1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
# Fuzzer for libFraunhoferAAC decoder
## Plugin Design Considerations
The fuzzer plugin for aac decoder is designed based on the understanding of the
codec and tries to achieve the following:
##### Maximize code coverage
This fuzzer makes use of the following config parameters:
1. Transport type (parameter name: `TRANSPORT_TYPE`)
| Parameter| Valid Values| Configured Value|
|------------- |-------------| ----- |
| `TRANSPORT_TYPE` | 0.`TT_UNKNOWN ` 1.`TT_MP4_RAW ` 2.`TT_MP4_ADIF ` 3.`TT_MP4_ADTS ` 4.`TT_MP4_LATM_MCP1 ` 5.`TT_MP4_LATM_MCP0 ` 6.`TT_MP4_LOAS ` 7.`TT_DRM ` | `TT_MP4_ADIF ` |
Note: Value of `TRANSPORT_TYPE` could be set to any of these values.
It is set to `TT_MP4_ADIF` in the fuzzer plugin.
##### Maximize utilization of input data
The plugin feeds the entire input data to the codec using a loop.
* If the decode operation was successful, the input is advanced by an
offset calculated using valid bytes.
* If the decode operation was un-successful, the input is advanced by 1 byte
till it reaches a valid frame or end of stream.
This ensures that the plugin tolerates any kind of input (empty, huge,
malformed, etc) and doesnt `exit()` on any input and thereby increasing the
chance of identifying vulnerabilities.
## Build
This describes steps to build aac_dec_fuzzer binary.
## Android
### Steps to build
Build the fuzzer
```
$ mm -j$(nproc) aac_dec_fuzzer
```
### Steps to run
Create a directory CORPUS_DIR and copy some aac files to that folder.
Push this directory to device.
To run on device
```
$ adb sync data
$ adb shell /data/fuzz/arm64/aac_dec_fuzzer/aac_dec_fuzzer CORPUS_DIR
```
To run on host
```
$ $ANDROID_HOST_OUT/fuzz/x86_64/aac_dec_fuzzer/aac_dec_fuzzer CORPUS_DIR
```
# Fuzzer for libFraunhoferAAC encoder
## Plugin Design Considerations
The fuzzer plugin for aac encoder is designed based on the understanding of the
codec and tries to achieve the following:
##### Maximize code coverage
The configuration parameters are not hardcoded, but instead selected based on
incoming data. This ensures more code paths are reached by the fuzzer.
Following arguments are passed to aacEncoder_SetParam to set the respective AACENC_PARAM parameter:
| Variable name| AACENC_PARAM param| Valid Values| Configured Value|
|------------- |-------------| ----- |----- |
| `sbrMode` |`AACENC_SBR_MODE` | `AAC_SBR_OFF ` `AAC_SBR_SINGLE_RATE ` `AAC_SBR_DUAL_RATE ` `AAC_SBR_AUTO ` | Calculated using first byte of data |
| `aacAOT` | `AACENC_AOT` |`AOT_AAC_LC ` `AOT_ER_AAC_ELD ` `AOT_SBR ` `AOT_PS ` `AOT_ER_AAC_LD ` | Calculated using second byte of data |
| `sampleRate` |`AACENC_SAMPLERATE` | `8000 ` `11025 ` `12000 ` `16000 ` `22050 ` `24000 ` `32000 ` `44100 ` `48000 `| Calculated using third byte of data |
| `bitRate` |`AACENC_BITRATE` | In range `8000 ` to `960000 ` | Calculated using fourth, fifth and sixth byte of data |
| `channelMode` |`AACENC_CHANNELMODE` | `MODE_1 ` `MODE_2 ` `MODE_1_2 ` `MODE_1_2_1 ` `MODE_1_2_2 ` `MODE_1_2_2_1 ` `MODE_1_2_2_2_1 ` `MODE_7_1_BACK ` | Calculated using seventh byte of data |
| `identifier` |`AACENC_TRANSMUX` | `TT_MP4_RAW ` `TT_MP4_ADIF ` `TT_MP4_ADTS ` `TT_MP4_LATM_MCP1 ` `TT_MP4_LATM_MCP0 ` `TT_MP4_LOAS ` `TT_DRM ` | Calculated using eight byte of data |
| `sbrRatio` | `AACENC_SBR_RATIO` |`0 ` `1 ` `2 ` | Calculated using ninth byte of data |
Following values are configured to set up the meta data represented by the class variable `mMetaData ` :
