Add TransportFeedbackPacketLossTracker.

webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc

Index: webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
diff --git a/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc b/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..762813385632171397377dc6845808a22cc3495b
--- /dev/null
+++ b/webrtc/test/fuzzers/transport_feedback_packet_loss_tracker_fuzzer.cc
@@ -0,0 +1,146 @@
+/*
+ *  Copyright (c) 2016 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include <algorithm>
+
+#include "webrtc/base/array_view.h"
+#include "webrtc/modules/rtp_rtcp/source/byte_io.h"
+#include "webrtc/modules/rtp_rtcp/source/rtcp_packet/transport_feedback.h"
+#include "webrtc/voice_engine/transport_feedback_packet_loss_tracker.h"
+
+namespace webrtc {
+
+namespace {
+
+using TransportFeedback = rtcp::TransportFeedback;
+
+class FuzzTransportFeedback final : public rtcp::TransportFeedbackInterface {
+ public:
+  explicit FuzzTransportFeedback(rtc::ArrayView<const uint8_t> data)
+      : data_(data), ended_(false), data_idx_(0) {
+    ParseNextTransportFeedback();
+  }
+
+  uint16_t GetBaseSequence() const override { return base_seq_num_; }
+
+  std::vector<StatusSymbol> GetStatusVector() const override {
+    return statuses_;
+  }
+
+  void ParseNextTransportFeedback() {
+    statuses_.clear();
+
+    if (!ReadData<uint16_t>(&base_seq_num_)) {
+      return;
+    }
+
+    uint16_t num_statuses = 0;
+    if (!ReadData<uint16_t>(&num_statuses))
+      return;
+    num_statuses = std::max(num_statuses, static_cast<uint16_t>(1));

[kwiberg-webrtc, 2017/01/05 02:51:12]

I think you can skip the cast if you specify the template argument explicitly:

  num_statuses = std::max<uint16_t>(...);

[minyue-webrtc, 2017/01/19 10:57:55]

oh, sounds nice

+
+    while (true) {
+      uint8_t status_byte = 0;
+      if (!ReadData<uint8_t>(&status_byte))
+        break;

[kwiberg-webrtc, 2017/01/05 02:51:12]

Maybe say "return" here, for clarity? Your call.

[minyue-webrtc, 2017/01/19 10:57:55]

that is better.

+      // Each status byte contains 8 statuses.
+      for (size_t j = 0; j < 8; ++j) {
+        if (status_byte & 0x01) {
+          // |kReceivedSmallDelta| and |kReceivedLargeDelta| make no difference
+          // to TransportFeedbackPacketLossTracker. So we test only one case.
+          statuses_.push_back(
+              TransportFeedback::StatusSymbol::kReceivedSmallDelta);
+        } else {
+          statuses_.push_back(TransportFeedback::StatusSymbol::kNotReceived);
+        }
+        if (statuses_.size() >= num_statuses)
+          return;
+        status_byte >>= 1;
+      }
+    }
+  }
+
+  bool ended() const { return ended_; }
+
+  void SetBase(uint16_t base_sequence, int64_t ref_timestamp_us) override {
+    RTC_NOTREACHED();
+  }
+  void SetFeedbackSequenceNumber(uint8_t feedback_sequence) override {
+    RTC_NOTREACHED();
+  }
+  bool AddReceivedPacket(uint16_t sequence_number,
+                         int64_t timestamp_us) override {
+    RTC_NOTREACHED();
+    return false;
+  }
+  std::vector<int16_t> GetReceiveDeltas() const override {
+    RTC_NOTREACHED();
+    return std::vector<int16_t>();
+  }
+  int64_t GetBaseTimeUs() const override {
+    RTC_NOTREACHED();
+    return 0;
+  }
+  std::vector<int64_t> GetReceiveDeltasUs() const override {
+    RTC_NOTREACHED();
+    return std::vector<int64_t>();
+  }
+
+ private:
+  template <typename T>
+  bool ReadData(T* value) {
+    RTC_DCHECK(!ended_);
+    if (data_idx_ + sizeof(T) > data_.size()) {
+      ended_ = true;
+      return false;
+    }
+    *value = ByteReader<T>::ReadBigEndian(&data_[data_idx_]);
+    data_idx_ += sizeof(T);
+    return true;
+  }
+
+  const rtc::ArrayView<const uint8_t> data_;
+  bool ended_;
+  size_t data_idx_;
+  uint16_t base_seq_num_;
+  std::vector<TransportFeedback::StatusSymbol> statuses_;
+};
+
+}  // namespace
+
+void FuzzOneInput(const uint8_t* data, size_t size) {
+  if (size < sizeof(uint32_t)) {
+    return;
+  }
+  constexpr size_t kSeqNumHalf = 0x8000u;
+  const size_t window_size_1 = std::min(
+      kSeqNumHalf,
+      static_cast<size_t>(std::max(static_cast<uint16_t>(1),

[kwiberg-webrtc, 2017/01/05 02:51:12]

Specify template argument explicitly and avoid cast?

[minyue-webrtc, 2017/01/19 10:57:55]

Done.

+                                   ByteReader<uint16_t>::ReadBigEndian(data))));
+  data += sizeof(uint16_t);
+  const size_t window_size_2 = std::min(
+      kSeqNumHalf,
+      static_cast<size_t>(std::max(static_cast<uint16_t>(1),

[kwiberg-webrtc, 2017/01/05 02:51:12]

Here too?

[minyue-webrtc, 2017/01/19 10:57:55]

Done.

+                                   ByteReader<uint16_t>::ReadBigEndian(data))));
+  data += sizeof(uint16_t);
+  size -= 2 * sizeof(uint16_t);
+
+  TransportFeedbackPacketLossTracker tracker(
+      std::min(window_size_1, window_size_2),
+      std::max(window_size_1, window_size_2));
+  FuzzTransportFeedback feedback(rtc::ArrayView<const uint8_t>(data, size));
+  while (!feedback.ended()) {
+    tracker.OnReceivedTransportFeedback(feedback);
+    tracker.Validate();
+    feedback.ParseNextTransportFeedback();
+  }
+}
+
+}  // namespace webrtc