OLD | NEW |
(Empty) | |
| 1 /* Copyright (c) 2017 Google Inc. */ |
| 2 /* |
| 3 Redistribution and use in source and binary forms, with or without |
| 4 modification, are permitted provided that the following conditions |
| 5 are met: |
| 6 |
| 7 - Redistributions of source code must retain the above copyright |
| 8 notice, this list of conditions and the following disclaimer. |
| 9 |
| 10 - Redistributions in binary form must reproduce the above copyright |
| 11 notice, this list of conditions and the following disclaimer in the |
| 12 documentation and/or other materials provided with the distribution. |
| 13 |
| 14 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 15 ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 16 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 17 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER |
| 18 OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, |
| 19 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, |
| 20 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
| 21 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 22 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
| 23 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
| 24 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 25 */ |
| 26 |
| 27 #ifdef HAVE_CONFIG_H |
| 28 #include "config.h" |
| 29 #endif |
| 30 |
| 31 #include <stdlib.h> |
| 32 #include <string.h> |
| 33 #include "opus.h" |
| 34 #include "opus_types.h" |
| 35 |
| 36 #define MAX_FRAME_SAMP 5760 |
| 37 #define MAX_PACKET 1500 |
| 38 |
| 39 /* 4 bytes: packet length, 4 bytes: encoder final range */ |
| 40 #define SETUP_BYTE_COUNT 8 |
| 41 |
| 42 typedef struct { |
| 43 int fs; |
| 44 int channels; |
| 45 } TocInfo; |
| 46 |
| 47 static void ParseToc(const uint8_t *toc, TocInfo *const info) { |
| 48 const int samp_freqs[5] = {8000, 12000, 16000, 24000, 48000}; |
| 49 const int bandwidth = opus_packet_get_bandwidth(toc); |
| 50 |
| 51 info->fs = samp_freqs[bandwidth - OPUS_BANDWIDTH_NARROWBAND]; |
| 52 info->channels = opus_packet_get_nb_channels(toc); |
| 53 } |
| 54 |
| 55 /* Treats the input data as concatenated packets encoded by opus_demo, |
| 56 * structured as |
| 57 * bytes 0..3: packet length |
| 58 * bytes 4..7: encoder final range |
| 59 * bytes 8+ : Opus packet, including ToC |
| 60 */ |
| 61 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
| 62 OpusDecoder *dec; |
| 63 opus_int16 *pcm; |
| 64 uint8_t *packet; |
| 65 TocInfo toc; |
| 66 int i, err; |
| 67 |
| 68 /* Not enough data to setup the decoder (+1 for the ToC) */ |
| 69 if (size < SETUP_BYTE_COUNT + 1) { |
| 70 return 0; |
| 71 } |
| 72 |
| 73 /* Create decoder based on info from the first ToC available */ |
| 74 ParseToc(&data[SETUP_BYTE_COUNT], &toc); |
| 75 |
| 76 dec = opus_decoder_create(toc.fs, toc.channels, &err); |
| 77 if (err != OPUS_OK | dec == NULL) { |
| 78 return 0; |
| 79 } |
| 80 |
| 81 pcm = (opus_int16*) malloc(sizeof(*pcm) * MAX_FRAME_SAMP * toc.channels); |
| 82 packet = (uint8_t*) calloc(MAX_PACKET, sizeof(*packet)); |
| 83 |
| 84 i = 0; |
| 85 while (1) { |
| 86 int len, fec; |
| 87 |
| 88 if (i + SETUP_BYTE_COUNT >= size) { |
| 89 break; |
| 90 } |
| 91 |
| 92 len = (opus_uint32) data[i ] << 24 | |
| 93 (opus_uint32) data[i + 1] << 16 | |
| 94 (opus_uint32) data[i + 2] << 8 | |
| 95 (opus_uint32) data[i + 3]; |
| 96 if (len > MAX_PACKET || len < 0) { |
| 97 break; |
| 98 } |
| 99 |
| 100 /* Bytes 4..7 represent encoder final range, but are unused here. |
| 101 * Instead, byte 4 is repurposed to determine if FEC is used. */ |
| 102 fec = data[i + 4] & 1; |
| 103 |
| 104 /* Lost packet */ |
| 105 if (len == 0) { |
| 106 int frame_size; |
| 107 opus_decoder_ctl(dec, OPUS_GET_LAST_PACKET_DURATION(&frame_size)); |
| 108 (void) opus_decode(dec, NULL, size, pcm, frame_size, fec); |
| 109 } else { |
| 110 if (i + SETUP_BYTE_COUNT + len > size) { |
| 111 break; |
| 112 } |
| 113 memcpy(pcm, &data[i + SETUP_BYTE_COUNT], len); |
| 114 (void) opus_decode(dec, data, size, pcm, MAX_FRAME_SAMP, fec); |
| 115 } |
| 116 |
| 117 i += SETUP_BYTE_COUNT + len; |
| 118 } |
| 119 |
| 120 opus_decoder_destroy(dec); |
| 121 free(pcm); |
| 122 free(packet); |
| 123 |
| 124 return 0; |
| 125 } |
OLD | NEW |