xref: /aosp_15_r20/external/flac/oss-fuzz/decoder.cc (revision 600f14f40d737144c998e2ec7a483122d3776fbc)

/* Copyright 2019 Guido Vranken
 *
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the
 * "Software"), to deal in the Software without restriction, including
 * without limitation the rights to use, copy, modify, merge, publish,
 * distribute, sublicense, and/or sell copies of the Software, and to
 * permit persons to whom the Software is furnished to do so, subject
 * to the following conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

#include <cstddef>
#include <cstdint>

#include <fuzzing/datasource/datasource.hpp>
#include <fuzzing/memory.hpp>

#include "FLAC++/decoder.h"
#include "FLAC++/metadata.h"
#include "common.h"

template <> FLAC__MetadataType fuzzing::datasource::Base::Get<FLAC__MetadataType>(const uint64_t id) {
    (void)id;
    switch ( Get<uint8_t>() ) {
        case 0:
            return FLAC__METADATA_TYPE_STREAMINFO;
        case 1:
            return FLAC__METADATA_TYPE_PADDING;
        case 2:
            return FLAC__METADATA_TYPE_APPLICATION;
        case 3:
            return FLAC__METADATA_TYPE_SEEKTABLE;
        case 4:
            return FLAC__METADATA_TYPE_VORBIS_COMMENT;
        case 5:
            return FLAC__METADATA_TYPE_CUESHEET;
        case 6:
            return FLAC__METADATA_TYPE_PICTURE;
        case 7:
            return FLAC__METADATA_TYPE_UNDEFINED;
        case 8:
            return FLAC__MAX_METADATA_TYPE;
        default:
            return FLAC__METADATA_TYPE_STREAMINFO;
    }
}

namespace FLAC {
	namespace Decoder {
        class FuzzerStream : public Stream {
            private:
                fuzzing::datasource::Datasource& ds;
            public:
                FuzzerStream(fuzzing::datasource::Datasource& dsrc) :
                    Stream(), ds(dsrc) { }

                ::FLAC__StreamDecoderReadStatus read_callback(FLAC__byte buffer[], size_t *bytes)  override {
                    try {
                        const size_t maxCopySize = *bytes;

                        if ( maxCopySize > 0 ) {
                            /* memset just to test if this overwrites anything, and triggers ASAN */
                            memset(buffer, 0, maxCopySize);
                        }

                        const auto data = ds.GetData(0);
                        const auto dataSize = data.size();
                        const auto copySize = std::min(maxCopySize, dataSize);

                        if ( copySize > 0 ) {
                            memcpy(buffer, data.data(), copySize);
                        }

                        *bytes = copySize;

                        return FLAC__STREAM_DECODER_READ_STATUS_CONTINUE;
                    } catch ( ... ) {
	                    return FLAC__STREAM_DECODER_READ_STATUS_ABORT;
                    }
                }

                ::FLAC__StreamDecoderWriteStatus write_callback(const ::FLAC__Frame *frame, const FLAC__int32 * const buffer[])  override {
                    {
                        fuzzing::memory::memory_test(&(frame->header), sizeof(frame->header));
                        fuzzing::memory::memory_test(&(frame->footer), sizeof(frame->footer));
                    }

                    {
                        const auto numChannels = get_channels();
                        const size_t bytesPerChannel = frame->header.blocksize * sizeof(FLAC__int32);
                        for (size_t i = 0; i < numChannels; i++) {
                            fuzzing::memory::memory_test(buffer[i], bytesPerChannel);
                        }
                    }

                    try {
                        if ( ds.Get<bool>() == true ) {
	                        return FLAC__STREAM_DECODER_WRITE_STATUS_ABORT;
                        }
                    } catch ( ... ) { }
                    return FLAC__STREAM_DECODER_WRITE_STATUS_CONTINUE;
                }

                void error_callback(::FLAC__StreamDecoderErrorStatus status)  override {
                    fuzzing::memory::memory_test(status);
                }

