Add vgmstream

projects/vgmstream/Dockerfile

@@ -0,0 +1,42 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+FROM gcr.io/oss-fuzz-base/base-builder
+
+# Build deps. We deliberately keep optional codec libs (mpg123, vorbis,
+# speex, opus, ffmpeg) OFF for the initial integration so the build is
+# self-contained, fast, and reproducible. They can be enabled in a
+# follow-up PR once the base integration lands.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    make \
+    cmake \
+    autoconf \
+    automake \
+    libtool \
+    pkg-config \
+    git \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git clone --depth 1 https://github.com/vgmstream/vgmstream.git $SRC/vgmstream
+
+# Fuzzer harness, dictionary, seed-corpus generator, and build script all
+# live alongside this Dockerfile in the OSS-Fuzz repo and get copied in.
+COPY build.sh $SRC/
+COPY vgmstream_fuzz_bnk.c $SRC/
+COPY vgmstream_fuzz_bnk.dict $SRC/
+COPY vgmstream_fuzz_bnk_seedgen.py $SRC/
+
+WORKDIR $SRC/vgmstream

projects/vgmstream/build.sh

@@ -0,0 +1,79 @@
+#!/bin/bash -eu
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+# Build static libvgmstream.a with all optional codec backends disabled.
+# The parser/demuxer code in src/meta/* is reachable without any of them
+# and is the surface we want to fuzz first.
+
+cd $SRC/vgmstream
+
+mkdir -p build_oss_fuzz
+cd build_oss_fuzz
+
+cmake -S .. -B . \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DBUILD_STATIC=ON \
+    -DBUILD_CLI=OFF \
+    -DBUILD_V123=OFF \
+    -DBUILD_AUDACIOUS=OFF \
+    -DBUILD_FB2K=OFF \
+    -DBUILD_WINAMP=OFF \
+    -DBUILD_XMPLAY=OFF \
+    -DUSE_MPEG=OFF \
+    -DUSE_VORBIS=OFF \
+    -DUSE_FFMPEG=OFF \
+    -DUSE_G7221=OFF \
+    -DUSE_G719=OFF \
+    -DUSE_ATRAC9=OFF \
+    -DUSE_CELT=OFF \
+    -DUSE_SPEEX=OFF \
+    -DCMAKE_C_COMPILER="$CC" \
+    -DCMAKE_CXX_COMPILER="$CXX" \
+    -DCMAKE_C_FLAGS="$CFLAGS" \
+    -DCMAKE_CXX_FLAGS="$CXXFLAGS"
+
+make -j$(nproc) libvgmstream
+
+# ----------------------------------------------------------------------------
+# Build the fuzzer harness and link against libvgmstream.a
+# ----------------------------------------------------------------------------
+LIBVGM="$SRC/vgmstream/build_oss_fuzz/src/libvgmstream.a"
+
+$CC $CFLAGS \
+    -I$SRC/vgmstream/src \
+    -c $SRC/vgmstream_fuzz_bnk.c \
+    -o $WORK/vgmstream_fuzz_bnk.o
+
+$CXX $CXXFLAGS \
+    $WORK/vgmstream_fuzz_bnk.o \
+    "$LIBVGM" \
+    $LIB_FUZZING_ENGINE \
+    -lm \
+    -o $OUT/vgmstream_fuzz_bnk
+
+# ----------------------------------------------------------------------------
+# Dictionary
+# ----------------------------------------------------------------------------
+cp $SRC/vgmstream_fuzz_bnk.dict $OUT/vgmstream_fuzz_bnk.dict
+
+# ----------------------------------------------------------------------------
+# Seed corpus — generated at build time so the OSS-Fuzz repo stays small
+# and the seeds always match the harness's expected layout.
+# ----------------------------------------------------------------------------
+mkdir -p $WORK/vgmstream_fuzz_bnk_seeds
+python3 $SRC/vgmstream_fuzz_bnk_seedgen.py $WORK/vgmstream_fuzz_bnk_seeds
+(cd $WORK/vgmstream_fuzz_bnk_seeds && zip -q -r $OUT/vgmstream_fuzz_bnk_seed_corpus.zip .)

