::string& replay_config_filepath, + const uint8_t* rtp_dump_data, + size_t rtp_dump_size); + + // Construct an RtpReplayer from a set of + // VideoReceiveStreamInterface::Configs. Note the stream_state.transport must + // be set for each receiver stream. + static void Replay( + std::unique_ptr<StreamState> stream_state, + std::vector<VideoReceiveStreamInterface::Config> receive_stream_config, + const uint8_t* rtp_dump_data, + size_t rtp_dump_size); + + private: + // Reads the replay configuration from Json. + static std::vector<VideoReceiveStreamInterface::Config> ReadConfigFromFile( + const std::string& replay_config, + Transport* transport); + + // Configures the stream state based on the receiver configurations. + static void SetupVideoStreams( + std::vector<VideoReceiveStreamInterface::Config>* receive_stream_configs, + StreamState* stream_state, + Call* call); + + // Creates a new RtpReader which can read the RtpDump + static std::unique_ptr<test::RtpFileReader> CreateRtpReader( + const uint8_t* rtp_dump_data, + size_t rtp_dump_size); + + // Replays each packet to from the RtpDump. + static void ReplayPackets(rtc::FakeClock* clock, + Call* call, + test::RtpFileReader* rtp_reader, + const RtpHeaderExtensionMap& extensions); +}; // class RtpReplayer + +} // namespace test +} // namespace webrtc + +#endif // TEST_FUZZERS_UTILS_RTP_REPLAYER_H_ diff --git a/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc new file mode 100644 index 0000000000..1691b55cc0 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp8_depacketizer_fuzzer.cc @@ -0,0 +1,20 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "api/array_view.h" +#include "modules/rtp_rtcp/source/rtp_video_header.h" +#include "modules/rtp_rtcp/source/video_rtp_depacketizer_vp8.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + RTPVideoHeader video_header; + VideoRtpDepacketizerVp8::ParseRtpPayload(rtc::MakeArrayView(data, size), + &video_header); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc new file mode 100644 index 0000000000..2ecfd820c8 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp8_qp_parser_fuzzer.cc @@ -0,0 +1,17 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "modules/video_coding/utility/vp8_header_parser.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + int qp; + vp8::GetQp(data, size, &qp); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc new file mode 100644 index 0000000000..819b9626f9 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp8_replay_fuzzer.cc @@ -0,0 +1,42 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include <memory> + +#include "test/fuzzers/utils/rtp_replayer.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + auto stream_state = std::make_unique<test::RtpReplayer::StreamState>(); + VideoReceiveStreamInterface::Config vp8_config(&(stream_state->transport)); + + VideoReceiveStreamInterface::Decoder vp8_decoder; + vp8_decoder.video_format = SdpVideoFormat("VP8"); + vp8_decoder.payload_type = 125; + vp8_config.decoders.push_back(std::move(vp8_decoder)); + + vp8_config.rtp.local_ssrc = 7731; + vp8_config.rtp.remote_ssrc = 1337; + vp8_config.rtp.rtx_ssrc = 100; + vp8_config.rtp.nack.rtp_history_ms = 1000; + vp8_config.rtp.lntf.enabled = true; + + std::vector<VideoReceiveStreamInterface::Config> replay_configs; + replay_configs.push_back(std::move(vp8_config)); + + test::RtpReplayer::Replay(std::move(stream_state), std::move(replay_configs), + data, size); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc new file mode 100644 index 0000000000..ae36a94931 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp9_depacketizer_fuzzer.cc @@ -0,0 +1,20 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "api/array_view.h" +#include "modules/rtp_rtcp/source/rtp_video_header.h" +#include "modules/rtp_rtcp/source/video_rtp_depacketizer_vp9.