20 benchmark programs
If you are going to fuzz these programs, checkout our Dockerfile repo for building with fuzzers!
| Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE |
|---|---|---|---|---|---|---|
| exiv2 | 0.26 | https://www.exiv2.org/ | https://github.com/Exiv2/exiv2 | github | @@ | link |
| gdk-pixbuf-pixdata | gdk-pixbuf 2.31.1 | https://developer.gnome.org/gdk-pixbuf/ | https://gitlab.gnome.org/GNOME/gdk-pixbuf | gitlab | @@ /dev/null | link |
| imginfo | jasper 2.0.12 | https://www.ece.uvic.ca/~frodo/jasper/ | https://github.com/mdadams/jasper | github bugzilla | -f @@ | link |
| jhead | 3.00 | https://www.sentex.ca/~mwandel/jhead/ | Bugzilla redhat ubuntu | @@ | link | |
| tiffsplit | libtiff 3.9.7 | https://gitlab.com/libtiff/libtiff | https://gitlab.com/libtiff/libtiff | gitlab | @@ | link |
Attention: running mp3gain may change the input file, make a copy of your crash files before validating, otherwise you may not be able to reproduce crashes.
| Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
|---|---|---|---|---|---|---|
| lame | 3.99.5 | https://lame.sourceforge.io/ | https://sourceforge.net/p/lame/svn/HEAD/tree/trunk/lame/ | sourceforge | @@ /dev/null | link |
| mp3gain | 1.5.2 | http://mp3gain.sourceforge.net/ | https://sourceforge.net/p/mp3gain/code/ci/master/tree/mp3gain/ | sourceforge | @@ (Attention: input file will be overwritten) | link |
| wav2swf | swftools 0.9.2 | http://swftools.org/ | https://github.com/matthiaskramm/swftools | github | -o /dev/null @@ | link |
| Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
|---|---|---|---|---|---|---|
| ffmpeg | 4.0.1 | https://www.ffmpeg.org/ | https://git.ffmpeg.org/ffmpeg.git | debian | -y -i @@ -c:v mpeg4 -c:a copy -f mp4 /dev/null | link |
| flvmeta | 1.2.1 | https://www.flvmeta.com/ | https://github.com/noirotm/flvmeta | github | @@ | N.A. |
| mp42aac | Bento4 1.5.1-628 | https://www.bento4.com/ | https://github.com/axiomatic-systems/Bento4 | github | @@ /dev/null | link |
Note: infotocap is actually binary tic, the name infotocap should not be changed. This is like busybox, which functionality is determined by its binary name
| Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
|---|---|---|---|---|---|---|
| cflow | 1.6 | https://www.gnu.org/software/cflow/ | https://git.savannah.gnu.org/cgit/cflow.git | maillist bug-cflow@gnu.org | @@ | link |
| infotocap | ncurses 6.1 | https://www.gnu.org/software/ncurses/ | http://invisible-mirror.net/archives/ncurses/current/ | maillist bug-ncurses@gnu.org | -o /dev/null @@ | link |
| jq | 1.5 | https://stedolan.github.io/jq/ | https://github.com/stedolan/jq | github | . @@ | link |
| mujs | 1.0.2 | https://mujs.com/ | https://github.com/ccxvii/mujs | github bugzilla | @@ | link |
| pdftotext | 4.00 | https://www.xpdfreader.com/ | https://www.xpdfreader.com/download.html | forum | @@ /dev/null | link |
| sqlite3 | SQLite 3.8.9 | https://www.sqlite.org/index.html | https://www.sqlite.org/cgi/src/doc/trunk/README.md | tickets | (stdin) | link |
| Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
|---|---|---|---|---|---|---|
| nm | binutils 5279478 | https://www.gnu.org/software/binutils/ | http://sourceware.org/git/?p=binutils-gdb.git | bugzilla | -A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D @@ | link |
| objdump | binutils 2.28 | https://www.gnu.org/software/binutils/ | http://sourceware.org/git/?p=binutils-gdb.git | bugzilla | -S @@ | link |
| Program | Version | Official Website | Get Latest | Issue | Fuzzing Arguments | CVE link |
|---|---|---|---|---|---|---|
| tcpdump | 4.8.1 + libpcap 1.8.1 | https://www.tcpdump.org/ | https://github.com/the-tcpdump-group/tcpdump | github | -e -vv -nr @@ | link |