WebCodecs: Fuzzing AudioDecoder

Bug: 1120745 Change-Id: Idd2721941fee38a3ad4c6beb30ed1b39ff7759c9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2368284Reviewed-by: Jeremy Roman <jbroman@chromium.org> Reviewed-by: Thomas Guilbert <tguilbert@chromium.org> Commit-Queue: Chrome Cunningham <chcunningham@chromium.org> Auto-Submit: Chrome Cunningham <chcunningham@chromium.org> Cr-Commit-Position: refs/heads/master@{#800800}

WebCodecs: Fuzzing AudioDecoder
Bug: 1120745 Change-Id: Idd2721941fee38a3ad4c6beb30ed1b39ff7759c9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2368284Reviewed-by: Jeremy Roman <jbroman@chromium.org> Reviewed-by: Thomas Guilbert <tguilbert@chromium.org> Commit-Queue: Chrome Cunningham <chcunningham@chromium.org> Auto-Submit: Chrome Cunningham <chcunningham@chromium.org> Cr-Commit-Position: refs/heads/master@{#800800}
80429ef7 · Chris Cunningham · Commit Bot · 4a53be96 · 80429ef7 · 80429ef7
Commit 80429ef7 authored Aug 22, 2020 by Chris Cunningham Committed by Commit Bot Aug 22, 2020
9 changed files
--- a/third_party/blink/renderer/modules/BUILD.gn
+++ b/third_party/blink/renderer/modules/BUILD.gn
@@ -572,4 +572,22 @@ if (use_libfuzzer) {
      "//third_party/protobuf:protobuf_lite",
    ]
  }
+
+  fuzzer_test("webcodecs_audio_decoder_fuzzer") {
+    sources = [
+      "webcodecs/audio_decoder_fuzzer.cc",
+      "webcodecs/fuzzer_utils.cc",
+      "webcodecs/fuzzer_utils.h",
+    ]
+
+    seed_corpus = "webcodecs/fuzzer_seed_corpus/audio_decoder"
+
+    deps = [
+      ":modules",
+      "//third_party/blink/renderer/modules/webcodecs:fuzzer_protos",
+      "//third_party/blink/renderer/platform:blink_fuzzer_test_support",
+      "//third_party/libprotobuf-mutator",
+      "//third_party/protobuf:protobuf_lite",
+    ]
+  }
 }
--- a/third_party/blink/renderer/modules/DEPS
+++ b/third_party/blink/renderer/modules/DEPS
@@ -27,6 +27,10 @@ specific_include_rules = {
        "+testing/libfuzzer/proto/lpm_interface.h",
        "+third_party/protobuf/src/google/protobuf/repeated_field.h",
    ],
+    "audio_decoder_fuzzer.cc": [
+        "+base/run_loop.h",
+        "+testing/libfuzzer/proto/lpm_interface.h",
+    ],
    "video_decoder_fuzzer.cc": [
        "+base/run_loop.h",
        "+testing/libfuzzer/proto/lpm_interface.h",