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + RTPVideoHeader video_header; + VideoRtpDepacketizerVp9::ParseRtpPayload(rtc::MakeArrayView(data, size), + &video_header); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc new file mode 100644 index 0000000000..09848ae4de --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp9_encoder_references_fuzzer.cc @@ -0,0 +1,624 @@ +/* + * Copyright (c) 2021 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stdint.h> + +#include "absl/algorithm/container.h" +#include "absl/base/macros.h" +#include "absl/container/inlined_vector.h" +#include "api/array_view.h" +#include "api/field_trials_view.h" +#include "api/video/video_frame.h" +#include "api/video_codecs/video_codec.h" +#include "api/video_codecs/video_encoder.h" +#include "modules/video_coding/codecs/interface/libvpx_interface.h" +#include "modules/video_coding/codecs/vp9/libvpx_vp9_encoder.h" +#include "modules/video_coding/frame_dependencies_calculator.h" +#include "rtc_base/numerics/safe_compare.h" +#include "test/fuzzers/fuzz_data_helper.h" + +// Fuzzer simulates various svc configurations and libvpx encoder dropping +// layer frames. +// Validates vp9 encoder wrapper produces consistent frame references. +namespace webrtc { +namespace { + +using test::FuzzDataHelper; + +constexpr int kBitrateEnabledBps = 100'000; + +class FrameValidator : public EncodedImageCallback { + public: + ~FrameValidator() override = default; + + Result OnEncodedImage(const EncodedImage& encoded_image, + const CodecSpecificInfo* codec_specific_info) override { + RTC_CHECK(codec_specific_info); + RTC_CHECK_EQ(codec_specific_info->codecType, kVideoCodecVP9); + if (codec_specific_info->codecSpecific.VP9.first_frame_in_picture) { + ++picture_id_; + } + int64_t frame_id = frame_id_++; + LayerFrame& layer_frame = frames_[frame_id % kMaxFrameHistorySize]; + layer_frame.picture_id = picture_id_; + layer_frame.spatial_id = encoded_image.SpatialIndex().value_or(0); + layer_frame.frame_id = frame_id; + layer_frame.temporal_id = + codec_specific_info->codecSpecific.VP9.temporal_idx; + if (layer_frame.temporal_id == kNoTemporalIdx) { + layer_frame.temporal_id = 0; + } + layer_frame.vp9_non_ref_for_inter_layer_pred = + codec_specific_info->codecSpecific.VP9.non_ref_for_inter_layer_pred; + CheckVp9References(layer_frame, codec_specific_info->codecSpecific.VP9); + + if (codec_specific_info->generic_frame_info.has_value()) { + absl::InlinedVector<int64_t, 5> frame_dependencies = + dependencies_calculator_.FromBuffersUsage( + frame_id, + codec_specific_info->generic_frame_info->encoder_buffers); + + CheckGenericReferences(frame_dependencies, + *codec_specific_info->generic_frame_info); + CheckGenericAndCodecSpecificReferencesAreConsistent( + frame_dependencies, *codec_specific_info, layer_frame); + } + + return Result(Result::OK); + } + + private: + // With 4 spatial layers and patterns up to 8 pictures, it should be enough to + // keep the last 32 frames to validate dependencies. + static constexpr size_t kMaxFrameHistorySize = 32; + struct LayerFrame { + int64_t frame_id; + int64_t picture_id; + int spatial_id; + int temporal_id; + bool vp9_non_ref_for_inter_layer_pred; + }; + + void CheckVp9References(const LayerFrame& layer_frame, + const CodecSpecificInfoVP9& vp9_info) { + if (layer_frame.frame_id == 0) { + RTC_CHECK(!vp9_info.inter_layer_predicted); + } else { + const LayerFrame& previous_frame = Frame(layer_frame.frame_id - 1); + if (vp9_info.inter_layer_predicted) { + RTC_CHECK(!previous_frame.vp9_non_ref_for_inter_layer_pred); + RTC_CHECK_EQ(layer_frame.picture_id, previous_frame.picture_id); + } + if (previous_frame.picture_id == layer_frame.picture_id) { + RTC_CHECK_GT(layer_frame.spatial_id, previous_frame.spatial_id); + // The