UniBench

March 17, 2021 · View on GitHub

20 benchmark programs

If you are going to fuzz these programs, checkout our Dockerfile repo for building with fuzzers!

Structed Data (id, prog, commandline, seed_folder)

data = [
    #id, prog, commandline, seed_folder
    [1, "exiv2", "@@", "jpg"],
    [2,"tiffsplit","@@","tiff"],
    [3,"mp3gain","@@","mp3"],
    [4,"wav2swf","-o /dev/null @@","wav"],
    [5,"pdftotext","@@ /dev/null","pdf"],
    [6,"infotocap","-o /dev/null @@","text"],
    [7,"mp42aac","@@ /dev/null","mp4"],
    [8,"flvmeta","@@","flv"],
    [9,"objdump","-S @@","obj"],
    [14, "tcpdump", "-e -vv -nr @@", "tcpdump100"],
    [15, "ffmpeg", "-y -i @@ -c:v mpeg4 -c:a copy -f mp4 /dev/null", "ffmpeg100"],
    [16, "gdk-pixbuf-pixdata", "@@ /dev/null", "pixbuf"],
    [17, "cflow", "@@", "cflow"],
    [18, "nm-new", "-A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D @@", "nm"],
    [19, "sqlite3", " < @@", "sql"],
    [20, "lame3.99.5", "@@ /dev/null", "lame3.99.5"],
    [21, "jhead", "@@", "jhead"],
    [22, "imginfo", "-f @@", "imginfo"],
    [23, "jq", ". @@", "json"],
    [24, "mujs", "@@", "mujs"],
    # below is the LAVA-M settings
    [10,"uniq","@@","uniq"],
    [11,"base64","-d @@","base64"],
    [12,"md5sum","-c @@","md5sum"],
    [13,"who","@@","who"],
]

Image

Program	Version	Official Website	Get Latest	Issue	Fuzzing Arguments	CVE
exiv2	0.26	https://www.exiv2.org/	https://github.com/Exiv2/exiv2	github	@@	link
gdk-pixbuf-pixdata	gdk-pixbuf 2.31.1	https://developer.gnome.org/gdk-pixbuf/	https://gitlab.gnome.org/GNOME/gdk-pixbuf	gitlab	@@ /dev/null	link
imginfo	jasper 2.0.12	https://www.ece.uvic.ca/~frodo/jasper/	https://github.com/mdadams/jasper	github bugzilla	-f @@	link
jhead	3.00	https://www.sentex.ca/~mwandel/jhead/		Bugzilla redhat ubuntu	@@	link
tiffsplit	libtiff 3.9.7	https://gitlab.com/libtiff/libtiff	https://gitlab.com/libtiff/libtiff	gitlab	@@	link

Audio

Attention: running mp3gain may change the input file, make a copy of your crash files before validating, otherwise you may not be able to reproduce crashes.

Program	Version	Official Website	Get Latest	Issue	Fuzzing Arguments	CVE link
lame	3.99.5	https://lame.sourceforge.io/	https://sourceforge.net/p/lame/svn/HEAD/tree/trunk/lame/	sourceforge	@@ /dev/null	link
mp3gain	1.5.2	http://mp3gain.sourceforge.net/	https://sourceforge.net/p/mp3gain/code/ci/master/tree/mp3gain/	sourceforge	@@ (Attention: input file will be overwritten)	link
wav2swf	swftools 0.9.2	http://swftools.org/	https://github.com/matthiaskramm/swftools	github	-o /dev/null @@	link

Video

Program	Version	Official Website	Get Latest	Issue	Fuzzing Arguments	CVE link
ffmpeg	4.0.1	https://www.ffmpeg.org/	https://git.ffmpeg.org/ffmpeg.git	debian	-y -i @@ -c:v mpeg4 -c:a copy -f mp4 /dev/null	link
flvmeta	1.2.1	https://www.flvmeta.com/	https://github.com/noirotm/flvmeta	github	@@	N.A.
mp42aac	Bento4 1.5.1-628	https://www.bento4.com/	https://github.com/axiomatic-systems/Bento4	github	@@ /dev/null	link

Text

Note: infotocap is actually binary tic, the name infotocap should not be changed. This is like busybox, which functionality is determined by its binary name

Program	Version	Official Website	Get Latest	Issue	Fuzzing Arguments	CVE link
cflow	1.6	https://www.gnu.org/software/cflow/	https://git.savannah.gnu.org/cgit/cflow.git	maillist bug-cflow@gnu.org	@@	link
infotocap	ncurses 6.1	https://www.gnu.org/software/ncurses/	http://invisible-mirror.net/archives/ncurses/current/	maillist bug-ncurses@gnu.org	-o /dev/null @@	link
jq	1.5	https://stedolan.github.io/jq/	https://github.com/stedolan/jq	github	. @@	link
mujs	1.0.2	https://mujs.com/	https://github.com/ccxvii/mujs	github bugzilla	@@	link
pdftotext	4.00	https://www.xpdfreader.com/	https://www.xpdfreader.com/download.html	forum	@@ /dev/null	link
sqlite3	SQLite 3.8.9	https://www.sqlite.org/index.html	https://www.sqlite.org/cgi/src/doc/trunk/README.md	tickets	(stdin)	link

Binary

Program	Version	Official Website	Get Latest	Issue	Fuzzing Arguments	CVE link
nm	binutils 5279478	https://www.gnu.org/software/binutils/	http://sourceware.org/git/?p=binutils-gdb.git	bugzilla	-A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D @@	link
objdump	binutils 2.28	https://www.gnu.org/software/binutils/	http://sourceware.org/git/?p=binutils-gdb.git	bugzilla	-S @@	link

Network

Program	Version	Official Website	Get Latest	Issue	Fuzzing Arguments	CVE link
tcpdump	4.8.1 + libpcap 1.8.1	https://www.tcpdump.org/	https://github.com/the-tcpdump-group/tcpdump	github	-e -vv -nr @@	link