--- a/third_party/blink/renderer/modules/webcodecs/audio_decoder_fuzzer.cc
+++ b/third_party/blink/renderer/modules/webcodecs/audio_decoder_fuzzer.cc
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/run_loop.h"
+#include "testing/libfuzzer/proto/lpm_interface.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_audio_decoder_init.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_audio_frame_output_callback.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_encoded_audio_config.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_web_codecs_error_callback.h"
+#include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/core/frame/settings.h"
+#include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/modules/webcodecs/audio_decoder.h"
+#include "third_party/blink/renderer/modules/webcodecs/encoded_audio_chunk.h"
+#include "third_party/blink/renderer/modules/webcodecs/fuzzer_inputs.pb.h"
+#include "third_party/blink/renderer/modules/webcodecs/fuzzer_utils.h"
+#include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/bindings/script_state.h"
+#include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
+#include "third_party/blink/renderer/platform/heap/persistent.h"
+#include "third_party/blink/renderer/platform/testing/blink_fuzzer_test_support.h"
+#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
+#include "third_party/blink/renderer/platform/wtf/vector.h"
+
+#include <string>
+
+namespace blink {
+
+DEFINE_TEXT_PROTO_FUZZER(
+    const wc_fuzzer::AudioDecoderApiInvocationSequence& proto) {
+  static BlinkFuzzerTestSupport test_support = BlinkFuzzerTestSupport();
+  static DummyPageHolder* page_holder = []() {
+    auto page_holder = std::make_unique<DummyPageHolder>();
+    page_holder->GetFrame().GetSettings()->SetScriptEnabled(true);
+    return page_holder.release();
+  }();
+
+  //
+  // NOTE: GC objects that need to survive iterations of the loop below
+  // must be Persistent<>!
+  //
+  // GC may be triggered by the RunLoop().RunUntilIdle() below, which will GC
+  // raw pointers on the stack. This is not required in production code because
+  // GC typically runs at the top of the stack, or is conservative enough to
+  // keep stack pointers alive.
+  //
+
+  // Scoping Persistent<> refs so GC can collect these at the end.
+  {
+    Persistent<ScriptState> script_state =
+        ToScriptStateForMainWorld(&page_holder->GetFrame());
+    ScriptState::Scope scope(script_state);
+
+    Persistent<FakeFunction> error_function =
+        FakeFunction::Create(script_state, "error");
+    Persistent<V8WebCodecsErrorCallback> error_callback =
+        V8WebCodecsErrorCallback::Create(error_function->Bind());
+    Persistent<FakeFunction> output_function =
+        FakeFunction::Create(script_state, "output");
+    Persistent<V8AudioFrameOutputCallback> output_callback =
+        V8AudioFrameOutputCallback::Create(output_function->Bind());
+
+    Persistent<AudioDecoderInit> audio_decoder_init =
+        MakeGarbageCollected<AudioDecoderInit>();
+    audio_decoder_init->setError(error_callback);
+    audio_decoder_init->setOutput(output_callback);
+
+    Persistent<AudioDecoder> audio_decoder = AudioDecoder::Create(
+        script_state, audio_decoder_init, IGNORE_EXCEPTION_FOR_TESTING);
+
+    for (auto& invocation : proto.invocations()) {
+      switch (invocation.Api_case()) {
+        case wc_fuzzer::AudioDecoderApiInvocation::kConfigure:
+          audio_decoder->configure(
+              MakeAudioDecoderConfig(invocation.configure()),
+              IGNORE_EXCEPTION_FOR_TESTING);
+          break;
+        case wc_fuzzer::AudioDecoderApiInvocation::kDecode:
+          audio_decoder->decode(
+              MakeEncodedAudioChunk(invocation.decode().chunk()),
+              IGNORE_EXCEPTION_FOR_TESTING);
+          break;
+        case wc_fuzzer::AudioDecoderApiInvocation::kFlush: {
+          // TODO(https://crbug.com/1119253): Fuzz whether to await resolution
+          // of the flush promise.
+          audio_decoder->flush(IGNORE_EXCEPTION_FOR_TESTING);
+          break;
+        }
+        case wc_fuzzer::AudioDecoderApiInvocation::kReset:
+          audio_decoder->reset(IGNORE_EXCEPTION_FOR_TESTING);
+          break;
+        case wc_fuzzer::AudioDecoderApiInvocation::kClose:
+          audio_decoder->close(IGNORE_EXCEPTION_FOR_TESTING);
+          break;
+        case wc_fuzzer::AudioDecoderApiInvocation::API_NOT_SET:
+          break;
+      }
+
+      // Give other tasks a chance to run (e.g. calling our output callback).
+      base::RunLoop().RunUntilIdle();
+    }
+  }
+
+  // Request a V8 GC. Oilpan will be invoked by the GC epilogue.
+  //
+  // Multiple GCs may be required to ensure everything is collected (due to
+  // a chain of persistent handles), so some objects may not be collected until
+  // a subsequent iteration. This is slow enough as is, so we compromise on one
+  // major GC, as opposed to the 5 used in V8GCController for unit tests.
+  V8PerIsolateData::MainThreadIsolate()->RequestGarbageCollectionForTesting(
+      v8::Isolate::kFullGarbageCollection);
+}
+
+}  // namespace blink
--- a/third_party/blink/renderer/modules/webcodecs/fuzzer_inputs.proto
+++ b/third_party/blink/renderer/modules/webcodecs/fuzzer_inputs.proto
@@ -13,12 +13,24 @@ message ConfigureVideoDecoder {
  optional bytes description = 2;
 }

