aosp12/external/tremolo/fuzzer

Fuzzer for libvorbis decoder

Plugin Design Considerations

The fuzzer plugin for Vorbis is designed based on the understanding of the codec and tries to achieve the following:

Maximize code coverage

Dict file (dictionary file) is created for vorbis to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that decoder does not reject any input file in the first check

Maximize utilization of input data

The plugin feeds the entire input data to the codec in a loop till the desired headers (01vorbis, 05vorbis) are parsed. After that, the remaining data is passed at once to the decoder. FrameSize in Vorbis is determined only after the call to extractor, so in absence of call to extractor, we feed the entire remaining data to the decoder.

This ensures that the plugin tolerates any kind of input (empty, huge, malformed, etc) and doesnt exit() on any input and thereby increasing the chance of identifying vulnerabilities.

Build

This describes steps to build vorbis_dec_fuzzer binary.

Android

Steps to build

Build the fuzzer

  $ mm -j$(nproc) vorbis_dec_fuzzer

Steps to run

Create a directory CORPUS_DIR and copy some vorbis files to that folder Push this directory to device.

To run on device

  $ adb sync data
  $ adb shell /data/fuzz/arm64/vorbis_dec_fuzzer/vorbis_dec_fuzzer CORPUS_DIR

To run on host

  $ $ANDROID_HOST_OUT/fuzz/x86_64/vorbis_dec_fuzzer/vorbis_dec_fuzzer CORPUS_DIR

References:

• http://llvm.org/docs/LibFuzzer.html
• https://github.com/google/oss-fuzz