projects/vgmstream/project.yaml

@@ -0,0 +1,17 @@
+homepage: "https://github.com/vgmstream/vgmstream"
+language: c++
+primary_contact: "shravankumarsheri39@gmail.com"
+auto_ccs:
+  - "shravankumarsheri39@gmail.com"
+main_repo: "https://github.com/vgmstream/vgmstream.git"
+file_github_issue: true
+sanitizers:
+  - address
+  - undefined
+architectures:
+  - x86_64
+fuzzing_engines:
+  - libfuzzer
+  - afl
+  - honggfuzz
+vendor_ccs: []

projects/vgmstream/vgmstream_fuzz_bnk.c

@@ -0,0 +1,80 @@
+/* Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ******************************************************************************
+ *
+ * vgmstream_fuzz_bnk.c — OSS-Fuzz harness for vgmstream's format dispatch.
+ *
+ * Despite the name, this harness is not BNK-specific. It writes the
+ * fuzzer-supplied buffer to a tmp file in /dev/shm and calls
+ * init_vgmstream(), which walks vgmstream's full demuxer dispatch table
+ * (~447 formats in src/meta/*) until one matches. A single corpus
+ * therefore exercises every parser in the library; the seed corpus and
+ * dictionary are biased toward Sony BNK because that is the format with
+ * the highest manually-verified bug density.
+ *
+ * Per-iteration cost is one mkstemp + one write + one init_vgmstream
+ * call + one close + one unlink, all on tmpfs.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/types.h>
+
+#include "vgmstream.h"
+
+/* 8 MiB cap. vgmstream demuxers do their own bounds checks but we want
+ * to keep per-iteration disk write small. Plenty of room for any
+ * realistic header + a few sample frames. */
+#define VGMSTREAM_FUZZ_MAX_SIZE  (8u * 1024u * 1024u)
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size == 0 || size > VGMSTREAM_FUZZ_MAX_SIZE) return 0;
+
+    char path[] = "/dev/shm/vgmstream_fuzz_XXXXXX";
+    int fd = mkstemp(path);
+    if (fd < 0) {
+        /* /dev/shm should always be writable inside OSS-Fuzz runners; if
+         * not, fall back to /tmp so we don't false-negative the corpus. */
+        char path2[] = "/tmp/vgmstream_fuzz_XXXXXX";
+        fd = mkstemp(path2);
+        if (fd < 0) return 0;
+        ssize_t w = write(fd, data, size);
+        close(fd);
+        if (w != (ssize_t)size) { unlink(path2); return 0; }
+        VGMSTREAM *v = init_vgmstream(path2);
+        if (v) close_vgmstream(v);
+        unlink(path2);
+        return 0;
+    }
+
+    ssize_t w = write(fd, data, size);
+    close(fd);
+    if (w != (ssize_t)size) {
+        unlink(path);
+        return 0;
+    }
+
+    VGMSTREAM *v = init_vgmstream(path);
+    if (v) close_vgmstream(v);
+
+    unlink(path);
+    return 0;
+}

