1 #include <stdlib.h> 2 #include <stddef.h> 3 #include <stdint.h> 4 #include <algorithm> 5 #include <audio_utils/limiter.h> 6 #include <system/audio-base.h> 7 #include <audio_utils/mono_blend.h> 8 #include <fuzzer/FuzzedDataProvider.h> 9 decideFormat(uint32_t num)10audio_format_t decideFormat(uint32_t num) { 11 12 switch (num % 3) { 13 case 0: 14 return AUDIO_FORMAT_PCM_16_BIT; // 1st switch case in mono_blend() 15 case 1: 16 return AUDIO_FORMAT_PCM_FLOAT; // 2nd switch case in mono_blend() 17 default: 18 return (audio_format_t) num; // default switch case in mono_blend() 19 } 20 21 } 22 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)23extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 24 25 /* Minimum size == 9 bytes 26 * 4 bytes: uint32_t audio_format_t 27 * 4 bytes: uint32_t channelCount 28 * 1 byte : bool limit 29 * Extra : float *buf 30 */ 31 32 if (data == nullptr || size < 9) { 33 return 0; 34 } 35 36 FuzzedDataProvider fuzzed_data(data, size); 37 38 // calculate size of buffer in floats 39 size_t samples = (size - 9) / sizeof(float); 40 41 // initialize the 5 parameters 42 float *buf = (float *) malloc(samples * sizeof(float)); 43 audio_format_t format = decideFormat(fuzzed_data.ConsumeIntegral<uint32_t>()); 44 size_t channelCount = samples / std::max(fuzzed_data.ConsumeIntegral<uint32_t>(), (uint32_t)1); 45 size_t frames = samples / std::max(channelCount, (size_t)1); 46 bool limit = fuzzed_data.ConsumeBool(); 47 48 // fill buffer with floats 49 for (size_t i = 0; i < frames * channelCount; ++i) { 50 buf[i] = fuzzed_data.ConsumeFloatingPoint<float>(); 51 } 52 53 mono_blend((void *) buf, format, channelCount, frames, limit); 54 55 free(buf); 56 return 0; 57 } 58