From fe32a76d6001d17c34ab597026fd1e16e5c3b9ea Mon Sep 17 00:00:00 2001 From: Henrik Lundin Date: Tue, 8 Dec 2015 11:27:27 +0100 Subject: [PATCH] Create fuzzer tests for audio decoders This change adds fuzzer tests for iLBC, iSAC fix and float, and Opus. The fuzzer function takes a random input vector and splits it into a number of payloads. The lengths of the payloads is also determined by the random vector. The payloads are decoded with the decoders. BUG=webrtc:5306 R=kjellander@webrtc.org, pbos@webrtc.org Review URL: https://codereview.webrtc.org/1499093002 . Cr-Commit-Position: refs/heads/master@{#10932} --- webrtc/BUILD.gn | 4 ++ webrtc/test/fuzzers/BUILD.gn | 51 +++++++++++++++++++ webrtc/test/fuzzers/audio_decoder_fuzzer.cc | 49 ++++++++++++++++++ webrtc/test/fuzzers/audio_decoder_fuzzer.h | 31 +++++++++++ .../test/fuzzers/audio_decoder_ilbc_fuzzer.cc | 22 ++++++++ .../test/fuzzers/audio_decoder_isac_fuzzer.cc | 22 ++++++++ .../fuzzers/audio_decoder_isacfix_fuzzer.cc | 22 ++++++++ .../test/fuzzers/audio_decoder_opus_fuzzer.cc | 23 +++++++++ 8 files changed, 224 insertions(+) create mode 100644 webrtc/test/fuzzers/audio_decoder_fuzzer.cc create mode 100644 webrtc/test/fuzzers/audio_decoder_fuzzer.h create mode 100644 webrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc create mode 100644 webrtc/test/fuzzers/audio_decoder_isac_fuzzer.cc create mode 100644 webrtc/test/fuzzers/audio_decoder_isacfix_fuzzer.cc create mode 100644 webrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc diff --git a/webrtc/BUILD.gn b/webrtc/BUILD.gn index d968dd242c..d12ade2308 100644 --- a/webrtc/BUILD.gn +++ b/webrtc/BUILD.gn @@ -284,6 +284,10 @@ if (use_libfuzzer) { group("webrtc_fuzzers") { testonly = true deps = [ + "test/fuzzers:audio_decoder_ilbc_fuzzer", + "test/fuzzers:audio_decoder_isac_fuzzer", + "test/fuzzers:audio_decoder_isacfix_fuzzer", + "test/fuzzers:audio_decoder_opus_fuzzer", "test/fuzzers:vp8_qp_parser_fuzzer", "test/fuzzers:vp9_depacketizer_fuzzer", ] diff --git a/webrtc/test/fuzzers/BUILD.gn b/webrtc/test/fuzzers/BUILD.gn index 4cf6a5ce91..07eea2795e 100644 --- a/webrtc/test/fuzzers/BUILD.gn +++ b/webrtc/test/fuzzers/BUILD.gn @@ -10,6 +10,7 @@ import("//build/config/features.gni") import("//testing/test.gni") static_library("webrtc_fuzzer_main") { + public_configs = [ "../..:common_inherited_config" ] sources = [ "webrtc_fuzzer_main.cc", ] @@ -50,3 +51,53 @@ test("vp8_qp_parser_fuzzer") { configs -= [ "//build/config/clang:find_bad_constructs" ] } } + +source_set("audio_decoder_fuzzer") { + sources = [ + "audio_decoder_fuzzer.cc", + "audio_decoder_fuzzer.h", + ] + deps = [ + ":webrtc_fuzzer_main", + ] +} + +test("audio_decoder_ilbc_fuzzer") { + sources = [ + "audio_decoder_ilbc_fuzzer.cc", + ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:ilbc", + ] +} + +test("audio_decoder_isac_fuzzer") { + sources = [ + "audio_decoder_isac_fuzzer.cc", + ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:isac", + ] +} + +test("audio_decoder_isacfix_fuzzer") { + sources = [ + "audio_decoder_isacfix_fuzzer.cc", + ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:isac_fix", + ] +} + +test("audio_decoder_opus_fuzzer") { + sources = [ + "audio_decoder_opus_fuzzer.cc", + ] + deps = [ + ":audio_decoder_fuzzer", + "../../modules/audio_coding:webrtc_opus", + ] +} diff --git a/webrtc/test/fuzzers/audio_decoder_fuzzer.cc b/webrtc/test/fuzzers/audio_decoder_fuzzer.cc new file mode 100644 index 0000000000..fb5adb6cd8 --- /dev/null +++ b/webrtc/test/fuzzers/audio_decoder_fuzzer.cc @@ -0,0 +1,49 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "webrtc/test/fuzzers/audio_decoder_fuzzer.h" + +#include "webrtc/base/checks.h" +#include "webrtc/modules/audio_coding/codecs/audio_decoder.h" + +namespace webrtc { +namespace { +size_t PacketSizeFromTwoBytes(const uint8_t* data, size_t size) { + if (size < 2) + return 0; + return static_cast((data[0] << 8) + data[1]); +} +} // namespace + +// This function reads two bytes from the beginning of |data|, interprets them +// as the first packet length, and reads this many bytes if available. The +// payload is inserted into the decoder, and the process continues until no more +// data is available. +void FuzzAudioDecoder(const uint8_t* data, + size_t size, + AudioDecoder* decoder, + int sample_rate_hz, + size_t