1# Fuzzer for extractors 2 3## Table of contents 4+ [libextractorfuzzerbase](#ExtractorFuzzerBase) 5+ [libmp4extractor](#mp4ExtractorFuzzer) 6+ [libwavextractor](#wavExtractorFuzzer) 7+ [libamrextractor](#amrExtractorFuzzer) 8+ [libmkvextractor](#mkvExtractorFuzzer) 9+ [liboggextractor](#oggExtractorFuzzer) 10+ [libmpeg2extractor](#mpeg2ExtractorFuzzer) 11+ [libmp3extractor](#mp3ExtractorFuzzer) 12+ [libaacextractor](#aacExtractorFuzzer) 13+ [libflacextractor](#flacExtractor) 14+ [libmidiextractor](#midiExtractorFuzzer) 15 16# <a name="ExtractorFuzzerBase"></a> Fuzzer for libextractorfuzzerbase 17All the extractors have a common API - creating a data source, extraction 18of all the tracks, etc. These common APIs have been abstracted in a base class 19called `ExtractorFuzzerBase` to ensure code is reused between fuzzer plugins. 20 21Additionally, `ExtractorFuzzerBase` also has support for memory based buffer 22`BufferSource` since the fuzzing engine feeds data using memory buffers and 23usage of standard data source objects like FileSource, HTTPSource, etc. is 24not feasible. 25 26# <a name="mp4ExtractorFuzzer"></a> Fuzzer for libmp4extractor 27 28## Plugin Design Considerations 29The fuzzer plugin for MP4 extractor uses the `ExtractorFuzzerBase` class and 30implements only the `createExtractor` to create the MP4 extractor class. 31 32##### Maximize code coverage 33Dict file (dictionary file) is created for MP4 to ensure that the required MP4 34atoms are present in every input file that goes to the fuzzer. 35This ensures that larger code gets covered as a range of MP4 atoms will be 36present in the input data. 37 38 39## Build 40 41This describes steps to build mp4_extractor_fuzzer binary. 42 43### Android 44 45#### Steps to build 46Build the fuzzer 47``` 48 $ mm -j$(nproc) mp4_extractor_fuzzer 49``` 50 51#### Steps to run 52Create a directory CORPUS_DIR and copy some MP4 files to that folder 53Push this directory to device. 54 55To run on device 56``` 57 $ adb sync data 58 $ adb shell /data/fuzz/arm64/mp4_extractor_fuzzer/mp4_extractor_fuzzer CORPUS_DIR 59``` 60 61# <a name="wavExtractorFuzzer"></a> Fuzzer for libwavextractor 62 63## Plugin Design Considerations 64The fuzzer plugin for WAV extractor uses the `ExtractorFuzzerBase` class and 65implements only the `createExtractor` to create the WAV extractor class. 66 67 68## Build 69 70This describes steps to build wav_extractor_fuzzer binary. 71 72### Android 73 74#### Steps to build 75Build the fuzzer 76``` 77 $ mm -j$(nproc) wav_extractor_fuzzer 78``` 79 80#### Steps to run 81Create a directory CORPUS_DIR and copy some wav files to that folder 82Push this directory to device. 83 84To run on device 85``` 86 $ adb sync data 87 $ adb shell /data/fuzz/arm64/wav_extractor_fuzzer/wav_extractor_fuzzer CORPUS_DIR 88``` 89 90# <a name="amrExtractorFuzzer"></a> Fuzzer for libamrextractor 91 92## Plugin Design Considerations 93The fuzzer plugin for AMR extractor uses the `ExtractorFuzzerBase` class and 94implements only the `createExtractor` to create the AMR extractor class. 95 96##### Maximize code coverage 97Dict file (dictionary file) is created for AMR to ensure that the required start 98bytes are present in every input file that goes to the fuzzer. 99This ensures that larger code gets covered. 100 101 102## Build 103 104This describes steps to build amr_extractor_fuzzer binary. 105 106### Android 107 108#### Steps to build 109Build the fuzzer 110``` 111 $ mm -j$(nproc) amr_extractor_fuzzer 112``` 113 114#### Steps to run 115Create a directory CORPUS_DIR and copy some AMR files to that folder 116Push this directory to device. 