+message ConfigureAudioDecoder {
+  // String describing codec (e.g. "opus")
+  optional string codec = 1;
+
+  optional uint32 sample_rate = 2;
+
+  optional uint32 number_of_channels = 3;
+
+  optional bytes description = 4;
+}
+
+enum EncodedChunkType {
+  KEY = 0;
+  DELTA = 1;
+}
+
 message EncodedVideoChunk {
-  enum EncodedVideoChunkType {
-    KEY = 0;
-    DELTA = 1;
-  }
-  optional EncodedVideoChunkType type = 1;
+  optional EncodedChunkType type = 1;

  optional uint64 timestamp = 2;

@@ -27,10 +39,22 @@ message EncodedVideoChunk {
  optional bytes data = 4;
 }

+message EncodedAudioChunk {
+  optional EncodedChunkType type = 1;
+
+  optional uint64 timestamp = 2;
+
+  optional bytes data = 4;
+}
+
 message DecodeVideo {
  optional EncodedVideoChunk chunk = 1;
 }

+message DecodeAudio {
+  optional EncodedAudioChunk chunk = 1;
+}
+
 message Flush {
  optional bool wait_for_promise = 1;
 }
@@ -52,3 +76,17 @@ message VideoDecoderApiInvocation {
 message VideoDecoderApiInvocationSequence {
  repeated VideoDecoderApiInvocation invocations = 1;
 }
+
+message AudioDecoderApiInvocation {
+  oneof Api {
+    ConfigureAudioDecoder configure = 1;
+    DecodeAudio decode = 2;
+    Flush flush = 3;
+    Reset reset = 4;
+    Close close = 5;
+  }
+}
+
+message AudioDecoderApiInvocationSequence {
+  repeated AudioDecoderApiInvocation invocations = 1;
+}
--- a/third_party/blink/renderer/modules/webcodecs/fuzzer_seed_corpus/audio_decoder/decode_aac.textproto
+++ b/third_party/blink/renderer/modules/webcodecs/fuzzer_seed_corpus/audio_decoder/decode_aac.textproto
+# Simulates reasonable usage of AudioDecoder
+#  configure(aac)
+#  decode() 2 real frames
+#  flush(), reset(), re configure(aac)
+#  decode() a 3rd real frame
+#  close()
+
+invocations: [
+  {
+    configure {
+      codec: 'mp4a.40.2',
+      sample_rate: 44100,
+      number_of_channels: 2
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 0,
+
+        # aac-44100-packet-0
+        data: "\377\361P\200.\177\374!\000\005\000\240\033\377\300\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\243\200\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000{"
+      }
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 23222,
+        
+        # aac-44100-packet-1
+        data: "\377\361P\200.\237\374!\020\005\000\240\033\377\300\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\244\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000w"
+      }
+    }
+  },
+  {
+    flush {}
+  },
+  {
+    reset {}
+  },
+  {
+    configure {
+      codec: 'mp4a.40.2',
+      sample_rate: 44100,
+      number_of_channels: 2
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 46444,
+        
+        # aac-44100-packet-3
+        data: "\377\361P\200.\237\374!\020\005\000\240\033\377\300\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\244\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000u"
+      }
+    }
+  },
+  {
+    close {}
+  }
+]
\ No newline at end of file
--- a/third_party/blink/renderer/modules/webcodecs/fuzzer_seed_corpus/audio_decoder/decode_vorbis.textproto
+++ b/third_party/blink/renderer/modules/webcodecs/fuzzer_seed_corpus/audio_decoder/decode_vorbis.textproto
+# Simulates reasonable usage of AudioDecoder
+#  configure(vorbis)
+#  decode() 4 real frames
+#  flush()
+#  close()
+
+invocations: [
+  {
+    configure {
+      codec: 'vorbis',
+      sample_rate: 44100,
+      number_of_channels: 2
+
+      # vorbis-extradata
+      description: "\002\036-\001vorbis\000\000\000\000\002D\254\000\000\377\377\377\377\000\372\000\000\377\377\377\377\270\001\003vorbis\035\000\000\000Xiph.Org libVorbis I 20070622\000\000\000\000\001\005vorbis!BCV\001\000\000\001\000\030cT)F\231R\322J\211\031s\2241F\231b\222J\211\245\204\026BH\235s\024S\2519\327\234k\254\271\265 \204\020\032SP)\005\231R\216Ri\031c\220)\005\231R\020KI%t\022:\'\235c\020[I\301\326\230k\213A\266\034\204\r\232RL)\304\224R\212B\010\031S\214)\305\224RJB\007%t\016:\346\034S\216J(A\270\234s\253\265\226\226c\213\251t\222J\347$dLBH)\205\222J\007\245SNBH5\226\326R)\035sRRjA\350 \204\020B\266 \204\r\202\320\220U\000\000\001\000\300@\020\032\262\n\000P\000\000\020\212\241\030\212\002\204\206\254\002\0002\000\000\004\240(\216\342(\216#9\222cI\026\020\032\262\n\000\000\002\000\020\000\000\300p\024I\221\024\311\261$K\322,K\323DQU}\3256UU\366u]\327u]\327u 4d\025\000\000\001\000@H\247\231\245\032 \302\014d\030\010\rY\005\000 \000\000\000F(\302\020\003BCV\001\000\000\001\000\000b(9\210&\264\346|s\216\203f9h*\305\346tp\"\325\346In*\346\346\234s\3169\'\233s\3068\347\234s\212rf1h&\264\346\234s\022\203f)h&\264\346\234s\236\304\346Ak\252\264\346\234s\3069\247\203qF\030\347\234s\232\264\346Aj6\326\346\234s\026\264\2469j.