Loading media/extractors/fuzzers/Android.bp +28 −0 Original line number Diff line number Diff line Loading @@ -111,6 +111,34 @@ cc_fuzz { ], } cc_fuzz { name: "amr_extractor_fuzzer", srcs: [ "amr_extractor_fuzzer.cpp", ], include_dirs: [ "frameworks/av/media/extractors/amr", ], static_libs: [ "liblog", "libstagefright_foundation", "libmedia", "libextractorfuzzerbase", "libamrextractor", ], shared_libs: [ "libutils", "libmediandk", "libbinder", ], dictionary: "amr_extractor_fuzzer.dict", } cc_fuzz { name: "mp3_extractor_fuzzer", Loading media/extractors/fuzzers/README.md +35 −0 Original line number Diff line number Diff line Loading @@ -4,6 +4,7 @@ + [libextractorfuzzerbase](#ExtractorFuzzerBase) + [libmp4extractor](#mp4ExtractorFuzzer) + [libwavextractor](#wavExtractorFuzzer) + [libamrextractor](#amrExtractorFuzzer) + [libmp3extractor](#mp3ExtractorFuzzer) + [libaacextractor](#aacExtractorFuzzer) Loading Loading @@ -81,6 +82,40 @@ To run on device $ adb shell /data/fuzz/arm64/wav_extractor_fuzzer/wav_extractor_fuzzer CORPUS_DIR ``` # <a name="amrExtractorFuzzer"></a> Fuzzer for libamrextractor ## Plugin Design Considerations The fuzzer plugin for AMR extractor uses the `ExtractorFuzzerBase` class and implements only the `createExtractor` to create the AMR extractor class. ##### Maximize code coverage Dict file (dictionary file) is created for AMR to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that larger code gets covered. ## Build This describes steps to build amr_extractor_fuzzer binary. ### Android #### Steps to build Build the fuzzer ``` $ mm -j$(nproc) amr_extractor_fuzzer ``` #### Steps to run Create a directory CORPUS_DIR and copy some AMR files to that folder Push this directory to device. To run on device ``` $ adb sync data $ adb shell /data/fuzz/arm64/amr_extractor_fuzzer/amr_extractor_fuzzer CORPUS_DIR ``` # <a name="mp3ExtractorFuzzer"></a> Fuzzer for libmp3extractor ## Plugin Design Considerations Loading media/extractors/fuzzers/amr_extractor_fuzzer.cpp 0 → 100644 +62 −0 Original line number Diff line number Diff line /****************************************************************************** * * Copyright (C) 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * ***************************************************************************** * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore */ #include "ExtractorFuzzerBase.h" #include "AMRExtractor.h" using namespace android; class AmrExtractor : public ExtractorFuzzerBase { public: AmrExtractor() = default; ~AmrExtractor() = default; bool createExtractor(); }; bool AmrExtractor::createExtractor() { mExtractor = new AMRExtractor(new DataSourceHelper(mDataSource->wrap())); if (!mExtractor) { return false; } mExtractor->name(); return true; } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { if ((!data) || (size == 0)) { return 0; } AmrExtractor* extractor = new AmrExtractor(); if (!extractor) { return 0; } if (extractor->setDataSource(data, size)) { if (extractor->createExtractor()) { extractor->getExtractorDef(); extractor->getMetadata(); extractor->extractTracks(); extractor->getTracksMetadata(); } } delete extractor; return 0; } media/extractors/fuzzers/amr_extractor_fuzzer.dict 0 → 100644 +2 −0 Original line number Diff line number Diff line # Start code kw1="#!AMR" Loading
media/extractors/fuzzers/Android.bp +28 −0 Original line number Diff line number Diff line Loading @@ -111,6 +111,34 @@ cc_fuzz { ], } cc_fuzz { name: "amr_extractor_fuzzer", srcs: [ "amr_extractor_fuzzer.cpp", ], include_dirs: [ "frameworks/av/media/extractors/amr", ], static_libs: [ "liblog", "libstagefright_foundation", "libmedia", "libextractorfuzzerbase", "libamrextractor", ], shared_libs: [ "libutils", "libmediandk", "libbinder", ], dictionary: "amr_extractor_fuzzer.dict", } cc_fuzz { name: "mp3_extractor_fuzzer", Loading
media/extractors/fuzzers/README.md +35 −0 Original line number Diff line number Diff line Loading @@ -4,6 +4,7 @@ + [libextractorfuzzerbase](#ExtractorFuzzerBase) + [libmp4extractor](#mp4ExtractorFuzzer) + [libwavextractor](#wavExtractorFuzzer) + [libamrextractor](#amrExtractorFuzzer) + [libmp3extractor](#mp3ExtractorFuzzer) + [libaacextractor](#aacExtractorFuzzer) Loading Loading @@ -81,6 +82,40 @@ To run on device $ adb shell /data/fuzz/arm64/wav_extractor_fuzzer/wav_extractor_fuzzer CORPUS_DIR ``` # <a name="amrExtractorFuzzer"></a> Fuzzer for libamrextractor ## Plugin Design Considerations The fuzzer plugin for AMR extractor uses the `ExtractorFuzzerBase` class and implements only the `createExtractor` to create the AMR extractor class. ##### Maximize code coverage Dict file (dictionary file) is created for AMR to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that larger code gets covered. ## Build This describes steps to build amr_extractor_fuzzer binary. ### Android #### Steps to build Build the fuzzer ``` $ mm -j$(nproc) amr_extractor_fuzzer ``` #### Steps to run Create a directory CORPUS_DIR and copy some AMR files to that folder Push this directory to device. To run on device ``` $ adb sync data $ adb shell /data/fuzz/arm64/amr_extractor_fuzzer/amr_extractor_fuzzer CORPUS_DIR ``` # <a name="mp3ExtractorFuzzer"></a> Fuzzer for libmp3extractor ## Plugin Design Considerations Loading
media/extractors/fuzzers/amr_extractor_fuzzer.cpp 0 → 100644 +62 −0 Original line number Diff line number Diff line /****************************************************************************** * * Copyright (C) 2020 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * ***************************************************************************** * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore */ #include "ExtractorFuzzerBase.h" #include "AMRExtractor.h" using namespace android; class AmrExtractor : public ExtractorFuzzerBase { public: AmrExtractor() = default; ~AmrExtractor() = default; bool createExtractor(); }; bool AmrExtractor::createExtractor() { mExtractor = new AMRExtractor(new DataSourceHelper(mDataSource->wrap())); if (!mExtractor) { return false; } mExtractor->name(); return true; } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { if ((!data) || (size == 0)) { return 0; } AmrExtractor* extractor = new AmrExtractor(); if (!extractor) { return 0; } if (extractor->setDataSource(data, size)) { if (extractor->createExtractor()) { extractor->getExtractorDef(); extractor->getMetadata(); extractor->extractTracks(); extractor->getTracksMetadata(); } } delete extractor; return 0; }
media/extractors/fuzzers/amr_extractor_fuzzer.dict 0 → 100644 +2 −0 Original line number Diff line number Diff line # Start code kw1="#!AMR"