diff options
author | Jean-Francois Mauguit <jfmauguit@mac.com> | 2024-09-24 09:03:25 -0400 |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-09-24 09:03:25 -0400 |
commit | bab614c421ed7ae329d26bf028c4a3b1d2450f5a (patch) | |
tree | 12f17f78986871dd2cfb0a56e5e93b545c1ae0d0 /Src/external_dependencies/openmpt-trunk/contrib/fuzzing | |
parent | 4bde6044fddf053f31795b9eaccdd2a5a527d21f (diff) | |
parent | 20d28e80a5c861a9d5f449ea911ab75b4f37ad0d (diff) | |
download | winamp-bab614c421ed7ae329d26bf028c4a3b1d2450f5a.tar.gz |
Merge pull request #5 from WinampDesktop/community
Merge to main
Diffstat (limited to 'Src/external_dependencies/openmpt-trunk/contrib/fuzzing')
9 files changed, 500 insertions, 0 deletions
diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict new file mode 100644 index 00000000..e920f505 --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/all_formats.dict @@ -0,0 +1,325 @@ +669="if" +669="JN" + +amf="ASYLUM Music Format V1.0\x00" +amf="AMF\x0A" + +ams="Extreme" +ams="AMShdr\x1A\x02\x02" + +#dbm="DBM0" +dbm="NAME" +dbm="INFO" +dbm="SONG" +dbm="INST" +dbm="VENV" +dbm="PENV" +dbm="PNAM" +dbm="SMPL" +dbm="DSPE" +#dbm="MPEG" + +digi="DIGI Booster module\x00" + +dmf="DDMF" +#dmf="XTRACKER" +dmf="CMSG" +dmf="SEQU" +dmf="SMPI" +dmf="SMPD" +#dmf="SMPJ" +#dmf="ENDE" +#dmf="SETT" + +dsm="RIFF" +dsm="DSMF" + +dsym="\x02\x01\x13\x13\x14\x12\x01\x0B\x01" + +dtm="D.T." +dtm="S.Q." +#dtm="PATT" +#dtm="INST" +dtm="DAPT" +dtm="DAIT" + +far="FAR\xFE" +far="\x0D\x0A\x1A" + +fmt="FMTracker\x01\x01" + +gdm="GDM\xFE" +gdm="GMFS" + +imf="IM10" +imf="IS10" + +it="IMPM" +it="IMPI" +it="IMPS" +#it="OMPT" +it="PNAM" +it="CNAM" +it="STPM" +it="XTPM" +it="CHBI" +it="FX00" +it="F255" +it="DWRT" +it="PROG" +it="CHFX" + +it="..TD" +it="DTFR" +it=".BPR" +it=".MPR" +it="...C" +it="SnhC" +it="..MT" +it=".MMP" +it=".VWC" +it="VWSL" +it=".APS" +it="VTSV" +it=".VGD" +it="..PR" +it="RSMP" +it="CUES" +it="SWNG" +it=".FSM" +it="AUTH" + +itp=".pti\x03\x01\x00\x00" + +j2b="MUSE\xDE\xAD\xBE\xAF" +j2b="MUSE\xDE\xAD\xBA\xBE" +j2b="AMFF" +j2b="AM " +j2b="MAIN" +j2b="INIT" +j2b="ORDR" +j2b="AI " +j2b="AS " + +MDL="DMDL" +# Most chunk IDs are commented out as they are substrings of other dictionary entries +#mdl="IN" +mdl="ME" +#mdl="PA" +#mdl="TR" +mdl="II" +#mdl="VE" +#mdl="PE" +#mdl="FE" +#mdl="IS" +#mdl="SA" + +med="MMD1" + +mo3="MO3\x05" + +# A couple of magic bytes are commented out because they do not modify the loader's behaviour, apart from setting a "made with" string. +mod="M.K." +#mod="M!K!" +mod="M&K!" +mod="N.T." +#mod="FEST" +#mod="NSMS" +#mod="LARD" +mod="OKTA" +#mod="OCTA" +#mod="CD61" +mod="CD81" +#mod="FA08" +mod="FLT8" +#mod="EXO8" +# Depending on the byte offset in the file, we generate either a "xCHN" or "xxCH" magic +mod="99CHN" +mod="TDZ8" +ice="MTN\x00" +ice="IT10" +pt36="CMNT" +pt36="PTDT" +sfx="SO31" +# External Startrekker instrument files. +stam="ST1.3 ModuleINFO" +stam="AudioSculpture10" + +mptm="->MPT_ORIGINAL_IT<-" +mptm=".tpm" +mptm="mptm" +mptm="\x89\x08" +mptm="\x8D\x08" +# No structural changes in these format versions +#mptm="\x8E\x08" +#mptm="\x8F\x08" +#mptm="\x90\x08" +mptm="\x91\x08" +mptm="228\x04" + +mt2="MT20" +#mt2="MadTracker 2.0" +mt2="BPM+" +mt2="TFXM" +mt2="TRKS" +mt2="TRKL" +mt2="PATN" +mt2="MSG\x00" +#mt2="PICT" +mt2="SUM\x00" +mt2="VST2" + +mtm="MTM\x10" + +okt="OKTASONG" +okt="CMOD" +okt="SAMP" +okt="SPEE" +okt="SLEN" +okt="PLEN" +okt="PATT" +okt="PBOD" +okt="SBOD" + +plm="PLM\x1A" +plm="PLS\x1A" + +psm="PSM " +psm="FILE" +psm="TITL" +psm="SDFT" +psm="DATE" +psm="OPLH" +psm="PPAN" +psm="DSAM" +psm="DSMP" +psm="MAINSONG" +psm="\x00\xFF\x00\x00\x01\x00" +psm16="PSM\xFE" +psm16="PORD" +#psm16="PPAN" +psm16="PSAH" +psm16="PPAT" + +ptm="PTMF" +ptm="\x1A\x03\x02" + +s3m="SCRM" +#s3m="SCRS" +#s3m="SCRI" + +stm="\x1A\x02\x15" + +stp="STP3\x02" + +symmod="SymM\x00\x00\x00\x01\xFF\xFF\xFF\xFF\x00\x00\x00" + +ult="MAS_UTrack_V004" + +umx="\xC1\x83\x2A\x9E" +umx="music" +umx="sound" + +xm="Extended Module: " +xm="OpenMPT " +#xm="FastTracker v 2.00 " +xm="MilkyTracker " +xm="text" +xm="MIDI" + +it="..OF" +it="LTTP" +it="PTTF" +it="..Fd" +it="..VG" +it="...P" +it="..EV" +it="..EP" +it=".EiP" +it=".SLV" +it=".ELV" +it=".BSV" +it=".ESV" +it=".SLP" +it=".ELP" +it=".BSP" +it=".ESP" +it="SLiP" +it="ELiP" +it="BSiP" +it="ESiP" +it=".ANN" +it=".TCD" +it=".AND" +it="..SP" +it="..SV" +it=".CFI" +it=".RFI" +it="..BM" +it="..PM" +it="..CM" +it=".SPP" +it=".CPP" +it=".[PV" +it=".[PP" +it="[PiP" +it=".[EV" +it=".[EP" +it="[EiP" +it="..[K" +it="..[n" +it=".[MN" +it=".[nf" +it=".PiM" +it="..RV" +it="...R" +it="..SC" +it="..SR" +it="..MF" +it="HEVP" +it="HOVP" +it="NREP" +it="NREA" +it="NREV" +it="GLFP" +it="GLFA" +it="GLFV" +it="DWPM" + +mmcmp="ziRCONia\x0e\x00" + +xpk="XPKF\x00\x10\x00\x00SQSH" + +pp20="PP20" + +plugin_chorus="OMXD\x9C\x62\xE6\xEF" +plugin_compressor="OMXD\x79\x1F\x01\xEF" +plugin_distortion="OMXD\x90\x4C\x11\xEF" +plugin_echo="OMXD\x2C\x93\x3E\xEF" +plugin_flanger="OMXD\x92\x3D\xCA\xEF" +plugin_gargle="OMXD\x10\x82\xFD\xDA" +plugin_i3dl2reverb="OMXD\x71\x5E\x98\xEF" +plugin_parameq="OMXD\x89\xED\x0C\x12" +plugin_wavesreverb="OMDX\x68\x02\xFC\x87" +plugin_lfo="OMPTLFO " +plugin_dbproecho="DBM0Echo" +plugin_symmodecho="SymMEcho" + +midi="MThd\x00\x00\x00\x06\x00\x01\x00\x01\x01\xE0MTrk" + +wave="WAVEfmt " +wave="data" + +# IFF / AIFF (for SymMOD loader) +iff="FORM" +iff="AIFF" +iff="AIFC" +iff="8SVX" +iff="16SV" +iff="MAUD" +iff="VHDR" +iff="BODY" +iff="CHAN" +iff="MHDR" +iff="MDAT" +iff="NAME" diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh new file mode 100644 index 00000000..833397ef --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/build.sh @@ -0,0 +1,4 @@ +#!/usr/bin/env bash +cd "${0%/*}" +cd ../.. +AFL_HARDEN=1 CONFIG=afl make clean all EXAMPLES=0 TEST=0 OPENMPT123=0 NO_VORBIS=1 NO_VORBISFILE=1 NO_MPG123=1 CHECKED_ADDRESS=1 diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh new file mode 100644 index 00000000..6f67ea49 --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-main.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash +cd "${0%/*}" +. ./fuzz-settings.sh + +# Create tmpfs for storing temporary fuzzing data +mkdir $FUZZING_TEMPDIR +sudo mount -t tmpfs -o size=300M none $FUZZING_TEMPDIR +rm -rf $FUZZING_TEMPDIR/bin +mkdir $FUZZING_TEMPDIR/bin +cp -d ../../bin/* $FUZZING_TEMPDIR/bin/ + +#export AFL_PRELOAD=$AFL_DIR/libdislocator.so +LD_LIBRARY_PATH=$FUZZING_TEMPDIR/bin $AFL_DIR/afl-fuzz -p exploit -f $FUZZING_TEMPDIR/infile01 -x all_formats.dict -t $FUZZING_TIMEOUT $FUZZING_INPUT -o $FUZZING_FINDINGS_DIR -D -M fuzzer01 $FUZZING_TEMPDIR/bin/fuzz $FUZZING_TEMPDIR/infile01 diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh new file mode 100644 index 00000000..2d6a867b --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary1.