\305\346\234s\"\345\346Im.\325\346\234s\3169\347\234s\3169\347\234s\252\027\247spN8\347\234s\242\366\346ZnB\027\347\234s>\031\247{sB8\347\234s\3169\347\234s\3169\347\234s\202\320\220U\000\000\020\000\000A\0306\206q\247 H\237\243\201\030E\210i\310\244\007\335\243\303$h\014r\n\251G\243\243\221R\352 \224T\306I)\235 4d\025\000\000\010\000\000!\204\024RH!\205\024RH!\205\024R\210!\206\030b\310)\247\234\202\n*\251\244\242\2122\312,\263\3142\313,\263\3142\353\260\263\316:\3540\304\020C\014\255\264\022KM\265\325Xc\255\271\347\234k\016\322Zi\255\265\326J)\245\224RJ)\010\rY\005\000\200\000\000\020\010\031d\220AF!\205\024R\210!\246\234r\312)\250\240\002BCV\001\000\200\000\000\002\000\000\000<\311sDGtDGtDGtDGtD\307s<G\224DI\224DI\264L\313\324LO\025U\325\225][\326e\335\366ma\027v\335\367u\337\367u\343\327\205aY\226eY\226eY\226eY\226eY\226eY\202\320\220U\000\000\010\000\000\200\020B\010!\205\024RH!\245\030c\3141\347\240\223PB 4d\025\000\000\010\000 \000\000\000\300Q\034\305q$Gr$\311\222,I\2234K\263<\315\323<M\364DQ\024M\323TEWtE\335\264E\331\224M\327tM\331tUY\265]Y\266m\331\326m_\226m\337\367}\337\367}\337\367}\337\367}\337\367u\035\010\rY\005\000H\000\000\350H\216\244H\212\244H\216\3438\222$\001\241!\253\000\000\031\000\000\001\000(\212\2438\216\343H\222$I\226\244I\236\345Y\242fj\246gz\252\250\002\241!\253\000\000@\000\000\001\000\000\000\000\000(\232\342)\246\342)\242\3429\242#J\242eZ\242\246j\256(\233\262\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272\256\353\272.\020\032\262\n\000\220\000\000\320\221\034\311\221\034I\221\024I\221\034\311\001BCV\001\0002\000\000\002\000p\014\307\220\024\311\261,K\323<\315\323<M\364DO\364LO\025]\321\005BCV\001\000\200\000\000\002\000\000\000\000\0000$\303R,Gs4I\224TK\265TM\265TK\025UOUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU5M\3234M 4d%\000\020\005\000@)\213\261\366 \034\201\034\203\226sh\020d\320zQ\0253\312Q-&R\0101\251\301D\214)&\261\247\2101\346\244\345X1\204\030\264\330;\250\024\203\322\002\241!+\004\200\320\014\000\203$\001\222\246\001\222\246\001\000\000\000\000\000\000\200\344i\200&\212\200\346\211\000\000\000\000\000\000\000 i\032\240\211\036\240\211\"\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\222\247\001\236(\002\236(\002\000\000\000\000\000\000\200&\212\200h\232\200h\232\000\000\000\000\000\000\000\240\211\"\340\231\" \232&\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\222\346\001\232(\002\236(\002\000\000\000\000\000\000\200&\212\200h\232\200(\232\000\000\000\000\000\000\000\240\211\" \232& \232&\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\200\000\000\200\000\007\000\200\000\013\241\320\220\025\001@\234\000\200\301q,\013\000\000\034I\3224\000\000p$I\323\000\000\300\3224Q\004\000\000M\323D\021\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000@\000\000\300\200\003\000@\200\te\240\320\220\225\000@\024\000\200AQ4\rH\216\246\001I\3224`i\236\007\360<\200h\002D\021\240\252\000@\000\000@\201\003\000@\200\r\232\022\213\003\024\032\262\022\000\210\002\00008\212ei\232(\222$M\3634Q$I\232\346y\242H\323<\317\363L\023\236\347y\246\tQ\024EU\205(\212\242\252\3024MSU\201(\252\252\000\000\200\002\007\000\200\000\0334%\026\007(4d%\000\020\022\000`p\034\313\362<\317\363<Q4MUeY\232\346y\242(\212\246i\252\252J\2624\315\363DQ\024M\323TU\225\246y\236\347\211\242(\232\246\252\272.<\317\363DQ\024MSU]\027\236\'\212\246i\232\252\252\252\256\013\317\023E\3234MUUU\327\205(\212\242i\232\246\252\272\256+\003Q4M\323TU\327\225e \212\246\251\252\252\352\272\262\014D\3214USU]W\226\201i\232\246\252\272\256+\3132\3004U\325u]Y\226\001\252\352\272\256+\313\266\rPUWu]Y\226e\200\353\272\256,\313\262m\003p]\327\225e\333\026\000\000p\340\000\000\020`\004\235dTY\204\215&\\x\000\n\rY\021\000D\001\000\000\3060\245\230R\2061\t!\205\3200&!\244\0202)%\245TJ\005!\245\222J\251 \244\222R)\031\225\224RJ\251\202\220JI\251T\020R)\251\244\002\000\300\016\034\000\300\016,\204BCV\002\000y\000\000\2041J1\306\030s\020!