check below would fail for temporal shift structures. Remove it + // or move it to !flexible_mode section when vp9 encoder starts + // supporting such structures. + RTC_CHECK_EQ(layer_frame.temporal_id, previous_frame.temporal_id); + } + } + if (!vp9_info.flexible_mode) { + if (vp9_info.gof.num_frames_in_gof > 0) { + gof_.CopyGofInfoVP9(vp9_info.gof); + } + RTC_CHECK_EQ(gof_.temporal_idx[vp9_info.gof_idx], + layer_frame.temporal_id); + } + } + + void CheckGenericReferences(rtc::ArrayView<const int64_t> frame_dependencies, + const GenericFrameInfo& generic_info) const { + for (int64_t dependency_frame_id : frame_dependencies) { + RTC_CHECK_GE(dependency_frame_id, 0); + const LayerFrame& dependency = Frame(dependency_frame_id); + RTC_CHECK_GE(generic_info.spatial_id, dependency.spatial_id); + RTC_CHECK_GE(generic_info.temporal_id, dependency.temporal_id); + } + } + + void CheckGenericAndCodecSpecificReferencesAreConsistent( + rtc::ArrayView<const int64_t> frame_dependencies, + const CodecSpecificInfo& info, + const LayerFrame& layer_frame) const { + const CodecSpecificInfoVP9& vp9_info = info.codecSpecific.VP9; + const GenericFrameInfo& generic_info = *info.generic_frame_info; + + RTC_CHECK_EQ(generic_info.spatial_id, layer_frame.spatial_id); + RTC_CHECK_EQ(generic_info.temporal_id, layer_frame.temporal_id); + auto picture_id_diffs = + rtc::MakeArrayView(vp9_info.p_diff, vp9_info.num_ref_pics); + RTC_CHECK_EQ( + frame_dependencies.size(), + picture_id_diffs.size() + (vp9_info.inter_layer_predicted ? 1 : 0)); + for (int64_t dependency_frame_id : frame_dependencies) { + RTC_CHECK_GE(dependency_frame_id, 0); + const LayerFrame& dependency = Frame(dependency_frame_id); + if (dependency.spatial_id != layer_frame.spatial_id) { + RTC_CHECK(vp9_info.inter_layer_predicted); + RTC_CHECK_EQ(layer_frame.picture_id, dependency.picture_id); + RTC_CHECK_GT(layer_frame.spatial_id, dependency.spatial_id); + } else { + RTC_CHECK(vp9_info.inter_pic_predicted); + RTC_CHECK_EQ(layer_frame.spatial_id, dependency.spatial_id); + RTC_CHECK(absl::c_linear_search( + picture_id_diffs, layer_frame.picture_id - dependency.picture_id)); + } + } + } + + const LayerFrame& Frame(int64_t frame_id) const { + auto& frame = frames_[frame_id % kMaxFrameHistorySize]; + RTC_CHECK_EQ(frame.frame_id, frame_id); + return frame; + } + + GofInfoVP9 gof_; + int64_t frame_id_ = 0; + int64_t picture_id_ = 1; + FrameDependenciesCalculator dependencies_calculator_; + LayerFrame frames_[kMaxFrameHistorySize]; +}; + +class FieldTrials : public FieldTrialsView { + public: + explicit FieldTrials(FuzzDataHelper& config) + : flags_(config.ReadOrDefaultValue<uint8_t>(0)) {} + + ~FieldTrials() override = default; + std::string Lookup(absl::string_view key) const override { + static constexpr absl::string_view kBinaryFieldTrials[] = { + "WebRTC-Vp9ExternalRefCtrl", + "WebRTC-Vp9IssueKeyFrameOnLayerDeactivation", + }; + for (size_t i = 0; i < ABSL_ARRAYSIZE(kBinaryFieldTrials); ++i) { + if (key == kBinaryFieldTrials[i]) { + return (flags_ & (1u << i)) ? "Enabled" : "Disabled"; + } + } + + // Ignore following field trials. + if (key == "WebRTC-CongestionWindow" || + key == "WebRTC-UseBaseHeavyVP8TL3RateAllocation" || + key == "WebRTC-SimulcastUpswitchHysteresisPercent" || + key == "WebRTC-SimulcastScreenshareUpswitchHysteresisPercent" || + key == "WebRTC-VideoRateControl" || + key == "WebRTC-VP9-PerformanceFlags" || + key == "WebRTC-VP9VariableFramerateScreenshare" || + key == "WebRTC-VP9QualityScaler") { + return ""; + } + // Crash when using unexpected field trial to decide if it should be fuzzed + // or have a constant value. + RTC_CHECK(false) << "Unfuzzed field trial " << key << "\n"; + } + + private: + const uint8_t