diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn index a063d6a62c..7acbf023e2 100644 --- a/test/fuzzers/BUILD.gn +++ b/test/fuzzers/BUILD.gn @@ -546,6 +546,17 @@ webrtc_fuzzer_test("rtp_depacketizer_av1_parse_fuzzer") { ] } +webrtc_fuzzer_test("rtp_depacketizer_av1_assemble_frame_fuzzer") { + sources = [ + "rtp_depacketizer_av1_assemble_frame_fuzzer.cc", + ] + deps = [ + ":fuzz_data_helper", + "../../api:array_view", + "../../modules/rtp_rtcp", + ] +} + webrtc_fuzzer_test("rtp_dependency_descriptor_fuzzer") { sources = [ "rtp_dependency_descriptor_fuzzer.cc", diff --git a/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc b/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc new file mode 100644 index 0000000000..c6ff926c78 --- /dev/null +++ b/test/fuzzers/rtp_depacketizer_av1_assemble_frame_fuzzer.cc @@ -0,0 +1,39 @@ +/* + * Copyright (c) 2019 The WebRTC project authors. All Rights Reserved. + * + * Use of this source code is governed by a BSD-style license + * that can be found in the LICENSE file in the root of the source + * tree. An additional intellectual property rights grant can be found + * in the file PATENTS. All contributing project authors may + * be found in the AUTHORS file in the root of the source tree. + */ +#include "modules/rtp_rtcp/source/rtp_depacketizer_av1.h" + +#include +#include + +#include + +#include "api/array_view.h" +#include "test/fuzzers/fuzz_data_helper.h" + +namespace webrtc { +void FuzzOneInput(const uint8_t* data, size_t size) { + std::vector> rtp_payloads; + + // Convert plain array of bytes into array of array bytes. + test::FuzzDataHelper fuzz_input(rtc::MakeArrayView(data, size)); + while (fuzz_input.CanReadBytes(sizeof(uint16_t))) { + // In practice one rtp payload can be up to ~1200 - 1500 bytes. Majority + // of the payload is just copied. To make fuzzing more efficient limit the + // size of rtp payload to realistic value. + uint16_t next_size = fuzz_input.Read() % 1200; + if (next_size > fuzz_input.BytesLeft()) { + next_size = fuzz_input.BytesLeft(); + } + rtp_payloads.push_back(fuzz_input.ReadByteArray(next_size)); + } + // Run code under test. + RtpDepacketizerAv1::AssembleFrame(rtp_payloads); +} +} // namespace webrtc