1 /* 2 * Copyright (c) 2017 The WebRTC project authors. All Rights Reserved. 3 * 4 * Use of this source code is governed by a BSD-style license 5 * that can be found in the LICENSE file in the root of the source 6 * tree. An additional intellectual property rights grant can be found 7 * in the file PATENTS. All contributing project authors may 8 * be found in the AUTHORS file in the root of the source tree. 9 */ 10 11 #include <algorithm> 12 13 #include "modules/rtp_rtcp/include/rtp_rtcp_defines.h" 14 #include "modules/rtp_rtcp/source/byte_io.h" 15 #include "modules/rtp_rtcp/source/rtp_packet_received.h" 16 #include "modules/rtp_rtcp/source/ulpfec_receiver.h" 17 #include "test/fuzzers/fuzz_data_helper.h" 18 19 namespace webrtc { 20 21 namespace { 22 class DummyCallback : public RecoveredPacketReceiver { OnRecoveredPacket(const uint8_t * packet,size_t length)23 void OnRecoveredPacket(const uint8_t* packet, size_t length) override {} 24 }; 25 } // namespace 26 FuzzOneInput(const uint8_t * data,size_t size)27void FuzzOneInput(const uint8_t* data, size_t size) { 28 constexpr size_t kMinDataNeeded = 12; 29 if (size < kMinDataNeeded || size > 2000) { 30 return; 31 } 32 33 uint32_t ulpfec_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 0); 34 uint16_t ulpfec_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 4); 35 uint32_t media_ssrc = ByteReader<uint32_t>::ReadLittleEndian(data + 6); 36 uint16_t media_seq_num = ByteReader<uint16_t>::ReadLittleEndian(data + 10); 37 38 DummyCallback callback; 39 UlpfecReceiver receiver(ulpfec_ssrc, 0, &callback, {}, 40 Clock::GetRealTimeClock()); 41 42 test::FuzzDataHelper fuzz_data(rtc::MakeArrayView(data, size)); 43 while (fuzz_data.CanReadBytes(kMinDataNeeded)) { 44 size_t packet_length = kRtpHeaderSize + fuzz_data.Read<uint8_t>(); 45 auto raw_packet = fuzz_data.ReadByteArray(packet_length); 46 47 RtpPacketReceived parsed_packet; 48 if (!parsed_packet.Parse(raw_packet)) 49 continue; 50 51 // Overwrite the fields for the sequence number and SSRC with 52 // consistent values for either a received UlpFEC packet or received media 53 // packet. (We're still relying on libfuzzer to manage to generate packet 54 // headers that interact together; this just ensures that we have two 55 // consistent streams). 56 if (fuzz_data.ReadOrDefaultValue<uint8_t>(0) % 2 == 0) { 57 // Simulate UlpFEC packet. 58 parsed_packet.SetSequenceNumber(ulpfec_seq_num++); 59 parsed_packet.SetSsrc(ulpfec_ssrc); 60 } else { 61 // Simulate media packet. 62 parsed_packet.SetSequenceNumber(media_seq_num++); 63 parsed_packet.SetSsrc(media_ssrc); 64 } 65 66 receiver.AddReceivedRedPacket(parsed_packet); 67 } 68 69 receiver.ProcessReceivedFec(); 70 } 71 72 } // namespace webrtc 73