commit 5429aa5cbf9f7227279ba6513366d2b7d8442773
author Danil Chapovalov <danilchap@webrtc.org> Wed Sep 10 14:53:37 2025
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Sep 11 08:52:28 2025
tree 2e079f67d4e3f27ab3125c4680fa5857d2e3fa60
parent aeb99a056b4d1823c3162e2d40d28f3897a14f1e

Avoid out of bound access in audio decoder opus fuzzer on empty input

Bug: webrtc:444013301
Change-Id: I05275bd186277741614e4464c1f80be2c927d83f
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/408907
Reviewed-by: Sam Zackrisson <saza@webrtc.org>
Commit-Queue: Danil Chapovalov <danilchap@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#45622}

test/fuzzers/BUILD.gn

diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn
index 0271277..e7a254c 100644
--- a/test/fuzzers/BUILD.gn
+++ b/test/fuzzers/BUILD.gn
@@ -379,6 +379,7 @@
   sources = [ "audio_decoder_multistream_opus_fuzzer.cc" ]
   deps = [
     ":audio_decoder_fuzzer",
+    "../../api:array_view",
     "../../api/audio_codecs/opus:audio_decoder_multiopus",
     "../../api/audio_codecs/opus:audio_decoder_opus_config",
     "../../rtc_base:checks",

test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc

diff --git a/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc b/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
index 9d61908..16255d8 100644
--- a/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
+++ b/test/fuzzers/audio_decoder_multistream_opus_fuzzer.cc
@@ -13,13 +13,17 @@
 #include <memory>
 #include <vector>
 
+#include "api/array_view.h"
 #include "api/audio_codecs/opus/audio_decoder_multi_channel_opus.h"
 #include "api/audio_codecs/opus/audio_decoder_multi_channel_opus_config.h"
 #include "rtc_base/checks.h"
 #include "test/fuzzers/audio_decoder_fuzzer.h"
+#include "test/fuzzers/fuzz_data_helper.h"
 
 namespace webrtc {
 
+using test::FuzzDataHelper;
+
 AudioDecoderMultiChannelOpusConfig MakeDecoderConfig(
     int num_channels,
     int num_streams,
@@ -34,7 +38,7 @@
 }
 
 void FuzzOneInput(const uint8_t* data, size_t size) {
-  const std::vector<AudioDecoderMultiChannelOpusConfig> surround_configs = {
+  const AudioDecoderMultiChannelOpusConfig kSurroundConfigs[] = {
       MakeDecoderConfig(1, 1, 0, {0}),  // Mono
 
       MakeDecoderConfig(2, 2, 0, {0, 0}),  // Copy the first (of
@@ -50,7 +54,9 @@
       MakeDecoderConfig(8, 5, 3, {0, 6, 1, 2, 3, 4, 5, 7})  // 7.1
   };
 
-  const auto config = surround_configs[data[0] % surround_configs.size()];
+  FuzzDataHelper helper(MakeArrayView(data, size));
+
+  const auto config = helper.SelectOneOf(kSurroundConfigs);
   RTC_CHECK(config.IsOk());
   std::unique_ptr<AudioDecoder> dec =
       AudioDecoderMultiChannelOpus::MakeAudioDecoder(config);