View source for Internships/ProjectIdeas/CoverageGuidedDiskImageFuzzer

=== Coverage-guided disk image fuzzing ===

'''Summary:''' Implement a coverage-guided fuzzer for disk images file formats

Fuzz testing runs a program with random inputs to find bugs that lead to crashes or other program failures. Fuzz testing is a popular technique for finding security bugs. 

QEMU has a qcow2 fuzzer (see tests/image-fuzzer). However, this fuzzer is not
coverage-guided, is limited to qcow2 images, and does not run
on [https://google.github.io/oss-fuzz/ OSS-Fuzz]. Therefore the existing fuzzer does not provide a lot of code coverage and a modern coverage-guided fuzzer integrated into OSS-Fuzz is desirable.

Disk image files sometimes come from an untrusted source and this makes QEMU's disk image format code an attack surface. One example is the qemu-img utility that can convert between disk image formats and may be used to import untrusted disk images during virtual machine creation. As such, it is important to fuzz this code effectively.

Your task will be to create a coverage-guided fuzzer for image formats
supported by QEMU. Beyond basic image-parsing code (qemu-img info), the fuzzer should be able
to find bugs in image-conversion code (qemu-img convert). Combined with a corpus of disk image files,
the coverage-guided fuzzer will be able to explore code paths without much built-in knowledge of the about disk image file layout.

Project goals include:
* Implement a fuzzer capable of exploring qemu-img convert and block/qcow2-*.c code.
* Retarget the fuzzer to VMDK (block/vmdk.c) and VHDX (block/vhdx*.c) image files.
* Add the new fuzzer to OSS-Fuzz
* Stretch goal: Support DMG (block/dmg.c), Parallels (block/parallels.c), VDI (block/vdi.c), and VPC (block/vpc.c)

'''Links:'''
* [https://qemu.readthedocs.io/en/latest/tools/qemu-img.html qemu-img(1) - the utility to fuzz]
* [https://gitlab.com/qemu-project/qemu/-/blob/master/docs/interop/qcow2.txt qcow2 file format specification]
* [https://llvm.org/docs/LibFuzzer.html libFuzzer]

'''Details:'''
* Project size: 175 hours
* Difficulty: intermediate
* Required skills: C programming
* Topic/Skill Areas: Fuzzing, libFuzzer/AFL
* Mentor: Alexander Bulekov <alxndr@bu.edu> (a1xndr on IRC)