mirror of
https://github.com/mollyim/webrtc.git
synced 2025-05-18 08:07:56 +01:00
8fabab1509
The number of calls to ComfortNoiseDecoder::Generate() was determined by the fuzzer input, and was chosen between 0 and 255. This would sometimes lead to very long runs, with questionable merit. With this change, the number of call to Generate() is limited to 17 (an arbitrary small integer). Bug: chromium:820078 Change-Id: I27b5c7f0b72d53370d002a6b157d4451079a0ba9 Reviewed-on: https://webrtc-review.googlesource.com/60941 Reviewed-by: Alex Loiko <aleloi@webrtc.org> Commit-Queue: Henrik Lundin <henrik.lundin@webrtc.org> Cr-Commit-Position: refs/heads/master@{#22360}
59 lines
1.8 KiB
C++
59 lines
1.8 KiB
C++
/*
|
|
* Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
|
|
*
|
|
* Use of this source code is governed by a BSD-style license
|
|
* that can be found in the LICENSE file in the root of the source
|
|
* tree. An additional intellectual property rights grant can be found
|
|
* in the file PATENTS. All contributing project authors may
|
|
* be found in the AUTHORS file in the root of the source tree.
|
|
*/
|
|
|
|
#include <algorithm>
|
|
|
|
#include "api/array_view.h"
|
|
#include "modules/audio_coding/codecs/cng/webrtc_cng.h"
|
|
#include "rtc_base/buffer.h"
|
|
#include "test/fuzzers/fuzz_data_helper.h"
|
|
|
|
namespace webrtc {
|
|
namespace test {
|
|
namespace {
|
|
|
|
void FuzzOneInputTest(rtc::ArrayView<const uint8_t> data) {
|
|
FuzzDataHelper fuzz_data(data);
|
|
ComfortNoiseDecoder cng_decoder;
|
|
|
|
while (1) {
|
|
if (!fuzz_data.CanReadBytes(1))
|
|
break;
|
|
const uint8_t sid_frame_len = fuzz_data.Read<uint8_t>();
|
|
auto sid_frame = fuzz_data.ReadByteArray(sid_frame_len);
|
|
if (sid_frame.empty())
|
|
break;
|
|
cng_decoder.UpdateSid(sid_frame);
|
|
if (!fuzz_data.CanReadBytes(3))
|
|
break;
|
|
constexpr bool kTrueOrFalse[] = {true, false};
|
|
const bool new_period = fuzz_data.SelectOneOf(kTrueOrFalse);
|
|
constexpr size_t kOutputSizes[] = {80, 160, 320, 480};
|
|
const size_t output_size = fuzz_data.SelectOneOf(kOutputSizes);
|
|
const size_t num_generate_calls =
|
|
std::min(fuzz_data.Read<uint8_t>(), static_cast<uint8_t>(17));
|
|
rtc::BufferT<int16_t> output(output_size);
|
|
for (size_t i = 0; i < num_generate_calls; ++i) {
|
|
cng_decoder.Generate(output, new_period);
|
|
}
|
|
}
|
|
}
|
|
|
|
} // namespace
|
|
} // namespace test
|
|
|
|
void FuzzOneInput(const uint8_t* data, size_t size) {
|
|
// Limit the input size to 100000 bytes to avoid fuzzer timeout.
|
|
if (size > 200000)
|
|
return;
|
|
test::FuzzOneInputTest(rtc::ArrayView<const uint8_t>(data, size));
|
|
}
|
|
|
|
} // namespace webrtc
|