webrtc_m130/test/fuzzers/audio_processing_fuzzer_helper.cc
Alex Loiko 38c15d3995 Template argument and corpora for Audio Processing Fuzzer.
We found out that

  int16_t x = test::FuzzDataHelper::ReadOrDefaultValue(0)

reads 4 bytes from the fuzzer input instead of 2. That means that
almost half the bits in the input data to audio_processing_fuzzer are
ignored. This change adds template arguments to force reading 2 bytes
when we only need 2.

We also add a small manually generated corpus. During local testing we
let the fuzzer run for a few hours on an empty corpus. Adding the
manually-generated files resulted in an immediate coverage increase by
~3%, and then by another 3% over the next few hours.

The manually generated corpus contains a short segment of speech with
real echo. We suspect that triggering Voice Activity Detection or echo
estimation filter convergence can be difficult for an automatic
fuzzer.

We remove the Level Controller config. We read 20 bytes extra after the
config to guard against future configuration changes.

Bug: webrtc:7820
Change-Id: If60c04f53b27c519c349a40bd13664eef7999368
Reviewed-on: https://webrtc-review.googlesource.com/58744
Reviewed-by: Sam Zackrisson <saza@webrtc.org>
Commit-Queue: Alex Loiko <aleloi@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#22269}
2018-03-02 14:00:39 +00:00

121 lines
4.5 KiB
C++

/*
* Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
*
* Use of this source code is governed by a BSD-style license
* that can be found in the LICENSE file in the root of the source
* tree. An additional intellectual property rights grant can be found
* in the file PATENTS. All contributing project authors may
* be found in the AUTHORS file in the root of the source tree.
*/
#include "test/fuzzers/audio_processing_fuzzer_helper.h"
#include <algorithm>
#include <array>
#include <cmath>
#include <limits>
#include "modules/audio_processing/include/audio_processing.h"
#include "modules/include/module_common_types.h"
#include "rtc_base/checks.h"
namespace webrtc {
namespace {
void GenerateFloatFrame(test::FuzzDataHelper* fuzz_data,
size_t input_rate,
size_t num_channels,
float* const* float_frames) {
const size_t samples_per_input_channel =
rtc::CheckedDivExact(input_rate, 100ul);
RTC_DCHECK_LE(samples_per_input_channel, 480);
for (size_t i = 0; i < num_channels; ++i) {
for (size_t j = 0; j < samples_per_input_channel; ++j) {
float_frames[i][j] =
static_cast<float>(fuzz_data->ReadOrDefaultValue<int16_t>(0)) /
static_cast<float>(std::numeric_limits<int16_t>::max());
}
}
}
void GenerateFixedFrame(test::FuzzDataHelper* fuzz_data,
size_t input_rate,
size_t num_channels,
AudioFrame* fixed_frame) {
const size_t samples_per_input_channel =
rtc::CheckedDivExact(input_rate, 100ul);
fixed_frame->samples_per_channel_ = samples_per_input_channel;
fixed_frame->sample_rate_hz_ = input_rate;
fixed_frame->num_channels_ = num_channels;
RTC_DCHECK_LE(samples_per_input_channel * num_channels,
AudioFrame::kMaxDataSizeSamples);
for (size_t i = 0; i < samples_per_input_channel * num_channels; ++i) {
fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue<int16_t>(0);
}
}
} // namespace
void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data,
std::unique_ptr<AudioProcessing> apm) {
AudioFrame fixed_frame;
std::array<float, 480> float_frame1;
std::array<float, 480> float_frame2;
std::array<float* const, 2> float_frame_ptrs = {
&float_frame1[0], &float_frame2[0],
};
float* const* ptr_to_float_frames = &float_frame_ptrs[0];
using Rate = AudioProcessing::NativeRate;
const Rate rate_kinds[] = {Rate::kSampleRate8kHz, Rate::kSampleRate16kHz,
Rate::kSampleRate32kHz, Rate::kSampleRate48kHz};
// We may run out of fuzz data in the middle of a loop iteration. In
// that case, default values will be used for the rest of that
// iteration.
while (fuzz_data->CanReadBytes(1)) {
const bool is_float = fuzz_data->ReadOrDefaultValue(true);
// Decide input/output rate for this iteration.
const auto input_rate =
static_cast<size_t>(fuzz_data->SelectOneOf(rate_kinds));
const auto output_rate =
static_cast<size_t>(fuzz_data->SelectOneOf(rate_kinds));
const bool num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1;
const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue<uint8_t>(0);
// API call needed for AEC-2 and AEC-m to run.
apm->set_stream_delay_ms(stream_delay);
// Make the APM call depending on capture/render mode and float /
// fix interface.
const bool is_capture = fuzz_data->ReadOrDefaultValue(true);
// Fill the arrays with audio samples from the data.
int apm_return_code = AudioProcessing::Error::kNoError;
if (is_float) {
GenerateFloatFrame(fuzz_data, input_rate, num_channels,
ptr_to_float_frames);
if (is_capture) {
apm_return_code = apm->ProcessStream(
ptr_to_float_frames, StreamConfig(input_rate, num_channels),
StreamConfig(output_rate, num_channels), ptr_to_float_frames);
} else {
apm_return_code = apm->ProcessReverseStream(
ptr_to_float_frames, StreamConfig(input_rate, 1),
StreamConfig(output_rate, 1), ptr_to_float_frames);
}
} else {
GenerateFixedFrame(fuzz_data, input_rate, num_channels, &fixed_frame);
if (is_capture) {
apm_return_code = apm->ProcessStream(&fixed_frame);
} else {
apm_return_code = apm->ProcessReverseStream(&fixed_frame);
}
}
RTC_DCHECK_NE(apm_return_code, AudioProcessing::kBadDataLengthError);
}
}
} // namespace webrtc