\245\030s\3169\210\220R\2149\347\234d\2141\306\234sNJ\311\030c\3169\'\245t\3169\347\234\223R:\347\234s\316I)\235s\3169\347\244\224R:\347\234sRJ)!t\3169)\245\224\3169\347\234\000\000\240\002\007\000\200\000\033E6\'\030\t*4d%\000\220\n\000`p\034\313\3224M\363<Q\324$I\323<\317\363D\32145K\3224\317\363<Q4M\236\347y\242(\212\246\251\252<\317\363DQ\024MSU\271\256(\232\246i\252\252\252\222eQ\024E\323TU\325\205h\232\246\252\272\252\353\3024EQU]\327u!\313\246\251\252\256+\313\260m\323TU\327\225e\240\272\252*\273\262\014\\WUe\327\266\005\000\200\'8\000\000\025\330\260:\302I\321X`\241!+\001\200\014\000\000\302\030c\024B\010)\204\020RJ!\244\224BH\000\000\300\200\003\000@\200\te\240\320\220\225\000@\024\000\000@\010\245\224RJ\230\242\224RJ\215c\224RJ)\245\224RJ)\245\224RJ)\245\224Rj\255\265\326Zk\255\265\326Zk\255\265\326Zk\255\265\326Z+\000@w\302\001@\367\301\006M\211\305\001\n\rY\t\000\244\002\000\000\306(\305\030\204\222Z\253\020b\3149)-\265V!\304\230sRZj-h\3149\010\245\264\026c\321\230c\020Ji\255\305dJ\347\244\244\324Z\254I\225\216II\251\265\330\222R\246\224\222Rk1&\245TH\241\266\330bL\316\310\232Rk1\326\330\234\3231\225\230b\254\2619\347\234\254\255\305\030cs\3169\031[\3531\307\002\0000\033\034\000 \022lX\035\341\244h,\260\320\220\225\000@H\000\000\201\220R\2141\346\234s\3169\'\225b\2141\347 \204\020B\010\245R\2149\346\034\204\020B\010\241d\2141\347\034\204\020B\010!\224R2\346\034t\020B(!\224RR\347\234\203\020B\010\241\204RJ\351\234s\020B\010!\204RR)\235\203\020B\010!\204PJ)%\245\316A\010!\204\020BI)\245\024B\010!\204PB\t)\225\224B\010!\204\020B(!\245\222R\010!\204\020B\010%\244\222RJ)\204\022B\010!\204\222JJ)\225RJ\010!\204PRJ)\245PB\010!\204\020R*)\245RJ\010!\204\020BI%\245\224R\n!\204\020B(\000\000\340\300\001\000 \300\010:\311\250\262\010\033M\270\360\000\024\032\262\022\000\210\002\000\200\014\224PR\213\r@\214Aj\265C\014:\2111\226\014\032\305\244\325P1\245\230\264\026:\310\024s\324RJ\241cNZ\213\265\245\020BkA\350\336J\212\001\000\000\020\004\000\004\230\000\002\003\004\005_\010\0011\006\000 \010\221\031\"\241\260\n\026\030\224A\203\303<\000x\200\210\220\010\000\022\023\024i\027\027\320e\200\013\272\270\353@\010A\010B\020\213\003( \001\007\'\334\360\304\033\236p\203\023t\212J\035\010\000\000\000\000\300\002\000<\000\000 \024@DD3Waq\201\221\241\261\301\321\341\361\001\"\000\000\000\000\000X\000\360\001\000\200\204\000\021\021\315\\\205\305\005F\206\306\006G\207\307\007H\000\000 \200\000\000\000\000\000\010 \000\001\001\001\000\000\000\000\200\000\000\000\000\001\001"
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 0,
+
+        # vorbis-packet-0
+        data: "\354\314ijv\34645\'\000Lb\201\n@\nc\275*\024\261\231\331\334r\205o[\367zE\263i\313?o\207\2705\000"
+      }
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 0,
+        
+        # vorbis-packet-1
+        data: "\354\312Rd\357\312Rd\037\032K\002L\032\243\2128\030/Y\317\3718v\'\267)\352}7\242\221\325\242\221\211\223\2377o\001"
+      }
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 0,
+        
+        # vorbis-packet-2
+        data: ":\311u\263\374!~\240\200\200I\256\233\345\017\361\003\005\004\370\005\reFC\220D\260\323\346\025\006\360\331\377O\244\356\216\252\243\340&\330\305\212)b\265\252\3254\355\006\330\034bq\262[MLl\026\233&\032\315\"\333F\244\275\212\333\313\335L\341\034\352f\343|\031\233\201\331\353\321\353\367\335\250H1l+3\323h\366L\266\372T\336\255\351\253\220^\266\204\334\237\374]\313{EW\321\014\026\016\322$\271\244\237Nn\014\277\336fs\204\315\331\207\362\331\253RzG\'\212\225\324\321Nu\224t\277\327\277\036\252\270\230e\016O\212P\002a\304\005"
+      }
+    }
+  },
+  {
+    decode {
+      chunk {
+        type: KEY,
+        timestamp: 2902000,
+        
+        # vorbis-packet-3
+        data: "\376\310\325^\007~\240\001<r\265\327\201\037h\000\256\275\377\377\211\2122dV\244zk\353S\231ef\322h\3324gNr&\215\210\332\014E\222!U\025\345s\351^\355\266\217\037B\035\337&v9\337\272\257\377{<\341=\346\337\217\036\311\336Cs\2248\217\371I\365\327\215/\267\351\\~5|l=\217\204\354\316kn\010\211\352\326\200\306\317\2764Mw3\206xdzk\252/CKH~\231\366y\0314G\300l\343\027\375\334\227\014\221\241\013\263\240\212\220\000"
+      }
+    }
+  },
+  {
+    flush {}
+  },
+  {
+    close {}
+  }
+]
\ No newline at end of file
--- a/third_party/blink/renderer/modules/webcodecs/fuzzer_utils.cc
+++ b/third_party/blink/renderer/modules/webcodecs/fuzzer_utils.cc
@@ -34,7 +34,7 @@ ScriptValue FakeFunction::Call(ScriptValue) {
  return ScriptValue();
 }