117 118To run on device 119``` 120 $ adb sync data 121 $ adb shell /data/fuzz/arm64/amr_extractor_fuzzer/amr_extractor_fuzzer CORPUS_DIR 122``` 123 124# <a name="mkvExtractorFuzzer"></a> Fuzzer for libmkvextractor 125 126## Plugin Design Considerations 127The fuzzer plugin for MKV extractor uses the `ExtractorFuzzerBase` class and 128implements only the `createExtractor` to create the MKV extractor class. 129 130##### Maximize code coverage 131Dict file (dictionary file) is created for MKV to ensure that the required element 132ID's are present in every input file that goes to the fuzzer. 133This ensures that larger code gets covered. 134 135 136## Build 137 138This describes steps to build mkv_extractor_fuzzer binary. 139 140### Android 141 142#### Steps to build 143Build the fuzzer 144``` 145 $ mm -j$(nproc) mkv_extractor_fuzzer 146``` 147 148#### Steps to run 149Create a directory CORPUS_DIR and copy some mkv files to that folder. 150Push this directory to device. 151 152To run on device 153``` 154 $ adb sync data 155 $ adb shell /data/fuzz/arm64/mkv_extractor_fuzzer/mkv_extractor_fuzzer CORPUS_DIR 156``` 157 158# <a name="oggExtractorFuzzer"></a> Fuzzer for liboggextractor 159 160## Plugin Design Considerations 161The fuzzer plugin for OGG extractor uses the `ExtractorFuzzerBase` class and 162implements only the `createExtractor` to create the OGG extractor object. 163 164##### Maximize code coverage 165Dict file (dictionary file) is created for OGG to ensure that the required start 166bytes are present in every input file that goes to the fuzzer. 167This ensures that larger code gets covered. 168 169 170## Build 171 172This describes steps to build ogg_extractor_fuzzer binary. 173 174### Android 175 176#### Steps to build 177Build the fuzzer 178``` 179 $ mm -j$(nproc) ogg_extractor_fuzzer 180``` 181 182#### Steps to run 183Create a directory CORPUS_DIR and copy some ogg files to that folder. 184Push this directory to device. 185 186To run on device 187``` 188 $ adb sync data 189 $ adb shell /data/fuzz/arm64/ogg_extractor_fuzzer/ogg_extractor_fuzzer CORPUS_DIR 190``` 191 192# <a name="mpeg2ExtractorFuzzer"></a> Fuzzer for libmpeg2extractor 193 194## Plugin Design Considerations 195The fuzzer plugins for MPEG2-PS and MPEG2-TS extractor use the `ExtractorFuzzerBase` class and 196implement only the `createExtractor` to create the MPEG2-PS or MPEG2-TS extractor 197object respectively. 198 199##### Maximize code coverage 200Dict files (dictionary files) are created for MPEG2-PS and MPEG2-TS to ensure that the 201required start bytes are present in every input file that goes to the fuzzer. 202This ensures that larger code gets covered. 203 204##### Other considerations 205Two fuzzer binaries - mpeg2ps_extractor_fuzzer and mpeg2ts_extractor_fuzzer are 206generated based on the presence of a flag - `MPEG2PS` 207 208 209## Build 210 211This describes steps to build mpeg2ps_extractor_fuzzer and mpeg2ts_extractor_fuzzer binary. 212 213### Android 214 215#### Steps to build 216Build the fuzzer 217``` 218 $ mm -j$(nproc) mpeg2ps_extractor_fuzzer 219 $ mm -j$(nproc) mpeg2ts_extractor_fuzzer 220``` 221 222#### Steps to run 223Create a directory CORPUS_DIR and copy some mpeg2 files to that folder 224Push this directory to device. 225 226To run on device 227``` 228 $ adb sync data 229 $ adb shell /data/fuzz/arm64/mpeg2ps_extractor_fuzzer/mpeg2ps_extractor_fuzzer CORPUS_DIR 230 $ adb shell /data/fuzz/arm64/mpeg2ts_extractor_fuzzer/mpeg2ts_extractor_fuzzer CORPUS_DIR 231``` 232 233# <a name="mp3ExtractorFuzzer"></a> Fuzzer for libmp3extractor 234 235## Plugin Design Considerations 236The fuzzer plugin for MP3 extractor uses the `ExtractorFuzzerBase` class and 237implements only the `createExtractor` to create the MP3 extractor class. 