repo creation with initial code after cloning public repo

fuzz/.gitignore

@@ -0,0 +1 @@
+Findings

fuzz/Emby.Server.Implementations.Fuzz/Emby.Server.Implementations.Fuzz.csproj

@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Reference Include="Emby.Server.Implementations">
+      <HintPath>Emby.Server.Implementations.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../MediaBrowser.Controller/MediaBrowser.Controller.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="AutoFixture" />
+    <PackageReference Include="AutoFixture.AutoMoq" />
+    <PackageReference Include="Moq" />
+    <PackageReference Include="SharpFuzz" />
+  </ItemGroup>
+
+</Project>

fuzz/Emby.Server.Implementations.Fuzz/Program.cs

@@ -0,0 +1,71 @@
+using System;
+using AutoFixture;
+using AutoFixture.AutoMoq;
+using Emby.Server.Implementations.Data;
+using Emby.Server.Implementations.Library;
+using MediaBrowser.Controller;
+using MediaBrowser.Controller.Entities;
+using MediaBrowser.Model.Entities;
+using Microsoft.Extensions.Configuration;
+using Moq;
+using SharpFuzz;
+
+namespace Emby.Server.Implementations.Fuzz
+{
+    public static class Program
+    {
+        public static void Main(string[] args)
+        {
+            switch (args[0])
+            {
+                case "PathExtensions.TryReplaceSubPath": Run(PathExtensions_TryReplaceSubPath); return;
+                case "SqliteItemRepository.ItemImageInfoFromValueString": Run(SqliteItemRepository_ItemImageInfoFromValueString); return;
+                default: throw new ArgumentException($"Unknown fuzzing function: {args[0]}");
+            }
+        }
+
+        private static void Run(Action<string> action) => Fuzzer.OutOfProcess.Run(action);
+
+        private static void PathExtensions_TryReplaceSubPath(string data)
+        {
+            // Stupid, but it worked
+            var parts = data.Split(':');
+            if (parts.Length != 3)
+            {
+                return;
+            }
+
+            _ = PathExtensions.TryReplaceSubPath(parts[0], parts[1], parts[2], out _);
+        }
+
+        private static void SqliteItemRepository_ItemImageInfoFromValueString(string data)
+        {
+            var sqliteItemRepository = MockSqliteItemRepository();
+            sqliteItemRepository.ItemImageInfoFromValueString(data);
+        }
+
+        private static SqliteItemRepository MockSqliteItemRepository()
+        {
+            const string VirtualMetaDataPath = "%MetadataPath%";
+            const string MetaDataPath = "/meta/data/path";
+
+            var appHost = new Mock<IServerApplicationHost>();
+            appHost.Setup(x => x.ExpandVirtualPath(It.IsAny<string>()))
+                .Returns((string x) => x.Replace(VirtualMetaDataPath, MetaDataPath, StringComparison.Ordinal));
+            appHost.Setup(x => x.ReverseVirtualPath(It.IsAny<string>()))
+                .Returns((string x) => x.Replace(MetaDataPath, VirtualMetaDataPath, StringComparison.Ordinal));
+
+            var configSection = new Mock<IConfigurationSection>();
+            configSection.SetupGet(x => x[It.Is<string>(s => s == MediaBrowser.Controller.Extensions.ConfigurationExtensions.SqliteCacheSizeKey)])
+                .Returns("0");
+            var config = new Mock<IConfiguration>();
+            config.Setup(x => x.GetSection(It.Is<string>(s => s == MediaBrowser.Controller.Extensions.ConfigurationExtensions.SqliteCacheSizeKey)))
+                .Returns(configSection.Object);
+
+            IFixture fixture = new Fixture().Customize(new AutoMoqCustomization { ConfigureMembers = true });
+            fixture.Inject(appHost);
+            fixture.Inject(config);
+            return fixture.Create<SqliteItemRepository>();
+        }
+    }
+}

fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt

@@ -0,0 +1 @@
+/fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt/:/home/bond/dev/jellyfin/:/srv/jellyfin/

fuzz/Emby.Server.Implementations.Fuzz/Testcases/SqliteItemRepository.ItemImageInfoFromValueString/test1.txt