-EncodedVideoConfig* MakeDecoderConfig(
+EncodedVideoConfig* MakeVideoDecoderConfig(
    const wc_fuzzer::ConfigureVideoDecoder& proto) {
  auto* config = EncodedVideoConfig::Create();
  config->setCodec(proto.codec().c_str());
@@ -45,11 +45,26 @@ EncodedVideoConfig* MakeDecoderConfig(
  return config;
 }

-String ToChunkType(wc_fuzzer::EncodedVideoChunk_EncodedVideoChunkType type) {
+EncodedAudioConfig* MakeAudioDecoderConfig(
+    const wc_fuzzer::ConfigureAudioDecoder& proto) {
+  auto* config = EncodedAudioConfig::Create();
+  config->setCodec(proto.codec().c_str());
+  config->setSampleRate(proto.sample_rate());
+  config->setNumberOfChannels(proto.number_of_channels());
+
+  DOMArrayBuffer* data_copy = DOMArrayBuffer::Create(
+      proto.description().data(), proto.description().size());
+  config->setDescription(
+      ArrayBufferOrArrayBufferView::FromArrayBuffer(data_copy));
+
+  return config;
+}
+
+String ToChunkType(wc_fuzzer::EncodedChunkType type) {
  switch (type) {
-    case wc_fuzzer::EncodedVideoChunk_EncodedVideoChunkType_KEY:
+    case wc_fuzzer::EncodedChunkType::KEY:
      return "key";
-    case wc_fuzzer::EncodedVideoChunk_EncodedVideoChunkType_DELTA:
+    case wc_fuzzer::EncodedChunkType::DELTA:
      return "delta";
  }
 }
@@ -63,4 +78,13 @@ EncodedVideoChunk* MakeEncodedVideoChunk(
                                   proto.duration(), data_copy);
 }