                void metadata_callback(const ::FLAC__StreamMetadata *metadata) override {
                    Metadata::Prototype * cloned_object = nullptr;
                    fuzzing::memory::memory_test(metadata->type);
                    fuzzing::memory::memory_test(metadata->is_last);
                    fuzzing::memory::memory_test(metadata->length);
                    fuzzing::memory::memory_test(metadata->data);
                    if (metadata->type == FLAC__METADATA_TYPE_STREAMINFO)
                        cloned_object = new Metadata::StreamInfo(metadata);
                    else if (metadata->type == FLAC__METADATA_TYPE_PADDING)
                        cloned_object = new Metadata::Padding(metadata);
                    else if (metadata->type == FLAC__METADATA_TYPE_APPLICATION)
                        cloned_object = new Metadata::Application(metadata);
                    else if (metadata->type == FLAC__METADATA_TYPE_SEEKTABLE)
                        cloned_object = new Metadata::SeekTable(metadata);
                    else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT)
                        cloned_object = new Metadata::VorbisComment(metadata);
                    else if (metadata->type == FLAC__METADATA_TYPE_CUESHEET)
                        cloned_object = new Metadata::CueSheet(metadata);
                    else if (metadata->type == FLAC__METADATA_TYPE_PICTURE)
                        cloned_object = new Metadata::Picture(metadata);
                    else
                        return;
                    if (0 != cloned_object && *cloned_object == *metadata && cloned_object->is_valid()) {
                        if (cloned_object->get_type() == FLAC__METADATA_TYPE_SEEKTABLE)
                            dynamic_cast<Metadata::SeekTable *>(cloned_object)->is_legal();
                        if (cloned_object->get_type() == FLAC__METADATA_TYPE_PICTURE)
                            dynamic_cast<Metadata::Picture *>(cloned_object)->is_legal(NULL);
                        if (cloned_object->get_type() == FLAC__METADATA_TYPE_CUESHEET)
                            dynamic_cast<Metadata::CueSheet *>(cloned_object)->is_legal(true,NULL);
                    }
                    delete cloned_object;
                }

                ::FLAC__StreamDecoderSeekStatus seek_callback(FLAC__uint64 absolute_byte_offset) override {
                    fuzzing::memory::memory_test(absolute_byte_offset);

                    try {
                        if ( ds.Get<bool>() == true ) {
                            return FLAC__STREAM_DECODER_SEEK_STATUS_OK;
                        } else {
                            return FLAC__STREAM_DECODER_SEEK_STATUS_ERROR;
                        }
                    } catch ( ... ) {
                        return FLAC__STREAM_DECODER_SEEK_STATUS_OK;
                    }
                }
#if 0
                ::FLAC__StreamDecoderTellStatus tell_callback(FLAC__uint64 *absolute_byte_offset) override {
                    fuzzing::memory::memory_test(*absolute_byte_offset);

                    try {
                        if ( ds.Get<bool>() == true ) {
                            return FLAC__STREAM_DECODER_TELL_STATUS_OK;
                        } else {
                            return FLAC__STREAM_DECODER_TELL_STATUS_ERROR;
                        }
                    } catch ( ... ) {
                        return FLAC__STREAM_DECODER_TELL_STATUS_OK;
                    }
                }

                ::FLAC__StreamDecoderLengthStatus length_callback(FLAC__uint64 *stream_length) override {
                    fuzzing::memory::memory_test(*stream_length);

                    try {
                        if ( ds.Get<bool>() == true ) {
                            return FLAC__STREAM_DECODER_LENGTH_STATUS_OK;
                        } else {
                            return FLAC__STREAM_DECODER_LENGTH_STATUS_ERROR;
                        }
                    } catch ( ... ) {
                        return FLAC__STREAM_DECODER_LENGTH_STATUS_OK;
                    }
                }
#endif
        };
    }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    fuzzing::datasource::Datasource ds(data, size);
    FLAC::Decoder::FuzzerStream decoder(ds);
    bool use_ogg = true;

