1 /*
2 * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved.
3 *
4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree.
9 */
10
11 #include "test/fuzzers/audio_processing_fuzzer_helper.h"
12
13 #include <algorithm>
14 #include <array>
15 #include <cmath>
16 #include <limits>
17
18 #include "api/audio/audio_frame.h"
19 #include "modules/audio_processing/include/audio_frame_proxies.h"
20 #include "modules/audio_processing/include/audio_processing.h"
21 #include "rtc_base/checks.h"
22
23 namespace webrtc {
24 namespace {
ValidForApm(float x)25 bool ValidForApm(float x) {
26 return std::isfinite(x) && -1.0f <= x && x <= 1.0f;
27 }
28
GenerateFloatFrame(test::FuzzDataHelper * fuzz_data,int input_rate,int num_channels,float * const * float_frames)29 void GenerateFloatFrame(test::FuzzDataHelper* fuzz_data,
30 int input_rate,
31 int num_channels,
32 float* const* float_frames) {
33 const int samples_per_input_channel =
34 AudioProcessing::GetFrameSize(input_rate);
35 RTC_DCHECK_LE(samples_per_input_channel, 480);
36 for (int i = 0; i < num_channels; ++i) {
37 std::fill(float_frames[i], float_frames[i] + samples_per_input_channel, 0);
38 const size_t read_bytes = sizeof(float) * samples_per_input_channel;
39 if (fuzz_data->CanReadBytes(read_bytes)) {
40 rtc::ArrayView<const uint8_t> byte_array =
41 fuzz_data->ReadByteArray(read_bytes);
42 memmove(float_frames[i], byte_array.begin(), read_bytes);
43 }
44
45 // Sanitize input.
46 for (int j = 0; j < samples_per_input_channel; ++j) {
47 if (!ValidForApm(float_frames[i][j])) {
48 float_frames[i][j] = 0.f;
49 }
50 }
51 }
52 }
53
GenerateFixedFrame(test::FuzzDataHelper * fuzz_data,int input_rate,int num_channels,AudioFrame * fixed_frame)54 void GenerateFixedFrame(test::FuzzDataHelper* fuzz_data,
55 int input_rate,
56 int num_channels,
57 AudioFrame* fixed_frame) {
58 const int samples_per_input_channel =
59 AudioProcessing::GetFrameSize(input_rate);
60
61 fixed_frame->samples_per_channel_ = samples_per_input_channel;
62 fixed_frame->sample_rate_hz_ = input_rate;
63 fixed_frame->num_channels_ = num_channels;
64
65 RTC_DCHECK_LE(samples_per_input_channel * num_channels,
66 AudioFrame::kMaxDataSizeSamples);
67 for (int i = 0; i < samples_per_input_channel * num_channels; ++i) {
68 fixed_frame->mutable_data()[i] = fuzz_data->ReadOrDefaultValue<int16_t>(0);
69 }
70 }
71 } // namespace
72
FuzzAudioProcessing(test::FuzzDataHelper * fuzz_data,rtc::scoped_refptr<AudioProcessing> apm)73 void FuzzAudioProcessing(test::FuzzDataHelper* fuzz_data,
74 rtc::scoped_refptr<AudioProcessing> apm) {
75 AudioFrame fixed_frame;
76 // Normal usage is up to 8 channels. Allowing to fuzz one beyond this allows
77 // us to catch implicit assumptions about normal usage.
78 constexpr int kMaxNumChannels = 9;
79 std::array<std::array<float, 480>, kMaxNumChannels> float_frames;
80 std::array<float*, kMaxNumChannels> float_frame_ptrs;
81 for (int i = 0; i < kMaxNumChannels; ++i) {
82 float_frame_ptrs[i] = float_frames[i].data();
83 }
84 float* const* ptr_to_float_frames = &float_frame_ptrs[0];
85
86 constexpr int kSampleRatesHz[] = {8000, 11025, 16000, 22050,
87 32000, 44100, 48000};
88
89 // We may run out of fuzz data in the middle of a loop iteration. In
90 // that case, default values will be used for the rest of that
91 // iteration.
92 while (fuzz_data->CanReadBytes(1)) {
93 const bool is_float = fuzz_data->ReadOrDefaultValue(true);
94 // Decide input/output rate for this iteration.
95 const int input_rate = fuzz_data->SelectOneOf(kSampleRatesHz);
96 const int output_rate = fuzz_data->SelectOneOf(kSampleRatesHz);
97
98 const uint8_t stream_delay = fuzz_data->ReadOrDefaultValue<uint8_t>(0);
99 // API call needed for AECM to run.
100 apm->set_stream_delay_ms(stream_delay);
101
102 const bool key_pressed = fuzz_data->ReadOrDefaultValue(true);
103 apm->set_stream_key_pressed(key_pressed);
104
105 // Make the APM call depending on capture/render mode and float /
106 // fix interface.
107 const bool is_capture = fuzz_data->ReadOrDefaultValue(true);
108
109 // Fill the arrays with audio samples from the data.
110 int apm_return_code = AudioProcessing::Error::kNoError;
111 if (is_float) {
112 const int num_channels =
113 fuzz_data->ReadOrDefaultValue<uint8_t>(1) % kMaxNumChannels;
114
115 GenerateFloatFrame(fuzz_data, input_rate, num_channels,
116 ptr_to_float_frames);
117 if (is_capture) {
118 apm_return_code = apm->ProcessStream(
119 ptr_to_float_frames, StreamConfig(input_rate, num_channels),
120 StreamConfig(output_rate, num_channels), ptr_to_float_frames);
121 } else {
122 apm_return_code = apm->ProcessReverseStream(
123 ptr_to_float_frames, StreamConfig(input_rate, num_channels),
124 StreamConfig(output_rate, num_channels), ptr_to_float_frames);
125 }
126 } else {
127 const int num_channels = fuzz_data->ReadOrDefaultValue(true) ? 2 : 1;
128 GenerateFixedFrame(fuzz_data, input_rate, num_channels, &fixed_frame);
129
130 if (is_capture) {
131 apm_return_code = ProcessAudioFrame(apm.get(), &fixed_frame);
132 } else {
133 apm_return_code = ProcessReverseAudioFrame(apm.get(), &fixed_frame);
134 }
135 }
136
137 // Cover stats gathering code paths.
138 static_cast<void>(apm->GetStatistics(true /*has_remote_tracks*/));
139
140 RTC_DCHECK_NE(apm_return_code, AudioProcessing::kBadDataLengthError);
141 }
142 }
143 } // namespace webrtc
144