Merge "Fuzzing: add LC3 decoder fuzzer" (11a55ace) · Commits · e / os / android_packages_modules_Bluetooth

system/embdrv/lc3/Android.bp

+2 −1

Original line number	Diff line number	Diff line
		@@ -51,10 +51,11 @@ cc_fuzz {
		name: "liblc3_fuzzer",

		srcs: [
		"fuzzer/liblc3encoder_fuzzer.cpp",
		"fuzzer/liblc3_fuzzer.cpp",
		],

		static_libs: [
		"liblc3",
		],
		}

system/embdrv/lc3/fuzzer/liblc3encoder_fuzzer.cpp→system/embdrv/lc3/fuzzer/liblc3_fuzzer.cpp

+45 −8

Original line number	Diff line number	Diff line
		@@ -17,18 +17,16 @@

		#include "include/lc3.h"


		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		FuzzedDataProvider fdp(data, size);

		void TestEncoder(FuzzedDataProvider& fdp) {
		int dt_us = fdp.PickValueInArray({10000, 7500});
		int sr_hz = fdp.PickValueInArray({8000, 16000, 24000, 32000, /44100,/ 48000});
		int sr_hz =
		fdp.PickValueInArray({8000, 16000, 24000, 32000, /44100,/ 48000});
		unsigned enc_size = lc3_encoder_size(dt_us, sr_hz);
		uint16_t output_byte_count = fdp.ConsumeIntegralInRange(20, 400);
		uint16_t num_frames = lc3_frame_samples(dt_us, sr_hz);

		if (fdp.remaining_bytes() < num_frames * 2) {
		return 0;
		return;
		}

		std::vector<uint16_t> input_frames(num_frames);
		@@ -41,10 +39,49 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		lc3_setup_encoder(dt_us, sr_hz, 0, lc3_encoder_mem);

		std::vector<uint8_t> output(output_byte_count);
		lc3_encode(lc3_encoder, (const int16_t*)input_frames.data(), 1,
		output.size(), output.data());
		lc3_encode(lc3_encoder, (const int16_t*)input_frames.data(), 1, output.size(),
		output.data());

		free(lc3_encoder_mem);
		lc3_encoder_mem = nullptr;
		return;
		}

		void TestDecoder(FuzzedDataProvider& fdp) {
		int dt_us = fdp.PickValueInArray({10000, 7500});
		int sr_hz =
		fdp.PickValueInArray({8000, 16000, 24000, 32000, /44100,/ 48000});
		unsigned dec_size = lc3_decoder_size(dt_us, sr_hz);
		uint16_t input_byte_count = fdp.ConsumeIntegralInRange(20, 400);
		uint16_t num_frames = lc3_frame_samples(dt_us, sr_hz);

		if (fdp.remaining_bytes() < input_byte_count) {
		return;
		}

		std::vector<uint8_t> input(input_byte_count);
		fdp.ConsumeData(input.data(), input.size());

		void* lc3_decoder_mem = nullptr;
		lc3_decoder_mem = malloc(dec_size);
		lc3_decoder_t lc3_decoder =
		lc3_setup_decoder(dt_us, sr_hz, 0, lc3_decoder_mem);

		std::vector<uint16_t> output(num_frames);
		lc3_decode(lc3_decoder, input.data(), input.size(), (int16_t*)output.data(),
		1);

		/* Empty input performs PLC (packet loss concealment) */
		lc3_decode(lc3_decoder, nullptr, 0, (int16_t*)output.data(), 1);

		free(lc3_decoder_mem);
		lc3_decoder_mem = nullptr;
		return;
		}

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		FuzzedDataProvider fdp(data, size);
		TestEncoder(fdp);
		TestDecoder(fdp);
		return 0;
		}
		No newline at end of file