aboutsummaryrefslogtreecommitdiff
path: root/Src/external_dependencies/openmpt-trunk/contrib/fuzzing
diff options
context:
space:
mode:
authorJean-Francois Mauguit <jfmauguit@mac.com>2024-09-24 09:03:25 -0400
committerGitHub <noreply@github.com>2024-09-24 09:03:25 -0400
commitbab614c421ed7ae329d26bf028c4a3b1d2450f5a (patch)
tree12f17f78986871dd2cfb0a56e5e93b545c1ae0d0 /Src/external_dependencies/openmpt-trunk/contrib/fuzzing
parent4bde6044fddf053f31795b9eaccdd2a5a527d21f (diff)
parent20d28e80a5c861a9d5f449ea911ab75b4f37ad0d (diff)
downloadwinamp-bab614c421ed7ae329d26bf028c4a3b1d2450f5a.tar.gz
Merge pull request #5 from WinampDesktop/community
Merge to main
Diffstat (limited to 'Src/external_dependencies/openmpt-trunk/contrib/fuzzing')
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict325
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh4
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh13
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh6
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh6
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh18
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c59
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh18
-rw-r--r--Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md51
9 files changed, 500 insertions, 0 deletions
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict
new file mode 100644
index 00000000..e920f505
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict
@@ -0,0 +1,325 @@
+669="if"
+669="JN"
+
+amf="ASYLUM Music Format V1.0\x00"
+amf="AMF\x0A"
+
+ams="Extreme"
+ams="AMShdr\x1A\x02\x02"
+
+#dbm="DBM0"
+dbm="NAME"
+dbm="INFO"
+dbm="SONG"
+dbm="INST"
+dbm="VENV"
+dbm="PENV"
+dbm="PNAM"
+dbm="SMPL"
+dbm="DSPE"
+#dbm="MPEG"
+
+digi="DIGI Booster module\x00"
+
+dmf="DDMF"
+#dmf="XTRACKER"
+dmf="CMSG"
+dmf="SEQU"
+dmf="SMPI"
+dmf="SMPD"
+#dmf="SMPJ"
+#dmf="ENDE"
+#dmf="SETT"
+
+dsm="RIFF"
+dsm="DSMF"
+
+dsym="\x02\x01\x13\x13\x14\x12\x01\x0B\x01"
+
+dtm="D.T."
+dtm="S.Q."
+#dtm="PATT"
+#dtm="INST"
+dtm="DAPT"
+dtm="DAIT"
+
+far="FAR\xFE"
+far="\x0D\x0A\x1A"
+
+fmt="FMTracker\x01\x01"
+
+gdm="GDM\xFE"
+gdm="GMFS"
+
+imf="IM10"
+imf="IS10"
+
+it="IMPM"
+it="IMPI"
+it="IMPS"
+#it="OMPT"
+it="PNAM"
+it="CNAM"
+it="STPM"
+it="XTPM"
+it="CHBI"
+it="FX00"
+it="F255"
+it="DWRT"
+it="PROG"
+it="CHFX"
+
+it="..TD"
+it="DTFR"
+it=".BPR"
+it=".MPR"
+it="...C"
+it="SnhC"
+it="..MT"
+it=".MMP"
+it=".VWC"
+it="VWSL"
+it=".APS"
+it="VTSV"
+it=".VGD"
+it="..PR"
+it="RSMP"
+it="CUES"
+it="SWNG"
+it=".FSM"
+it="AUTH"
+
+itp=".pti\x03\x01\x00\x00"
+
+j2b="MUSE\xDE\xAD\xBE\xAF"
+j2b="MUSE\xDE\xAD\xBA\xBE"
+j2b="AMFF"
+j2b="AM "
+j2b="MAIN"
+j2b="INIT"
+j2b="ORDR"
+j2b="AI "
+j2b="AS "
+
+MDL="DMDL"
+# Most chunk IDs are commented out as they are substrings of other dictionary entries
+#mdl="IN"
+mdl="ME"
+#mdl="PA"
+#mdl="TR"
+mdl="II"
+#mdl="VE"
+#mdl="PE"
+#mdl="FE"
+#mdl="IS"
+#mdl="SA"
+
+med="MMD1"
+
+mo3="MO3\x05"
+
+# A couple of magic bytes are commented out because they do not modify the loader's behaviour, apart from setting a "made with" string.