+EncodedAudioChunk* MakeEncodedAudioChunk(
+    const wc_fuzzer::EncodedAudioChunk& proto) {
+  DOMArrayBuffer* data_copy =
+      DOMArrayBuffer::Create(proto.data().data(), proto.data().size());
+
+  return EncodedAudioChunk::Create(ToChunkType(proto.type()), proto.timestamp(),
+                                   data_copy);
+}
+
 }  // namespace blink
--- a/third_party/blink/renderer/modules/webcodecs/fuzzer_utils.h
+++ b/third_party/blink/renderer/modules/webcodecs/fuzzer_utils.h
@@ -7,9 +7,11 @@

 #include "third_party/blink/renderer/bindings/core/v8/script_function.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_encoded_audio_config.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_encoded_video_config.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_video_decoder_init.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h"
+#include "third_party/blink/renderer/modules/webcodecs/encoded_audio_chunk.h"
 #include "third_party/blink/renderer/modules/webcodecs/encoded_video_chunk.h"
 #include "third_party/blink/renderer/modules/webcodecs/fuzzer_inputs.pb.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
@@ -32,13 +34,19 @@ class FakeFunction : public ScriptFunction {
  const std::string name_;
 };

-EncodedVideoConfig* MakeDecoderConfig(
+EncodedVideoConfig* MakeVideoDecoderConfig(
    const wc_fuzzer::ConfigureVideoDecoder& proto);

+EncodedAudioConfig* MakeAudioDecoderConfig(
+    const wc_fuzzer::ConfigureAudioDecoder& proto);
+
 EncodedVideoChunk* MakeEncodedVideoChunk(
    const wc_fuzzer::EncodedVideoChunk& proto);

-String ToChunkType(wc_fuzzer::EncodedVideoChunk_EncodedVideoChunkType type);
+EncodedAudioChunk* MakeEncodedAudioChunk(
+    const wc_fuzzer::EncodedAudioChunk& proto);
+
+String ToChunkType(wc_fuzzer::EncodedChunkType type);

 }  // namespace blink


--- a/third_party/blink/renderer/modules/webcodecs/video_decoder_fuzzer.cc
+++ b/third_party/blink/renderer/modules/webcodecs/video_decoder_fuzzer.cc
@@ -73,8 +73,9 @@ DEFINE_TEXT_PROTO_FUZZER(
    for (auto& invocation : proto.invocations()) {
      switch (invocation.Api_case()) {
        case wc_fuzzer::VideoDecoderApiInvocation::kConfigure:
-          video_decoder->configure(MakeDecoderConfig(invocation.configure()),
-                                   IGNORE_EXCEPTION_FOR_TESTING);
+          video_decoder->configure(
+              MakeVideoDecoderConfig(invocation.configure()),
+              IGNORE_EXCEPTION_FOR_TESTING);
          break;
        case wc_fuzzer::VideoDecoderApiInvocation::kDecode:
          video_decoder->decode(