Awesome
UniBench
20 benchmark programs
If you are going to fuzz these programs, checkout our Dockerfile repo for building with fuzzers!
Structed Data (id, prog, commandline, seed_folder)
data = [
#id, prog, commandline, seed_folder
[1, "exiv2", "@@", "jpg"],
[2,"tiffsplit","@@","tiff"],
[3,"mp3gain","@@","mp3"],
[4,"wav2swf","-o /dev/null @@","wav"],
[5,"pdftotext","@@ /dev/null","pdf"],
[6,"infotocap","-o /dev/null @@","text"],
[7,"mp42aac","@@ /dev/null","mp4"],
[8,"flvmeta","@@","flv"],
[9,"objdump","-S @@","obj"],
[14, "tcpdump", "-e -vv -nr @@", "tcpdump100"],
[15, "ffmpeg", "-y -i @@ -c:v mpeg4 -c:a copy -f mp4 /dev/null", "ffmpeg100"],
[16, "gdk-pixbuf-pixdata", "@@ /dev/null", "pixbuf"],
[17, "cflow", "@@", "cflow"],
[18, "nm-new", "-A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D @@", "nm"],
[19, "sqlite3", " < @@", "sql"],
[20, "lame3.99.5", "@@ /dev/null", "lame3.99.5"],
[21, "jhead", "@@", "jhead"],
[22, "imginfo", "-f @@", "imginfo"],
[23, "jq", ". @@", "json"],
[24, "mujs", "@@", "mujs"],
# below is the LAVA-M settings
[10,"uniq","@@","uniq"],
[11,"base64","-d @@","base64"],
[12,"md5sum","-c @@","md5sum"],
[13,"who","@@","who"],
]
Image
Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE |
---|---|---|---|---|---|---|
exiv2 | 0.26 | https://www.exiv2.org/ | https://github.com/Exiv2/exiv2 | github | @@ | link |
gdk-pixbuf-pixdata | gdk-pixbuf 2.31.1 | https://developer.gnome.org/gdk-pixbuf/ | https://gitlab.gnome.org/GNOME/gdk-pixbuf | gitlab | @@ /dev/null | link |
imginfo | jasper 2.0.12 | https://www.ece.uvic.ca/~frodo/jasper/ | https://github.com/mdadams/jasper | github bugzilla | -f @@ | link |
jhead | 3.00 | https://www.sentex.ca/~mwandel/jhead/ | Bugzilla redhat ubuntu | @@ | link | |
tiffsplit | libtiff 3.9.7 | https://gitlab.com/libtiff/libtiff | https://gitlab.com/libtiff/libtiff | gitlab | @@ | link |
Audio
Attention: running mp3gain may change the input file, make a copy of your crash files before validating, otherwise you may not be able to reproduce crashes.
Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
---|---|---|---|---|---|---|
lame | 3.99.5 | https://lame.sourceforge.io/ | https://sourceforge.net/p/lame/svn/HEAD/tree/trunk/lame/ | sourceforge | @@ /dev/null | link |
mp3gain | 1.5.2 | http://mp3gain.sourceforge.net/ | https://sourceforge.net/p/mp3gain/code/ci/master/tree/mp3gain/ | sourceforge | @@ (Attention: input file will be overwritten) | link |
wav2swf | swftools 0.9.2 | http://swftools.org/ | https://github.com/matthiaskramm/swftools | github | -o /dev/null @@ | link |
Video
Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
---|---|---|---|---|---|---|
ffmpeg | 4.0.1 | https://www.ffmpeg.org/ | https://git.ffmpeg.org/ffmpeg.git | debian | -y -i @@ -c:v mpeg4 -c:a copy -f mp4 /dev/null | link |
flvmeta | 1.2.1 | https://www.flvmeta.com/ | https://github.com/noirotm/flvmeta | github | @@ | N.A. |
mp42aac | Bento4 1.5.1-628 | https://www.bento4.com/ | https://github.com/axiomatic-systems/Bento4 | github | @@ /dev/null | link |
Text
Note: infotocap is actually binary tic
, the name infotocap should not be changed. This is like busybox, which functionality is determined by its binary name
Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
---|---|---|---|---|---|---|
cflow | 1.6 | https://www.gnu.org/software/cflow/ | https://git.savannah.gnu.org/cgit/cflow.git | maillist bug-cflow@gnu.org | @@ | link |
infotocap | ncurses 6.1 | https://www.gnu.org/software/ncurses/ | http://invisible-mirror.net/archives/ncurses/current/ | maillist bug-ncurses@gnu.org | -o /dev/null @@ | link |
jq | 1.5 | https://stedolan.github.io/jq/ | https://github.com/stedolan/jq | github | . @@ | link |
mujs | 1.0.2 | https://mujs.com/ | https://github.com/ccxvii/mujs | github bugzilla | @@ | link |
pdftotext | 4.00 | https://www.xpdfreader.com/ | https://www.xpdfreader.com/download.html | forum | @@ /dev/null | link |
sqlite3 | SQLite 3.8.9 | https://www.sqlite.org/index.html | https://www.sqlite.org/cgi/src/doc/trunk/README.md | tickets | (stdin) | link |
Binary
Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
---|---|---|---|---|---|---|
nm | binutils 5279478 | https://www.gnu.org/software/binutils/ | http://sourceware.org/git/?p=binutils-gdb.git | bugzilla | -A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D @@ | link |
objdump | binutils 2.28 | https://www.gnu.org/software/binutils/ | http://sourceware.org/git/?p=binutils-gdb.git | bugzilla | -S @@ | link |
Network
Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
---|---|---|---|---|---|---|
tcpdump | 4.8.1 + libpcap 1.8.1 | https://www.tcpdump.org/ | https://github.com/the-tcpdump-group/tcpdump | github | -e -vv -nr @@ | link |