238 239 240## Build 241 242This describes steps to build mp3_extractor_fuzzer binary. 243 244### Android 245 246#### Steps to build 247Build the fuzzer 248``` 249 $ mm -j$(nproc) mp3_extractor_fuzzer 250``` 251 252#### Steps to run 253Create a directory CORPUS_DIR and copy some mp3 files to that folder 254Push this directory to device. 255 256To run on device 257``` 258 $ adb sync data 259 $ adb shell /data/fuzz/arm64/mp3_extractor_fuzzer/mp3_extractor_fuzzer CORPUS_DIR 260``` 261 262# <a name="aacExtractorFuzzer"></a> Fuzzer for libaacextractor 263 264## Plugin Design Considerations 265The fuzzer plugin for AAC extractor uses the `ExtractorFuzzerBase` class and 266implements only the `createExtractor` to create the AAC extractor class. 267 268 269## Build 270 271This describes steps to build aac_extractor_fuzzer binary. 272 273### Android 274 275#### Steps to build 276Build the fuzzer 277``` 278 $ mm -j$(nproc) aac_extractor_fuzzer 279``` 280 281#### Steps to run 282Create a directory CORPUS_DIR and copy some aac files to that folder 283Push this directory to device. 284 285To run on device 286``` 287 $ adb sync data 288 $ adb shell /data/fuzz/arm64/aac_extractor_fuzzer/aac_extractor_fuzzer CORPUS_DIR 289``` 290 291# <a name="flacExtractor"></a> Fuzzer for libflacextractor 292 293## Plugin Design Considerations 294The fuzzer plugin for FLAC extractor uses the `ExtractorFuzzerBase` class and 295implements only the `createExtractor` to create the FLAC extractor object. 296 297##### Maximize code coverage 298Dict file (dictionary file) is created for FLAC to ensure that the required start 299bytes are present in every input file that goes to the fuzzer. 300This ensures that larger code gets covered. 301 302 303## Build 304 305This describes steps to build flac_extractor_fuzzer binary. 306 307### Android 308 309#### Steps to build 310Build the fuzzer 311``` 312 $ mm -j$(nproc) flac_extractor_fuzzer 313``` 314 315#### Steps to run 316Create a directory CORPUS_DIR and copy some flac files to that folder 317Push this directory to device. 318 319To run on device 320``` 321 $ adb sync data 322 $ adb shell /data/fuzz/arm64/flac_extractor_fuzzer/flac_extractor_fuzzer CORPUS_DIR 323``` 324 325# <a name="midiExtractorFuzzer"></a> Fuzzer for libmidiextractor 326 327## Plugin Design Considerations 328The fuzzer plugin for MIDI extractor uses the `ExtractorFuzzerBase` class and 329implements only the `createExtractor` to create the MIDI extractor class. 330 331##### Maximize code coverage 332Dict file (dictionary file) is created for MIDI to ensure that the required MIDI 333headers are present in every input file that goes to the fuzzer. 334This ensures that larger code gets covered as a range of MIDI headers will be 335present in the input data. 336 337 338## Build 339 340This describes steps to build midi_extractor_fuzzer binary. 341 342### Android 343 344#### Steps to build 345Build the fuzzer 346``` 347 $ mm -j$(nproc) midi_extractor_fuzzer 348``` 349 350#### Steps to run 351Create a directory CORPUS_DIR and copy some MIDI files to that folder 352Push this directory to device. 353 354To run on device 355``` 356 $ adb sync data 357 $ adb shell /data/fuzz/arm64/midi_extractor_fuzzer/midi_extractor_fuzzer CORPUS_DIR 358``` 359 360## References: 361 * http://llvm.org/docs/LibFuzzer.html 362 * https://github.com/google/oss-fuzz 363