Add TransportFeedbackPacketLossTracker.

webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc

Index: webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
diff --git a/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc b/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..54cea2808587d48e547e744795d55f07d197db50
--- /dev/null
+++ b/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
@@ -0,0 +1,116 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "webrtc/base/array_view.h"
+#include "webrtc/modules/remote_bitrate_estimator/transport_feedback_packet_loss_tracker.h"
+#include "webrtc/modules/rtp_rtcp/source/byte_io.h"
+#include "webrtc/modules/rtp_rtcp/source/rtcp_packet/transport_feedback.h"
+
+namespace webrtc {
+
+namespace {
+
+using TransportFeedback = rtcp::TransportFeedback;
+
+class FuzzTransportFeedback : public TransportFeedback {

[stefan-webrtc, 2016/12/19 09:17:00]

Shouldn't it be possible to write this without inheritance? I think that would
be a lot cleaner as we then won't have to add virtual to the methods of
TransportFeedback just for this test.

[minyue-webrtc, 2016/12/19 10:21:55]

It will somewhat complicated. TransportFeedback has a Build method, but it has
its limitations  and can be hard to use in our unittest and our fuzzer test.
(and we don't need to test the logic of Build().) I don't think we want add any
other public methods.

Another idea is to create an abstract class for TransportFeedback. Then
TransportFeedback can be "final" and the new tests (old tests can also) can
inherit from the abstract class. WDYT?

[stefan-webrtc, 2016/12/20 12:13:41]

I see. So basically what you want is a mock/fake version of TransportFeedback?

Note that you'll probably test your class with more erroneous cases than what it
will see in practice since the real TransportFeedback already checks some of
these problems. This means we'll have checks for bitstream errors in two places.
That's a reason why it may be better to built real TransportFeedback objects.

If I would write a fuzzer I would have done something like this:

while (size > 0) {
  if (size < sizeof(uint16_t))
    return;
  size_t packet_length = ByteReader<uint16_t>(data);
  size -= packet_length;
  packet_length = std::min(packet_length, size);
  std::unique_ptr<TransportFeedback> feedback =
TransportFeedback::ParseFrom(data, packet_length);
  size -= packet_length;
  tracker.OnReceivedTransportFeedback(feedback);
}

+ public:
+  explicit FuzzTransportFeedback(rtc::ArrayView<const uint8_t> data)
+      : data_(data), ended_(false), data_idx_(0) {
+    ParseNextTransportFeedback();
+  }
+
+  uint16_t GetBaseSequence() const override { return base_seq_num_; }
+
+  std::vector<TransportFeedback::StatusSymbol> GetStatusVector()
+      const override {
+    return statuses_;
+  }
+
+  void ParseNextTransportFeedback() {
+    statuses_.clear();
+
+    if (!ReadData<uint16_t>(&base_seq_num_)) {
+      return;
+    }
+
+    uint16_t num_statuses = 0;
+    if (!ReadData<uint16_t>(&num_statuses))
+      return;
+
+    while (statuses_.size() < num_statuses) {
+      uint8_t status_byte = 0;
+      if (!ReadData<uint8_t>(&status_byte))
+        break;
+      // Each status byte contains 8 statuses.
+      for (size_t j = 0; j < 8; ++j) {
+        if (status_byte & 0x01) {
+          // |kReceivedSmallDelta| and |kReceivedLargeDelta| make no difference
+          // to TransportFeedbackPacketLossTracker. So we test only one case.
+          statuses_.push_back(
+              TransportFeedback::StatusSymbol::kReceivedSmallDelta);
+        } else {
+          statuses_.push_back(TransportFeedback::StatusSymbol::kNotReceived);
+        }
+        if (statuses_.size() >= num_statuses)
+          break;
+        status_byte >>= 1;
+      }
+    }
+  }
+
+  bool ended() const { return ended_; }
+
+ private:
+  template <typename T>
+  bool ReadData(T* value) {
+    RTC_DCHECK(!ended_);
+    if (data_idx_ + sizeof(T) > data_.size()) {
+      ended_ = true;
+      return false;
+    }
+    *value = ByteReader<T>::ReadBigEndian(&data_[data_idx_]);
+    data_idx_ += sizeof(T);
+    return true;
+  }
+
+  rtc::ArrayView<const uint8_t> data_;
+  bool ended_;
+  size_t data_idx_;
+  uint16_t base_seq_num_;
+  std::vector<TransportFeedback::StatusSymbol> statuses_;
+};
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size < sizeof(uint32_t)) {
+    return;
+  }
+  uint32_t dummy = ByteReader<uint32_t>::ReadBigEndian(data);
+  data += sizeof(uint32_t);
+  size -= sizeof(uint32_t);
+
+  size_t min_window_size = (dummy & 0x7FFF) + 1;
+  constexpr size_t kSeqNumHalf = 0x8000u;
+  size_t max_window_size =
+      std::min(kSeqNumHalf, min_window_size + ((dummy >> 16) & 0x7FFF));
+
+  TransportFeedbackPacketLossTracker tracker(min_window_size, max_window_size);
+  FuzzTransportFeedback feedback(rtc::ArrayView<const uint8_t>(data, size));
+  while (!feedback.ended()) {
+    tracker.OnReceivedTransportFeedback(feedback);
+    tracker.Validate();
+    feedback.ParseNextTransportFeedback();
+  }
+}
+
+}  // namespace webrtc