mirror of https://github.com/mstorsjo/fdk-aac.git
138 lines
6.8 KiB
Markdown
138 lines
6.8 KiB
Markdown
# Fuzzer for libFraunhoferAAC decoder
|
|
|
|
## Plugin Design Considerations
|
|
The fuzzer plugin for aac decoder is designed based on the understanding of the
|
|
codec and tries to achieve the following:
|
|
|
|
##### Maximize code coverage
|
|
|
|
This fuzzer makes use of the following config parameters:
|
|
1. Transport type (parameter name: `TRANSPORT_TYPE`)
|
|
|
|
| Parameter| Valid Values| Configured Value|
|
|
|------------- |-------------| ----- |
|
|
| `TRANSPORT_TYPE` | 0.`TT_UNKNOWN ` 1.`TT_MP4_RAW ` 2.`TT_MP4_ADIF ` 3.`TT_MP4_ADTS ` 4.`TT_MP4_LATM_MCP1 ` 5.`TT_MP4_LATM_MCP0 ` 6.`TT_MP4_LOAS ` 7.`TT_DRM ` | `TT_MP4_ADIF ` |
|
|
|
|
Note: Value of `TRANSPORT_TYPE` could be set to any of these values.
|
|
It is set to `TT_MP4_ADIF` in the fuzzer plugin.
|
|
|
|
##### Maximize utilization of input data
|
|
The plugin feeds the entire input data to the codec using a loop.
|
|
* If the decode operation was successful, the input is advanced by an
|
|
offset calculated using valid bytes.
|
|
* If the decode operation was un-successful, the input is advanced by 1 byte
|
|
till it reaches a valid frame or end of stream.
|
|
|
|
This ensures that the plugin tolerates any kind of input (empty, huge,
|
|
malformed, etc) and doesnt `exit()` on any input and thereby increasing the
|
|
chance of identifying vulnerabilities.
|
|
|
|
## Build
|
|
|
|
This describes steps to build aac_dec_fuzzer binary.
|
|
|
|
## Android
|
|
|
|
### Steps to build
|
|
Build the fuzzer
|
|
```
|
|
$ mm -j$(nproc) aac_dec_fuzzer
|
|
```
|
|
|
|
### Steps to run
|
|
Create a directory CORPUS_DIR and copy some aac files to that folder.
|
|
Push this directory to device.
|
|
|
|
To run on device
|
|
```
|
|
$ adb sync data
|
|
$ adb shell /data/fuzz/arm64/aac_dec_fuzzer/aac_dec_fuzzer CORPUS_DIR
|
|
```
|
|
To run on host
|
|
```
|
|
$ $ANDROID_HOST_OUT/fuzz/x86_64/aac_dec_fuzzer/aac_dec_fuzzer CORPUS_DIR
|
|
```
|
|
|
|
# Fuzzer for libFraunhoferAAC encoder
|
|
|
|
## Plugin Design Considerations
|
|
The fuzzer plugin for aac encoder is designed based on the understanding of the
|
|
codec and tries to achieve the following:
|
|
|
|
##### Maximize code coverage
|
|
|
|
The configuration parameters are not hardcoded, but instead selected based on
|
|
incoming data. This ensures more code paths are reached by the fuzzer.
|
|
|
|
Following arguments are passed to aacEncoder_SetParam to set the respective AACENC_PARAM parameter:
|
|
|
|
| Variable name| AACENC_PARAM param| Valid Values| Configured Value|
|
|
|------------- |-------------| ----- |----- |
|
|
| `sbrMode` |`AACENC_SBR_MODE` | `AAC_SBR_OFF ` `AAC_SBR_SINGLE_RATE ` `AAC_SBR_DUAL_RATE ` `AAC_SBR_AUTO ` | Calculated using first byte of data |
|
|
| `aacAOT` | `AACENC_AOT` |`AOT_AAC_LC ` `AOT_ER_AAC_ELD ` `AOT_SBR ` `AOT_PS ` `AOT_ER_AAC_LD ` | Calculated using second byte of data |
|
|
| `sampleRate` |`AACENC_SAMPLERATE` | `8000 ` `11025 ` `12000 ` `16000 ` `22050 ` `24000 ` `32000 ` `44100 ` `48000 `| Calculated using third byte of data |
|
|
| `bitRate` |`AACENC_BITRATE` | In range `8000 ` to `960000 ` | Calculated using fourth, fifth and sixth byte of data |
|
|
| `channelMode` |`AACENC_CHANNELMODE` | `MODE_1 ` `MODE_2 ` `MODE_1_2 ` `MODE_1_2_1 ` `MODE_1_2_2 ` `MODE_1_2_2_1 ` `MODE_1_2_2_2_1 ` `MODE_7_1_BACK ` | Calculated using seventh byte of data |
|
|
| `identifier` |`AACENC_TRANSMUX` | `TT_MP4_RAW ` `TT_MP4_ADIF ` `TT_MP4_ADTS ` `TT_MP4_LATM_MCP1 ` `TT_MP4_LATM_MCP0 ` `TT_MP4_LOAS ` `TT_DRM ` | Calculated using eight byte of data |
|
|
| `sbrRatio` | `AACENC_SBR_RATIO` |`0 ` `1 ` `2 ` | Calculated using ninth byte of data |
|
