1# Fuzzer for libcmd_fuzzer
2
3## Plugin Design Considerations
4The fuzzer plugin for libcmd is designed based on the understanding of the library and tries to achieve the following:
5
6##### Maximize code coverage
7The configuration parameters are not hardcoded, but instead selected based on
8incoming data. This ensures more code paths are reached by the fuzzer.
9
10libcmd supports the following parameters:
111. In (parameter name: `in`)
122. Out (parameter name: `out`)
133. Err (parameter name: `err`)
144. Run Mode (parameter name: `runMode`)
15
16| Parameter| Valid Values| Configured Value|
17|------------- |-------------| ----- |
18| `in` | `INT32_MIN` to `INT32_MAX` | Value obtained from FuzzedDataProvider|
19| `out` | `INT32_MIN` to `INT32_MAX` | Value obtained from FuzzedDataProvider|
20| `err` | `INT32_MIN` to `INT32_MAX` | Value obtained from FuzzedDataProvider|
21| `runMode` | 1.`RunMode::kStandalone` 2. `RunMode::kLibrary` | Value chosen from valid values using FuzzedDataProvider|
22
23This also ensures that the plugin is always deterministic for any given input.
24
25##### Maximize utilization of input data
26The plugin feeds the entire input data to the cmd module.
27This ensures that the plugin tolerates any kind of input (empty, huge,
28malformed, etc) and doesnt `exit()` on any input and thereby increasing the
29chance of identifying vulnerabilities.
30
31## Build
32
33This describes steps to build cmd_fuzzer binary.
34
35### Android
36
37#### Steps to build
38Build the fuzzer
39```
40  $ mm -j$(nproc) cmd_fuzzer
41```
42#### Steps to run
43To run on device
44```
45  $ adb sync data
46  $ adb shell /data/fuzz/${TARGET_ARCH}/cmd_fuzzer/cmd_fuzzer
47```
48
49## References:
50 * http://llvm.org/docs/LibFuzzer.html
51 * https://github.com/google/oss-fuzz
52