1
0
Fork 0
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
..
aec3-config-json-corpus
agc-corpus
audio_processing-corpus
dependency_descriptor-corpus
field_trial-corpus
mdns-corpus
pseudotcp-corpus
rtcp-corpus
rtp-corpus
rtp-depacketizer-av1-assemble-frame-corpus
rtpdump-corpus
sdp-corpus
string_to_number-corpus
stun-corpus
README
sdp.tokens
stun.tokens

README

This is a collection of corpora for various WebRTC fuzzers. To use
them, the gn targets define seed_corpus=$corpus_dir, which causes the
ClusterFuzz upload bot to bundle $corpus_dir and upload it.

The format is simple: one file per test case. Specific notes are
included below.

### SDP ###
This corpus was initially assembled manually from the following
sources:

  - curl --silent https://www.ietf.org/rfc/rfc4317.txt | grep '^[ a-z]*=[^=]*$' | sed 's/^[[:space:]]*//' | awk -v RS='(^|\n)v=' '/./ {print "v="$0 > NR".sdp"}'
  - all the SDPs used in the parser unit tests
  - some manually gathered SDPs from Firefox and Opera

The SDP tokens come from:

 -  grep "^static const " webrtc/api/webrtcsdp.cc | cut -d'=' -f2 | cut -d ';' -f1 | tr -d '"' | tr -d "'" | tr -d ' ' | sort -u | grep -v '^(\n|\r|\r\n)$|^$' | sed -e 's/^/"/' -e 's/$/"/' | tail -n +2

### STUN ###
This corpus was initially assembled from the STUN unit tests, together
with a crash that it found relatively quickly.

### RT(C)P ###
This corpus was initially assembled from the unittests. RTCP was
minimised first.

There is also rt(c?)p-corpus-with-extra-byte, in which each sample is
prefixed by the byte 0xff. Some of the rtp fuzzers need to decide
which header extensions to enable, and the first byte of the fuzz data
is used for this.

### PseudoTCP ###
Very small corpus minimised from the unit tests.