|
|
|
Following values are configured to set up the meta data represented by the class variable `mMetaData ` :
|
|
| Variable name| Possible Values| Configured Value|
|
|
|------------- | ----- |----- |
|
|
| `drc_profile` | `AACENC_METADATA_DRC_NONE ` `AACENC_METADATA_DRC_FILMSTANDARD ` `AACENC_METADATA_DRC_FILMLIGHT ` `AACENC_METADATA_DRC_MUSICSTANDARD ` `AACENC_METADATA_DRC_MUSICLIGHT ` `AACENC_METADATA_DRC_SPEECH ` `AACENC_METADATA_DRC_NOT_PRESENT ` | Calculated using tenth byte of data |
|
|
| `comp_profile` | `AACENC_METADATA_DRC_NONE ` `AACENC_METADATA_DRC_FILMSTANDARD ` `AACENC_METADATA_DRC_FILMLIGHT ` `AACENC_METADATA_DRC_MUSICSTANDARD ` `AACENC_METADATA_DRC_MUSICLIGHT ` `AACENC_METADATA_DRC_SPEECH ` `AACENC_METADATA_DRC_NOT_PRESENT ` | Calculated using eleventh byte of data |
|
|
| `drc_TargetRefLevel` | In range `0 ` to `255 ` | Calculated using twelfth byte of data |
|
|
| `comp_TargetRefLevel` | In range `0 ` to `255 ` | Calculated using thirteenth byte of data |
|
|
| `prog_ref_level_present` | `0 ` `1 ` | Calculated using fourteenth byte of data |
|
|
| `prog_ref_level` | In range `0 ` to `255 ` | Calculated using fifteenth byte of data |
|
|
| `PCE_mixdown_idx_present` | `0 ` `1 ` | Calculated using sixteenth byte of data |
|
|
| `ETSI_DmxLvl_present` | `0 ` `1 ` | Calculated using seventeenth byte of data |
|
|
| `centerMixLevel` | In range `0 ` to `7 ` | Calculated using eighteenth byte of data |
|
|
| `surroundMixLevel` | In range `0 ` to `7 ` | Calculated using nineteenth byte of data |
|
|
| `dolbySurroundMode` | In range `0 ` to `2 ` | Calculated using twentieth byte of data |
|
|
| `drcPresentationMode` | In range `0 ` to `2 ` | Calculated using twenty-first byte of data |
|
|
| `extAncDataEnable` | `0 ` `1 ` | Calculated using twenty-second byte of data |
|
|
| `extDownmixLevelEnable` | `0 ` `1 ` | Calculated using twenty-third byte of data |
|
|
| `extDownmixLevel_A` | In range `0 ` to `7 ` | Calculated using twenty-fourth byte of data |
|
|
| `extDownmixLevel_B` | In range `0 ` to `7 ` | Calculated using twenty-fifth byte of data |
|
|
| `dmxGainEnable` | `0 ` `1 ` | Calculated using twenty-sixth byte of data |
|
|
| `dmxGain5` | In range `0 ` to `255 ` | Calculated using twenty-seventh byte of data |
|
|
| `dmxGain2` | In range `0 ` to `255 ` | Calculated using twenty-eighth byte of data |
|
|
| `lfeDmxEnable` | `0 ` `1 ` | Calculated using twenty-ninth byte of data |
|
|
| `lfeDmxLevel` | In range `0 ` to `15 ` | Calculated using thirtieth byte of data |
|
|
|
|
Indexes `mInBufferIdx_1`, `mInBufferIdx_2` and `mInBufferIdx_3`(in range `0 ` to `2`) are calculated using the thirty-first, thirty-second and thirty-third byte respectively.
|
|
|
|
##### Maximize utilization of input data
|
|
The plugin feeds the entire input data to the codec and continues with the encoding even on a failure. This ensures that the plugin tolerates any kind of input (empty, huge, malformed, etc) and doesnt `exit()` on any input and thereby increasing the chance of identifying vulnerabilities.
|
|
|
|
## Build
|
|
|
|
This describes steps to build aac_enc_fuzzer binary.
|
|
|
|
## Android
|
|
|
|
### Steps to build
|
|
Build the fuzzer
|
|
```
|
|
$ mm -j$(nproc) aac_enc_fuzzer
|
|
```
|
|
|
|
### Steps to run
|
|
Create a directory CORPUS_DIR and copy some raw files to that folder.
|
|
Push this directory to device.
|
|
|
|
To run on device
|
|
```
|
|
$ adb sync data
|
|
$ adb shell /data/fuzz/arm64/aac_enc_fuzzer/aac_enc_fuzzer CORPUS_DIR
|
|
```
|
|
To run on host
|
|
```
|
|
$ $ANDROID_HOST_OUT/fuzz/x86_64/aac_enc_fuzzer/aac_enc_fuzzer CORPUS_DIR
|
|
```
|
|
|
|
## References:
|
|
* http://llvm.org/docs/LibFuzzer.html
|
|
* https://github.com/google/oss-fuzz
|