@@ -0,0 +1 @@
+/mnt/series/Family Guy/Season 1/Family Guy - S01E01-thumb.jpg*637452096478512963*Primary*1920*1080*WjQbtJtSO8nhNZ%L_Io#R/oaS6o}-;adXAoIn7j[%hW9s:WGw[nN

fuzz/Emby.Server.Implementations.Fuzz/fuzz.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+dotnet build -c Release ../../Emby.Server.Implementations/Emby.Server.Implementations.csproj --output bin
+sharpfuzz bin/Emby.Server.Implementations.dll
+cp bin/Emby.Server.Implementations.dll .
+
+dotnet build
+mkdir -p Findings
+AFL_SKIP_BIN_CHECK=1 afl-fuzz -i "Testcases/$1" -o "Findings/$1" -t 5000 ./bin/Debug/net10.0/Emby.Server.Implementations.Fuzz "$1"

fuzz/Jellyfin.Api.Fuzz/Jellyfin.Api.Fuzz.csproj

@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Reference Include="Jellyfin.Api">
+      <HintPath>Jellyfin.Api.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../MediaBrowser.Common/MediaBrowser.Common.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="SharpFuzz" />
+  </ItemGroup>
+
+</Project>

fuzz/Jellyfin.Api.Fuzz/Program.cs

@@ -0,0 +1,33 @@
+using System;
+using System.Collections.Generic;
+using Jellyfin.Api.Middleware;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.Features;
+using Microsoft.Extensions.Primitives;
+using SharpFuzz;
+
+namespace Jellyfin.Api.Fuzz
+{
+    public static class Program
+    {
+        public static void Main(string[] args)
+        {
+            switch (args[0])
+            {
+                case "UrlDecodeQueryFeature": Run(UrlDecodeQueryFeature); return;
+                default: throw new ArgumentException($"Unknown fuzzing function: {args[0]}");
+            }
+        }
+
+        private static void Run(Action<string> action) => Fuzzer.OutOfProcess.Run(action);
+
+        private static void UrlDecodeQueryFeature(string data)
+        {
+            var dict = new Dictionary<string, StringValues>
+            {
+                { data, StringValues.Empty }
+            };
+            _ = new UrlDecodeQueryFeature(new QueryFeature(new QueryCollection(dict)));
+        }
+    }
+}

fuzz/Jellyfin.Api.Fuzz/Testcases/UrlDecodeQueryFeature/test1.txt

@@ -0,0 +1 @@
+a%3D1%26b%3D2%26c%3D3

fuzz/Jellyfin.Api.Fuzz/fuzz.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+dotnet build -c Release ../../Jellyfin.Api/Jellyfin.Api.csproj --output bin
+sharpfuzz bin/Jellyfin.Api.dll
+cp bin/Jellyfin.Api.dll .
+
+dotnet build
+mkdir -p Findings
+AFL_SKIP_BIN_CHECK=1 afl-fuzz -i "Testcases/$1" -o "Findings/$1" -t 5000 ./bin/Debug/net10.0/Jellyfin.Api.Fuzz "$1"

fuzz/README.md

@@ -0,0 +1,20 @@
+# Jellyfin fuzzing
+
+## Setup
+
+Install AFL++
+```sh
+git clone https://github.com/AFLplusplus/AFLplusplus
+cd AFLplusplus
+make all
+sudo make install
+```
+
+Install SharpFuzz.CommandLine global .NET tool
+```sh
+dotnet tool install --global SharpFuzz.CommandLine
+```
+
+## Running
+Run the `fuzz.sh` in the directory corresponding to the project you want to fuzz.
+The script takes a parameter of which fuzz case you want to run.