1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
/*
* Copyright (c) 2022 The WebRTC project authors. All Rights Reserved.
*
* Use of this source code is governed by a BSD-style license
* that can be found in the LICENSE file in the root of the source
* tree. An additional intellectual property rights grant can be found
* in the file PATENTS. All contributing project authors may
* be found in the AUTHORS file in the root of the source tree.
*/
#include <algorithm>
#include <array>
#include <cstddef>
#include <cstdint>
#include <memory>
#include <string>
#include <utility>
#include "api/array_view.h"
#include "api/audio/audio_processing.h"
#include "api/audio/builtin_audio_processing_builder.h"
#include "api/environment/environment_factory.h"
#include "api/scoped_refptr.h"
#include "rtc_base/checks.h"
#include "test/fuzzers/fuzz_data_helper.h"
namespace webrtc {
namespace {
constexpr int kMaxNumChannels = 2;
// APM supported max rate is 384000 Hz, using a limit slightly above lets the
// fuzzer exercise the handling of too high rates.
constexpr int kMaxSampleRateHz = 400000;
constexpr int kMaxSamplesPerChannel = kMaxSampleRateHz / 100;
void GenerateFloatFrame(test::FuzzDataHelper& fuzz_data,
int input_rate,
int num_channels,
float* const* float_frames) {
const int samples_per_input_channel =
AudioProcessing::GetFrameSize(input_rate);
RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel);
for (int i = 0; i < num_channels; ++i) {
float channel_value;
fuzz_data.CopyTo<float>(&channel_value);
std::fill(float_frames[i], float_frames[i] + samples_per_input_channel,
channel_value);
}
}
void GenerateFixedFrame(test::FuzzDataHelper& fuzz_data,
int input_rate,
int num_channels,
int16_t* fixed_frames) {
const int samples_per_input_channel =
AudioProcessing::GetFrameSize(input_rate);
RTC_DCHECK_LE(samples_per_input_channel, kMaxSamplesPerChannel);
// Write interleaved samples.
for (int ch = 0; ch < num_channels; ++ch) {
const int16_t channel_value = fuzz_data.ReadOrDefaultValue<int16_t>(0);
for (int i = ch; i < samples_per_input_channel * num_channels;
i += num_channels) {
fixed_frames[i] = channel_value;
}
}
}
// No-op processor used to influence APM input/output pipeline decisions based
// on what submodules are present.
class NoopCustomProcessing : public CustomProcessing {
public:
NoopCustomProcessing() {}
~NoopCustomProcessing() override {}
void Initialize(int sample_rate_hz, int num_channels) override {}
void Process(AudioBuffer* audio) override {}
std::string ToString() const override { return ""; }
void SetRuntimeSetting(AudioProcessing::RuntimeSetting setting) override {}
};
} // namespace
// This fuzzer is directed at fuzzing unexpected input and output sample rates
// of APM. For example, the sample rate 22050 Hz is processed by APM in frames
// of floor(22050/100) = 220 samples. This is not exactly 10 ms of audio
// content, and may break assumptions commonly made on the APM frame size.
void FuzzOneInput(const uint8_t* data, size_t size) {
if (size > 100) {
return;
}
test::FuzzDataHelper fuzz_data(webrtc::ArrayView<const uint8_t>(data, size));
std::unique_ptr<CustomProcessing> capture_processor =
fuzz_data.ReadOrDefaultValue(true)
? std::make_unique<NoopCustomProcessing>()
: nullptr;
std::unique_ptr<CustomProcessing> render_processor =
fuzz_data.ReadOrDefaultValue(true)
? std::make_unique<NoopCustomProcessing>()
: nullptr;
scoped_refptr<AudioProcessing> apm =
BuiltinAudioProcessingBuilder()
.SetConfig({.pipeline = {.multi_channel_render = true,
.multi_channel_capture = true}})
.SetCapturePostProcessing(std::move(capture_processor))
.SetRenderPreProcessing(std::move(render_processor))
.Build(CreateEnvironment());
RTC_DCHECK(apm);
std::array<int16_t, kMaxSamplesPerChannel * kMaxNumChannels> fixed_frame;
std::array<std::array<float, kMaxSamplesPerChannel>, kMaxNumChannels>
float_frames;
std::array<float*, kMaxNumChannels> float_frame_ptrs;
for (int i = 0; i < kMaxNumChannels; ++i) {
float_frame_ptrs[i] = float_frames[i].data();
}
float* const* ptr_to_float_frames = &float_frame_ptrs[0];
// Choose whether to fuzz the float or int16_t interfaces of APM.
const bool is_float = fuzz_data.ReadOrDefaultValue(true);
// We may run out of fuzz data in the middle of a loop iteration. In
// that case, default values will be used for the rest of that
// iteration.
while (fuzz_data.CanReadBytes(1)) {
// Decide input/output rate for this iteration.
const int input_rate = static_cast<int>(
fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz);
const int output_rate = static_cast<int>(
fuzz_data.ReadOrDefaultValue<size_t>(8000) % kMaxSampleRateHz);
const int num_channels = fuzz_data.ReadOrDefaultValue(true) ? 2 : 1;
// Since render and capture calls have slightly different reinitialization
// procedures, we let the fuzzer choose the order.
const bool is_capture = fuzz_data.ReadOrDefaultValue(true);
int apm_return_code = AudioProcessing::Error::kNoError;
if (is_float) {
GenerateFloatFrame(fuzz_data, input_rate, num_channels,
ptr_to_float_frames);
if (is_capture) {
apm_return_code = apm->ProcessStream(
ptr_to_float_frames, StreamConfig(input_rate, num_channels),
StreamConfig(output_rate, num_channels), ptr_to_float_frames);
} else {
apm_return_code = apm->ProcessReverseStream(
ptr_to_float_frames, StreamConfig(input_rate, num_channels),
StreamConfig(output_rate, num_channels), ptr_to_float_frames);
}
} else {
GenerateFixedFrame(fuzz_data, input_rate, num_channels,
fixed_frame.data());
if (is_capture) {
apm_return_code = apm->ProcessStream(
fixed_frame.data(), StreamConfig(input_rate, num_channels),
StreamConfig(output_rate, num_channels), fixed_frame.data());
} else {
apm_return_code = apm->ProcessReverseStream(
fixed_frame.data(), StreamConfig(input_rate, num_channels),
StreamConfig(output_rate, num_channels), fixed_frame.data());
}
}
// APM may flag an error on unsupported audio formats, but should not crash.
RTC_DCHECK(apm_return_code == AudioProcessing::kNoError ||
apm_return_code == AudioProcessing::kBadSampleRateError);
}
}
} // namespace webrtc
|
