1# Fuzzer for libstagefright_mp3dec decoder
2
3## Plugin Design Considerations
4The fuzzer plugin for mp3 decoder is designed based on the understanding of the
5codec and tries to achieve the following:
6
7##### Maximize code coverage
8
9This fuzzer makes use of the following config parameters:
101. Equalizer type (parameter name: `equalizerType`)
11
12| Parameter| Valid Values| Configured Value|
13|------------- |-------------| ----- |
14| `equalizerType` | 0. `flat ` 1. `bass_boost ` 2. `rock ` 3. `pop ` 4. `jazz ` 5. `classical ` 6. `talk ` 7. `flat_ ` | Bits 0, 1 and 2 of first byte of input stream |
15| `crcEnabled` | 0. `false ` 1. `true `| Bit 0 of second byte of input stream |
16
17##### Maximize utilization of input data
18The plugin feeds the entire input data to the codec using a loop.
19 * If the decode operation was successful, the input is advanced by the number
20   of bytes used by the decoder.
21 * If the decode operation was un-successful, the input is advanced by 1 byte
22   till it reaches a valid frame or end of stream.
23
24This ensures that the plugin tolerates any kind of input (empty, huge,
25malformed, etc) and doesnt `exit()` on any input and thereby increasing the
26chance of identifying vulnerabilities.
27
28## Build
29
30This describes steps to build mp3_dec_fuzzer binary.
31
32### Android
33
34#### Steps to build
35Build the fuzzer
36```
37  $ mm -j$(nproc) mp3_dec_fuzzer
38```
39
40#### Steps to run
41Create a directory CORPUS_DIR and copy some mp3 files to that folder.
42Push this directory to device.
43
44To run on device
45```
46  $ adb sync data
47  $ adb shell /data/fuzz/arm64/mp3_dec_fuzzer/mp3_dec_fuzzer CORPUS_DIR
48```
49To run on host
50```
51  $ $ANDROID_HOST_OUT/fuzz/x86_64/mp3_dec_fuzzer/mp3_dec_fuzzer CORPUS_DIR
52```
53
54## References:
55 * http://llvm.org/docs/LibFuzzer.html
56 * https://github.com/google/oss-fuzz
57