1*a97c2a1fSXin Li# Fuzzer for libmpeg2 decoder 2*a97c2a1fSXin Li 3*a97c2a1fSXin LiThis describes steps to build mpeg2_dec_fuzzer binary. 4*a97c2a1fSXin Li 5*a97c2a1fSXin Li## Linux x86/x64 6*a97c2a1fSXin Li 7*a97c2a1fSXin Li### Requirements 8*a97c2a1fSXin Li- cmake (3.5 or above) 9*a97c2a1fSXin Li- make 10*a97c2a1fSXin Li- clang (6.0 or above) 11*a97c2a1fSXin Li needs to support -fsanitize=fuzzer, -fsanitize=fuzzer-no-link 12*a97c2a1fSXin Li 13*a97c2a1fSXin Li### Steps to build 14*a97c2a1fSXin LiClone libmpeg2 repository 15*a97c2a1fSXin Li``` 16*a97c2a1fSXin Li$ git clone https://android.googlesource.com/platform/external/libmpeg2 17*a97c2a1fSXin Li``` 18*a97c2a1fSXin LiCreate a directory inside libmpeg2 and change directory 19*a97c2a1fSXin Li``` 20*a97c2a1fSXin Li $ cd libmpeg2 21*a97c2a1fSXin Li $ mkdir build 22*a97c2a1fSXin Li $ cd build 23*a97c2a1fSXin Li``` 24*a97c2a1fSXin LiBuild libmpeg2 using cmake 25*a97c2a1fSXin Li``` 26*a97c2a1fSXin Li $ CC=clang CXX=clang++ cmake ../ \ 27*a97c2a1fSXin Li -DSANITIZE=fuzzer-no-link,address,signed-integer-overflow 28*a97c2a1fSXin Li $ make 29*a97c2a1fSXin Li ``` 30*a97c2a1fSXin LiBuild the fuzzer 31*a97c2a1fSXin Li``` 32*a97c2a1fSXin Li $ clang++ -std=c++11 -fsanitize=fuzzer,address -I. -I../ -I../common \ 33*a97c2a1fSXin Li -I../decoder -Wl,--start-group ../fuzzer/mpeg2_dec_fuzzer.cpp \ 34*a97c2a1fSXin Li -o ./mpeg2_dec_fuzzer ./libmpeg2dec.a -Wl,--end-group 35*a97c2a1fSXin Li``` 36*a97c2a1fSXin Li 37*a97c2a1fSXin Li### Steps to run 38*a97c2a1fSXin LiCreate a directory CORPUS_DIR and copy some elementary mpeg2 files to that folder 39*a97c2a1fSXin LiTo run the fuzzer 40*a97c2a1fSXin Li``` 41*a97c2a1fSXin Li$ ./mpeg2_dec_fuzzer CORPUS_DIR 42*a97c2a1fSXin Li``` 43*a97c2a1fSXin Li 44*a97c2a1fSXin Li## Android 45*a97c2a1fSXin Li 46*a97c2a1fSXin Li### Steps to build 47*a97c2a1fSXin LiBuild the fuzzer 48*a97c2a1fSXin Li``` 49*a97c2a1fSXin Li $ SANITIZE_TARGET=address SANITIZE_HOST=address mmma -j$(nproc) \ 50*a97c2a1fSXin Li external/libmpeg2/fuzzer 51*a97c2a1fSXin Li``` 52*a97c2a1fSXin Li 53*a97c2a1fSXin Li### Steps to run 54*a97c2a1fSXin LiCreate a directory CORPUS_DIR and copy some elementary mpeg2 files to that folder 55*a97c2a1fSXin LiPush this directory to device. 56*a97c2a1fSXin Li 57*a97c2a1fSXin LiTo run on device 58*a97c2a1fSXin Li``` 59*a97c2a1fSXin Li $ adb sync data 60*a97c2a1fSXin Li $ adb shell /data/fuzz/mpeg2_dec_fuzzer CORPUS_DIR 61*a97c2a1fSXin Li``` 62*a97c2a1fSXin LiTo run on host 63*a97c2a1fSXin Li``` 64*a97c2a1fSXin Li $ $ANDROID_HOST_OUT/fuzz/mpeg2_dec_fuzzer CORPUS_DIR 65*a97c2a1fSXin Li``` 66*a97c2a1fSXin Li 67*a97c2a1fSXin Li## References: 68*a97c2a1fSXin Li * http://llvm.org/docs/LibFuzzer.html 69*a97c2a1fSXin Li * https://github.com/google/oss-fuzz 70