Added ogg_extractor_fuzzer (ca7174de) · Commits · e / os / android_frameworks_av

media/extractors/fuzzers/Android.bp

+30 −0

Original line number	Diff line number	Diff line
		@@ -171,6 +171,36 @@ cc_fuzz {
		dictionary: "mkv_extractor_fuzzer.dict",
		}

		cc_fuzz {
		name: "ogg_extractor_fuzzer",

		srcs: [
		"ogg_extractor_fuzzer.cpp",
		],

		include_dirs: [
		"frameworks/av/media/extractors/ogg",
		],

		static_libs: [
		"liblog",
		"libstagefright_foundation",
		"libmedia",
		"libextractorfuzzerbase",
		"libstagefright_metadatautils",
		"libvorbisidec",
		"liboggextractor",
		],

		shared_libs: [
		"libutils",
		"libmediandk",
		"libbinder",
		],

		dictionary: "ogg_extractor_fuzzer.dict",
		}

		cc_fuzz {
		name: "mp3_extractor_fuzzer",

media/extractors/fuzzers/README.md

+35 −0

Original line number	Diff line number	Diff line
		@@ -6,6 +6,7 @@
		+ [libwavextractor](#wavExtractorFuzzer)
		+ [libamrextractor](#amrExtractorFuzzer)
		+ [libmkvextractor](#mkvExtractorFuzzer)
		+ [liboggextractor](#oggExtractorFuzzer)
		+ [libmp3extractor](#mp3ExtractorFuzzer)
		+ [libaacextractor](#aacExtractorFuzzer)

		@@ -151,6 +152,40 @@ To run on device
		$ adb shell /data/fuzz/arm64/mkv_extractor_fuzzer/mkv_extractor_fuzzer CORPUS_DIR
		```

		# <a name="oggExtractorFuzzer"></a> Fuzzer for liboggextractor

		## Plugin Design Considerations
		The fuzzer plugin for OGG extractor uses the `ExtractorFuzzerBase` class and
		implements only the `createExtractor` to create the OGG extractor object.

		##### Maximize code coverage
		Dict file (dictionary file) is created for OGG to ensure that the required start
		bytes are present in every input file that goes to the fuzzer.
		This ensures that larger code gets covered.


		## Build

		This describes steps to build ogg_extractor_fuzzer binary.

		### Android

		#### Steps to build
		Build the fuzzer
		```
		$ mm -j$(nproc) ogg_extractor_fuzzer
		```

		#### Steps to run
		Create a directory CORPUS_DIR and copy some ogg files to that folder.
		Push this directory to device.

		To run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/ogg_extractor_fuzzer/ogg_extractor_fuzzer CORPUS_DIR
		```

		# <a name="mp3ExtractorFuzzer"></a> Fuzzer for libmp3extractor

		## Plugin Design Considerations

media/extractors/fuzzers/ogg_extractor_fuzzer.cpp

0 → 100644

+62 −0

Original line number	Diff line number	Diff line
		/******************************************************************************
		*
		* Copyright (C) 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at:
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*
		*****************************************************************************
		* Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore
		*/

		#include "ExtractorFuzzerBase.h"

		#include "OggExtractor.h"

		using namespace android;

		class OGGExtractor : public ExtractorFuzzerBase {
		public:
		OGGExtractor() = default;
		~OGGExtractor() = default;

		bool createExtractor();
		};

		bool OGGExtractor::createExtractor() {
		mExtractor = new OggExtractor(new DataSourceHelper(mDataSource->wrap()));
		if (!mExtractor) {
		return false;
		}
		mExtractor->name();
		return true;
		}

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		if ((!data) \|\| (size == 0)) {
		return 0;
		}
		OGGExtractor* extractor = new OGGExtractor();
		if (!extractor) {
		return 0;
		}
		if (extractor->setDataSource(data, size)) {
		if (extractor->createExtractor()) {
		extractor->getExtractorDef();
		extractor->getMetadata();
		extractor->extractTracks();
		extractor->getTracksMetadata();
		}
		}
		delete extractor;
		return 0;
		}

media/extractors/fuzzers/ogg_extractor_fuzzer.dict

0 → 100644

+3 −0

Original line number	Diff line number	Diff line
		# Start code(bytes 0-3)
		# The below 4 bytes correspond to "OggS" in ASCII
		kw1="\x4F\x67\x67\x53"