1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 // Authors: corbin.souffrant@leviathansecurity.com
17 // dylan.katz@leviathansecurity.com
18
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include <media/stagefright/MediaBuffer.h>
21 #include <media/stagefright/SkipCutBuffer.h>
22 #include <media/stagefright/foundation/ABuffer.h>
23 #include <media/stagefright/foundation/AMessage.h>
24
25 namespace android {
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)26 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
27 FuzzedDataProvider fdp = FuzzedDataProvider(data, size);
28 size_t skip = fdp.ConsumeIntegral<size_t>();
29 size_t cut = fdp.ConsumeIntegral<size_t>();
30 size_t num16Channels = fdp.ConsumeIntegral<size_t>();
31 sp<SkipCutBuffer> sBuffer(new SkipCutBuffer(skip, cut, num16Channels));
32
33 while (fdp.remaining_bytes() > 0) {
34 // Cap size to 1024 to limit max amount allocated.
35 size_t buf_size = fdp.ConsumeIntegralInRange<size_t>(0, 1024);
36 size_t range = fdp.ConsumeIntegralInRange<size_t>(0, buf_size);
37 size_t length = fdp.ConsumeIntegralInRange<size_t>(0, buf_size - range);
38
39 switch (fdp.ConsumeIntegralInRange<uint8_t>(0, 4)) {
40 case 0: {
41 sp<ABuffer> a_buffer(new ABuffer(buf_size));
42 sp<AMessage> format(new AMessage);
43 sp<MediaCodecBuffer> s_buffer(new MediaCodecBuffer(format, a_buffer));
44 s_buffer->setRange(range, length);
45 sBuffer->submit(s_buffer);
46 break;
47 }
48 case 1: {
49 std::unique_ptr<MediaBufferBase> m_buffer(new MediaBuffer(buf_size));
50 m_buffer->set_range(range, length);
51 sBuffer->submit(reinterpret_cast<MediaBuffer *>(m_buffer.get()));
52 break;
53 }
54 case 2: {
55 sp<ABuffer> a_buffer(new ABuffer(buf_size));
56 sp<AMessage> format(new AMessage);
57 sp<MediaCodecBuffer> s_buffer(new MediaCodecBuffer(format, a_buffer));
58 a_buffer->setRange(range, length);
59 sBuffer->submit(a_buffer);
60 break;
61 }
62 case 3: {
63 sBuffer->clear();
64 break;
65 }
66 case 4: {
67 sBuffer->size();
68 }
69 }
70 }
71 return 0;
72 }
73 } // namespace android
74