Add more fuzzing tests (#3422)

tests/fuzz/Makefile

@@ -1,3 +1,5 @@
+# Read Fuzzing.md located at the root of pjproject dir for build instructions
+
 #Modify this to point to the PJSIP location.
 PJBASE=../../
 
@@ -10,6 +12,10 @@ XML=fuzz-xml
 SDP=fuzz-sdp
 STUN=fuzz-stun
 SIP=fuzz-sip
+RTCP=fuzz-rtcp
+DNS=fuzz-dns
+H264=fuzz-h264
+VPX=fuzz-vpx
 
 EXTFLAGS=-Wall -Werror
 
@@ -21,12 +27,20 @@ $(TARGET):
 	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(SDP).c
 	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(STUN).c
 	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(SIP).c
+	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(RTCP).c
+	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(DNS).c
+	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(H264).c
+	$(CC) $(PJ_CFLAGS) $(EXTFLAGS) -c $(VPX).c
 
 	$(CXX) $(PJ_CFLAGS) -o $(JSON) $(JSON).o $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
 	$(CXX) $(PJ_CFLAGS) -o $(XML)  $(XML).o  $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
 	$(CXX) $(PJ_CFLAGS) -o $(SDP)  $(SDP).o  $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
 	$(CXX) $(PJ_CFLAGS) -o $(STUN) $(STUN).o $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
 	$(CXX) $(PJ_CFLAGS) -o $(SIP)  $(SIP).o  $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
+	$(CXX) $(PJ_CFLAGS) -o $(RTCP) $(RTCP).o $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
+	$(CXX) $(PJ_CFLAGS) -o $(DNS)  $(DNS).o  $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
+	$(CXX) $(PJ_CFLAGS) -o $(H264) $(H264).o $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
+	$(CXX) $(PJ_CFLAGS) -o $(VPX)  $(VPX).o  $(PJ_LDFLAGS) $(PJ_LDLIBS) $(LDFLAGS) $(LIB_FUZZING_ENGINE)
 
 clean:
-	rm $(JSON) $(XML) $(SDP) $(STUN) $(SIP) *.o
+	rm $(JSON) $(XML) $(SDP) $(STUN) $(SIP) $(RTCP) $(DNS) $(H264) ($VPX) *.o

tests/fuzz/fuzz-dns.c

@@ -0,0 +1,78 @@
+/* 
+ * Copyright (C) 2023 Teluu Inc. (http://www.teluu.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
+ */
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#include <pjlib.h>
+
+#include <pjlib-util/dns.h>
+
+#define kMinInputLength 10
+#define kMaxInputLength 5120
+
+pj_pool_factory *mem;
+
+int dns_parser(char *data, size_t size)
+{
+
+    int ret = 0;
+	pj_pool_t *pool;
+	pj_status_t status;
+    pj_dns_parsed_packet *dns;
+
+    pool = pj_pool_create(mem, "dns_test", 4000, 4000, NULL);
+
+    status = pj_dns_parse_packet(pool, data, size, &dns);
+    if (status != PJ_SUCCESS)
+        ret = 1;
+
+    pj_pool_release(pool);
+
+    return ret;
+}
+
+extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
+{
+    int ret = 0;
+    char *data;
+    pj_caching_pool caching_pool;
+
+    if (Size < kMinInputLength || Size > kMaxInputLength) {
+        return 1;
+    }
+
+    /* Add null termination for the data */
+    data = (char *)calloc((Size+1), sizeof(char));
+    memcpy((void *)data, (void *)Data, Size);
+
+    /* Init */
+    pj_init();
+    pj_caching_pool_init(&caching_pool, &pj_pool_factory_default_policy, 0);
+    pj_log_set_level(0);
+
+    mem = &caching_pool.factory;
+
+    /* Fuzz */
+    ret = dns_parser(data, Size);
+
+    free(data);
+    pj_caching_pool_destroy(&caching_pool);
+
+    return ret;
+}