| Variable name| Possible Values| Configured Value|
|------------- | ----- |----- |
| `drc_profile` | `AACENC_METADATA_DRC_NONE ` `AACENC_METADATA_DRC_FILMSTANDARD ` `AACENC_METADATA_DRC_FILMLIGHT ` `AACENC_METADATA_DRC_MUSICSTANDARD ` `AACENC_METADATA_DRC_MUSICLIGHT ` `AACENC_METADATA_DRC_SPEECH ` `AACENC_METADATA_DRC_NOT_PRESENT ` | Calculated using tenth byte of data |
| `comp_profile` | `AACENC_METADATA_DRC_NONE ` `AACENC_METADATA_DRC_FILMSTANDARD ` `AACENC_METADATA_DRC_FILMLIGHT ` `AACENC_METADATA_DRC_MUSICSTANDARD ` `AACENC_METADATA_DRC_MUSICLIGHT ` `AACENC_METADATA_DRC_SPEECH ` `AACENC_METADATA_DRC_NOT_PRESENT ` | Calculated using eleventh byte of data |
| `drc_TargetRefLevel` | In range `0 ` to `255 ` | Calculated using twelfth byte of data |
| `comp_TargetRefLevel` | In range `0 ` to `255 ` | Calculated using thirteenth byte of data |
| `prog_ref_level_present` | `0 ` `1 ` | Calculated using fourteenth byte of data |
| `prog_ref_level` | In range `0 ` to `255 ` | Calculated using fifteenth byte of data |
| `PCE_mixdown_idx_present` | `0 ` `1 ` | Calculated using sixteenth byte of data |
| `ETSI_DmxLvl_present` | `0 ` `1 ` | Calculated using seventeenth byte of data |
| `centerMixLevel` | In range `0 ` to `7 ` | Calculated using eighteenth byte of data |
| `surroundMixLevel` | In range `0 ` to `7 ` | Calculated using nineteenth byte of data |
| `dolbySurroundMode` | In range `0 ` to `2 ` | Calculated using twentieth byte of data |
| `drcPresentationMode` | In range `0 ` to `2 ` | Calculated using twenty-first byte of data |
| `extAncDataEnable` | `0 ` `1 ` | Calculated using twenty-second byte of data |
| `extDownmixLevelEnable` | `0 ` `1 ` | Calculated using twenty-third byte of data |
| `extDownmixLevel_A` | In range `0 ` to `7 ` | Calculated using twenty-fourth byte of data |
| `extDownmixLevel_B` | In range `0 ` to `7 ` | Calculated using twenty-fifth byte of data |
| `dmxGainEnable` | `0 ` `1 ` | Calculated using twenty-sixth byte of data |
| `dmxGain5` | In range `0 ` to `255 ` | Calculated using twenty-seventh byte of data |
| `dmxGain2` | In range `0 ` to `255 ` | Calculated using twenty-eighth byte of data |
| `lfeDmxEnable` | `0 ` `1 ` | Calculated using twenty-ninth byte of data |
| `lfeDmxLevel` | In range `0 ` to `15 ` | Calculated using thirtieth byte of data |
Indexes `mInBufferIdx_1`, `mInBufferIdx_2` and `mInBufferIdx_3`(in range `0 ` to `2`) are calculated using the thirty-first, thirty-second and thirty-third byte respectively.
##### Maximize utilization of input data
The plugin feeds the entire input data to the codec and continues with the encoding even on a failure. This ensures that the plugin tolerates any kind of input (empty, huge, malformed, etc) and doesnt `exit()` on any input and thereby increasing the chance of identifying vulnerabilities.
## Build
This describes steps to build aac_enc_fuzzer binary.
## Android
### Steps to build
Build the fuzzer
```
$ mm -j$(nproc) aac_enc_fuzzer
```
### Steps to run
Create a directory CORPUS_DIR and copy some raw files to that folder.
Push this directory to device.
To run on device
```
$ adb sync data
$ adb shell /data/fuzz/arm64/aac_enc_fuzzer/aac_enc_fuzzer CORPUS_DIR
```
To run on host
```
$ $ANDROID_HOST_OUT/fuzz/x86_64/aac_enc_fuzzer/aac_enc_fuzzer CORPUS_DIR
```
## References:
* http://llvm.org/docs/LibFuzzer.html
* https://github.com/google/oss-fuzz
|