+mod="M.K."
+#mod="M!K!"
+mod="M&K!"
+mod="N.T."
+#mod="FEST"
+#mod="NSMS"
+#mod="LARD"
+mod="OKTA"
+#mod="OCTA"
+#mod="CD61"
+mod="CD81"
+#mod="FA08"
+mod="FLT8"
+#mod="EXO8"
+# Depending on the byte offset in the file, we generate either a "xCHN" or "xxCH" magic
+mod="99CHN"
+mod="TDZ8"
+ice="MTN\x00"
+ice="IT10"
+pt36="CMNT"
+pt36="PTDT"
+sfx="SO31"
+# External Startrekker instrument files.
+stam="ST1.3 ModuleINFO"
+stam="AudioSculpture10"
+
+mptm="->MPT_ORIGINAL_IT<-"
+mptm=".tpm"
+mptm="mptm"
+mptm="\x89\x08"
+mptm="\x8D\x08"
+# No structural changes in these format versions
+#mptm="\x8E\x08"
+#mptm="\x8F\x08"
+#mptm="\x90\x08"
+mptm="\x91\x08"
+mptm="228\x04"
+
+mt2="MT20"
+#mt2="MadTracker 2.0"
+mt2="BPM+"
+mt2="TFXM"
+mt2="TRKS"
+mt2="TRKL"
+mt2="PATN"
+mt2="MSG\x00"
+#mt2="PICT"
+mt2="SUM\x00"
+mt2="VST2"
+
+mtm="MTM\x10"
+
+okt="OKTASONG"
+okt="CMOD"
+okt="SAMP"
+okt="SPEE"
+okt="SLEN"
+okt="PLEN"
+okt="PATT"
+okt="PBOD"
+okt="SBOD"
+
+plm="PLM\x1A"
+plm="PLS\x1A"
+
+psm="PSM "
+psm="FILE"
+psm="TITL"
+psm="SDFT"
+psm="DATE"
+psm="OPLH"
+psm="PPAN"
+psm="DSAM"
+psm="DSMP"
+psm="MAINSONG"
+psm="\x00\xFF\x00\x00\x01\x00"
+psm16="PSM\xFE"
+psm16="PORD"
+#psm16="PPAN"
+psm16="PSAH"
+psm16="PPAT"
+
+ptm="PTMF"
+ptm="\x1A\x03\x02"
+
+s3m="SCRM"
+#s3m="SCRS"
+#s3m="SCRI"
+
+stm="\x1A\x02\x15"
+
+stp="STP3\x02"
+
+symmod="SymM\x00\x00\x00\x01\xFF\xFF\xFF\xFF\x00\x00\x00"
+
+ult="MAS_UTrack_V004"
+
+umx="\xC1\x83\x2A\x9E"
+umx="music"
+umx="sound"
+
+xm="Extended Module: "
+xm="OpenMPT "
+#xm="FastTracker v 2.00 "
+xm="MilkyTracker "
+xm="text"
+xm="MIDI"
+
+it="..OF"
+it="LTTP"
+it="PTTF"
+it="..Fd"
+it="..VG"
+it="...P"
+it="..EV"
+it="..EP"
+it=".EiP"
+it=".SLV"
+it=".ELV"
+it=".BSV"
+it=".ESV"
+it=".SLP"
+it=".ELP"
+it=".BSP"
+it=".ESP"
+it="SLiP"
+it="ELiP"
+it="BSiP"
+it="ESiP"
+it=".ANN"
+it=".TCD"
+it=".AND"
+it="..SP"
+it="..SV"
+it=".CFI"
+it=".RFI"
+it="..BM"
+it="..PM"
+it="..CM"
+it=".SPP"
+it=".CPP"
+it=".[PV"
+it=".[PP"
+it="[PiP"
+it=".[EV"
+it=".[EP"
+it="[EiP"
+it="..[K"
+it="..[n"
+it=".[MN"
+it=".[nf"
+it=".PiM"
+it="..RV"
+it="...R"
+it="..SC"
+it="..SR"
+it="..MF"
+it="HEVP"
+it="HOVP"
+it="NREP"
+it="NREA"
+it="NREV"
+it="GLFP"
+it="GLFA"
+it="GLFV"
+it="DWPM"
+
+mmcmp="ziRCONia\x0e\x00"
+
+xpk="XPKF\x00\x10\x00\x00SQSH"
+
+pp20="PP20"
+
+plugin_chorus="OMXD\x9C\x62\xE6\xEF"
+plugin_compressor="OMXD\x79\x1F\x01\xEF"
+plugin_distortion="OMXD\x90\x4C\x11\xEF"
+plugin_echo="OMXD\x2C\x93\x3E\xEF"
+plugin_flanger="OMXD\x92\x3D\xCA\xEF"
+plugin_gargle="OMXD\x10\x82\xFD\xDA"
+plugin_i3dl2reverb="OMXD\x71\x5E\x98\xEF"
+plugin_parameq="OMXD\x89\xED\x0C\x12"
