28 Aug 2017 · 3 min read

Fuzzing libVLC - Final Report

Update: My fuzz targets have been merged into the VLC mainline tree by commits 74e7bd2, b83e9f2.

Introduction to my GSoC project here

Majority of the parsing code of VLC has been successfully setup to be fuzzed by:

The demux fuzz target which creates an input stream from the fuzzed input provided by libfuzzer, probes and loads an appropriate demux module and demultiplexes the input into the various output elementary streams, minimally handling all the ES callbacks and calling various demux_Control’s to increase code coverage.

The decoder fuzz target by creating a packetizer and a decoder instance while ignoring the stream out, packetizing the input block and then proceeding to decode the various packetized blocks. Hardware decoding as been disabled, so that we only test the codecs included in VLC and the module itself though many of the codecs are provided by 3rd party libraries.

These two fuzz targets cover over 35 demux modules and 64 different codec modules or 163k lines of code which is 20.7% of the VLC code base.

Actual code coverage as measured by libFuzzer would be different if not more but since as of now VLC is unable to build with the clang linker, I do not have that coverage information.

🔗 Some additional challenges and features were

adding first class support for sanitizers in the VLC build system. You can now compile VLC with sanitizers just by using the –with-sanitizer switch. These changes are merged into the mainline, more details here
finding and adding sample inputs of various video file formats and containers and elementary streams encoded with different codecs for the fuzz targets
Creating a dictionary of various tokens and FourCC’s used to separate the various chunks and atoms in container formats.

🔗 Code

Since VideoLAN has still not decided whether to use Google’s OSS-fuzz or agree to their terms and doesn’t want this code to be misused by hackers, they have decided not to keep this in the mainline tree to minimize exposure.

And so here are all of my out of tree patches:

My main work repo has been code.videolan.org/GSoC2017/shalzz/vlc with all my commit history in the master branch and final patches in the release branch. There is a clone of the repo on github as well.

To run the code,

clone the repo and build vlc instrumented with one or more of the sanitizers using the new --with-sanitizer= switch.
Get and build libFuzzer by changing into the test/fuzz/ directory and using the ./build-libfuzzer.sh script
Build the fuzz target binaries by running make check.
Run the fuzz targets manually or by using the ./run-fuzzer.sh helper script

🔗 Bug Trophy

As for the number of bugs found by the initial fuzzing done on my small laptop there have been quite a few, all of which have been fixed, by me and other VLC developers. Few of them:

🔗 Continuous Fuzzing

One thing that’s left to do is setting up of a continuous fuzzing server. Since OSS-fuzz is not in the picture right now, that is something VLC devs will have to do on their own infrastructure.