The fuzzer plugin for aac decoder is designed based on the understanding of the codec and tries to achieve the following:
This fuzzer makes use of the following config parameters:
TRANSPORT_TYPE
)Parameter | Valid Values | Configured Value |
---|---|---|
TRANSPORT_TYPE | 0.TT_UNKNOWN 1.TT_MP4_RAW 2.TT_MP4_ADIF 3.TT_MP4_ADTS 4.TT_MP4_LATM_MCP1 5.TT_MP4_LATM_MCP0 6.TT_MP4_LOAS 7.TT_DRM | TT_MP4_ADIF |
Note: Value of TRANSPORT_TYPE
could be set to any of these values. It is set to TT_MP4_ADIF
in the fuzzer plugin.
The plugin feeds the entire input data to the codec using a loop.
This ensures that the plugin tolerates any kind of input (empty, huge, malformed, etc) and doesnt exit()
on any input and thereby increasing the chance of identifying vulnerabilities.
This describes steps to build aac_dec_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) aac_dec_fuzzer
Create a directory CORPUS_DIR and copy some aac files to that folder. Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/aac_dec_fuzzer/aac_dec_fuzzer CORPUS_DIR
To run on host
$ $ANDROID_HOST_OUT/fuzz/x86_64/aac_dec_fuzzer/aac_dec_fuzzer CORPUS_DIR