Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 990ac03f authored by Kevin Deus's avatar Kevin Deus
Browse files

Adding a corpus that should get the fuzzer deeper into the code. 

Also break out some of the fuzz values into variables so they're
easier to debug.

Test: Manually ran the fuzzer and verified it reaches more code.
Change-Id: I973b1a44719295c390ecbca8fd356ccf8b3c142d
parent 2245fb2c

media/libstagefright/tests/fuzzers/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -74,6 +74,7 @@ cc_fuzz { 
    srcs: [

        "FrameDecoderFuzzer.cpp",

    ],

    corpus: ["corpus/*"],

    defaults: ["libstagefright_fuzzer_defaults"],

}

media/libstagefright/tests/fuzzers/FrameDecoderFuzzer.cpp

+8 −5
Original line number Diff line number Diff line
@@ -46,12 +46,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 
    }



    while (fdp.remaining_bytes()) {

        switch (fdp.ConsumeIntegralInRange<uint8_t>(0, 3)) {

            case 0:

                decoder->init(/*frameTimeUs*/ fdp.ConsumeIntegral<int64_t>(),

                              /*option*/ fdp.ConsumeIntegral<int>(),

                              /*colorFormat*/ fdp.ConsumeIntegral<int>());

        uint8_t switchCase = fdp.ConsumeIntegralInRange<uint8_t>(0, 3);

        switch (switchCase) {

            case 0: {

                int64_t frameTimeUs = fdp.ConsumeIntegral<int64_t>();

                int option = fdp.ConsumeIntegral<int>();

                int colorFormat = fdp.ConsumeIntegral<int>();

                decoder->init(frameTimeUs, option, colorFormat);

                break;

            }

            case 1:

                decoder->extractFrame();

                break;

media/libstagefright/tests/fuzzers/corpus/color_format_rgb_565.dat

0 → 100644
+385 B

File added.

No diff preview for this file type.

View file