From bded44b79bf24340c34b4e788e30261665c0ba8a Mon Sep 17 00:00:00 2001
From: stefan <stefan@webrtc.org>
Date: Mon, 18 Jul 2016 09:26:06 -0700
Subject: [PATCH] Add a CongestionController fuzzer.

BUG=

Review-Url: https://codereview.webrtc.org/2157783002
Cr-Commit-Position: refs/heads/master@{#13497}
---
 webrtc/test/fuzzers/BUILD.gn                  |  9 ++
 .../congestion_controller_feedback_fuzzer.cc  | 89 +++++++++++++++++++
 2 files changed, 98 insertions(+)
 create mode 100644 webrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc

diff --git a/webrtc/test/fuzzers/BUILD.gn b/webrtc/test/fuzzers/BUILD.gn
index 3615e8e416..d917f1afa7 100644
--- a/webrtc/test/fuzzers/BUILD.gn
+++ b/webrtc/test/fuzzers/BUILD.gn
@@ -109,6 +109,15 @@ webrtc_fuzzer_test("rtp_header_fuzzer") {
   ]
 }
 
+webrtc_fuzzer_test("congestion_controller_feedback_fuzzer") {
+  sources = [
+    "congestion_controller_feedback_fuzzer.cc",
+  ]
+  deps = [
+    "../../modules/congestion_controller/",
+  ]
+}
+
 source_set("audio_decoder_fuzzer") {
   public_configs = [ "../..:common_inherited_config" ]
   sources = [
diff --git a/webrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc b/webrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc
new file mode 100644
index 0000000000..aa0d62e138
--- /dev/null
+++ b/webrtc/test/fuzzers/congestion_controller_feedback_fuzzer.cc
@@ -0,0 +1,89 @@
+/*
+ *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "webrtc/call/rtc_event_log.h"
+#include "webrtc/modules/congestion_controller/include/congestion_controller.h"
+#include "webrtc/modules/remote_bitrate_estimator/include/remote_bitrate_estimator.h"
+#include "webrtc/modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+
+class NullBitrateObserver : public CongestionController::Observer,
+                            public RemoteBitrateObserver {
+ public:
+  ~NullBitrateObserver() override {}
+  void OnNetworkChanged(uint32_t bitrate_bps,
+                        uint8_t fraction_loss,
+                        int64_t rtt_ms) override {}
+  void OnReceiveBitrateChanged(const std::vector<uint32_t>& ssrcs,
+                               uint32_t bitrate) override {}
+};
+
+class NullEventLog : public RtcEventLog {
+ public:
+  ~NullEventLog() override {}
+  bool StartLogging(const std::string& file_name,
+                    int64_t max_size_bytes) override {
+    return true;
+  }
+  bool StartLogging(rtc::PlatformFile platform_file, int64_t max_size_bytes) {
+    return true;
+  }
+  void StopLogging() override{};
+  void LogVideoReceiveStreamConfig(
+      const webrtc::VideoReceiveStream::Config& config) override {}
+  void LogVideoSendStreamConfig(
+      const webrtc::VideoSendStream::Config& config) override {}
+  void LogRtpHeader(PacketDirection direction,
+                    MediaType media_type,
+                    const uint8_t* header,
+                    size_t packet_length) override {}
+  void LogRtcpPacket(PacketDirection direction,
+                     MediaType media_type,
+                     const uint8_t* packet,
+                     size_t length) override {}
+  void LogAudioPlayout(uint32_t ssrc) override {}
+  void LogBwePacketLossEvent(int32_t bitrate,
+                             uint8_t fraction_loss,
+                             int32_t total_packets) override {}
+};
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  size_t i = 0;
+  if (size < sizeof(int64_t) + sizeof(uint8_t) + sizeof(uint32_t))
+    return;
+  SimulatedClock clock(data[i++]);
+  NullBitrateObserver observer;
+  NullEventLog event_log;
+  CongestionController cc(&clock, &observer, &observer, &event_log);
+  RemoteBitrateEstimator* rbe = cc.GetRemoteBitrateEstimator(true);
+  RTPHeader header;
+  header.ssrc = ByteReader<uint32_t>::ReadBigEndian(&data[i]);
+  i += sizeof(uint32_t);
+  header.extension.hasTransportSequenceNumber = true;
+  int64_t arrival_time_ms =
+      std::max<int64_t>(ByteReader<int64_t>::ReadBigEndian(&data[i]), 0);
+  i += sizeof(int64_t);
+  const size_t kMinPacketSize =
+      sizeof(size_t) + sizeof(uint16_t) + sizeof(uint8_t);
+  while (i + kMinPacketSize < size) {
+    size_t payload_size = ByteReader<size_t>::ReadBigEndian(&data[i]) % 1500;
+    i += sizeof(size_t);
+    header.extension.transportSequenceNumber =
+        ByteReader<uint16_t>::ReadBigEndian(&data[i]);
+    i += sizeof(uint16_t);
+    rbe->IncomingPacket(arrival_time_ms, payload_size, header);
+    clock.AdvanceTimeMilliseconds(5);
+    arrival_time_ms += ByteReader<uint8_t>::ReadBigEndian(&data[i]);
+    arrival_time_ms += sizeof(uint8_t);
+  }
+  rbe->Process();
+}
+}  // namespace webrtc