diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn index 4516af2e1d..d7c0ed0649 100644 --- a/test/fuzzers/BUILD.gn +++ b/test/fuzzers/BUILD.gn @@ -416,6 +416,7 @@ if (!build_with_chromium) { "../../pc:libjingle_peerconnection", "../../test:test_support", ] + absl_deps = [ "//third_party/abseil-cpp/absl/strings" ] seed_corpus = "corpora/sdp-corpus" } } diff --git a/test/fuzzers/sdp_integration_fuzzer.cc b/test/fuzzers/sdp_integration_fuzzer.cc index bc181f0573..2a8be3978c 100644 --- a/test/fuzzers/sdp_integration_fuzzer.cc +++ b/test/fuzzers/sdp_integration_fuzzer.cc @@ -11,6 +11,7 @@ #include #include +#include "absl/strings/string_view.h" #include "pc/test/integration_test_helpers.h" namespace webrtc { @@ -20,6 +21,36 @@ class FuzzerTest : public PeerConnectionIntegrationBaseTest { FuzzerTest() : PeerConnectionIntegrationBaseTest(SdpSemantics::kUnifiedPlan) {} + void RunNegotiateCycle(absl::string_view message) { + CreatePeerConnectionWrappers(); + // Note - we do not do test.ConnectFakeSignaling(); all signals + // generated are discarded. + + auto srd_observer = + rtc::make_ref_counted(); + + SdpParseError error; + std::unique_ptr sdp( + CreateSessionDescription("offer", std::string(message), &error)); + // Note: This form of SRD takes ownership of the description. + caller()->pc()->SetRemoteDescription(srd_observer, sdp.release()); + // Wait a short time for observer to be called. Timeout is short + // because the fuzzer should be trying many branches. + EXPECT_TRUE_WAIT(srd_observer->called(), 100); + + // If set-remote-description was successful, try to answer. + auto sld_observer = + rtc::make_ref_counted(); + if (srd_observer->result()) { + caller()->pc()->SetLocalDescription(sld_observer.get()); + EXPECT_TRUE_WAIT(sld_observer->called(), 100); + } + // If there is an EXPECT failure, die here. + RTC_CHECK(!HasFailure()); + } + + // This test isn't using the test definition macros, so we have to + // define the TestBody() function, even though we don't need it. void TestBody() override {} }; @@ -27,32 +58,10 @@ void FuzzOneInput(const uint8_t* data, size_t size) { if (size > 16384) { return; } - std::string message(reinterpret_cast(data), size); FuzzerTest test; - test.CreatePeerConnectionWrappers(); - // Note - we do not do test.ConnectFakeSignaling(); all signals - // generated are discarded. - - auto srd_observer = - rtc::make_ref_counted(); - - webrtc::SdpParseError error; - std::unique_ptr sdp( - CreateSessionDescription("offer", message, &error)); - // Note: This form of SRD takes ownership of the description. - test.caller()->pc()->SetRemoteDescription(srd_observer, sdp.release()); - // Wait a short time for observer to be called. Timeout is short - // because the fuzzer should be trying many branches. - EXPECT_TRUE_WAIT(srd_observer->called(), 100); - - // If set-remote-description was successful, try to answer. - auto sld_observer = - rtc::make_ref_counted(); - if (srd_observer->result()) { - test.caller()->pc()->SetLocalDescription(sld_observer.get()); - EXPECT_TRUE_WAIT(sld_observer->called(), 100); - } + test.RunNegotiateCycle( + absl::string_view(reinterpret_cast(data), size)); } } // namespace webrtc