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash +cd "${0%/*}" +. ./fuzz-settings.sh + +#export AFL_PRELOAD=$AFL_DIR/libdislocator.so +LD_LIBRARY_PATH=$FUZZING_TEMPDIR/bin $AFL_DIR/afl-fuzz -p coe -f $FUZZING_TEMPDIR/infile02 -x all_formats.dict -t $FUZZING_TIMEOUT $FUZZING_INPUT -o $FUZZING_FINDINGS_DIR -S fuzzer02 $FUZZING_TEMPDIR/bin/fuzz $FUZZING_TEMPDIR/infile02 diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh new file mode 100644 index 00000000..97b28395 --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-secondary2.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash +cd "${0%/*}" +. ./fuzz-settings.sh + +#export AFL_PRELOAD=$AFL_DIR/libdislocator.so +LD_LIBRARY_PATH=$FUZZING_TEMPDIR/bin $AFL_DIR/afl-fuzz -p explore -f $FUZZING_TEMPDIR/infile03 -x all_formats.dict -t $FUZZING_TIMEOUT $FUZZING_INPUT -o $FUZZING_FINDINGS_DIR -S fuzzer03 $FUZZING_TEMPDIR/bin/fuzz $FUZZING_TEMPDIR/infile03 diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh new file mode 100644 index 00000000..1b280673 --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz-settings.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash + +# Input data for fuzzer +# If you run the fuzzer for the first time, specify a directory with some input +# files for the fuzzer, e.g. +# FUZZING_INPUT="-i /home/foo/testcases/" +# If you want to continue fuzzing using the previous findings, use: +# FUZZING_INPUT=-i- +FUZZING_INPUT=-i- + +# Directory to place temporary fuzzing data into +FUZZING_TEMPDIR=~/libopenmpt-fuzzing-temp +# Directory to store permanent fuzzing data (e.g. found crashes) into +FUZZING_FINDINGS_DIR=~/libopenmpt-fuzzing +# Fuzzer timeout in ms, + = don't abort on timeout +FUZZING_TIMEOUT=5000+ +# Path to afl-fuzz binary +AFL_DIR=afl diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c new file mode 100644 index 00000000..653dab6d --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/fuzz.c @@ -0,0 +1,59 @@ +/* + * fuzz.c + * ------ + * Purpose: Tiny libopenmpt user to be used by fuzzing tools + * Notes : (currently none) + * Authors: OpenMPT Devs + * The OpenMPT source code is released under the BSD license. Read LICENSE for more details. + */ + +#include <memory.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <time.h> + +#include <errno.h> +#include <unistd.h> + +#include <libopenmpt/libopenmpt.h> +#include <libopenmpt/libopenmpt_stream_callbacks_file.h> + +#define BUFFERSIZE 450 // shouldn't match OpenMPT's internal mix buffer size (512) +#define SAMPLERATE 22050 + +static int16_t buffer[BUFFERSIZE]; + +int main( int argc, char * argv[] ) { + static FILE * file = NULL; + static openmpt_module * mod = NULL; + static size_t count = 0; + static int i = 0; + (void)argc; +#ifdef __AFL_HAVE_MANUAL_CONTROL + __AFL_INIT(); +#endif + file = fopen( argv[1], "rb" ); + mod = openmpt_module_create( openmpt_stream_get_file_callbacks(), file, NULL, NULL, NULL ); + fclose( file ); + if ( mod == NULL ) return 1; + openmpt_module_ctl_set( mod, "render.resampler.emulate_amiga", (openmpt_module_get_num_orders( mod ) & 1) ? "0" : "1" ); + /* render about a second of the module for fuzzing the actual mix routines */ + for(; i < 50; i++) { + count = openmpt_module_read_mono( mod, SAMPLERATE, BUFFERSIZE, buffer ); + if ( count == 0 ) { + break; + } + } + openmpt_module_set_position_seconds( mod, 1.0 ); + openmpt_module_read_mono( mod, SAMPLERATE, BUFFERSIZE, buffer ); + openmpt_module_set_position_order_row( mod, 3, 16 ); + openmpt_module_read_mono( mod, SAMPLERATE, BUFFERSIZE, buffer ); + + /* fuzz string-related stuff */ + openmpt_free_string ( openmpt_module_get_metadata( mod, "date" ) ); + openmpt_free_string ( openmpt_module_get_metadata( mod, "message" ) ); + openmpt_module_destroy( mod ); + return 0; +} diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh new file mode 100644 index 00000000..16f0c364 --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/get-afl.