max_decoded_bytes, + int16_t* decoded) { + const uint8_t* data_ptr = data; + size_t remaining_size = size; + size_t packet_len = PacketSizeFromTwoBytes(data_ptr, remaining_size); + while (packet_len != 0 && packet_len <= remaining_size - 2) { + data_ptr += 2; + remaining_size -= 2; + AudioDecoder::SpeechType speech_type; + decoder->Decode(data_ptr, packet_len, sample_rate_hz, max_decoded_bytes, + decoded, &speech_type); + data_ptr += packet_len; + remaining_size -= packet_len; + packet_len = PacketSizeFromTwoBytes(data_ptr, remaining_size); + } +} +} // namespace webrtc diff --git a/webrtc/test/fuzzers/audio_decoder_fuzzer.h b/webrtc/test/fuzzers/audio_decoder_fuzzer.h new file mode 100644 index 0000000000..cdd8574300 --- /dev/null +++ b/webrtc/test/fuzzers/audio_decoder_fuzzer.h @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#ifndef WEBRTC_TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_ +#define WEBRTC_TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_ + +#include + +#include "webrtc/typedefs.h" + +namespace webrtc { + +class AudioDecoder; + +void FuzzAudioDecoder(const uint8_t* data, + size_t size, + AudioDecoder* decoder, + int sample_rate_hz, + size_t max_decoded_bytes, + int16_t* decoded); + +} // namespace webrtc + +#endif // WEBRTC_TEST_FUZZERS_AUDIO_DECODER_FUZZER_H_ diff --git a/webrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc b/webrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc new file mode 100644 index 0000000000..d2a87f0cb6 --- /dev/null +++ b/webrtc/test/fuzzers/audio_decoder_ilbc_fuzzer.cc @@ -0,0 +1,22 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "webrtc/modules/audio_coding/codecs/ilbc/audio_decoder_ilbc.h" +#include "webrtc/test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + AudioDecoderIlbc dec; + static const int kSampleRateHz = 8000; + static const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(data, size, &dec, kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc diff --git a/webrtc/test/fuzzers/audio_decoder_isac_fuzzer.cc b/webrtc/test/fuzzers/audio_decoder_isac_fuzzer.cc new file mode 100644 index 0000000000..984cfda398 --- /dev/null +++ b/webrtc/test/fuzzers/audio_decoder_isac_fuzzer.cc @@ -0,0 +1,22 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "webrtc/modules/audio_coding/codecs/isac/main/include/audio_decoder_isac.h" +#include "webrtc/test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + AudioDecoderIsac dec(nullptr); + const int sample_rate_hz = size % 2 == 0 ? 16000 : 32000; // 16 or 32 kHz. + static const size_t kAllocatedOuputSizeSamples = 32000 / 10; // 100 ms. + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(data, size, &dec, sample_rate_hz, sizeof(output), output); +} +} // namespace webrtc diff --git a/webrtc/test/fuzzers/audio_decoder_isacfix_fuzzer.cc b/webrtc/test/fuzzers/audio_decoder_isacfix_fuzzer.cc new file mode 100644 index 0000000000..83fb8c2d62 --- /dev/null +++ b/webrtc/test/fuzzers/audio_decoder_isacfix_fuzzer.cc @@ -0,0 +1,22 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "webrtc/modules/audio_coding/codecs/isac/fix/include/audio_decoder_isacfix.h" +#include "webrtc/test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + AudioDecoderIsacFix dec(nullptr); + static const int kSampleRateHz = 16000; + static const size_t kAllocatedOuputSizeSamples = 16000 / 10; // 100 ms. + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(data, size, &dec, kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc diff --git a/webrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc b/webrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc new file mode 100644 index 0000000000..3d70ec507d --- /dev/null +++ b/webrtc/test/fuzzers/audio_decoder_opus_fuzzer.cc @@ -0,0 +1,23 @@ +/* + * Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ + +#include "webrtc/modules/audio_coding/codecs/opus/audio_decoder_opus.h" +#include "webrtc/test/fuzzers/audio_decoder_fuzzer.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + const size_t channels = (size % 2) + 1; // 1 or 2 channels. + AudioDecoderOpus dec(channels); + const int kSampleRateHz = 48000; + const size_t kAllocatedOuputSizeSamples = kSampleRateHz / 10; // 100 ms. + int16_t output[kAllocatedOuputSizeSamples]; + FuzzAudioDecoder(data, size, &dec, kSampleRateHz, sizeof(output), output); +} +} // namespace webrtc