tests/fuzz/fuzz-h264.c

@@ -0,0 +1,94 @@
+/* 
+ * Copyright (C) 2023 Teluu Inc. (http://www.teluu.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
+ */
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#include <pjlib.h>
+
+#include <pjmedia-codec/h264_packetizer.h>
+
+#define kMinInputLength 10
+#define kMaxInputLength 5120
+
+pj_pool_factory *mem;
+
+int h264_unpacketizer(const uint8_t *data, size_t size,
+                      uint8_t *output, size_t output_size)
+{
+
+    int ret = 0;
+	pj_pool_t *pool;
+	pj_status_t status;
+    pjmedia_h264_packetizer_cfg cfg;
+    pjmedia_h264_packetizer *pktz;
+    unsigned bits_pos = 0;
+
+    pool = pj_pool_create(mem, "h264_test", 1000, 1000, NULL);
+
+    pj_bzero(&cfg, sizeof(cfg));
+    cfg.mtu = 1500;
+    cfg.unpack_nal_start = 4;
+    cfg.mode = PJMEDIA_H264_PACKETIZER_MODE_NON_INTERLEAVED;
+
+    status = pjmedia_h264_packetizer_create(pool, &cfg, &pktz);
+
+    if (status == PJ_SUCCESS) {
+        status = pjmedia_h264_unpacketize(pktz, data, size, output,
+                                          output_size, &bits_pos);
+    }
+
+    pj_pool_release(pool);
+
+    return ret;
+}
+
+extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
+{
+    int ret = 0;
+    uint8_t *data;
+    uint8_t *output;
+    size_t output_size;
+    pj_caching_pool caching_pool;
+
+    if (Size < kMinInputLength || Size > kMaxInputLength) {
+        return 1;
+    }
+
+    /* Add null termination for the data */
+    data = (uint8_t *)calloc((Size+1), sizeof(uint8_t));
+    memcpy((void *)data, (void *)Data, Size);
+    output_size = Size + 32;
+    output = (uint8_t *)calloc(output_size, sizeof(uint8_t));
+
+    /* Init */
+    pj_init();
+    pj_caching_pool_init(&caching_pool, &pj_pool_factory_default_policy, 0);
+    pj_log_set_level(0);
+
+    mem = &caching_pool.factory;
+
+    /* Fuzz */
+    ret = h264_unpacketizer(data, Size, output, output_size);
+
+    free(data);
+    free(output);
+    pj_caching_pool_destroy(&caching_pool);
+
+    return ret;
+}

tests/fuzz/fuzz-rtcp.c

@@ -0,0 +1,75 @@
+/* 
+ * Copyright (C) 2023 Teluu Inc. (http://www.teluu.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
+ */
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#include <pjlib.h>
+
+#include <pjmedia/event.h>
+#include <pjmedia/rtcp.h>
+
+#define kMinInputLength 10
+#define kMaxInputLength 5120
+
+int rtcp_parser(char *data, size_t size)
+{
+
+    int ret = 0;
+    pjmedia_rtcp_session_setting setting;
+    pjmedia_rtcp_session session;
+
+    pjmedia_rtcp_session_setting_default(&setting);
+    pjmedia_rtcp_init2(&session, &setting);
+
+    pjmedia_rtcp_rx_rtcp(&session, data, size);
+
+    return ret;
+}
+
+extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
+{
+    char *data;
+    int ret = 0;
+    pj_caching_pool caching_pool;
+    pj_pool_t *pool;
+
+    if (Size < kMinInputLength || Size > kMaxInputLength) {
+        return 1;
+    }
+
+    /* Add null termination for the data */
+    data = (char *)calloc((Size+1), sizeof(char));
+    memcpy((void *)data, (void *)Data, Size);
+
+    /* Init */
+    pj_init();
+    pj_caching_pool_init(&caching_pool, &pj_pool_factory_default_policy, 0);
+    pool = pj_pool_create(&caching_pool.factory, "test", 1000, 1000, NULL);
+    pj_log_set_level(0);
+
+    pjmedia_event_mgr_create(pool, 0, NULL);
+
+    /* Fuzz */
+    ret = rtcp_parser(data, Size);
+
+    free(data);
+    pjmedia_event_mgr_destroy(pjmedia_event_mgr_instance());
+
+    return ret;
+}

tests/fuzz/fuzz-vpx.c

@@ -0,0 +1,84 @@
+/* 
+ * Copyright (C) 2023 Teluu Inc. (http://www.teluu.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
+ */
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#include <pjlib.h>
+
+#include <pjmedia-codec/vpx_packetizer.h>
+
+#define kMinInputLength 10
+#define kMaxInputLength 5120
+
+pj_pool_factory *mem;
+
+int vpx_unpacketizer(const uint8_t *data, size_t size)
+{
+
+    int ret = 0;
+	pj_pool_t *pool;
+	pj_status_t status;
+    pjmedia_vpx_packetizer_cfg cfg;
+    pjmedia_vpx_packetizer *pktz;
+    unsigned desc_len = 0;
+
+    pool = pj_pool_create(mem, "vpx_test", 1000, 1000, NULL);
+
+    pj_bzero(&cfg, sizeof(cfg));
+
+    status = pjmedia_vpx_packetizer_create(pool, &cfg, &pktz);
+
+    if (status == PJ_SUCCESS) {
+        status = pjmedia_vpx_unpacketize(pktz, data, size, &desc_len);
+    }
+
+    pj_pool_release(pool);
+
+    return ret;
+}
+
+extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
+{
+    int ret = 0;
+    uint8_t *data;
+    pj_caching_pool caching_pool;
+
+    if (Size < kMinInputLength || Size > kMaxInputLength) {
+        return 1;
+    }
+
+    /* Add null termination for the data */
+    data = (uint8_t *)calloc((Size+1), sizeof(uint8_t));
+    memcpy((void *)data, (void *)Data, Size);
+
+    /* Init */
+    pj_init();
+    pj_caching_pool_init(&caching_pool, &pj_pool_factory_default_policy, 0);
+    pj_log_set_level(0);
+
+    mem = &caching_pool.factory;
+
+    /* Fuzz */
+    ret = vpx_unpacketizer(data, Size);
+
+    free(data);
+    pj_caching_pool_destroy(&caching_pool);
+
+    return ret;
+}