Skip to content

Add OSS-Fuzz compatible libFuzzer targets for high-level API#137

Open
s2ongmo wants to merge 1 commit intolieff:masterfrom
s2ongmo:add-oss-fuzz-targets
Open

Add OSS-Fuzz compatible libFuzzer targets for high-level API#137
s2ongmo wants to merge 1 commit intolieff:masterfrom
s2ongmo:add-oss-fuzz-targets

Conversation

@s2ongmo
Copy link
Copy Markdown

@s2ongmo s2ongmo commented Mar 10, 2026

Add OSS-Fuzz compatible fuzz targets for high-level API

Summary

This PR modernizes the existing fuzzing infrastructure and adds three libFuzzer-compatible fuzz targets covering the core decode, buffer load/iterate, and streaming/seek APIs. The goal is to integrate minimp3 into Google's OSS-Fuzz for continuous fuzzing.

Background

The existing fuzzing/fuzz.c is an AFL-only harness (stdin + __AFL_LOOP). The LIBFUZZER path in minimp3_test.c does not compile (calls 4-parameter decode_file with 6 arguments). This PR adds standalone libFuzzer targets that work with OSS-Fuzz's build system while keeping the existing AFL harness intact.

What's Added

fuzz/fuzz_decode_frame.c — Core frame decoder

  • Exercises mp3dec_decode_frame() in a loop over the input buffer
  • Covers minimp3.h (Layer 1/2/3 decode, sync, ID3 skip)

fuzz/fuzz_decode_buf.c — Buffer decode + iteration

  • Exercises mp3dec_load_buf() and mp3dec_iterate_buf()
  • Covers minimp3_ex.h high-level full-buffer APIs

fuzz/fuzz_decode_ex.c — Streaming API with seek

  • Exercises mp3dec_ex_open_buf(), mp3dec_ex_read(), mp3dec_ex_seek()
  • Covers the streaming/seeking code paths in minimp3_ex.h

fuzz/mp3.dict — MP3 format dictionary (frame sync words, ID3/APE/Xing tokens)

Build

# Example: ASAN + libFuzzer
clang -g -O1 -fsanitize=address -I. -c fuzz/fuzz_decode_frame.c -o fuzz_decode_frame.o
clang++ -g -O1 -fsanitize=address,fuzzer fuzz_decode_frame.o -o fuzz_decode_frame -lm

All three targets build cleanly with ASAN, UBSAN, and MSAN.

Notes

  • The existing fuzzing/ directory and minimp3_test.c are untouched.
  • Targets use Apache 2.0 headers per OSS-Fuzz convention.
  • minimp3 is CC0/public domain, so there is no license conflict.
  • I've also identified a memory safety issue in the streaming seek path — will file separately.

Related: #136

@s2ongmo
Copy link
Copy Markdown
Author

s2ongmo commented Mar 13, 2026

Thanks for merging #139 — the fix looks solid. These fuzz targets (fuzz_decode_frame, fuzz_decode_buf, fuzz_decode_ex) were what originally caught that seek truncation bug. Would you be open to merging this PR so the fuzz directory can be used for continuous fuzzing via OSS-Fuzz?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant