565efa4f39
c9cdae001 fix(toxav): remove extra copy of video frame on encode 4f6d4546b test: Improve the fake network library. a2581e700 refactor(toxcore): generate `Friend_Request` and `Dht_Nodes_Response` 2aaa11770 refactor(toxcore): use Tox_Memory in generated events 5c367452b test(toxcore): fix incorrect mutex in tox_scenario_get_time 8f92e710f perf: Add a timed limit of number of cookie requests. 695b6417a test: Add some more simulated network support. 815ae9ce9 test(toxcore): fix thread-safety in scenario framework 6d85c754e test(toxcore): add unit tests for net_crypto 9c22e79cc test(support): add SimulatedEnvironment for deterministic testing f34fcb195 chore: Update windows Dockerfile to debian stable (trixie). ece0e8980 fix(group_moderation): allow validating unsorted sanction list signatures a4fa754d7 refactor: rename struct Packet to struct Net_Packet d6f330f85 cleanup: Fix some warnings from coverity. e206bffa2 fix(group_chats): fix sync packets reverting topics 0e4715598 test: Add new scenario testing framework. 668291f44 refactor(toxcore): decouple Network_Funcs from sockaddr via IP_Port fc4396cef fix: potential division by zero in toxav and unsafe hex parsing 8e8b352ab refactor: Add nullable annotations to struct members. 7740bb421 refactor: decouple net_crypto from DHT 1936d4296 test: add benchmark for toxav audio and video 46bfdc2df fix: correct printf format specifiers for unsigned integers REVERT: 1828c5356 fix(toxav): remove extra copy of video frame on encode git-subtree-dir: external/toxcore/c-toxcore git-subtree-split: c9cdae001341e701fca980c9bb9febfeb95d2902
85 lines
2.1 KiB
C++
85 lines
2.1 KiB
C++
#include "rtp.h"
|
|
|
|
#include <cstdlib>
|
|
#include <memory>
|
|
#include <vector>
|
|
|
|
#include "../testing/support/public/fuzz_data.hh"
|
|
#include "../toxcore/logger.h"
|
|
#include "../toxcore/mono_time.h"
|
|
#include "../toxcore/os_memory.h"
|
|
|
|
namespace {
|
|
|
|
using tox::test::Fuzz_Data;
|
|
|
|
struct MockSessionData { };
|
|
|
|
static int mock_send_packet(void * /*user_data*/, const uint8_t * /*data*/, uint16_t /*length*/)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static int mock_m_cb(const Mono_Time * /*mono_time*/, void * /*cs*/, RTPMessage *msg)
|
|
{
|
|
std::free(msg);
|
|
return 0;
|
|
}
|
|
|
|
void fuzz_rtp_receive(Fuzz_Data &input)
|
|
{
|
|
const Memory *mem = os_memory();
|
|
struct LoggerDeleter {
|
|
void operator()(Logger *l) { logger_kill(l); }
|
|
};
|
|
std::unique_ptr<Logger, LoggerDeleter> log(logger_new(mem));
|
|
|
|
auto time_cb = [](void *) -> uint64_t { return 0; };
|
|
struct MonoTimeDeleter {
|
|
const Memory *m;
|
|
void operator()(Mono_Time *t) { mono_time_free(m, t); }
|
|
};
|
|
std::unique_ptr<Mono_Time, MonoTimeDeleter> mono_time(
|
|
mono_time_new(mem, time_cb, nullptr), MonoTimeDeleter{mem});
|
|
|
|
MockSessionData sd;
|
|
|
|
CONSUME1_OR_RETURN(uint8_t, payload_type_byte, input);
|
|
int payload_type = (payload_type_byte % 2 == 0) ? RTP_TYPE_AUDIO : RTP_TYPE_VIDEO;
|
|
|
|
struct RtpSessionDeleter {
|
|
Logger *l;
|
|
void operator()(RTPSession *s) { rtp_kill(l, s); }
|
|
};
|
|
std::unique_ptr<RTPSession, RtpSessionDeleter> session(
|
|
rtp_new(log.get(), payload_type, mono_time.get(), mock_send_packet, &sd, nullptr, nullptr,
|
|
nullptr, &sd, mock_m_cb),
|
|
RtpSessionDeleter{log.get()});
|
|
|
|
while (!input.empty()) {
|
|
CONSUME1_OR_RETURN(uint16_t, len, input);
|
|
|
|
if (input.size() < len) {
|
|
len = input.size();
|
|
}
|
|
|
|
if (len == 0) {
|
|
break;
|
|
}
|
|
|
|
const uint8_t *pkt_data = input.consume(__func__, len);
|
|
rtp_receive_packet(session.get(), pkt_data, len);
|
|
}
|
|
}
|
|
|
|
} // namespace
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
|
|
{
|
|
Fuzz_Data input(data, size);
|
|
fuzz_rtp_receive(input);
|
|
return 0;
|
|
}
|