1 // Copyright 2018 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
8 #include <fuzzer/FuzzedDataProvider.h>
10 #include "base/logging.h"
11 #include "base/numerics/safe_conversions.h"
13 #include "media/base/decrypt_config.h"
14 #include "media/base/subsample_entry.h"
15 #include "media/filters/ivf_parser.h"
16 #include "media/filters/vp9_parser.h"
20 // Disable noisy logging as per "libFuzzer in Chrome" documentation:
21 // testing/libfuzzer/getting_started.md#Disable-noisy-error-message-logging.
22 logging::SetMinLogLevel(logging::LOG_FATAL);
26 Environment* env = new Environment();
28 // Entry point for LibFuzzer.
29 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
30 FuzzedDataProvider data_provider(data, size);
31 std::string key_id = data_provider.ConsumeBytesAsString(4);
32 std::string iv = data_provider.ConsumeBytesAsString(16);
34 media::Vp9Parser vp9_parser(data_provider.ConsumeBool());
36 uint8_t subsample_count_upper_bound = 8;
37 uint8_t subsamples_count =
38 data_provider.ConsumeIntegral<uint8_t>() % subsample_count_upper_bound;
39 std::vector<media::SubsampleEntry> subsamples;
40 for (uint8_t entry = 0; entry < subsamples_count; ++entry) {
41 if (data_provider.remaining_bytes() >= 2 * sizeof(uint32_t)) {
42 uint32_t clear = data_provider.ConsumeIntegral<uint32_t>();
43 uint32_t cipher = data_provider.ConsumeIntegral<uint32_t>();
44 cipher &= 0xFFFFFFF0; // make sure cipher is a multiple of 16.
45 subsamples.push_back(media::SubsampleEntry(clear, cipher));
49 const uint8_t* ivf_payload = nullptr;
50 media::IvfParser ivf_parser;
51 media::IvfFileHeader ivf_file_header;
52 media::IvfFrameHeader ivf_frame_header;
54 if (!ivf_parser.Initialize(data, size, &ivf_file_header))
57 // Parse until the end of stream/unsupported stream/error in stream is found.
58 while (ivf_parser.ParseNextFrame(&ivf_frame_header, &ivf_payload)) {
59 media::Vp9FrameHeader vp9_frame_header;
61 ivf_payload, ivf_frame_header.frame_size,
62 media::DecryptConfig::CreateCencConfig(key_id, iv, subsamples));
63 // TODO(kcwu): further fuzzing the case of Vp9Parser::kAwaitingRefresh.
64 std::unique_ptr<media::DecryptConfig> null_config;
65 gfx::Size allocate_size;
66 while (vp9_parser.ParseNextFrame(&vp9_frame_header, &allocate_size,
67 &null_config) == media::Vp9Parser::kOk) {
68 // Repeat until all frames processed.