vp9_parser_encrypted_fuzzertest.cc 2.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stddef.h>
  5. #include <stdint.h>
  6. #include <fuzzer/FuzzedDataProvider.h>
  7. #include "base/logging.h"
  8. #include "base/numerics/safe_conversions.h"
  9. #include "media/base/decrypt_config.h"
  10. #include "media/base/subsample_entry.h"
  11. #include "media/filters/ivf_parser.h"
  12. #include "media/filters/vp9_parser.h"
  13. struct Environment {
  14. Environment() {
  15. // Disable noisy logging as per "libFuzzer in Chrome" documentation:
  16. // testing/libfuzzer/getting_started.md#Disable-noisy-error-message-logging.
  17. logging::SetMinLogLevel(logging::LOG_FATAL);
  18. }
  19. };
  20. Environment* env = new Environment();
  21. // Entry point for LibFuzzer.
  22. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  23. FuzzedDataProvider data_provider(data, size);
  24. std::string key_id = data_provider.ConsumeBytesAsString(4);
  25. std::string iv = data_provider.ConsumeBytesAsString(16);
  26. media::Vp9Parser vp9_parser(data_provider.ConsumeBool());
  27. uint8_t subsample_count_upper_bound = 8;
  28. uint8_t subsamples_count =
  29. data_provider.ConsumeIntegral<uint8_t>() % subsample_count_upper_bound;
  30. std::vector<media::SubsampleEntry> subsamples;
  31. for (uint8_t entry = 0; entry < subsamples_count; ++entry) {
  32. if (data_provider.remaining_bytes() >= 2 * sizeof(uint32_t)) {
  33. uint32_t clear = data_provider.ConsumeIntegral<uint32_t>();
  34. uint32_t cipher = data_provider.ConsumeIntegral<uint32_t>();
  35. cipher &= 0xFFFFFFF0; // make sure cipher is a multiple of 16.
  36. subsamples.push_back(media::SubsampleEntry(clear, cipher));
  37. }
  38. }
  39. const uint8_t* ivf_payload = nullptr;
  40. media::IvfParser ivf_parser;
  41. media::IvfFileHeader ivf_file_header;
  42. media::IvfFrameHeader ivf_frame_header;
  43. if (!ivf_parser.Initialize(data, size, &ivf_file_header))
  44. return 0;
  45. // Parse until the end of stream/unsupported stream/error in stream is found.
  46. while (ivf_parser.ParseNextFrame(&ivf_frame_header, &ivf_payload)) {
  47. media::Vp9FrameHeader vp9_frame_header;
  48. vp9_parser.SetStream(
  49. ivf_payload, ivf_frame_header.frame_size,
  50. media::DecryptConfig::CreateCencConfig(key_id, iv, subsamples));
  51. // TODO(kcwu): further fuzzing the case of Vp9Parser::kAwaitingRefresh.
  52. std::unique_ptr<media::DecryptConfig> null_config;
  53. gfx::Size allocate_size;
  54. while (vp9_parser.ParseNextFrame(&vp9_frame_header, &allocate_size,
  55. &null_config) == media::Vp9Parser::kOk) {
  56. // Repeat until all frames processed.
  57. }
  58. }
  59. return 0;
  60. }