diff --git a/fuzzing/fuzz_target.cc b/fuzzing/fuzz_target.cc index 2ca2018645d0bd49e5d96cd0d5064c8cfd1f3a7b..8c0f4179c6bac1ec5e96e58f1ebfab587f863352 100644 --- a/fuzzing/fuzz_target.cc +++ b/fuzzing/fuzz_target.cc @@ -12,6 +12,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { strm.bits_per_sample = (Data[0] & 0x1f) | 1; strm.block_size = 8 << (Data[1] & 3); strm.rsi = 2; + strm.flags = AEC_DATA_PREPROCESS; if (Data[1] & 0x80) strm.flags |= AEC_DATA_MSB; @@ -21,14 +22,21 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { strm.bits_per_sample > 16 && Data[1] & 0x10) strm.flags |= AEC_DATA_3BYTE; + + // Decode data + strm.next_in = (unsigned char *)(Data + 2); + strm.avail_in = Size - 2; + strm.next_out = dest; + strm.avail_out = (Size - 2) * 4; + aec_buffer_encode(&strm); + + // Encode data strm.next_in = (unsigned char *)(Data + 2); strm.avail_in = Size - 2; strm.next_out = dest; strm.avail_out = (Size - 2) * 4; - if (Data[1] & 0x20) - aec_buffer_encode(&strm); - else - aec_buffer_decode(&strm); + aec_buffer_decode(&strm); + free(dest); return 0; }