Add FEC producer fuzzing and a unittest for one of the issues found.

webrtc/modules/rtp_rtcp/source/forward_error_correction.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include "webrtc/modules/rtp_rtcp/source/forward_error_correction.h"
 
-#include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include <algorithm>
 #include <iterator>
 
+#include "webrtc/base/checks.h"
 #include "webrtc/base/logging.h"
 #include "webrtc/modules/rtp_rtcp/include/rtp_rtcp_defines.h"
 #include "webrtc/modules/rtp_rtcp/source/byte_io.h"
 #include "webrtc/modules/rtp_rtcp/source/forward_error_correction_internal.h"
 
 namespace webrtc {
 
 // FEC header size in bytes.
 const uint8_t kFecHeaderSize = 10;
 
@@ skipping 75 matching lines @@
 //   |                     FEC Level 0 Payload                       |
 //   |                                                               |
 //   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 int32_t ForwardErrorCorrection::GenerateFEC(const PacketList& media_packet_list,
                                             uint8_t protection_factor,
                                             int num_important_packets,
                                             bool use_unequal_protection,
                                             FecMaskType fec_mask_type,
                                             PacketList* fec_packet_list) {
   const uint16_t num_media_packets = media_packet_list.size();
-
   // Sanity check arguments.
   assert(num_media_packets > 0);
   assert(num_important_packets >= 0 &&
          num_important_packets <= num_media_packets);
   assert(fec_packet_list->empty());
 
   if (num_media_packets > kMaxMediaPackets) {
     LOG(LS_WARNING) << "Can't protect " << num_media_packets
                     << " media packets per frame. Max is " << kMaxMediaPackets;
     return -1;
   }
 
   bool l_bit = (num_media_packets > 8 * kMaskSizeLBitClear);
-  int num_maskBytes = l_bit ? kMaskSizeLBitSet : kMaskSizeLBitClear;
+  int num_mask_bytes = l_bit ? kMaskSizeLBitSet : kMaskSizeLBitClear;
 
   // Do some error checking on the media packets.
   for (Packet* media_packet : media_packet_list) {
     assert(media_packet);
 
     if (media_packet->length < kRtpHeaderSize) {
       LOG(LS_WARNING) << "Media packet " << media_packet->length << " bytes "
                       << "is smaller than RTP header.";
       return -1;
     }
@@ skipping 19 matching lines @@
                                            // packets.
     fec_packet_list->push_back(&generated_fec_packets_[i]);
   }
 
   const internal::PacketMaskTable mask_table(fec_mask_type, num_media_packets);
 
   // -- Generate packet masks --
   // Always allocate space for a large mask.
   rtc::scoped_ptr<uint8_t[]> packet_mask(
       new uint8_t[num_fec_packets * kMaskSizeLBitSet]);
-  memset(packet_mask.get(), 0, num_fec_packets * num_maskBytes);
+  memset(packet_mask.get(), 0, num_fec_packets * num_mask_bytes);
   internal::GeneratePacketMasks(num_media_packets, num_fec_packets,
                                 num_important_packets, use_unequal_protection,
                                 mask_table, packet_mask.get());
 
   int num_mask_bits = InsertZerosInBitMasks(
-      media_packet_list, packet_mask.get(), num_maskBytes, num_fec_packets);
-
-  l_bit = (num_mask_bits > 8 * kMaskSizeLBitClear);
+      media_packet_list, packet_mask.get(), num_mask_bytes, num_fec_packets);
 
   if (num_mask_bits < 0) {
     return -1;
   }
+  l_bit = (num_mask_bits > 8 * kMaskSizeLBitClear);
   if (l_bit) {
-    num_maskBytes = kMaskSizeLBitSet;
+    num_mask_bytes = kMaskSizeLBitSet;
   }
 
   GenerateFecBitStrings(media_packet_list, packet_mask.get(), num_fec_packets,
                         l_bit);
   GenerateFecUlpHeaders(media_packet_list, packet_mask.get(), l_bit,
                         num_fec_packets);
 
   return 0;
 }
 
@@ skipping 11 matching lines @@
 
 void ForwardErrorCorrection::GenerateFecBitStrings(
     const PacketList& media_packet_list,
     uint8_t* packet_mask,
     int num_fec_packets,
     bool l_bit) {
   if (media_packet_list.empty()) {
     return;
   }
   uint8_t media_payload_length[2];
-  const int num_maskBytes = l_bit ? kMaskSizeLBitSet : kMaskSizeLBitClear;
+  const int num_mask_bytes = l_bit ? kMaskSizeLBitSet : kMaskSizeLBitClear;
   const uint16_t ulp_header_size =
       l_bit ? kUlpHeaderSizeLBitSet : kUlpHeaderSizeLBitClear;
   const uint16_t fec_rtp_offset =
       kFecHeaderSize + ulp_header_size - kRtpHeaderSize;
 
   for (int i = 0; i < num_fec_packets; ++i) {
     PacketList::const_iterator media_list_it = media_packet_list.begin();
-    uint32_t pkt_mask_idx = i * num_maskBytes;
+    uint32_t pkt_mask_idx = i * num_mask_bytes;
     uint32_t media_pkt_idx = 0;
     uint16_t fec_packet_length = 0;
     uint16_t prev_seq_num = ParseSequenceNumber((*media_list_it)->data);
     while (media_list_it != media_packet_list.end()) {
-      // Each FEC packet has a multiple byte mask.
+      // Each FEC packet has a multiple byte mask. Determine if this media
+      // packet should be included in FEC packet i.
       if (packet_mask[pkt_mask_idx] & (1 << (7 - media_pkt_idx))) {
         Packet* media_packet = *media_list_it;
 
