Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81747aa7 authored by Ayushi Khopkar's avatar Ayushi Khopkar
Browse files

Added g711alaw_dec_fuzzer and g711mlaw_dec_fuzzer

Test: ./g711alaw_dec_fuzzer
Test: ./g711mlaw_dec_fuzzer
Bug: 151599224

Change-Id: I14498bf388703eec92d883a60176717cbe55e0eb
parent cb778277
Loading
Loading
Loading
Loading
+44 −0
Original line number Diff line number Diff line
/******************************************************************************
 *
 * Copyright (C) 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 *****************************************************************************
 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
 */

cc_fuzz {
    name: "g711alaw_dec_fuzzer",
    host_supported: true,
    srcs: [
        "g711_dec_fuzzer.cpp",
    ],
    static_libs: [
        "codecs_g711dec",
    ],
    cflags: [
        "-DALAW",
    ],
}

cc_fuzz {
    name: "g711mlaw_dec_fuzzer",
    host_supported: true,
    srcs: [
        "g711_dec_fuzzer.cpp",
    ],
    static_libs: [
        "codecs_g711dec",
    ],
}
+49 −0
Original line number Diff line number Diff line
# Fuzzer for libstagefright_g711dec decoder

## Plugin Design Considerations
The fuzzer plugin for G711 is designed based on the understanding of the
codec and tries to achieve the following:

##### Maximize code coverage
G711 supports two types of decoding:
1. DecodeALaw
2. DecodeMLaw

These two decoder API's are fuzzed separately using g711alaw_dec_fuzzer and
g711mlaw_dec_fuzzer respectively.

##### Maximize utilization of input data
The plugin feeds the entire input data to the codec as expected by decoder API.

## Build

This describes steps to build g711alaw_dec_fuzzer and g711mlaw_dec_fuzzer binary.

### Android

#### Steps to build
Build the fuzzer
```
  $ mm -j$(nproc) g711alaw_dec_fuzzer
  $ mm -j$(nproc) g711mlaw_dec_fuzzer
```

#### Steps to run
Create a directory CORPUS_DIR and copy some g711 files to that folder
Push this directory to device.

To run on device
```
  $ adb sync data
  $ adb shell /data/fuzz/arm64/g711alaw_dec_fuzzer/g711alaw_dec_fuzzer CORPUS_DIR
  $ adb shell /data/fuzz/arm64/g711mlaw_dec_fuzzer/g711mlaw_dec_fuzzer CORPUS_DIR
```
To run on host
```
  $ $ANDROID_HOST_OUT/fuzz/x86_64/g711alaw_dec_fuzzer/g711alaw_dec_fuzzer CORPUS_DIR
  $ $ANDROID_HOST_OUT/fuzz/x86_64/g711mlaw_dec_fuzzer/g711mlaw_dec_fuzzer CORPUS_DIR
```

## References:
 * http://llvm.org/docs/LibFuzzer.html
 * https://github.com/google/oss-fuzz
+58 −0
Original line number Diff line number Diff line
/******************************************************************************
 *
 * Copyright (C) 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 *****************************************************************************
 * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
 */

#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include "g711Dec.h"

class Codec {
 public:
  Codec() = default;
  ~Codec() = default;
  void decodeFrames(const uint8_t *data, size_t size);
};

void Codec::decodeFrames(const uint8_t *data, size_t size) {
  size_t outputBufferSize = sizeof(int16_t) * size;
  int16_t *out = new int16_t[outputBufferSize];
  if (!out) {
    return;
  }
#ifdef ALAW
  DecodeALaw(out, data, size);
#else
  DecodeMLaw(out, data, size);
#endif
  delete[] out;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  if (size < 1) {
    return 0;
  }
  Codec *codec = new Codec();
  if (!codec) {
    return 0;
  }
  codec->decodeFrames(data, size);
  delete codec;
  return 0;
}