test/fuzzers/frame_buffer_fuzzer.cc

/*
 *  Copyright (c) 2021 The WebRTC project authors. All Rights Reserved.
 *
 *  Use of this source code is governed by a BSD-style license
 *  that can be found in the LICENSE file in the root of the source
 *  tree. An additional intellectual property rights grant can be found
 *  in the file PATENTS.  All contributing project authors may
 *  be found in the AUTHORS file in the root of the source tree.
 */

#include <cstddef>
#include <cstdint>
#include <memory>
#include <utility>

#include "api/field_trials.h"
#include "api/video/encoded_frame.h"
#include "api/video/frame_buffer.h"
#include "rtc_base/numerics/sequence_number_unwrapper.h"
#include "test/fuzzers/fuzz_data_helper.h"

namespace webrtc {
namespace {
class FuzzyFrameObject : public EncodedFrame {
 public:
  int64_t ReceivedTime() const override { return 0; }
  int64_t RenderTime() const override { return 0; }
};

constexpr int kFrameIdLength = 1 << 15;

}  // namespace

void FuzzOneInput(FuzzDataHelper fuzz_data) {
  if (fuzz_data.size() > 10'000) {
    return;
  }

  FieldTrials field_trials("");
  FrameBuffer buffer(/*max_frame_slots=*/100, /*max_decode_history=*/1000,
                     field_trials);
  SeqNumUnwrapper<uint16_t, kFrameIdLength> unwrapper;

  while (fuzz_data.BytesLeft() > 0) {
    int action = fuzz_data.ReadOrDefaultValue<uint8_t>(0) % 6;

    switch (action) {
      case 0: {
        buffer.LastContinuousFrameId();
        break;
      }
      case 1: {
        buffer.LastContinuousTemporalUnitFrameId();
        break;
      }
      case 2: {
        buffer.DecodableTemporalUnitsInfo();
        break;
      }
      case 3: {
        buffer.ExtractNextDecodableTemporalUnit();
        break;
      }
      case 4: {
        buffer.DropNextDecodableTemporalUnit();
        break;
      }
      case 5: {
        auto frame = std::make_unique<FuzzyFrameObject>();
        frame->SetRtpTimestamp(fuzz_data.ReadOrDefaultValue<uint32_t>(0));
        int64_t wire_id =
            fuzz_data.ReadOrDefaultValue<uint16_t>(0) & (kFrameIdLength - 1);
        frame->SetId(unwrapper.Unwrap(wire_id));
        frame->is_last_spatial_layer =
            fuzz_data.ReadOrDefaultValue<bool>(false);

        frame->num_references = fuzz_data.ReadOrDefaultValue<uint8_t>(0) %
                                EncodedFrame::kMaxFrameReferences;

        for (uint8_t i = 0; i < frame->num_references; ++i) {
          frame->references[i] = fuzz_data.ReadOrDefaultValue<int64_t>(0);
        }

        buffer.InsertFrame(std::move(frame));
        break;
      }
    }
  }
}

}  // namespace webrtc