Add TransportFeedbackPacketLossTracker.

webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc

Index: webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
diff --git a/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc b/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..7774112842a0c605dc7ac54e73300d6c14f24aa5
--- /dev/null
+++ b/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
@@ -0,0 +1,117 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "webrtc/base/array_view.h"
+#include "webrtc/modules/rtp_rtcp/source/byte_io.h"
+#include "webrtc/modules/rtp_rtcp/source/rtcp_packet/transport_feedback.h"
+#include "webrtc/voice_engine/transport_feedback_packet_loss_tracker.h"
+
+namespace webrtc {
+
+namespace {
+
+using TransportFeedback = rtcp::TransportFeedback;
+
+class FuzzTransportFeedback : public TransportFeedback {
+ public:
+  explicit FuzzTransportFeedback(rtc::ArrayView<const uint8_t> data)
+      : data_(data), ended_(false), data_idx_(0) {
+    ParseNextTransportFeedback();
+  }
+
+  uint16_t GetBaseSequence() const override { return base_seq_num_; }
+
+  std::vector<TransportFeedback::StatusSymbol> GetStatusVector()
+      const override {
+    return statuses_;
+  }
+
+  void ParseNextTransportFeedback() {
+    statuses_.clear();
+
+    if (!ReadData<uint16_t>(&base_seq_num_)) {
+      return;
+    }
+
+    uint16_t num_statuses = 0;
+    if (!ReadData<uint16_t>(&num_statuses))
+      return;
+    num_statuses = (num_statuses & 0xFFFE) + 1;  // To make num_statuses > 1.

[stefan-webrtc, 2016/12/20 17:03:19]

I'd write this like this instead:
num_statuses = std::max(num_statuses, 1);

[minyue-webrtc, 2016/12/28 14:48:32]

sure.better to read although requires some casting.

+
+    while (statuses_.size() < num_statuses) {

[kwiberg-webrtc, 2016/12/22 02:31:41]

For simplicity, make the outer loop infinite, and rely on the exit check on line
64.

[minyue-webrtc, 2016/12/28 14:48:32]

yes, nice!

+      uint8_t status_byte = 0;
+      if (!ReadData<uint8_t>(&status_byte))
+        break;
+      // Each status byte contains 8 statuses.
+      for (size_t j = 0; j < 8; ++j) {
+        if (status_byte & 0x01) {
+          // |kReceivedSmallDelta| and |kReceivedLargeDelta| make no difference
+          // to TransportFeedbackPacketLossTracker. So we test only one case.
+          statuses_.push_back(
+              TransportFeedback::StatusSymbol::kReceivedSmallDelta);
+        } else {
+          statuses_.push_back(TransportFeedback::StatusSymbol::kNotReceived);
+        }
+        if (statuses_.size() >= num_statuses)
+          break;
+        status_byte >>= 1;
+      }
+    }
+  }
+
+  bool ended() const { return ended_; }
+
+ private:
+  template <typename T>
+  bool ReadData(T* value) {
+    RTC_DCHECK(!ended_);
+    if (data_idx_ + sizeof(T) > data_.size()) {
+      ended_ = true;
+      return false;
+    }
+    *value = ByteReader<T>::ReadBigEndian(&data_[data_idx_]);
+    data_idx_ += sizeof(T);
+    return true;
+  }
+
+  rtc::ArrayView<const uint8_t> data_;

[kwiberg-webrtc, 2016/12/22 02:31:41]

const?

[minyue-webrtc, 2016/12/28 14:48:32]

Done.

+  bool ended_;
+  size_t data_idx_;
+  uint16_t base_seq_num_;
+  std::vector<TransportFeedback::StatusSymbol> statuses_;
+};
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size < sizeof(uint32_t)) {
+    return;
+  }
+  uint32_t dummy = ByteReader<uint32_t>::ReadBigEndian(data);

[kwiberg-webrtc, 2016/12/22 02:31:41]

You're using this value below, so is it really a dummy? Also, it (and some more
variables below) could be const.

[minyue-webrtc, 2016/12/28 14:48:32]

not needed any longer.

+  data += sizeof(uint32_t);
+  size -= sizeof(uint32_t);
+
+  size_t min_window_size = (dummy & 0x7FFF) + 1;
+  constexpr size_t kSeqNumHalf = 0x8000u;
+  size_t max_window_size =
+      std::min(kSeqNumHalf, min_window_size + ((dummy >> 16) & 0x7FFF));

[kwiberg-webrtc, 2016/12/22 02:31:41]

OK, so min_window_size and max_window_size are two arbitrary numbers such that

  1 <= min_window_size <= max_window_size <= 0x8000

It took me two minutes to decode this, so a comment would be nice. Or maybe a
simpler implementation, like this one:

const size_t min_window_size =
    1 + (0x7fff & ByteReader<uint16_t>::ReadBigEndian(data));
data += sizeof(uint16_t);
const size_t max_window_size =
    1 + (0x7fff & ByteReader<uint16_t>::ReadBigEndian(data));
data += sizeof(uint16_t);
size += 2 * sizeof(uint16_t);
if (max_window_size < min_window_size)
  swap(min_window_size, max_window_size);

[minyue-webrtc, 2016/12/28 14:48:32]

Yes, I did your suggestion but with some changes.

[kwiberg-webrtc, 2017/01/05 02:51:11]

Acknowledged.

+
+  TransportFeedbackPacketLossTracker tracker(min_window_size, max_window_size);
+  FuzzTransportFeedback feedback(rtc::ArrayView<const uint8_t>(data, size));
+  while (!feedback.ended()) {
+    tracker.OnReceivedTransportFeedback(feedback);
+    tracker.Validate();
+    feedback.ParseNextTransportFeedback();
+  }
+}
+
+}  // namespace webrtc