1 /*
2 * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
3 *
4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree.
9 */
10
11 #include <cmath>
12 #include <limits>
13 #include <memory>
14 #include <vector>
15
16 #include "api/array_view.h"
17 #include "api/audio_codecs/builtin_audio_decoder_factory.h"
18 #include "modules/audio_coding/codecs/pcm16b/audio_encoder_pcm16b.h"
19 #include "modules/audio_coding/neteq/tools/audio_checksum.h"
20 #include "modules/audio_coding/neteq/tools/encode_neteq_input.h"
21 #include "modules/audio_coding/neteq/tools/neteq_test.h"
22 #include "rtc_base/numerics/safe_conversions.h"
23 #include "rtc_base/random.h"
24 #include "test/fuzzers/fuzz_data_helper.h"
25
26 namespace webrtc {
27 namespace test {
28 namespace {
29 // Generate a mixture of sine wave and gaussian noise.
30 class SineAndNoiseGenerator : public EncodeNetEqInput::Generator {
31 public:
32 // The noise generator is seeded with a value from the fuzzer data, but 0 is
33 // avoided (since it is not allowed by the Random class).
SineAndNoiseGenerator(int sample_rate_hz,FuzzDataHelper * fuzz_data)34 SineAndNoiseGenerator(int sample_rate_hz, FuzzDataHelper* fuzz_data)
35 : sample_rate_hz_(sample_rate_hz),
36 fuzz_data_(*fuzz_data),
37 noise_generator_(fuzz_data_.ReadOrDefaultValueNotZero<uint64_t>(1)) {}
38
39 // Generates num_samples of the sine-gaussian mixture.
Generate(size_t num_samples)40 rtc::ArrayView<const int16_t> Generate(size_t num_samples) override {
41 if (samples_.size() < num_samples) {
42 samples_.resize(num_samples);
43 }
44
45 rtc::ArrayView<int16_t> output(samples_.data(), num_samples);
46 // Randomize an amplitude between 0 and 32768; use 65000/2 if we are out of
47 // fuzzer data.
48 const float amplitude = fuzz_data_.ReadOrDefaultValue<uint16_t>(65000) / 2;
49 // Randomize a noise standard deviation between 0 and 1999.
50 const float noise_std = fuzz_data_.ReadOrDefaultValue<uint16_t>(0) % 2000;
51 for (auto& x : output) {
52 x = rtc::saturated_cast<int16_t>(amplitude * std::sin(phase_) +
53 noise_generator_.Gaussian(0, noise_std));
54 phase_ += 2 * kPi * kFreqHz / sample_rate_hz_;
55 }
56 return output;
57 }
58
59 private:
60 static constexpr int kFreqHz = 300; // The sinewave frequency.
61 const int sample_rate_hz_;
62 const double kPi = std::acos(-1);
63 std::vector<int16_t> samples_;
64 double phase_ = 0.0;
65 FuzzDataHelper& fuzz_data_;
66 Random noise_generator_;
67 };
68
69 class FuzzSignalInput : public NetEqInput {
70 public:
FuzzSignalInput(FuzzDataHelper * fuzz_data,int sample_rate,uint8_t payload_type)71 explicit FuzzSignalInput(FuzzDataHelper* fuzz_data,
72 int sample_rate,
73 uint8_t payload_type)
74 : fuzz_data_(*fuzz_data) {
75 AudioEncoderPcm16B::Config config;
76 config.payload_type = payload_type;
77 config.sample_rate_hz = sample_rate;
78 std::unique_ptr<AudioEncoder> encoder(new AudioEncoderPcm16B(config));
79 std::unique_ptr<EncodeNetEqInput::Generator> generator(
80 new SineAndNoiseGenerator(config.sample_rate_hz, fuzz_data));
81 input_.reset(new EncodeNetEqInput(std::move(generator), std::move(encoder),
82 std::numeric_limits<int64_t>::max()));
83 packet_ = input_->PopPacket();
84
85 // Select an output event period. This is how long time we wait between each
86 // call to NetEq::GetAudio. 10 ms is nominal, 9 and 11 ms will both lead to
87 // clock drift (in different directions).
