Added mp3_extractor_fuzzer (11ab23ba) · Commits · e / os / android_frameworks_av

media/extractors/fuzzers/Android.bp

+28 −0

Original line number	Diff line number	Diff line
		@@ -110,3 +110,31 @@ cc_fuzz {
		"libbase",
		],
		}

		cc_fuzz {
		name: "mp3_extractor_fuzzer",

		srcs: [
		"mp3_extractor_fuzzer.cpp",
		],

		include_dirs: [
		"frameworks/av/media/extractors/mp3",
		],

		static_libs: [
		"liblog",
		"libstagefright_foundation",
		"libmedia",
		"libextractorfuzzerbase",
		"libfifo",
		"libmp3extractor",
		"libstagefright_id3",
		],

		shared_libs: [
		"libutils",
		"libmediandk",
		"libbinder",
		],
		}

media/extractors/fuzzers/README.md

+33 −3

Original line number	Diff line number	Diff line
		# Fuzzer for extractors

		## Table of contents
		1. [libextractorfuzzerbase](#ExtractorFuzzerBase)
		2. [libmp4extractor](#mp4ExtractorFuzzer)
		3. [libwavextractor](#wavExtractorFuzzer)
		+ [libextractorfuzzerbase](#ExtractorFuzzerBase)
		+ [libmp4extractor](#mp4ExtractorFuzzer)
		+ [libwavextractor](#wavExtractorFuzzer)
		+ [libmp3extractor](#mp3ExtractorFuzzer)

		# <a name="ExtractorFuzzerBase"></a> Fuzzer for libextractorfuzzerbase
		All the extractors have a common API - creating a data source, extraction
		@@ -79,6 +80,35 @@ To run on device
		$ adb shell /data/fuzz/arm64/wav_extractor_fuzzer/wav_extractor_fuzzer CORPUS_DIR
		```

		# <a name="mp3ExtractorFuzzer"></a> Fuzzer for libmp3extractor

		## Plugin Design Considerations
		The fuzzer plugin for MP3 extractor uses the `ExtractorFuzzerBase` class and
		implements only the `createExtractor` to create the MP3 extractor class.


		## Build

		This describes steps to build mp3_extractor_fuzzer binary.

		### Android

		#### Steps to build
		Build the fuzzer
		```
		$ mm -j$(nproc) mp3_extractor_fuzzer
		```

		#### Steps to run
		Create a directory CORPUS_DIR and copy some mp3 files to that folder
		Push this directory to device.

		To run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/mp3_extractor_fuzzer/mp3_extractor_fuzzer CORPUS_DIR
		```

		## References:
		* http://llvm.org/docs/LibFuzzer.html
		* https://github.com/google/oss-fuzz

media/extractors/fuzzers/mp3_extractor_fuzzer.cpp

0 → 100644

+62 −0

Original line number	Diff line number	Diff line
		/******************************************************************************
		*
		* Copyright (C) 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		*****************************************************************************
		* Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
		*/

		#include "ExtractorFuzzerBase.h"

		#include "MP3Extractor.h"

		using namespace android;

		class Mp3Extractor : public ExtractorFuzzerBase {
		public:
		Mp3Extractor() = default;
		~Mp3Extractor() = default;

		bool createExtractor();
		};

		bool Mp3Extractor::createExtractor() {
		mExtractor = new MP3Extractor(new DataSourceHelper(mDataSource->wrap()), nullptr);
		if (!mExtractor) {
		return false;
		}
		mExtractor->name();
		return true;
		}

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		if ((!data) \|\| (size == 0)) {
		return 0;
		}
		Mp3Extractor* extractor = new Mp3Extractor();
		if (!extractor) {
		return 0;
		}
		if (extractor->setDataSource(data, size)) {
		if (extractor->createExtractor()) {
		extractor->getExtractorDef();
		extractor->getMetadata();
		extractor->extractTracks();
		extractor->getTracksMetadata();
		}
		}
		delete extractor;
		return 0;
		}