Peach pit file for fuzzing media players(ex. mplayer) which read wav file. Check out http://peachfuzzer.com/TutorialFileFuzzing.html

wav.xml

<?xml version="1.0" encoding="utf-8"?>
<Peach xmlns="http://phed.org/2008/Peach" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://phed.org/2008/Peach /peach/peach.xsd">

	<!-- Import defaults for Peach instance -->
	<Include ns="default" src="file:defaults.xml"/>

	<DataModel name="Chunk">
		<String name="ID" length="4" padCharacter=" " />
		<Number name="Size" size="32" signed="false">
			<Relation type="size" of="Data"/>
		</Number>
		<Blob name="Data" />
		<Blob name="Pad" lengthType="calc" length="int((int(self.find('Size').getInternalValue()) % 2 == 0) and '0' or '1')" />
	</DataModel>

	<DataModel name="ChunkFmt" ref="Chunk">
		<String name="ID" value="fmt " token="true"/>
		<Block name="Data">
			<Number name="CompressionCode" size="16" signed="false"/>
			<Number name="NumberOfChannels" size="16" signed="false"/>
			<Number name="SampleRate" size="32" signed="false"/>
			<Number name="AverageBytesPerSecond" size="32" signed="false"/>
			<Number name="BlockAlign" size="16" signed="false"/>
			<Number name="SignificantBitsPerSample" size="16" signed="false"/>
			<Number name="ExtraFormatBytes" size="16" signed="false"/>
			<Blob name="ExtraData" />
		</Block>
	</DataModel>

	<DataModel name="ChunkData" ref="Chunk">
		<String name="ID" value="data" token="true"/>
	</DataModel>

	<DataModel name="ChunkFact" ref="Chunk">
		<String name="ID" value="fact" token="true"/>
		<Block name="Data">
			<Number size="32" signed="false"/>
			<Blob/>
		</Block>
	</DataModel>

	<DataModel name="ChunkSint" ref="Chunk">
		<String name="ID" value="sInt" token="true"/>
		<Block name="Data">
			<Number size="32" signed="false"/>
		</Block>
	</DataModel>

	<DataModel name="ChunkWavl" ref="Chunk">
		<String name="ID" value="wavl" token="true"/>
		<Block name="Data">
			<Block name="ArrayOfChunks" maxOccurs="3000">
				<Block ref="ChunkSint"/>
				<Block ref="ChunkData" />
			</Block>
		</Block>
	</DataModel>

	<DataModel name="ChunkCue" ref="Chunk">
		<String name="ID" value="cue " token="true"/>
		<Block name="Data">
			<Block name="ArrayOfCues" maxOccurs="3000">
				<String length="4" />
				<Number size="32" signed="false"/>
				<String length="4" />
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
			</Block>
		</Block>
	</DataModel>

	<DataModel name="ChunkPlst" ref="Chunk">
		<String name="ID" value="plst" token="true"/>
		<Block name="Data">
			<Number name="NumberOfSegments" size="32" signed="false">
				<Relation type="count" of="ArrayOfSegments"/>
			</Number>
			<Block name="ArrayOfSegments" maxOccurs="3000">
				<String length="4" />
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
			</Block>
		</Block>
	</DataModel>

	<DataModel name="ChunkLabl" ref="Chunk">
		<String name="ID" value="labl" token="true"/>
		<Block name="Data">
			<Number size="32" signed="false"/>
			<String nullTerminated="true" />
		</Block>
	</DataModel>

	<DataModel name="ChunkNote" ref="ChunkLabl">
		<String name="ID" value="note" token="true"/>
	</DataModel>

	<DataModel name="ChunkLtxt" ref="Chunk">
		<String name="ID" value="ltxt" token="true"/>
		<Block name="Data">
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="16" signed="false"/>
			<Number size="16" signed="false"/>
			<Number size="16" signed="false"/>
			<Number size="16" signed="false"/>
			<String nullTerminated="true" />
		</Block>
	</DataModel>

	<DataModel name="ChunkList" ref="Chunk">
		<String name="ID" value="list" token="true"/>
		<Block name="Data">
			<String value="adtl" token="true" />
			<Choice maxOccurs="3000">
				<Block ref="ChunkLabl"/>
				<Block ref="ChunkNote"/>
				<Block ref="ChunkLtxt"/>
				<Block ref="Chunk"/>
			</Choice>
		</Block>
	</DataModel>

	<DataModel name="ChunkSmpl" ref="Chunk">
		<String name="ID" value="smpl" token="true"/>
		<Block name="Data">
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Number size="32" signed="false"/>
			<Block maxOccurs="3000">
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
				<Number size="32" signed="false"/>
			</Block>
		</Block>
	</DataModel>

	<DataModel name="ChunkInst" ref="Chunk">
		<String name="ID" value="inst" token="true"/>
		<Block name="Data">
			<Number size="8"/>
			<Number size="8"/>
			<Number size="8"/>
			<Number size="8"/>
			<Number size="8"/>
			<Number size="8"/>
			<Number size="8"/>
		</Block>
	</DataModel>

	<DataModel name="Wav">
		<String value="RIFF" token="true" />
		<Number size="32" signed="false"/>
		<String value="WAVE" token="true"/>

		<Choice maxOccurs="30000">
			<Block ref="ChunkFmt"/>
			<Block ref="ChunkData"/>
			<Block ref="ChunkFact"/>
			<Block ref="ChunkSint"/>
			<Block ref="ChunkWavl"/>
			<Block ref="ChunkCue"/>
			<Block ref="ChunkPlst"/>
			<Block ref="ChunkLtxt"/>
			<Block ref="ChunkSmpl"/>
			<Block ref="ChunkInst"/>
			<Block ref="Chunk"/>
		</Choice>
	</DataModel>

	<DataModel name="Param">
		<String name="Value" isStatic="true" />
	</DataModel>

	<StateModel name="TheState" initialState="Initial">
		<State name="Initial">
			<Action type="output">
				<DataModel ref="Wav" />
				<Data name="data" fileName="sample.wav"/>
			</Action>

			<Action type="close"/>

			<Action type="call" method="./MPlayer-0.90/mplayer">
				<Param name="wav file" type="in">
					<DataModel ref="Param"/>
					<Data name="filename">
						<Field name="Value" value="fuzzed.wav"/>
					</Data>
				</Param>
			</Action>
		</State>
	</StateModel>

	<Test name="TheTest">
		<StateModel ref="TheState"/>

		<Publisher class="file.FileWriterLauncher">
			<Param name="fileName" value="fuzzed.wav"/>
		</Publisher>
	</Test>

	<!-- Configure a single run -->
	<Run name="DefaultRun">

		<!-- TODO: Change log path if needed -->
		<Logger class="logger.Filesystem">
			<Param name="path" value="logs"/>
		</Logger>

		<Test ref="TheTest"/>

	</Run>

</Peach>
<!-- end -->