+plugin_wavesreverb="OMDX\x68\x02\xFC\x87"
+plugin_lfo="OMPTLFO "
+plugin_dbproecho="DBM0Echo"
+plugin_symmodecho="SymMEcho"
+
+midi="MThd\x00\x00\x00\x06\x00\x01\x00\x01\x01\xE0MTrk"
+
+wave="WAVEfmt "
+wave="data"
+
+# IFF / AIFF (for SymMOD loader)
+iff="FORM"
+iff="AIFF"
+iff="AIFC"
+iff="8SVX"
+iff="16SV"
+iff="MAUD"
+iff="VHDR"
+iff="BODY"
+iff="CHAN"
+iff="MHDR"
+iff="MDAT"
+iff="NAME"
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh
new file mode 100644
index 00000000..833397ef
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+cd "${0%/*}"
+cd ../..
+AFL_HARDEN=1 CONFIG=afl make clean all EXAMPLES=0 TEST=0 OPENMPT123=0 NO_VORBIS=1 NO_VORBISFILE=1 NO_MPG123=1 CHECKED_ADDRESS=1
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh
new file mode 100644
index 00000000..6f67ea49
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+cd "${0%/*}"
+. ./fuzz-settings.sh
+
+# Create tmpfs for storing temporary fuzzing data
+mkdir $FUZZING_TEMPDIR
+sudo mount -t tmpfs -o size=300M none $FUZZING_TEMPDIR
+rm -rf $FUZZING_TEMPDIR/bin
+mkdir $FUZZING_TEMPDIR/bin
+cp -d ../../bin/* $FUZZING_TEMPDIR/bin/
+
+#export AFL_PRELOAD=$AFL_DIR/libdislocator.so
+LD_LIBRARY_PATH=$FUZZING_TEMPDIR/bin $AFL_DIR/afl-fuzz -p exploit -f $FUZZING_TEMPDIR/infile01 -x all_formats.dict -t $FUZZING_TIMEOUT $FUZZING_INPUT -o $FUZZING_FINDINGS_DIR -D -M fuzzer01 $FUZZING_TEMPDIR/bin/fuzz $FUZZING_TEMPDIR/infile01
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh
new file mode 100644
index 00000000..2d6a867b
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+cd "${0%/*}"
+. ./fuzz-settings.sh
+
+#export AFL_PRELOAD=$AFL_DIR/libdislocator.so
+LD_LIBRARY_PATH=$FUZZING_TEMPDIR/bin $AFL_DIR/afl-fuzz -p coe -f $FUZZING_TEMPDIR/infile02 -x all_formats.dict -t $FUZZING_TIMEOUT $FUZZING_INPUT -o $FUZZING_FINDINGS_DIR -S fuzzer02 $FUZZING_TEMPDIR/bin/fuzz $FUZZING_TEMPDIR/infile02
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh
new file mode 100644
index 00000000..97b28395
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+cd "${0%/*}"
+. ./fuzz-settings.sh
+
+#export AFL_PRELOAD=$AFL_DIR/libdislocator.so
+LD_LIBRARY_PATH=$FUZZING_TEMPDIR/bin $AFL_DIR/afl-fuzz -p explore -f $FUZZING_TEMPDIR/infile03 -x all_formats.dict -t $FUZZING_TIMEOUT $FUZZING_INPUT -o $FUZZING_FINDINGS_DIR -S fuzzer03 $FUZZING_TEMPDIR/bin/fuzz $FUZZING_TEMPDIR/infile03
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh
new file mode 100644
index 00000000..1b280673
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Input data for fuzzer
+# If you run the fuzzer for the first time, specify a directory with some input
+# files for the fuzzer, e.g.
