diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn index fc43ada06f..660230e7cb 100644 --- a/test/fuzzers/BUILD.gn +++ b/test/fuzzers/BUILD.gn @@ -449,6 +449,7 @@ webrtc_fuzzer_test("audio_processing_fuzzer") { "../../modules/audio_processing/aec3", "../../rtc_base:rtc_base_approved", ] + seed_corpus = "corpora/audio_processing-corpus" } webrtc_fuzzer_test("comfort_noise_decoder_fuzzer") { diff --git a/test/fuzzers/audio_processing_configs_fuzzer.cc b/test/fuzzers/audio_processing_configs_fuzzer.cc index a977ff9215..5f61e00499 100644 --- a/test/fuzzers/audio_processing_configs_fuzzer.cc +++ b/test/fuzzers/audio_processing_configs_fuzzer.cc @@ -27,7 +27,6 @@ std::unique_ptr CreateApm(test::FuzzDataHelper* fuzz_data) { bool da = fuzz_data->ReadOrDefaultValue(true); bool ie = fuzz_data->ReadOrDefaultValue(true); bool red = fuzz_data->ReadOrDefaultValue(true); - bool lc = fuzz_data->ReadOrDefaultValue(true); bool hpf = fuzz_data->ReadOrDefaultValue(true); bool aec3 = fuzz_data->ReadOrDefaultValue(true); @@ -40,6 +39,18 @@ std::unique_ptr CreateApm(test::FuzzDataHelper* fuzz_data) { bool use_agc_limiter = fuzz_data->ReadOrDefaultValue(true); bool use_agc2_limiter = fuzz_data->ReadOrDefaultValue(true); + // Read an int8 value, but don't let it be too large or small. + const float gain_controller2_gain_db = + rtc::SafeClamp(fuzz_data->ReadOrDefaultValue(0), -50, 50); + + // Ignore a few bytes. Bytes from this segment will be used for + // future config flag changes. We assume 40 bytes is enough for + // configuring the APM. + constexpr size_t kSizeOfConfigSegment = 40; + RTC_DCHECK(kSizeOfConfigSegment >= fuzz_data->BytesRead()); + static_cast( + fuzz_data->ReadByteArray(kSizeOfConfigSegment - fuzz_data->BytesRead())); + // Filter out incompatible settings that lead to CHECK failures. if (use_aecm && use_aec) { return nullptr; @@ -71,14 +82,10 @@ std::unique_ptr CreateApm(test::FuzzDataHelper* fuzz_data) { webrtc::AudioProcessing::Config apm_config; apm_config.residual_echo_detector.enabled = red; - apm_config.level_controller.enabled = lc; apm_config.high_pass_filter.enabled = hpf; apm_config.gain_controller2.enabled = use_agc2_limiter; - // Read an int8 value, but don't let it be too large or small. - const float gain_db = - rtc::SafeClamp(fuzz_data->ReadOrDefaultValue(0), -50, 50); - apm_config.gain_controller2.fixed_gain_db = gain_db; + apm_config.gain_controller2.fixed_gain_db = gain_controller2_gain_db; apm->ApplyConfig(apm_config); diff --git a/test/fuzzers/audio_processing_fuzzer_helper.cc b/test/fuzzers/audio_processing_fuzzer_helper.cc index 30a66ed848..bdf5f105e7 100644 --- a/test/fuzzers/audio_processing_fuzzer_helper.cc +++ b/test/fuzzers/audio_processing_fuzzer_helper.cc @@ -50,7 +50,7 @@ void GenerateFixedFrame(test::FuzzDataHelper* fuzz_data, RTC_DCHECK_LE(samples_per_input_channel * num_channels, AudioFrame::kMaxDataSizeSamples); for (size_t i = 0; i < samples_per_input_channel * num_channels; ++i) { - fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue(0); + fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue(0); } } } // namespace @@ -81,7 +81,7 @@ void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data, static_cast(fuzz_data->SelectOneOf(rate_kinds)); const bool num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1; - const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue(0); + const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue(0); // API call needed for AEC-2 and AEC-m to run. apm->set_stream_delay_ms(stream_delay); diff --git a/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 new file mode 100644 index 0000000000..bc8471e92b Binary files /dev/null and b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-0 differ diff --git a/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 new file mode 100644 index 0000000000..3fe154394a Binary files /dev/null and b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-1 differ diff --git a/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 new file mode 100644 index 0000000000..cbd68b6fd5 Binary files /dev/null and b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-2 differ diff --git a/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 new file mode 100644 index 0000000000..50f85fbcae Binary files /dev/null and b/test/fuzzers/corpora/audio_processing-corpus/audio-processing-3 differ diff --git a/test/fuzzers/fuzz_data_helper.h b/test/fuzzers/fuzz_data_helper.h index fb64bfe4ff..b5b916fecf 100644 --- a/test/fuzzers/fuzz_data_helper.h +++ b/test/fuzzers/fuzz_data_helper.h @@ -79,6 +79,8 @@ class FuzzDataHelper { return data_.subview(index_to_return, bytes); } + size_t BytesRead() const { return data_ix_; } + private: rtc::ArrayView data_; size_t data_ix_ = 0;