28 Aug 2017 · 3 min read

Fuzzing libVLC - Final Report

<blockquote> <p>Update: My fuzz targets have been merged into the VLC mainline tree by commits <a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/74e7bd240d5b239d0eeb3b67a7511b8b83cb6694">74e7bd2</a>, <a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/b83e9fe08d12ae798390bfa64c08096801fcd8c1">b83e9f2</a>.</p> </blockquote> <blockquote> <p><em>Introduction to my GSoC project <a href="https://shaleenjain.com/blog/why-fuzz-vlc/">here</a></em></p> </blockquote> <p>Majority of the parsing code of VLC has been successfully setup to be fuzzed by:</p> <ul> <li>The demux fuzz target which creates an input stream from the fuzzed input provided by libfuzzer, probes and loads an appropriate demux module and demultiplexes the input into the various output elementary streams, minimally handling all the ES callbacks and calling various demux_Control’s to increase code coverage.</li> </ul> <span id="continue-reading"></span> <ul> <li>The decoder fuzz target by creating a packetizer and a decoder instance while ignoring the stream out, packetizing the input block and then proceeding to decode the various packetized blocks. Hardware decoding as been disabled, so that we only test the codecs included in VLC and the module itself though many of the codecs are provided by 3rd party libraries.</li> </ul> <p>These two fuzz targets cover over 35 demux modules and 64 different codec modules or 163k lines of code which is 20.7% of the VLC code base.</p> <p>Actual code coverage as measured by libFuzzer would be different if not more but since as of now VLC is unable to build with the clang linker, I do not have that coverage information.</p> <h4 id="some-additional-challenges-and-features-were"><a class="zola-anchor" href="#some-additional-challenges-and-features-were" aria-label="Anchor link for: some-additional-challenges-and-features-were">🔗</a> Some additional challenges and features were</h4> <ul> <li>adding first class support for sanitizers in the VLC build system. You can now compile VLC with sanitizers just by using the –with-sanitizer switch. These changes are merged into the mainline, more details <a rel="noopener nofollow noreferrer external" target="_blank" href="http://git.videolan.org/?p=vlc.git;a=commit;h=2bc9957c615d9505f89d88511a0d6ef3889b392b">here</a></li> <li>finding and adding sample inputs of various video file formats and containers and elementary streams encoded with different codecs for the fuzz targets</li> <li>Creating a dictionary of various tokens and FourCC’s used to separate the various chunks and atoms in container formats.</li> </ul> <h4 id="code"><a class="zola-anchor" href="#code" aria-label="Anchor link for: code">🔗</a> Code</h4> <p>Since VideoLAN has still not decided whether to use Google’s OSS-fuzz or agree to their terms and doesn’t want this code to be misused by hackers, they have decided not to keep this in the mainline tree to minimize exposure.</p> <p>And so here are all of my out of tree patches:</p> <ul> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="http://git.videolan.org/?p=vlc.git;a=commit;h=57949e7a9b9da4d9130db0359199b16fca1b061c">57949e7a9b9da4d9130db0359199b16fca1b061c</a> (merged)</li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="http://git.videolan.org/?p=vlc.git;a=commit;h=2bc9957c615d9505f89d88511a0d6ef3889b392b">2bc9957c615d9505f89d88511a0d6ef3889b392b</a> (merged)</li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/commit/583b4b6ed83e64cf52ab75d0d5163a360d626ec6">583b4b6ed83e64cf52ab75d0d5163a360d626ec6</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/commit/89cc31145c47cb3769d9c3258a1d2baa4d563c37">89cc31145c47cb3769d9c3258a1d2baa4d563c37</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/commit/c893f6597efc23cf234af12f09d05510c0c744c3">c893f6597efc23cf234af12f09d05510c0c744c3</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/commit/ef80ea254005e84589dd310abe87ce0d3d2a0c90">ef80ea254005e84589dd310abe87ce0d3d2a0c90</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/commit/f03556549bd074f724d47901bd58d730d12998d6">f03556549bd074f724d47901bd58d730d12998d6</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/commit/23f2e30f4a6241bc3476414ac187d1e7e8169dd3">23f2e30f4a6241bc3476414ac187d1e7e8169dd3</a></li> </ul> <p>My main work repo has been <a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/">code.videolan.org/GSoC2017/shalzz/vlc</a> with all my commit history in the master branch and final patches in the <a rel="noopener nofollow noreferrer external" target="_blank" href="https://code.videolan.org/GSoC2017/shalzz/vlc/tree/release">release</a> branch. There is a clone of the repo on <a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/Shalzz/vlc">github</a> as well.</p> <p>To run the code,</p> <ol> <li>clone the repo and build vlc instrumented with one or more of the sanitizers using the new <code>--with-sanitizer=</code> switch.</li> <li>Get and build libFuzzer by changing into the test/fuzz/ directory and using the <code>./build-libfuzzer.sh</code> script</li> <li>Build the fuzz target binaries by running <code>make check</code>.</li> <li>Run the fuzz targets manually or by using the <code>./run-fuzzer.sh</code> helper script</li> </ol> <h4 id="bug-trophy"><a class="zola-anchor" href="#bug-trophy" aria-label="Anchor link for: bug-trophy">🔗</a> Bug Trophy</h4> <p>As for the number of bugs found by the initial fuzzing done on my small laptop there have been quite a few, all of which have been fixed, by me and other VLC developers. Few of them:</p> <ul> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/6c947b775d4d6c6ed07ebde140bddd3a2007b41a">6c947b775d4d6c6ed07ebde140bddd3a2007b41a</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/a672ea060efbb5898e1d80327f5909a43e8b57d8">a672ea060efbb5898e1d80327f5909a43e8b57d8</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/b2fb79e3201c5ce77a176b52936835ce195aa986">b2fb79e3201c5ce77a176b52936835ce195aa986</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/1de4047a25cd336d1539ea0867c29180928dd230">1de4047a25cd336d1539ea0867c29180928dd230</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/7033852e1a8292734e1d5800bec864bb5fb24c30">7033852e1a8292734e1d5800bec864bb5fb24c30</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/3266d738e906b38b53f7936f58565441d0652713">3266d738e906b38b53f7936f58565441d0652713</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/4b76784615f74254a7b66e34ff78393b44af2ed5">4b76784615f74254a7b66e34ff78393b44af2ed5</a></li> <li><a rel="noopener nofollow noreferrer external" target="_blank" href="https://github.com/videolan/vlc/commit/7eea089393d6fc1de3436b4d486a466d14566a04">7eea089393d6fc1de3436b4d486a466d14566a04</a></li> </ul> <h4 id="continuous-fuzzing"><a class="zola-anchor" href="#continuous-fuzzing" aria-label="Anchor link for: continuous-fuzzing">🔗</a> Continuous Fuzzing</h4> <p>One thing that’s left to do is setting up of a continuous fuzzing server. Since OSS-fuzz is not in the picture right now, that is something VLC devs will have to do on their own infrastructure.</p>