1*bda690e4SXin Li# Fuzzer for libvorbis decoder 2*bda690e4SXin Li## Plugin Design Considerations 3*bda690e4SXin LiThe fuzzer plugin for Vorbis is designed based on the understanding of the 4*bda690e4SXin Licodec and tries to achieve the following: 5*bda690e4SXin Li 6*bda690e4SXin Li##### Maximize code coverage 7*bda690e4SXin LiDict file (dictionary file) is created for vorbis to ensure that the required start 8*bda690e4SXin Libytes are present in every input file that goes to the fuzzer. 9*bda690e4SXin LiThis ensures that decoder does not reject any input file in the first check 10*bda690e4SXin Li 11*bda690e4SXin Li##### Maximize utilization of input data 12*bda690e4SXin LiThe plugin feeds the entire input data to the codec in a loop till the desired headers 13*bda690e4SXin Li(`01vorbis`, `05vorbis`) are parsed. 14*bda690e4SXin LiAfter that, the remaining data is passed at once to the decoder. 15*bda690e4SXin LiFrameSize in Vorbis is determined only after the call to extractor, so in absence of call to extractor, 16*bda690e4SXin Liwe feed the entire remaining data to the decoder. 17*bda690e4SXin Li 18*bda690e4SXin LiThis ensures that the plugin tolerates any kind of input (empty, huge, malformed, etc) 19*bda690e4SXin Liand doesnt `exit()` on any input and thereby increasing the chance of identifying vulnerabilities. 20*bda690e4SXin Li 21*bda690e4SXin Li## Build 22*bda690e4SXin Li 23*bda690e4SXin LiThis describes steps to build vorbis_dec_fuzzer binary. 24*bda690e4SXin Li 25*bda690e4SXin Li### Android 26*bda690e4SXin Li 27*bda690e4SXin Li#### Steps to build 28*bda690e4SXin LiBuild the fuzzer 29*bda690e4SXin Li``` 30*bda690e4SXin Li $ mm -j$(nproc) vorbis_dec_fuzzer 31*bda690e4SXin Li``` 32*bda690e4SXin Li 33*bda690e4SXin Li#### Steps to run 34*bda690e4SXin LiCreate a directory CORPUS_DIR and copy some vorbis files to that folder 35*bda690e4SXin LiPush this directory to device. 36*bda690e4SXin Li 37*bda690e4SXin LiTo run on device 38*bda690e4SXin Li``` 39*bda690e4SXin Li $ adb sync data 40*bda690e4SXin Li $ adb shell /data/fuzz/arm64/vorbis_dec_fuzzer/vorbis_dec_fuzzer CORPUS_DIR 41*bda690e4SXin Li``` 42*bda690e4SXin LiTo run on host 43*bda690e4SXin Li``` 44*bda690e4SXin Li $ $ANDROID_HOST_OUT/fuzz/x86_64/vorbis_dec_fuzzer/vorbis_dec_fuzzer CORPUS_DIR 45*bda690e4SXin Li``` 46*bda690e4SXin Li 47*bda690e4SXin Li## References: 48*bda690e4SXin Li * http://llvm.org/docs/LibFuzzer.html 49*bda690e4SXin Li * https://github.com/google/oss-fuzz 50