         // Assign network-ordered media payload length.
         ByteWriter<uint16_t>::WriteBigEndian(
             media_payload_length, media_packet->length - kRtpHeaderSize);
 
         fec_packet_length = media_packet->length + fec_rtp_offset;
         // On the first protected packet, we don't need to XOR.
         if (generated_fec_packets_[i].length == 0) {
@@ skipping 33 matching lines @@
         if (fec_packet_length > generated_fec_packets_[i].length) {
           generated_fec_packets_[i].length = fec_packet_length;
         }
       }
       media_list_it++;
       if (media_list_it != media_packet_list.end()) {
         uint16_t seq_num = ParseSequenceNumber((*media_list_it)->data);
         media_pkt_idx += static_cast<uint16_t>(seq_num - prev_seq_num);
         prev_seq_num = seq_num;
       }
-      if (media_pkt_idx == 8) {
-        // Switch to the next mask byte.
-        media_pkt_idx = 0;
-        pkt_mask_idx++;
-      }
+      pkt_mask_idx += media_pkt_idx / 8;
+      media_pkt_idx %= 8;
     }
-    assert(generated_fec_packets_[i].length);
-    // Note: This shouldn't happen: means packet mask is wrong or poorly
-    // designed
+    RTC_DCHECK_GT(generated_fec_packets_[i].length, 0u)
+        << "Packet mask is wrong or poorly designed.";
   }
 }
 
 int ForwardErrorCorrection::InsertZerosInBitMasks(
     const PacketList& media_packets,
     uint8_t* packet_mask,
     int num_mask_bytes,
     int num_fec_packets) {
   uint8_t* new_mask = NULL;
   if (media_packets.size() <= 1) {
     return media_packets.size();
   }
   int last_seq_num = ParseSequenceNumber(media_packets.back()->data);
   int first_seq_num = ParseSequenceNumber(media_packets.front()->data);
   int total_missing_seq_nums =
       static_cast<uint16_t>(last_seq_num - first_seq_num) -
       media_packets.size() + 1;
   if (total_missing_seq_nums == 0) {
     // All sequence numbers are covered by the packet mask. No zero insertion
     // required.
     return media_packets.size();
   }
+  // We can only protect 8 * kMaskSizeLBitSet packets.
+  if (total_missing_seq_nums + media_packets.size() > 8 * kMaskSizeLBitSet)
+    return -1;
   // Allocate the new mask.
   int new_mask_bytes = kMaskSizeLBitClear;
   if (media_packets.size() + total_missing_seq_nums > 8 * kMaskSizeLBitClear) {
     new_mask_bytes = kMaskSizeLBitSet;
   }
   new_mask = new uint8_t[num_fec_packets * kMaskSizeLBitSet];
   memset(new_mask, 0, num_fec_packets * kMaskSizeLBitSet);
 
   PacketList::const_iterator it = media_packets.begin();
   uint16_t prev_seq_num = first_seq_num;
@@ skipping 91 matching lines @@
   //    0                   1                   2                   3
   //    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   //   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   //   |       Protection Length       |             mask              |
   //   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   //   |              mask cont. (present only when L = 1)             |
   //   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   PacketList::const_iterator media_list_it = media_packet_list.begin();
   Packet* media_packet = *media_list_it;
   assert(media_packet != NULL);
-  int num_maskBytes = l_bit ? kMaskSizeLBitSet : kMaskSizeLBitClear;
+  int num_mask_bytes = l_bit ? kMaskSizeLBitSet : kMaskSizeLBitClear;
   const uint16_t ulp_header_size =
       l_bit ? kUlpHeaderSizeLBitSet : kUlpHeaderSizeLBitClear;
 
   for (int i = 0; i < num_fec_packets; ++i) {
     // -- FEC header --
     generated_fec_packets_[i].data[0] &= 0x7f;  // Set E to zero.
     if (l_bit == 0) {
       generated_fec_packets_[i].data[0] &= 0xbf;  // Clear the L bit.
     } else {
       generated_fec_packets_[i].data[0] |= 0x40;  // Set the L bit.
     }
     // Two byte sequence number from first RTP packet to SN base.
     // We use the same sequence number base for every FEC packet,
     // but that's not required in general.
     memcpy(&generated_fec_packets_[i].data[2], &media_packet->data[2], 2);
 
     // -- ULP header --
     // Copy the payload size to the protection length field.
     // (We protect the entire packet.)
     ByteWriter<uint16_t>::WriteBigEndian(
         &generated_fec_packets_[i].data[10],
         generated_fec_packets_[i].length - kFecHeaderSize - ulp_header_size);
 
     // Copy the packet mask.
-    memcpy(&generated_fec_packets_[i].data[12], &packet_mask[i * num_maskBytes],
-           num_maskBytes);
+    memcpy(&generated_fec_packets_[i].data[12],
+           &packet_mask[i * num_mask_bytes], num_mask_bytes);
   }
 }
 
 void ForwardErrorCorrection::ResetState(
     RecoveredPacketList* recovered_packet_list) {
   fec_packet_received_ = false;
 
   // Free the memory for any existing recovered packets, if the user hasn't.
   while (!recovered_packet_list->empty()) {
     delete recovered_packet_list->front();
@@ skipping 391 matching lines @@
   }
   InsertPackets(received_packet_list, recovered_packet_list);
   AttemptRecover(recovered_packet_list);
   return 0;
 }
 
 size_t ForwardErrorCorrection::PacketOverhead() {
   return kFecHeaderSize + kUlpHeaderSizeLBitSet;
 }
 }  // namespace webrtc