flags_; +}; + +VideoCodec CodecSettings(FuzzDataHelper& rng) { + uint16_t config = rng.ReadOrDefaultValue<uint16_t>(0); + // Test up to to 4 spatial and 4 temporal layers. + int num_spatial_layers = 1 + (config & 0b11); + int num_temporal_layers = 1 + ((config >> 2) & 0b11); + + VideoCodec codec_settings = {}; + codec_settings.codecType = kVideoCodecVP9; + codec_settings.maxFramerate = 30; + codec_settings.width = 320 << (num_spatial_layers - 1); + codec_settings.height = 180 << (num_spatial_layers - 1); + if (num_spatial_layers > 1) { + for (int sid = 0; sid < num_spatial_layers; ++sid) { + SpatialLayer& spatial_layer = codec_settings.spatialLayers[sid]; + codec_settings.width = 320 << sid; + codec_settings.height = 180 << sid; + spatial_layer.width = codec_settings.width; + spatial_layer.height = codec_settings.height; + spatial_layer.targetBitrate = kBitrateEnabledBps * num_temporal_layers; + spatial_layer.maxFramerate = codec_settings.maxFramerate; + spatial_layer.numberOfTemporalLayers = num_temporal_layers; + } + } + codec_settings.VP9()->numberOfSpatialLayers = num_spatial_layers; + codec_settings.VP9()->numberOfTemporalLayers = num_temporal_layers; + int inter_layer_pred = (config >> 4) & 0b11; + // There are only 3 valid values. + codec_settings.VP9()->interLayerPred = static_cast<InterLayerPredMode>( + inter_layer_pred < 3 ? inter_layer_pred : 0); + codec_settings.VP9()->flexibleMode = (config & (1u << 6)) != 0; + codec_settings.SetFrameDropEnabled((config & (1u << 7)) != 0); + codec_settings.mode = VideoCodecMode::kRealtimeVideo; + return codec_settings; +} + +VideoEncoder::Settings EncoderSettings() { + return VideoEncoder::Settings(VideoEncoder::Capabilities(false), + /*number_of_cores=*/1, + /*max_payload_size=*/0); +} + +bool IsSupported(int num_spatial_layers, + int num_temporal_layers, + const VideoBitrateAllocation& allocation) { + // VP9 encoder doesn't support certain configurations. + // BitrateAllocator shouldn't produce them. + if (allocation.get_sum_bps() == 0) { + // Ignore allocation that turns off all the layers. + // In such a case it is up to upper layer code not to call Encode. + return false; + } + + for (int tid = 0; tid < num_temporal_layers; ++tid) { + int min_enabled_spatial_id = -1; + int max_enabled_spatial_id = -1; + int num_enabled_spatial_layers = 0; + for (int sid = 0; sid < num_spatial_layers; ++sid) { + if (allocation.GetBitrate(sid, tid) > 0) { + if (min_enabled_spatial_id == -1) { + min_enabled_spatial_id = sid; + } + max_enabled_spatial_id = sid; + ++num_enabled_spatial_layers; + } + } + if (num_enabled_spatial_layers == 0) { + // Each temporal layer should be enabled because skipping a full frame is + // not supported in non-flexible mode. + return false; + } + if (max_enabled_spatial_id - min_enabled_spatial_id + 1 != + num_enabled_spatial_layers) { + // To avoid odd spatial dependencies, there should be no gaps in active + // spatial layers. + return false; + } + } + + return true; +} + +struct LibvpxState { + LibvpxState() { + pkt.kind = VPX_CODEC_CX_FRAME_PKT; + pkt.data.frame.buf = pkt_buffer; + pkt.data.frame.sz = ABSL_ARRAYSIZE(pkt_buffer); + layer_id.spatial_layer_id = -1; + } + + uint8_t pkt_buffer[1000] = {}; + vpx_codec_enc_cfg_t config = {}; + vpx_codec_priv_output_cx_pkt_cb_pair_t callback = {}; + vpx_image_t img = {}; + vpx_svc_ref_frame_config_t ref_config = {}; + vpx_svc_layer_id_t layer_id = {}; + vpx_svc_frame_drop_t frame_drop = {}; + vpx_codec_cx_pkt pkt = {}; +}; + +class StubLibvpx : public LibvpxInterface { + public: + explicit StubLibvpx(LibvpxState* state) : state_(state) { RTC_CHECK(state_); } + + vpx_codec_err_t codec_enc_config_default(vpx_codec_iface_t* iface, + vpx_codec_enc_cfg_t* cfg, + unsigned int usage) const override { + state_->config = *cfg; + return VPX_CODEC_OK; + } + + vpx_codec_err_t codec_enc_init(vpx_codec_ctx_t* ctx, + vpx_codec_iface_t* iface, + const vpx_codec_enc_cfg_t* cfg, + vpx_codec_flags_t flags) const override { + RTC_CHECK(ctx); + ctx->err = VPX_CODEC_OK; + return VPX_CODEC_OK; + } + + vpx_image_t* img_wrap(vpx_image_t* img, + vpx_img_fmt_t fmt, + unsigned int d_w, + unsigned int d_h, + unsigned int stride_align, + unsigned char* img_data) const override { + state_->img.fmt = fmt; + state_->img.d_w = d_w; + state_->img.d_h = d_h; + return &state_->img; + } + + vpx_codec_err_t codec_encode(vpx_codec_ctx_t* ctx, + const vpx_image_t* img, + vpx_codec_pts_t pts, + uint64_t duration, + vpx_enc_frame_flags_t flags, + uint64_t deadline) const override { + if (flags & VPX_EFLAG_FORCE_KF) { + state_->pkt.data.frame.flags = VPX_FRAME_IS_KEY; + } else { + state_->pkt.data.frame.flags = 0; + } + state_->pkt.data.frame.duration = duration; + return VPX_CODEC_OK; + } + + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + void* param) const override { + if (ctrl_id == VP9E_REGISTER_CX_CALLBACK) { + state_->callback = + *reinterpret_cast<vpx_codec_priv_output_cx_pkt_cb_pair_t*>(param); + } + return VPX_CODEC_OK; + } + + vpx_codec_err_t codec_control( + vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_svc_ref_frame_config_t* param) const override { + switch (ctrl_id) { + case VP9E_SET_SVC_REF_FRAME_CONFIG: + state_->ref_config = *param; + break; + case VP9E_GET_SVC_REF_FRAME_CONFIG: + *param = state_->ref_config; + break; + default: + break; + } + return VPX_CODEC_OK; + } + + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_svc_layer_id_t* param) const override { + switch (ctrl_id) { + case VP9E_SET_SVC_LAYER_ID: + state_->layer_id = *param; + break; + case VP9E_GET_SVC_LAYER_ID: + *param = state_->layer_id; + break; + default: + break; + } + return VPX_CODEC_OK; + } + + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_svc_frame_drop_t* param) const override { + if (ctrl_id == VP9E_SET_SVC_FRAME_DROP_LAYER) { + state_->frame_drop = *param; + } + return VPX_CODEC_OK; + } + + vpx_codec_err_t codec_enc_config_set( + vpx_codec_ctx_t* ctx, + const vpx_codec_enc_cfg_t* cfg) const override { + state_->config = *cfg; + return VPX_CODEC_OK; + } + + vpx_image_t* img_alloc(vpx_image_t* img, + vpx_img_fmt_t fmt, + unsigned int d_w, + unsigned int d_h, + unsigned int align) const override { + return nullptr; + } + void img_free(vpx_image_t* img) const override {} + vpx_codec_err_t codec_enc_init_multi(vpx_codec_ctx_t* ctx, + vpx_codec_iface_t* iface, + vpx_codec_enc_cfg_t* cfg, + int num_enc, + vpx_codec_flags_t flags, + vpx_rational_t* dsf) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_destroy(vpx_codec_ctx_t* ctx) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + uint32_t param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + int param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + int* param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_roi_map* param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_active_map* param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_scaling_mode* param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_svc_extra_cfg_t* param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control( + vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_svc_spatial_layer_sync_t* param) const override { + return VPX_CODEC_OK; + } + vpx_codec_err_t codec_control(vpx_codec_ctx_t* ctx, + vp8e_enc_control_id ctrl_id, + vpx_rc_funcs_t* param) const override { + return VPX_CODEC_OK; + } + const vpx_codec_cx_pkt_t* codec_get_cx_data( + vpx_codec_ctx_t* ctx, + vpx_codec_iter_t* iter) const override { + return nullptr; + } + const char* codec_error_detail(vpx_codec_ctx_t* ctx) const override { + return nullptr; + } + const char* codec_error(vpx_codec_ctx_t* ctx) const override { + return nullptr; + } + const char* codec_err_to_string(vpx_codec_err_t err) const override { + return nullptr; + } + + private: + LibvpxState* const state_; +}; + +enum Actions { + kEncode, + kSetRates, +}; + +// When a layer frame is marked for drop, drops all layer frames from that +// pictures with larger spatial ids. +constexpr bool DropAbove(uint8_t layers_mask, int sid) { + uint8_t full_mask = (uint8_t{1} << (sid + 1)) - 1; + return (layers_mask & full_mask) != full_mask; +} +// inline unittests +static_assert(DropAbove(0b1011, /*sid=*/0) == false, ""); +static_assert(DropAbove(0b1011, /*sid=*/1) == false, ""); +static_assert(DropAbove(0b1011, /*sid=*/2) == true, ""); +static_assert(DropAbove(0b1011, /*sid=*/3) == true, ""); + +// When a layer frame is marked for drop, drops all layer frames from that +// pictures with smaller spatial ids. +constexpr bool DropBelow(uint8_t layers_mask, int sid, int num_layers) { + return (layers_mask >> sid) != (1 << (num_layers - sid)) - 1; +} +// inline unittests +static_assert(DropBelow(0b1101, /*sid=*/0, 4) == true, ""); +static_assert(DropBelow(0b1101, /*sid=*/1, 4) == true, ""); +static_assert(DropBelow(0b1101, /*sid=*/2, 4) == false, ""); +static_assert(DropBelow(0b1101, /*sid=*/3, 4) == false, ""); + +} // namespace + +void FuzzOneInput(const uint8_t* data, size_t size) { + FuzzDataHelper helper(rtc::MakeArrayView(data, size)); + + FrameValidator validator; + FieldTrials field_trials(helper); + // Setup call callbacks for the fake + LibvpxState state; + + // Initialize encoder + LibvpxVp9Encoder encoder(cricket::VideoCodec(), + std::make_unique<StubLibvpx>(&state), field_trials); + VideoCodec codec = CodecSettings(helper); + if (encoder.InitEncode(&codec, EncoderSettings()) != WEBRTC_VIDEO_CODEC_OK) { + return; + } + RTC_CHECK_EQ(encoder.RegisterEncodeCompleteCallback(&validator), + WEBRTC_VIDEO_CODEC_OK); + { + // Enable all the layers initially. Encoder doesn't support producing + // frames when no layers are enabled. + LibvpxVp9Encoder::RateControlParameters parameters; + parameters.framerate_fps = 30.0; + for (int sid = 0; sid < codec.VP9()->numberOfSpatialLayers; ++sid) { + for (int tid = 0; tid < codec.VP9()->numberOfTemporalLayers; ++tid) { + parameters.bitrate.SetBitrate(sid, tid, kBitrateEnabledBps); + } + } + encoder.SetRates(parameters); + } + + std::vector<VideoFrameType> frame_types(1); + VideoFrame fake_image = VideoFrame::Builder() + .set_video_frame_buffer(I420Buffer::Create( + int{codec.width}, int{codec.height})) + .build(); + + // Start producing frames at random. + while (helper.CanReadBytes(1)) { + uint8_t action = helper.Read<uint8_t>(); + switch (action & 0b11) { + case kEncode: { + // bitmask of the action: SSSS-K00, where + // four S bit indicate which spatial layers should be produced, + // K bit indicates if frame should be a key frame. + frame_types[0] = (action & 0b100) ? VideoFrameType::kVideoFrameKey + : VideoFrameType::kVideoFrameDelta; + encoder.Encode(fake_image, &frame_types); + uint8_t encode_spatial_layers = (action >> 4); + for (size_t sid = 0; sid < state.config.ss_number_layers; ++sid) { + if (state.config.ss_target_bitrate[sid] == 0) { + // Don't encode disabled spatial layers. + continue; + } + bool drop = true; + switch (state.frame_drop.framedrop_mode) { + case FULL_SUPERFRAME_DROP: + drop = encode_spatial_layers == 0; + break; + case LAYER_DROP: + drop = (encode_spatial_layers & (1 << sid)) == 0; + break; + case CONSTRAINED_LAYER_DROP: + drop = DropBelow(encode_spatial_layers, sid, + state.config.ss_number_layers); + break; + case CONSTRAINED_FROM_ABOVE_DROP: + drop = DropAbove(encode_spatial_layers, sid); + break; + } + if (!drop) { + state.layer_id.spatial_layer_id = sid; + state.callback.output_cx_pkt(&state.pkt, state.callback.user_priv); + } + } + } break; + case kSetRates: { + // bitmask of the action: (S2)(S1)(S0)01, + // where Sx is number of temporal layers to enable for spatial layer x + // In pariculat Sx = 0 indicates spatial layer x should be disabled. + LibvpxVp9Encoder::RateControlParameters parameters; + parameters.framerate_fps = 30.0; + for (int sid = 0; sid < codec.VP9()->numberOfSpatialLayers; ++sid) { + int temporal_layers = (action >> ((1 + sid) * 2)) & 0b11; + for (int tid = 0; tid < temporal_layers; ++tid) { + parameters.bitrate.SetBitrate(sid, tid, kBitrateEnabledBps); + } + } + if (IsSupported(codec.VP9()->numberOfSpatialLayers, + codec.VP9()->numberOfTemporalLayers, + parameters.bitrate)) { + encoder.SetRates(parameters); + } + } break; + default: + // Unspecificed values are noop. + break; + } + } +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc new file mode 100644 index 0000000000..80dfe15b16 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp9_qp_parser_fuzzer.cc @@ -0,0 +1,17 @@ +/* + * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "modules/video_coding/utility/vp9_uncompressed_header_parser.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + ParseUncompressedVp9Header(rtc::MakeArrayView(data, size)); +} +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc b/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc new file mode 100644 index 0000000000..fc10d9ffc7 --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/vp9_replay_fuzzer.cc @@ -0,0 +1,41 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include <stddef.h> +#include <stdint.h> + +#include <memory> + +#include "test/fuzzers/utils/rtp_replayer.h" + +namespace webrtc { + +void FuzzOneInput(const uint8_t* data, size_t size) { + auto stream_state = std::make_unique<test::RtpReplayer::StreamState>(); + VideoReceiveStreamInterface::Config vp9_config(&(stream_state->transport)); + + VideoReceiveStreamInterface::Decoder vp9_decoder; + vp9_decoder.video_format = SdpVideoFormat("VP9"); + vp9_decoder.payload_type = 124; + vp9_config.decoders.push_back(std::move(vp9_decoder)); + + vp9_config.rtp.local_ssrc = 7731; + vp9_config.rtp.remote_ssrc = 1337; + vp9_config.rtp.rtx_ssrc = 100; + vp9_config.rtp.nack.rtp_history_ms = 1000; + + std::vector<VideoReceiveStreamInterface::Config> replay_configs; + replay_configs.push_back(std::move(vp9_config)); + + test::RtpReplayer::Replay(std::move(stream_state), std::move(replay_configs), + data, size); +} + +} // namespace webrtc diff --git a/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc b/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc new file mode 100644 index 0000000000..a52dd231be --- /dev/null +++ b/third_party/libwebrtc/test/fuzzers/webrtc_fuzzer_main.cc @@ -0,0 +1,41 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +// This file is intended to provide a common interface for fuzzing functions. +// It's intended to set sane defaults, such as removing logging for further +// fuzzing efficiency. + +#include "rtc_base/logging.h" + +namespace { +bool g_initialized = false; +void InitializeWebRtcFuzzDefaults() { + if (g_initialized) + return; + +// Remove default logging to prevent huge slowdowns. +// TODO(pbos): Disable in Chromium: http://crbug.com/561667 +#if !defined(WEBRTC_CHROMIUM_BUILD) + rtc::LogMessage::LogToDebug(rtc::LS_NONE); +#endif // !defined(WEBRTC_CHROMIUM_BUILD) + + g_initialized = true; +} +} // namespace + +namespace webrtc { +extern void FuzzOneInput(const uint8_t* data, size_t size); +} // namespace webrtc + +extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size) { + InitializeWebRtcFuzzDefaults(); + webrtc::FuzzOneInput(data, size); + return 0; +} |