    try {
        if ( ds.Get<bool>() ) {
            use_ogg = false;
        }
        if ( ds.Get<bool>() ) {
#ifdef FUZZER_DEBUG
            printf("set_ogg_serial_number\n");
#endif
            decoder.set_ogg_serial_number(ds.Get<long>());
        }
        if ( ds.Get<bool>() ) {
#ifdef FUZZER_DEBUG
            printf("set_md5_checking\n");
#endif
            decoder.set_md5_checking(ds.Get<bool>());
        }
        if ( ds.Get<bool>() ) {
#ifdef FUZZER_DEBUG
            printf("set_metadata_respond\n");
#endif
            decoder.set_metadata_respond(ds.Get<::FLAC__MetadataType>());
        }
        if ( ds.Get<bool>() ) {
            const auto idVector = ds.GetData(0);
            unsigned char id[4];
            if ( idVector.size() >= sizeof(id) ) {
                memcpy(id, idVector.data(), sizeof(id));
#ifdef FUZZER_DEBUG
                printf("set_metadata_respond_application\n");
#endif
                decoder.set_metadata_respond_application(id);
            }
        }
        if ( ds.Get<bool>() ) {
#ifdef FUZZER_DEBUG
            printf("set_metadata_respond_all\n");
#endif
            decoder.set_metadata_respond_all();
        }
        if ( ds.Get<bool>() ) {
#ifdef FUZZER_DEBUG
            printf("set_metadata_ignore\n");
#endif
            decoder.set_metadata_ignore(ds.Get<::FLAC__MetadataType>());
        }
        if ( ds.Get<bool>() ) {
            const auto idVector = ds.GetData(0);
            unsigned char id[4];
            if ( idVector.size() >= sizeof(id) ) {
                memcpy(id, idVector.data(), sizeof(id));
#ifdef FUZZER_DEBUG
                printf("set_metadata_ignore_application\n");
#endif
                decoder.set_metadata_ignore_application(id);
            }
        }
        if ( ds.Get<bool>() ) {
#ifdef FUZZER_DEBUG
            printf("set_metadata_ignore_all\n");
#endif
            decoder.set_metadata_ignore_all();
        }
        {
            ::FLAC__StreamDecoderInitStatus ret;
            if ( !use_ogg ) {
                ret = decoder.init();
            } else {
                ret = decoder.init_ogg();
            }

            if ( ret != FLAC__STREAM_DECODER_INIT_STATUS_OK ) {
                goto end;
            }
        }

        while ( ds.Get<bool>() ) {
            switch ( ds.Get<uint8_t>() ) {
                case    0:
                    {
#ifdef FUZZER_DEBUG
                        printf("flush\n");
#endif
                        const bool res = decoder.flush();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    1:
                    {
#ifdef FUZZER_DEBUG
                        printf("reset\n");
#endif
                        const bool res = decoder.reset();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    2:
                    {
#ifdef FUZZER_DEBUG
                        printf("process_single\n");
#endif
                        const bool res = decoder.process_single();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    3:
                    {
#ifdef FUZZER_DEBUG
                        printf("process_until_end_of_metadata\n");
#endif
                        const bool res = decoder.process_until_end_of_metadata();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    4:
                    {
#ifdef FUZZER_DEBUG
                        printf("process_until_end_of_stream\n");
#endif
                        const bool res = decoder.process_until_end_of_stream();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    5:
                    {
#ifdef FUZZER_DEBUG
                        printf("skip_single_frame\n");
#endif
                        const bool res = decoder.skip_single_frame();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    6:
                    {
#ifdef FUZZER_DEBUG
                        printf("seek_absolute\n");
#endif
                        const bool res = decoder.seek_absolute(ds.Get<uint64_t>());
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    7:
                    {
#ifdef FUZZER_DEBUG
                        printf("get_md5_checking\n");
#endif
                        const bool res = decoder.get_md5_checking();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    8:
                    {
#ifdef FUZZER_DEBUG
                        printf("get_total_samples\n");
#endif
                        const bool res = decoder.get_total_samples();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    9:
                    {
#ifdef FUZZER_DEBUG
                        printf("get_channels\n");
#endif
                        const bool res = decoder.get_channels();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    10:
                    {
#ifdef FUZZER_DEBUG
                        printf("get_bits_per_sample\n");
#endif
                        const bool res = decoder.get_bits_per_sample();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    11:
                    {
#ifdef FUZZER_DEBUG
                        printf("get_sample_rate\n");
#endif
                        const bool res = decoder.get_sample_rate();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
                case    12:
                    {
#ifdef FUZZER_DEBUG
                        printf("get_blocksize\n");
#endif
                        const bool res = decoder.get_blocksize();
                        fuzzing::memory::memory_test(res);
                    }
                    break;
            }
        }
    } catch ( ... ) { }

end:
    {
        const bool res = decoder.finish();
        fuzzing::memory::memory_test(res);
    }
    return 0;
}