+# FUZZING_INPUT="-i /home/foo/testcases/"
+# If you want to continue fuzzing using the previous findings, use:
+# FUZZING_INPUT=-i-
+FUZZING_INPUT=-i-
+
+# Directory to place temporary fuzzing data into
+FUZZING_TEMPDIR=~/libopenmpt-fuzzing-temp
+# Directory to store permanent fuzzing data (e.g. found crashes) into
+FUZZING_FINDINGS_DIR=~/libopenmpt-fuzzing
+# Fuzzer timeout in ms, + = don't abort on timeout
+FUZZING_TIMEOUT=5000+
+# Path to afl-fuzz binary
+AFL_DIR=afl
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c
new file mode 100644
index 00000000..653dab6d
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c
@@ -0,0 +1,59 @@
+/*
+ * fuzz.c
+ * ------
+ * Purpose: Tiny libopenmpt user to be used by fuzzing tools
+ * Notes : (currently none)
+ * Authors: OpenMPT Devs
+ * The OpenMPT source code is released under the BSD license. Read LICENSE for more details.
+ */
+
+#include <memory.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <errno.h>
+#include <unistd.h>
+
+#include <libopenmpt/libopenmpt.h>
+#include <libopenmpt/libopenmpt_stream_callbacks_file.h>
+
+#define BUFFERSIZE 450 // shouldn't match OpenMPT's internal mix buffer size (512)
+#define SAMPLERATE 22050
+
+static int16_t buffer[BUFFERSIZE];
+
+int main( int argc, char * argv[] ) {
+ static FILE * file = NULL;
+ static openmpt_module * mod = NULL;
+ static size_t count = 0;
+ static int i = 0;
+ (void)argc;
+#ifdef __AFL_HAVE_MANUAL_CONTROL
+ __AFL_INIT();
+#endif
+ file = fopen( argv[1], "rb" );
+ mod = openmpt_module_create( openmpt_stream_get_file_callbacks(), file, NULL, NULL, NULL );
+ fclose( file );
+ if ( mod == NULL ) return 1;
+ openmpt_module_ctl_set( mod, "render.resampler.emulate_amiga", (openmpt_module_get_num_orders( mod ) & 1) ? "0" : "1" );
+ /* render about a second of the module for fuzzing the actual mix routines */
+ for(; i < 50; i++) {
+ count = openmpt_module_read_mono( mod, SAMPLERATE, BUFFERSIZE, buffer );
+ if ( count == 0 ) {
+ break;
+ }
+ }
+ openmpt_module_set_position_seconds( mod, 1.0 );
+ openmpt_module_read_mono( mod, SAMPLERATE, BUFFERSIZE, buffer );
+ openmpt_module_set_position_order_row( mod, 3, 16 );
+ openmpt_module_read_mono( mod, SAMPLERATE, BUFFERSIZE, buffer );
+
+ /* fuzz string-related stuff */
+ openmpt_free_string ( openmpt_module_get_metadata( mod, "date" ) );
+ openmpt_free_string ( openmpt_module_get_metadata( mod, "message" ) );
+ openmpt_module_destroy( mod );
+ return 0;
+}
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh
new file mode 100644
index 00000000..16f0c364
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+cd "${0%/*}"
+
+if [ -z "${GET_AFL_VERSION}" ]; then
+ GET_AFL_VERSION="$(wget --quiet -O - "https://api.github.com/repos/AFLplusplus/AFLplusplus/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")')"
+fi
+AFL_FILENAME="$GET_AFL_VERSION.tar.gz"
+AFL_URL="https://github.com/AFLplusplus/AFLplusplus/archive/$AFL_FILENAME"
+
+rm $AFL_FILENAME
+wget $AFL_URL || exit
+tar -xzvf $AFL_FILENAME
+rm $AFL_FILENAME
+cd AFLplusplus-*
+make source-only || exit
+cd ..