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +cd "${0%/*}" + +if [ -z "${GET_AFL_VERSION}" ]; then + GET_AFL_VERSION="$(wget --quiet -O - "https://api.github.com/repos/AFLplusplus/AFLplusplus/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")')" +fi +AFL_FILENAME="$GET_AFL_VERSION.tar.gz" +AFL_URL="https://github.com/AFLplusplus/AFLplusplus/archive/$AFL_FILENAME" + +rm $AFL_FILENAME +wget $AFL_URL || exit +tar -xzvf $AFL_FILENAME +rm $AFL_FILENAME +cd AFLplusplus-* +make source-only || exit +cd .. +rm -rf afl +mv AFLplusplus-* afl
\ No newline at end of file diff --git a/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md new file mode 100644 index 00000000..bb19163e --- /dev/null +++ b/Src/external_dependencies/openmpt-trunk/contrib/fuzzing/readme.md @@ -0,0 +1,51 @@ +libopenmpt fuzz suite +===================== + +In this directory, you can find the necessary tools for fuzzing libopenmpt with +the American Fuzzy Lop fuzzer (afl++). + +Contents: + +* `all_formats.dict`: A dictionary containing magic bytes from all supported + module formats to make the life of the fuzzer a bit easier. +* `fuzz-main.sh`: Script to launch the main fuzzing process. If you want to + use just one fuzzer instance, run this one. +* `fuzz-secondary[1|2].sh`: Scripts to launch the secondary fuzzing process. It + is recommended to run at least two fuzzer instances, as the deterministic and + random fuzz mode have been found to complement each other really well. The two + scripts are set up to use different exploration strategies +* `fuzz-settings.sh`: Set up your preferences and afl settings here before the + first run. +* `fuzz.c`: A tiny C program that is used by the fuzzer to test libopenmpt. +* `get-afl.sh`: A simple script to obtain the latest version of afl++. + You can also make it download from a specific branch or tag, e.g. + `GET_AFL_VERSION=stable ./get-afl.sh` to download the latest stable but + unreleased code. + +Prerequisites +============= +* [afl++](https://github.com/AFLplusplus/AFLplusplus) - the makefile expects + this to be installed in `contrib/fuzzing/afl`, as it is automatically done by + the `get-afl.sh` install script. +* Clang with LLVM dev headers (llvm-config needs to be installed). + afl also works with gcc, but our makefile has been set up to make use of afl's + faster LLVM-LTO mode. + +How to use +========== +* Run `get-afl.sh`, or manually extract afl to `contrib/fuzzing/afl`, use + `make source-only` to build. If building fails because `llvm-config` cannot be + found, try prepending `LLVM_CONFIG=/usr/bin/llvm-config-12` or similar, and + read the afl manual. +* Build libopenmpt with the `build.sh` script in this directory. +* Set up `fuzz-settings.sh` to your taste. Most importantly, you will have to + specify the input directory for first use. + The default setup mounts a tmpfs folder for all temporary files. You may + change this behaviour if you do not have root privileges. +* Run `fuzz-main.sh` for the first (deterministic) instance of afl-fuzz. +* For a "secondary" instance to run on another core, run `fuzz-secondary1.sh` + and/or `fuzz-secondary2.sh`. +* If you want to make use of even more cores, create more copies + `fuzz-secondary2.sh` and adjust "infile03" / "fuzzer03" to + "infile04" / "fuzzer04" and so o (they need to be unique). Try variying the + fuzzing strategey (the -p parameter) to get results more quickly. |