projects/vgmstream/vgmstream_fuzz_bnk.dict

@@ -0,0 +1,160 @@
+# vgmstream_bnk_dict.txt
+#
+# libFuzzer dictionary for the Phase 1 PS BNK campaign.
+# Tokens drawn from src/meta/bnk_sony.c (1359 LOC, 21 versions).
+#
+# AFL/libFuzzer dict format: name="value" with C-style escapes.
+# SOP: fresh per-target file. No reuse.
+
+# ============================================================================
+# BNK file-header magics (offset 0x00)
+# ============================================================================
+# Container version 1 — little-endian uint32 = 1
+container_v1_le="\x01\x00\x00\x00"
+# Container version 3 — little-endian uint32 = 3
+container_v3_le="\x03\x00\x00\x00"
+# Big-endian variants (rare PS3 cases)
+container_v1_be="\x00\x00\x00\x01"
+container_v3_be="\x00\x00\x00\x03"
+
+# ============================================================================
+# SBlk subblock magics (at sblk_offset)
+# ============================================================================
+sblk_magic="SBlk"
+sbv2_magic="SBv2"
+# Reversed (BE platforms with flipped IDs)
+sblk_be="klBS"
+sbv2_be="2vBS"
+zlsd_magic="ZLSD"
+data_magic="DATA"
+mmid_magic="MMID"
+
+# ============================================================================
+# sblk_version values from bnk_sony.c switch statements
+# ============================================================================
+ver_01="\x01\x00\x00\x00"
+ver_02="\x02\x00\x00\x00"
+ver_02_be="\x02\x00\x00\x00"
+ver_03="\x03\x00\x00\x00"
+ver_04="\x04\x00\x00\x00"
+ver_05="\x05\x00\x00\x00"
+ver_08="\x08\x00\x00\x00"
+ver_09="\x09\x00\x00\x00"
+ver_0c="\x0c\x00\x00\x00"
+ver_0d="\x0d\x00\x00\x00"
+ver_0e="\x0e\x00\x00\x00"
+ver_0f="\x0f\x00\x00\x00"
+ver_10="\x10\x00\x00\x00"
+ver_1a="\x1a\x00\x00\x00"
+ver_1c="\x1c\x00\x00\x00"
+ver_23="\x23\x00\x00\x00"
+
+# ============================================================================
+# Section count values
+# ============================================================================
+sections_2="\x02\x00\x00\x00"
+sections_3="\x03\x00\x00\x00"
+
+# ============================================================================
+# Common offset constants used in process_tables() switch
+# ============================================================================
+off_0x14="\x14\x00\x00\x00"
+off_0x16="\x16\x00\x00\x00"
+off_0x18="\x18\x00\x00\x00"
+off_0x1a="\x1a\x00\x00\x00"
+off_0x1c="\x1c\x00\x00\x00"
+off_0x20="\x20\x00\x00\x00"
+off_0x24="\x24\x00\x00\x00"
+off_0x28="\x28\x00\x00\x00"
+off_0x2c="\x2c\x00\x00\x00"
+off_0x30="\x30\x00\x00\x00"
+off_0x34="\x34\x00\x00\x00"
+off_0x38="\x38\x00\x00\x00"
+off_0x3c="\x3c\x00\x00\x00"
+off_0x120="\x20\x01\x00\x00"
+off_0x128="\x28\x01\x00\x00"
+off_0x98="\x98\x00\x00\x00"
+off_0xb0="\xb0\x00\x00\x00"
+
+# ============================================================================
+# Boundary values for entry counts (uint16) — likely to trigger int overflow
+# ============================================================================
+count_max="\xff\xff"
+count_high="\xff\x7f"
+count_zero="\x00\x00"
+count_one="\x01\x00"
+count_2k="\x00\x08"
+
+# ============================================================================
+# Boundary values for offsets (uint32)
+# ============================================================================
+offset_max="\xff\xff\xff\xff"
+offset_neg1="\xff\xff\xff\xff"
+offset_high="\x00\x00\x00\x80"
+offset_2g="\x00\x00\x00\x80"
+
+# ============================================================================
+# Codec enum values from bnk_codec enum (NONE..XVAG_ATRAC9)
+# ============================================================================
+codec_NONE="\x00\x00\x00\x00"
+codec_DUMMY="\x01\x00\x00\x00"
+codec_EXTERNAL="\x02\x00\x00\x00"
+codec_PSX="\x03\x00\x00\x00"
+codec_PCM16="\x04\x00\x00\x00"
+codec_MPEG="\x05\x00\x00\x00"
+codec_ATRAC9="\x06\x00\x00\x00"
+codec_HEVAG="\x07\x00\x00\x00"
+codec_RIFF_ATRAC9="\x08\x00\x00\x00"
+codec_XVAG_ATRAC9="\x09\x00\x00\x00"
+
+# ============================================================================
+# Tokens libFuzzer auto-discovered during quick sanity run (cross-format)
+# ============================================================================
+csbh_magic="CSBH"
+dbw_magic="_DBW"
+common_le_zero="\x00\x00\x00\x02"
+mask_03="\xff\xff\xff\x03"
+mask_00="\xff\xff\xff\x00"
+
+# ============================================================================
+# RIFF/WAV markers (for cross-format mutation since the harness covers all
+# 447 demuxers and many container parsers RIFF-derive)
+# ============================================================================
+riff_magic="RIFF"
+wave_magic="WAVE"
+fmt_magic="fmt "
+data_chunk="data"
+list_chunk="LIST"
+fact_chunk="fact"
+smpl_chunk="smpl"
+
+# ============================================================================
+# Subsong / cuesheet markers (CRI ACB, EA SCHl, etc.)
+# ============================================================================
+acb_magic="@UTF"
+cri_magic="CRID"
+schl_magic="SCHl"
+schb_magic="SCHb"
+sche_magic="SCHe"
+
+# ============================================================================
+# Wwise markers
+# ============================================================================
+bkhd_magic="BKHD"
+didx_magic="DIDX"
+wem_magic="\x46\x53\x42\x35"
+
+# ============================================================================
+# Nintendo DSP / GameCube markers
+# ============================================================================
+dsp_magic="DSP "
+ngc_magic="NGC1"
+brstm_magic="RSTM"
+brwav_magic="RWAV"
+fwav_magic="FWAV"
+
+# ============================================================================
+# Ubisoft Soundbank
+# ============================================================================
+ubi_sb_magic="UbiB"
+ubi_bao_magic="\x40\x42\x4f\x4e"