Felicia Lim | 468327d | 2017-02-10 11:42:08 -0800 | [diff] [blame] | 1 | /* Copyright (c) 2017 Google Inc. */ |
| 2 | /* |
| 3 | Redistribution and use in source and binary forms, with or without |
| 4 | modification, are permitted provided that the following conditions |
| 5 | are met: |
| 6 | |
| 7 | - Redistributions of source code must retain the above copyright |
| 8 | notice, this list of conditions and the following disclaimer. |
| 9 | |
| 10 | - Redistributions in binary form must reproduce the above copyright |
| 11 | notice, this list of conditions and the following disclaimer in the |
| 12 | documentation and/or other materials provided with the distribution. |
| 13 | |
| 14 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 15 | ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 16 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 17 | A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER |
| 18 | OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, |
| 19 | EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, |
| 20 | PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
| 21 | PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
| 22 | LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
| 23 | NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
| 24 | SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 25 | */ |
| 26 | |
| 27 | #ifdef HAVE_CONFIG_H |
| 28 | #include "config.h" |
| 29 | #endif |
| 30 | |
Felicia Lim | a1b050b | 2017-07-13 10:33:57 -0700 | [diff] [blame] | 31 | #include <stdint.h> |
Felicia Lim | 468327d | 2017-02-10 11:42:08 -0800 | [diff] [blame] | 32 | #include <stdlib.h> |
| 33 | #include <string.h> |
| 34 | #include "opus.h" |
| 35 | #include "opus_types.h" |
| 36 | |
| 37 | #define MAX_FRAME_SAMP 5760 |
| 38 | #define MAX_PACKET 1500 |
| 39 | |
| 40 | /* 4 bytes: packet length, 4 bytes: encoder final range */ |
| 41 | #define SETUP_BYTE_COUNT 8 |
| 42 | |
| 43 | typedef struct { |
| 44 | int fs; |
| 45 | int channels; |
| 46 | } TocInfo; |
| 47 | |
| 48 | static void ParseToc(const uint8_t *toc, TocInfo *const info) { |
| 49 | const int samp_freqs[5] = {8000, 12000, 16000, 24000, 48000}; |
| 50 | const int bandwidth = opus_packet_get_bandwidth(toc); |
| 51 | |
| 52 | info->fs = samp_freqs[bandwidth - OPUS_BANDWIDTH_NARROWBAND]; |
| 53 | info->channels = opus_packet_get_nb_channels(toc); |
| 54 | } |
| 55 | |
| 56 | /* Treats the input data as concatenated packets encoded by opus_demo, |
| 57 | * structured as |
| 58 | * bytes 0..3: packet length |
| 59 | * bytes 4..7: encoder final range |
| 60 | * bytes 8+ : Opus packet, including ToC |
| 61 | */ |
| 62 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
| 63 | OpusDecoder *dec; |
| 64 | opus_int16 *pcm; |
| 65 | uint8_t *packet; |
| 66 | TocInfo toc; |
| 67 | int i, err; |
| 68 | |
| 69 | /* Not enough data to setup the decoder (+1 for the ToC) */ |
| 70 | if (size < SETUP_BYTE_COUNT + 1) { |
| 71 | return 0; |
| 72 | } |
| 73 | |
| 74 | /* Create decoder based on info from the first ToC available */ |
| 75 | ParseToc(&data[SETUP_BYTE_COUNT], &toc); |
| 76 | |
| 77 | dec = opus_decoder_create(toc.fs, toc.channels, &err); |
| 78 | if (err != OPUS_OK | dec == NULL) { |
| 79 | return 0; |
| 80 | } |
| 81 | |
| 82 | pcm = (opus_int16*) malloc(sizeof(*pcm) * MAX_FRAME_SAMP * toc.channels); |
| 83 | packet = (uint8_t*) calloc(MAX_PACKET, sizeof(*packet)); |
| 84 | |
| 85 | i = 0; |
| 86 | while (1) { |
| 87 | int len, fec; |
| 88 | |
| 89 | if (i + SETUP_BYTE_COUNT >= size) { |
| 90 | break; |
| 91 | } |
| 92 | |
| 93 | len = (opus_uint32) data[i ] << 24 | |
| 94 | (opus_uint32) data[i + 1] << 16 | |
| 95 | (opus_uint32) data[i + 2] << 8 | |
| 96 | (opus_uint32) data[i + 3]; |
| 97 | if (len > MAX_PACKET || len < 0) { |
| 98 | break; |
| 99 | } |
| 100 | |
| 101 | /* Bytes 4..7 represent encoder final range, but are unused here. |
| 102 | * Instead, byte 4 is repurposed to determine if FEC is used. */ |
| 103 | fec = data[i + 4] & 1; |
| 104 | |
| 105 | /* Lost packet */ |
| 106 | if (len == 0) { |
| 107 | int frame_size; |
| 108 | opus_decoder_ctl(dec, OPUS_GET_LAST_PACKET_DURATION(&frame_size)); |
| 109 | (void) opus_decode(dec, NULL, size, pcm, frame_size, fec); |
| 110 | } else { |
| 111 | if (i + SETUP_BYTE_COUNT + len > size) { |
| 112 | break; |
| 113 | } |
| 114 | memcpy(pcm, &data[i + SETUP_BYTE_COUNT], len); |
| 115 | (void) opus_decode(dec, data, size, pcm, MAX_FRAME_SAMP, fec); |
| 116 | } |
| 117 | |
| 118 | i += SETUP_BYTE_COUNT + len; |
| 119 | } |
| 120 | |
| 121 | opus_decoder_destroy(dec); |
| 122 | free(pcm); |
| 123 | free(packet); |
| 124 | |
| 125 | return 0; |
| 126 | } |