+rm -rf afl
+mv AFLplusplus-* afl \ No newline at end of file
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md
new file mode 100644
index 00000000..bb19163e
--- /dev/null
+++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md
@@ -0,0 +1,51 @@
+libopenmpt fuzz suite
+=====================
+
+In this directory, you can find the necessary tools for fuzzing libopenmpt with
+the American Fuzzy Lop fuzzer (afl++).
+
+Contents:
+
+* `all_formats.dict`: A dictionary containing magic bytes from all supported
+ module formats to make the life of the fuzzer a bit easier.
+* `fuzz-main.sh`: Script to launch the main fuzzing process. If you want to
+ use just one fuzzer instance, run this one.
+* `fuzz-secondary[1|2].sh`: Scripts to launch the secondary fuzzing process. It
+ is recommended to run at least two fuzzer instances, as the deterministic and
+ random fuzz mode have been found to complement each other really well. The two
+ scripts are set up to use different exploration strategies
+* `fuzz-settings.sh`: Set up your preferences and afl settings here before the
+ first run.
+* `fuzz.c`: A tiny C program that is used by the fuzzer to test libopenmpt.
+* `get-afl.sh`: A simple script to obtain the latest version of afl++.
+ You can also make it download from a specific branch or tag, e.g.
+ `GET_AFL_VERSION=stable ./get-afl.sh` to download the latest stable but
+ unreleased code.
+
+Prerequisites
+=============
+* [afl++](https://github.com/AFLplusplus/AFLplusplus) - the makefile expects
+ this to be installed in `contrib/fuzzing/afl`, as it is automatically done by
+ the `get-afl.sh` install script.
+* Clang with LLVM dev headers (llvm-config needs to be installed).
+ afl also works with gcc, but our makefile has been set up to make use of afl's
+ faster LLVM-LTO mode.
+
+How to use
+==========
+* Run `get-afl.sh`, or manually extract afl to `contrib/fuzzing/afl`, use
+ `make source-only` to build. If building fails because `llvm-config` cannot be
+ found, try prepending `LLVM_CONFIG=/usr/bin/llvm-config-12` or similar, and
+ read the afl manual.
+* Build libopenmpt with the `build.sh` script in this directory.
+* Set up `fuzz-settings.sh` to your taste. Most importantly, you will have to
+ specify the input directory for first use.
+ The default setup mounts a tmpfs folder for all temporary files. You may
+ change this behaviour if you do not have root privileges.
+* Run `fuzz-main.sh` for the first (deterministic) instance of afl-fuzz.
+* For a "secondary" instance to run on another core, run `fuzz-secondary1.sh`
+ and/or `fuzz-secondary2.sh`.
+* If you want to make use of even more cores, create more copies
+ `fuzz-secondary2.sh` and adjust "infile03" / "fuzzer03" to
+ "infile04" / "fuzzer04" and so o (they need to be unique). Try variying the
+ fuzzing strategey (the -p parameter) to get results more quickly.