Add a fuzzer for FlexfecReceiver.

webrtc/test/fuzzers/flexfec_receiver_fuzzer.cc

Index: webrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
diff --git a/webrtc/test/fuzzers/flexfec_receiver_fuzzer.cc b/webrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..acffe2ca8c0a1a997ff3d5e50384b65a97bdc0c9
--- /dev/null
+++ b/webrtc/test/fuzzers/flexfec_receiver_fuzzer.cc
@@ -0,0 +1,69 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "webrtc/base/basictypes.h"
+#include "webrtc/modules/rtp_rtcp/include/rtp_rtcp_defines.h"
+#include "webrtc/modules/rtp_rtcp/include/flexfec_receiver.h"
+#include "webrtc/modules/rtp_rtcp/source/byte_io.h"
+
+namespace webrtc {
+
+namespace {
+class DummyCallback : public RecoveredPacketReceiver {
+  bool OnRecoveredPacket(const uint8_t* packet, size_t length) { return true; }
+};
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size < 12) {

[stefan-webrtc, 2016/10/05 14:48:26]

Make 12 a named constant. Or maybe we should randomize it to be 12 + X bytes to
make sure we handle rtp header extensions?

[brandtr, 2016/10/05 15:00:39]

Done.

The three literal 12's here signified different things. The first two 12's were
bytes needed to extract two SSRCs and two starting sequence numbers, whereas the
last 12 below was for the base RTP header size.

+    return;
+  }
+
+  uint32_t flexfec_ssrc;
+  memcpy(&flexfec_ssrc, data + 0, 4);
+  uint16_t flexfec_seq_num;
+  memcpy(&flexfec_seq_num, data + 4, 2);
+  uint32_t media_ssrc;
+  memcpy(&media_ssrc, data + 6, 4);
+  uint16_t media_seq_num;
+  memcpy(&media_seq_num, data + 10, 2);
+
+  DummyCallback callback;
+  std::unique_ptr<FlexfecReceiver> receiver =
+      FlexfecReceiver::Create(flexfec_ssrc, media_ssrc, &callback);
+
+  std::unique_ptr<uint8_t[]> packet;
+  size_t packet_length;
+  size_t i = 12;
+  while (i < size) {
+    packet_length = 12 + data[i++];  // RTP header plus payload.

[brandtr, 2016/10/05 15:00:39]

I add the minimum RTP header size here to eliminate the risk that the receiver
thinks that the received packet is truncated. The fuzzer would still work,
albeit less efficiently, without this 12 here.

+    packet = std::unique_ptr<uint8_t[]>(new uint8_t[packet_length]);
+    if (i + packet_length >= size) {
+      break;
+    }
+    memcpy(packet.get(), data + i, packet_length);
+    i += packet_length;
+    if (i < size && data[i++] % 2 == 0) {
+      // Simulate FlexFEC packet.
+      ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, flexfec_seq_num++);
+      ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, flexfec_ssrc);
+    } else {
+      // Simulate media packet.
+      ByteWriter<uint16_t>::WriteBigEndian(packet.get() + 2, media_seq_num++);
+      ByteWriter<uint32_t>::WriteBigEndian(packet.get() + 8, media_ssrc);
+    }
+    receiver->AddReceivedPacket(packet.get(), packet_length);
+  }
+  receiver->ProcessReceivedPackets();
+}
+
+}  // namespace webrtc