Merge "Added amrnb_enc_fuzzer" am: 52d9e3a0

/******************************************************************************

 *

 * Copyright (C) 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at:

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 *

 *****************************************************************************

 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore

 */

cc_fuzz {

    name: "amrnb_enc_fuzzer",

    host_supported: true,

    srcs: [

        "amrnb_enc_fuzzer.cpp",

    ],

    static_libs: [

        "liblog",

        "libstagefright_amrnbenc",

        "libstagefright_amrnb_common",

    ],

    fuzz_config: {

        cc: [

            "android-media-fuzzing-reports@google.com",

        ],

        componentid: 155276,

    },

}

# Fuzzer for libstagefright_amrnbenc encoder

## Plugin Design Considerations

The fuzzer plugin for AMR-NB is designed based on the understanding of the

codec and tries to achieve the following:

##### Maximize code coverage

The configuration parameters are not hardcoded, but instead selected based on

incoming data. This ensures more code paths are reached by the fuzzer.

AMR-WB supports the following parameters:

1. Output Format (parameter name: `outputFormat`)

2. Mode (parameter name: `mode`)

| Parameter| Valid Values| Configured Value|

|------------- |-------------| ----- |

| `outputFormat` | 0. `AMR_TX_WMF` 1. `AMR_TX_IF2` 2. `AMR_TX_ETS` | Bits 0, 1 and 2 of 1st byte of data. |

| `mode`   | 0. `MR475` 1. `MR515` 2. `MR59` 3. `MR67`  4. `MR74 ` 5. `MR795` 6. `MR102` 7. `MR122` 8. `MRDTX` | Bits 3, 4, 5 and 6 of 1st byte of data. |

This also ensures that the plugin is always deterministic for any given input.

##### Maximize utilization of input data

The plugin feeds the entire input data to the codec using a loop.

If the encode operation was successful, the input is advanced by the frame size.

If the encode operation was un-successful, the input is still advanced by frame size so

that the fuzzer can proceed to feed the next frame.

This ensures that the plugin tolerates any kind of input (empty, huge,

malformed, etc) and doesnt `exit()` on any input and thereby increasing the

chance of identifying vulnerabilities.

## Build

This describes steps to build amrnb_enc_fuzzer binary.

### Android

#### Steps to build

Build the fuzzer

```

  $ mm -j$(nproc) amrnb_enc_fuzzer

```

#### Steps to run

Create a directory CORPUS_DIR and copy some pcm files to that folder

Push this directory to device.

To run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/amrnb_enc_fuzzer/amrnb_enc_fuzzer CORPUS_DIR

```

To run on host

```

  $ $ANDROID_HOST_OUT/fuzz/x86_64/amrnb_enc_fuzzer/amrnb_enc_fuzzer CORPUS_DIR

```

## References:

 * http://llvm.org/docs/LibFuzzer.html

 * https://github.com/google/oss-fuzz

/******************************************************************************

 *

 * Copyright (C) 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at:

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 *

 *****************************************************************************

 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore

 */

#include <string.h>

#include <utils/Log.h>

#include <algorithm>

#include "gsmamr_enc.h"

// Constants for AMR-NB

const int32_t kNumInputSamples = L_FRAME;  // 160 samples

const int32_t kOutputBufferSize = 2 * kNumInputSamples * sizeof(Word16);

const Mode kModes[9] = {MR475, /* 4.75 kbps */

                        MR515, /* 5.15 kbps */

                        MR59,  /* 5.90 kbps */

                        MR67,  /* 6.70 kbps */

                        MR74,  /* 7.40 kbps */

                        MR795, /* 7.95 kbps */

                        MR102, /* 10.2 kbps */

                        MR122, /* 12.2 kbps */

                        MRDTX, /* DTX       */};

const Word16 kOutputFormat[3] = {AMR_TX_WMF, AMR_TX_IF2, AMR_TX_ETS};

class Codec {

   public:

    Codec() = default;

    ~Codec() { deInitEncoder(); }

    Word16 initEncoder(const uint8_t *data);

    void deInitEncoder();

    void encodeFrames(const uint8_t *data, size_t size);

   private:

    void *mEncState = nullptr;

    void *mSidState = nullptr;

};

Word16 Codec::initEncoder(const uint8_t *data) {

    return AMREncodeInit(&mEncState, &mSidState, (*data >> 1) & 0x01 /* dtx_enable flag */);

}

void Codec::deInitEncoder() {

    if (mEncState) {

        AMREncodeExit(&mEncState, &mSidState);

        mEncState = nullptr;

        mSidState = nullptr;

    }

}

void Codec::encodeFrames(const uint8_t *data, size_t size) {

    AMREncodeReset(mEncState, mSidState);

    uint8_t startByte = *data;

    int modeIndex = ((startByte >> 3) % 9);

    int outputFormatIndex = (startByte % 3);

    Mode mode = kModes[modeIndex];

    Word16 outputFormat = kOutputFormat[outputFormatIndex];

    // Consume startByte

    data++;

    size--;

    while (size > 0) {

        Frame_Type_3GPP frameType = (Frame_Type_3GPP)mode;

        Word16 inputBuf[kNumInputSamples] = {};

        int32_t minSize = std::min(size, sizeof(inputBuf));

        uint8_t outputBuf[kOutputBufferSize] = {};

        memcpy(inputBuf, data, minSize);

        AMREncode(mEncState, mSidState, mode, inputBuf, outputBuf, &frameType, outputFormat);

        data += minSize;

        size -= minSize;

    }

}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    if (size < 1) {

        return 0;

    }

    Codec *codec = new Codec();

    if (!codec) {

        return 0;

    }

    if (codec->initEncoder(data) == 0) {

        codec->encodeFrames(data, size);

    }

    delete codec;

    return 0;

}