| | 31 | |
| | 32 | === Testing protocol === |
| | 33 | |
| | 34 | The zzuf commands used to find bugs were rather straightforward. A few flags are recurrent: |
| | 35 | * `-r0.0001:0.02` to try several fuzzing ratios |
| | 36 | * `-s0:10000` to stop after 10000 tries |
| | 37 | * `-b8` to skip the first 8 bytes and ensure that the file format is not misinterpreted |
| | 38 | |
| | 39 | MPlayer is very easy to test, thanks to its `-benchmark` flag: |
| | 40 | {{{ |
| | 41 | #!sh |
| | 42 | % zzuf -vq -c -r0.0001:0.02 -s0:10000 -b8- -j8 -T5 -S mplayer -benchmark \ |
| | 43 | -ao pcm:file=/dev/null -vo md5sum:outfile=/dev/null filename |
| | 44 | }}} |
| | 45 | |
| | 46 | VLC doesn’t provide a benchmark flag, forcing us to spawn a lot more parallel processes using `-j`, so that the test goes a bit faster: |
| | 47 | {{{ |
| | 48 | #!sh |
| | 49 | % zzuf -vq -c -r0.0001:0.02 -s0:10000 -b8- -j80 vlc -I dummy \ |
| | 50 | -A dummy -V dummy filename vlc://quit |
| | 51 | }}} |
| | 52 | |
| | 53 | GStreamer is as easy to test as MPlayer: |
| | 54 | {{{ |
| | 55 | #!sh |
| | 56 | % zzuf -vq -I'orig.*' -r0.0001:0.02 -s0:10000 -b8- -j5 -S gst-launch-0.10 \ |
| | 57 | filesrc location=filename '!' decodebin '!' fakesink |
| | 58 | }}} |
| | 59 | |
| | 60 | I could not find a benchmark mode for xine, so I tested it using the libcaca output: |
| | 61 | {{{ |
| | 62 | #!sh |
| | 63 | % CACA_DRIVER=raw zzuf -vq -c -r0.0001:0.02 -s0:10000 -b8- -j15 -S cacaxine -A none -q filename |
| | 64 | }}} |
| | 65 | |
| | 66 | Finally, mpg321 and ogg123 don’t have a benchmark mode either. We increase the `-j` value as well: |
| | 67 | {{{ |
| | 68 | #!sh |
| | 69 | % zzuf -vq -c -r0.0001:0.02 -s0:10000 -b8- -j10 mpg321 filename |
| | 70 | % zzuf -vq -c -r0.0001:0.02 -s0:10000 -b8- -j10 ogg123 -d null filename |
| | 71 | }}} |