88 constexpr int output_event_periods[] = {9, 10, 11};
89 output_event_period_ms_ = fuzz_data_.SelectOneOf(output_event_periods);
90 }
91
NextPacketTime() const92 absl::optional<int64_t> NextPacketTime() const override {
93 return packet_->time_ms;
94 }
95
NextOutputEventTime() const96 absl::optional<int64_t> NextOutputEventTime() const override {
97 return next_output_event_ms_;
98 }
99
PopPacket()100 std::unique_ptr<PacketData> PopPacket() override {
101 RTC_DCHECK(packet_);
102 std::unique_ptr<PacketData> packet_to_return = std::move(packet_);
103 do {
104 packet_ = input_->PopPacket();
105 // If the next value from the fuzzer input is 0, the packet is discarded
106 // and the next one is pulled from the source.
107 } while (fuzz_data_.CanReadBytes(1) && fuzz_data_.Read<uint8_t>() == 0);
108 if (fuzz_data_.CanReadBytes(1)) {
109 // Generate jitter by setting an offset for the arrival time.
110 const int8_t arrival_time_offset_ms = fuzz_data_.Read<int8_t>();
111 // The arrival time can not be before the previous packets.
112 packet_->time_ms = std::max(packet_to_return->time_ms,
113 packet_->time_ms + arrival_time_offset_ms);
114 } else {
115 // Mark that we are at the end of the test. However, the current packet is
116 // still valid (but it may not have been fuzzed as expected).
117 ended_ = true;
118 }
119 return packet_to_return;
120 }
121
AdvanceOutputEvent()122 void AdvanceOutputEvent() override {
123 next_output_event_ms_ += output_event_period_ms_;
124 }
125
ended() const126 bool ended() const override { return ended_; }
127
NextHeader() const128 absl::optional<RTPHeader> NextHeader() const override {
129 RTC_DCHECK(packet_);
130 return packet_->header;
131 }
132
133 private:
134 bool ended_ = false;
135 FuzzDataHelper& fuzz_data_;
136 std::unique_ptr<EncodeNetEqInput> input_;
137 std::unique_ptr<PacketData> packet_;
138 int64_t next_output_event_ms_ = 0;
139 int64_t output_event_period_ms_ = 10;
140 };
141
142 template <class T>
MapHas(const std::map<int,T> & m,int key,const T & value)143 bool MapHas(const std::map<int, T>& m, int key, const T& value) {
144 const auto it = m.find(key);
145 return (it != m.end() && it->second == value);
146 }
147
148 } // namespace
149
FuzzOneInputTest(const uint8_t * data,size_t size)150 void FuzzOneInputTest(const uint8_t* data, size_t size) {
151 if (size < 1 || size > 65000) {
152 return;
153 }
154
155 FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
156
157 // Allowed sample rates and payload types used in the test.
158 std::pair<int, uint8_t> rate_types[] = {
159 {8000, 93}, {16000, 94}, {32000, 95}, {48000, 96}};
160 const auto rate_type = fuzz_data.SelectOneOf(rate_types);
161 const int sample_rate = rate_type.first;
162 const uint8_t payload_type = rate_type.second;
163
164 // Set up the input signal generator.
165 std::unique_ptr<FuzzSignalInput> input(
166 new FuzzSignalInput(&fuzz_data, sample_rate, payload_type));
167
168 // Output sink for the test.
169 std::unique_ptr<AudioChecksum> output(new AudioChecksum);
170
171 // Configure NetEq and the NetEqTest object.
172 NetEqTest::Callbacks callbacks;
173 NetEq::Config config;
174 config.enable_post_decode_vad = true;
175 config.enable_fast_accelerate = true;
176 auto codecs = NetEqTest::StandardDecoderMap();
177 // rate_types contains the payload types that will be used for encoding.
178 // Verify that they all are included in the standard decoder map, and that
179 // they point to the expected decoder types.
180 RTC_CHECK(
181 MapHas(codecs, rate_types[0].second, SdpAudioFormat("l16", 8000, 1)));
182 RTC_CHECK(
183 MapHas(codecs, rate_types[1].second, SdpAudioFormat("l16", 16000, 1)));
184 RTC_CHECK(
185 MapHas(codecs, rate_types[2].second, SdpAudioFormat("l16", 32000, 1)));
186 RTC_CHECK(
187 MapHas(codecs, rate_types[3].second, SdpAudioFormat("l16", 48000, 1)));
188
189 NetEqTest test(config, CreateBuiltinAudioDecoderFactory(), codecs,
190 /*text_log=*/nullptr, /*neteq_factory=*/nullptr,
191 std::move(input), std::move(output), callbacks);
192 test.Run();
193 }
194
195 } // namespace test
196
FuzzOneInput(const uint8_t * data,size_t size)197 void FuzzOneInput(const uint8_t* data, size_t size) {
198 test::FuzzOneInputTest(data, size);
199 }
200
201 } // namespace webrtc
202