admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace packet buffer fuzzer with rtp video frame assembler fuzzer

Browse Source 
PacketBuffer takes RtpVideoHeader struct as an input that is complicated
and hard to fuzz. Current PacketBuffer doesn't fuzz it and thus has very
low coverage.
RtpVideoFrameAssembler uses PacketBuffer underneath and takes as input
almost raw rtp packet and thus easier to fuzz and better match production input

Bug: webrtc:7408
Change-Id: I00394c35e002a667760eed477f11ac7898f7eacc
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/290574
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Reviewed-by: Philip Eliasson <philipel@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#39013}
This commit is contained in:
Danil Chapovalov 2023-01-05 13:12:32 +01:00 committed by WebRTC LUCI CQ
parent 46ca3f6092
commit 632cd9bb03
3 changed files with 48 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
test/fuzzers/BUILD.gn
View File

@ -191,12 +191,11 @@ webrtc_fuzzer_test("flexfec_receiver_fuzzer") {
]
}
webrtc_fuzzer_test("packet_buffer_fuzzer") {
sources = [ "packet_buffer_fuzzer.cc" ]
webrtc_fuzzer_test("rtp_video_frame_assembler_fuzzer") {
sources = [ "rtp_video_frame_assembler_fuzzer.cc" ]
deps = [
"../../modules/video_coding:packet_buffer",
"../../modules/video_coding/",
"../../system_wrappers",
"../../api/video:rtp_video_frame_assembler",
"../../modules/rtp_rtcp:rtp_rtcp_format",
]
}

46
test/fuzzers/packet_buffer_fuzzer.cc
View File

@ -1,46 +0,0 @@
/*
* Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
*
* Use of this source code is governed by a BSD-style license
* that can be found in the LICENSE file in the root of the source
* tree. An additional intellectual property rights grant can be found
* in the file PATENTS. All contributing project authors may
* be found in the AUTHORS file in the root of the source tree.
*/
#include <memory>
#include <utility>
#include "modules/video_coding/frame_object.h"
#include "modules/video_coding/packet_buffer.h"
#include "test/fuzzers/fuzz_data_helper.h"
namespace webrtc {
void IgnoreResult(video_coding::PacketBuffer::InsertResult result) {}
void FuzzOneInput(const uint8_t* data, size_t size) {
if (size > 200000) {
return;
}
video_coding::PacketBuffer packet_buffer(8, 1024);
test::FuzzDataHelper helper(rtc::ArrayView<const uint8_t>(data, size));
while (helper.BytesLeft()) {
auto packet = std::make_unique<video_coding::PacketBuffer::Packet>();
// Fuzz POD members of the packet.
helper.CopyTo(&packet->marker_bit);
helper.CopyTo(&packet->payload_type);
helper.CopyTo(&packet->seq_num);
helper.CopyTo(&packet->timestamp);
helper.CopyTo(&packet->times_nacked);
// Fuzz non-POD member of the packet.
packet->video_payload.SetSize(helper.ReadOrDefaultValue<uint8_t>(0));
// TODO(danilchap): Fuzz other non-POD members of the `packet`.
IgnoreResult(packet_buffer.InsertPacket(std::move(packet)));
}
}
} // namespace webrtc

44
test/fuzzers/rtp_video_frame_assembler_fuzzer.cc Normal file
View File

@ -0,0 +1,44 @@
/*
* Copyright (c) 2023 The WebRTC project authors. All Rights Reserved.
*
* Use of this source code is governed by a BSD-style license
* that can be found in the LICENSE file in the root of the source
* tree. An additional intellectual property rights grant can be found
* in the file PATENTS. All contributing project authors may
* be found in the AUTHORS file in the root of the source tree.
*/
#include <algorithm>
#include <cstddef>
#include <cstdint>
#include "api/video/rtp_video_frame_assembler.h"
#include "modules/rtp_rtcp/include/rtp_header_extension_map.h"
#include "modules/rtp_rtcp/source/rtp_dependency_descriptor_extension.h"
#include "modules/rtp_rtcp/source/rtp_generic_frame_descriptor_extension.h"
#include "modules/rtp_rtcp/source/rtp_packet_received.h"
namespace webrtc {
void FuzzOneInput(const uint8_t* data, size_t size) {
if (size == 0) {
return;
}
RtpHeaderExtensionMap extensions;
extensions.Register<RtpDependencyDescriptorExtension>(1);
extensions.Register<RtpGenericFrameDescriptorExtension00>(2);
RtpPacketReceived rtp_packet(&extensions);
RtpVideoFrameAssembler assembler(
static_cast<RtpVideoFrameAssembler::PayloadFormat>(data[0] % 6));
for (size_t i = 1; i < size;) {
size_t packet_size = std::min<size_t>(size - i, 300);
if (rtp_packet.Parse(data + i, packet_size)) {
assembler.InsertPacket(rtp_packet);
}
i += packet_size;
}
}
} // namespace webrtc