1# Fuzzer for libfastboot
2
3## Plugin Design Considerations
4The fuzzer plugin for libfastboot is designed based on the understanding of the
5source code and tries to achieve the following:
6
7##### Maximize code coverage
8The configuration parameters are not hardcoded, but instead selected based on
9incoming data. This ensures more code paths are reached by the fuzzer.
10
11libfastboot supports the following parameters:
121. Year (parameter name: `year`)
132. Month (parameter name: `month`)
143. Day (parameter name: `day`)
154. Version (parameter name: `version`)
165. Fs Option (parameter name: `fsOption`)
17
18| Parameter| Valid Values| Configured Value|
19|------------- |-------------| ----- |
20| `year` | `2000` to `2127` | Value obtained from FuzzedDataProvider|
21| `month` | `1` to `12` | Value obtained from FuzzedDataProvider|
22| `day` | `1` to `31` | Value obtained from FuzzedDataProvider|
23| `version` | `0` to `127` | Value obtained from FuzzedDataProvider|
24| `fsOption` | 0. `casefold` 1. `projid` 2. `compress` | Value obtained from FuzzedDataProvider|
25
26##### Maximize utilization of input data
27The plugin feeds the entire input data to the module.
28This ensures that the plugin tolerates any kind of input (empty, huge,
29malformed, etc) and doesnt `exit()` on any input and thereby increasing the
30chance of identifying vulnerabilities.
31
32## Build
33
34This describes steps to build fastboot_fuzzer binary.
35
36### Android
37
38#### Steps to build
39Build the fuzzer
40```
41  $ mm -j$(nproc) fastboot_fuzzer_fuzzer
42```
43#### Steps to run
44To run on host
45```
46  $ $ANDROID_HOST_OUT/fuzz/${TARGET_ARCH}/fastboot_fuzzer/fastboot_fuzzer CORPUS_DIR
47```
48
49## References:
50 * http://llvm.org/docs/LibFuzzer.html
51 * https://github.com/google/oss-fuzz
52