Name |
Date |
Size |
#Lines |
LOC |
||
---|---|---|---|---|---|---|
.. | - | - | ||||
Android.bp | D | 03-May-2024 | 2 KiB | 73 | 65 | |
README.md | D | 03-May-2024 | 2.6 KiB | 55 | 42 | |
mediametrics_service_fuzzer.cpp | D | 03-May-2024 | 13.3 KiB | 375 | 299 |
README.md
1# Fuzzer for libmediametricsservice 2 3## Plugin Design Considerations 4The fuzzer plugin for libmediametricsservice is designed based on the 5understanding of the service and tries to achieve the following: 6 7##### Maximize code coverage 8The configuration parameters are not hardcoded, but instead selected based on 9incoming data. This ensures more code paths are reached by the fuzzer. 10 11Media Metrics Service contains the following modules: 121. Media Metrics Item Manipulation (module name: `Item`) 132. Media Metrics Time Machine Storage (module name: `TimeMachineStorage`) 143. Media Metrics Transaction Log (module name: `TransactionLog`) 154. Media Metrics Analytics Action (module name: `AnalyticsAction`) 165. Media Metrics Audio Analytics (module name: `AudioAnalytics`) 176. Media Metrics Timed Action (module name: `TimedAction`) 18 19| Module| Valid Input Values| Configured Value| 20|------------- |-------------| ----- | 21| `Item` | Key: `std::string`. Values: `INT32_MIN` to `INT32_MAX`, `INT64_MIN` to `INT64_MAX`, `std::string`, `double`, `pair<INT32_MIN to INT32_MAX, INT32_MIN to INT32_MAX>` | Value obtained from FuzzedDataProvider | 22| `TimeMachineStorage` | Key: `std::string`. Values: `INT32_MIN` to `INT32_MAX`, `INT64_MIN` to `INT64_MAX`, `std::string`, `double`, `pair<INT32_MIN to INT32_MAX, INT32_MIN to INT32_MAX>` | Value obtained from FuzzedDataProvider | 23| `TranscationLog` | `mediametrics::Item` | `mediametrics::Item` created by obtaining values from FuzzedDataProvider| 24| `AnalyticsAction` | URL: `std::string` ending with .event, Value: `std::string`, action: A function | URL and Values obtained from FuzzedDataProvider, a placeholder function was passed as action| 25| `AudioAnalytics` | `mediametrics::Item` | `mediametrics::Item` created by obtaining values from FuzzedDataProvider| 26| `TimedAction` | time: `std::chrono::seconds`, function: `std::function` | `std::chrono::seconds` : value obtained from FuzzedDataProvider, `std::function`: a placeholder function was used. | 27 28This also ensures that the plugin is always deterministic for any given input. 29 30## Build 31 32This describes steps to build mediametrics_service_fuzzer binary. 33 34### Android 35 36#### Steps to build 37Build the fuzzer 38``` 39 $ mm -j$(nproc) mediametrics_service_fuzzer 40``` 41 42#### Steps to run 43Create a directory CORPUS_DIR and copy some files to that folder 44Push this directory to device. 45 46To run on device 47``` 48 $ adb sync data 49 $ adb shell /data/fuzz/arm64/mediametrics_service_fuzzer/mediametrics_service_fuzzer CORPUS_DIR 50``` 51 52## References: 53 * http://llvm.org/docs/LibFuzzer.html 54 * https://github.com/google/oss-fuzz 55