Clean up fuzz helper classes
- Remove OEMCrypto state changes hidden in constructors and destructors. - Use composition instead of inheritance to structure classes. - Avoid calling non-trivial destructors for objects with static lifetime. Merged from https://widevine-internal-review.googlesource.com/168497 Merged from https://widevine-internal-review.googlesource.com/171170 Merged from https://widevine-internal-review.googlesource.com/171171 Merged from https://widevine-internal-review.googlesource.com/171870 Change-Id: I20476a7b1132d11f011b8650ec01e3c2dc3fc0e8
This commit is contained in:
@@ -2,42 +2,55 @@
|
||||
// source code may only be used and distributed under the Widevine
|
||||
// License Agreement.
|
||||
|
||||
#include <vector>
|
||||
|
||||
#include "FuzzedDataProvider.h"
|
||||
#include "OEMCryptoCENC.h"
|
||||
#include "oec_session_util.h"
|
||||
#include "oemcrypto_fuzz_helper.h"
|
||||
#include "oemcrypto_fuzz_structs.h"
|
||||
|
||||
namespace wvoec {
|
||||
namespace {
|
||||
|
||||
// Limit output buffer size to 5 MB as 4 MB is maximum size specified by
|
||||
// resource rating tier documentation.
|
||||
const size_t MAX_FUZZ_SAMPLE_SIZE = 5 * MB;
|
||||
constexpr size_t MAX_FUZZ_SAMPLE_SIZE = 5 * wvoec::MB;
|
||||
|
||||
// Avoid calling non-trivial destructor.
|
||||
wvoec::OEMCryptoLicenseAPIFuzz& license_api_fuzz =
|
||||
*new wvoec::OEMCryptoLicenseAPIFuzz;
|
||||
|
||||
} // namespace
|
||||
|
||||
extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
|
||||
wvoec::RedirectStdoutToFile();
|
||||
license_api_fuzz.Initialize();
|
||||
license_api_fuzz.LoadLicense();
|
||||
return 0;
|
||||
}
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
// Redirect printf and log statements from oemcrypto functions to a file to
|
||||
// reduce noise
|
||||
RedirectStdoutToFile();
|
||||
|
||||
// Split data using separator.
|
||||
const std::vector<FuzzedData> inputs = SplitFuzzedData(data, size);
|
||||
const std::vector<wvoec::FuzzedData> inputs =
|
||||
wvoec::SplitFuzzedData(data, size);
|
||||
if (inputs.size() < 3) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Read cipher mode and pattern from fuzzed data.
|
||||
OEMCrypto_Decrypt_Cenc_Fuzz fuzzed_structure;
|
||||
wvoec::OEMCrypto_Decrypt_Cenc_Fuzz fuzzed_structure;
|
||||
if (inputs[0].size < sizeof(fuzzed_structure)) {
|
||||
return 0;
|
||||
}
|
||||
FuzzedDataProvider fuzzed_data(inputs[0].data, inputs[0].size);
|
||||
fuzzed_data.ConsumeData(&fuzzed_structure, sizeof(fuzzed_structure));
|
||||
ConvertDataToValidEnum(OEMCrypto_CipherMode_MaxValue,
|
||||
&fuzzed_structure.cipher_mode);
|
||||
wvoec::ConvertDataToValidEnum(OEMCrypto_CipherMode_MaxValue,
|
||||
&fuzzed_structure.cipher_mode);
|
||||
|
||||
// Allocate sample descriptions.
|
||||
std::vector<OEMCrypto_SampleDescription> sample_descriptions(
|
||||
fuzzed_data.remaining_bytes() / sizeof(OEMCrypto_SampleDescription_Fuzz));
|
||||
fuzzed_data.remaining_bytes() /
|
||||
sizeof(wvoec::OEMCrypto_SampleDescription_Fuzz));
|
||||
|
||||
// Allocate input buffers for each sample description.
|
||||
std::vector<std::vector<OEMCrypto_SharedMemory>> input_buffers(
|
||||
@@ -50,8 +63,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
std::vector<std::vector<OEMCrypto_SubSampleDescription>> subsamples(
|
||||
sample_descriptions.size());
|
||||
|
||||
OEMCryptoLicenseAPIFuzz license_api_fuzz;
|
||||
const uint32_t session_id = license_api_fuzz.session()->session_id();
|
||||
const uint32_t session_id = license_api_fuzz.session().session_id();
|
||||
|
||||
// Free first given number of output buffers.
|
||||
const auto FreeOutputBuffers = [&sample_descriptions, session_id,
|
||||
@@ -81,12 +93,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
FuzzedDataProvider subsample_data(inputs[2].data, inputs[2].size);
|
||||
for (size_t i = 0; i < sample_descriptions.size(); i++) {
|
||||
// Read and normalize sample description fuzzed properties.
|
||||
OEMCrypto_SampleDescription_Fuzz fuzzed_sample_description;
|
||||
wvoec::OEMCrypto_SampleDescription_Fuzz fuzzed_sample_description;
|
||||
sample_description_data.ConsumeData(&fuzzed_sample_description,
|
||||
sizeof(fuzzed_sample_description));
|
||||
fuzzed_sample_description.buffers.input_data_length %=
|
||||
MAX_FUZZ_SAMPLE_SIZE + 1;
|
||||
ConvertDataToValidEnum(
|
||||
wvoec::ConvertDataToValidEnum(
|
||||
OEMCrypto_BufferType_MaxValue,
|
||||
&fuzzed_sample_description.buffers.output_descriptor.type);
|
||||
fuzzed_sample_description.buffers.output_descriptor.buffer_config %=
|
||||
@@ -126,7 +138,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
// Initialize output buffer.
|
||||
OEMCrypto_DestBufferDesc& output_descriptor =
|
||||
sample_descriptions[i].buffers.output_descriptor;
|
||||
const OEMCrypto_DestBufferDesc_Fuzz& fuzzed_output_descriptor =
|
||||
const wvoec::OEMCrypto_DestBufferDesc_Fuzz& fuzzed_output_descriptor =
|
||||
fuzzed_sample_description.buffers.output_descriptor;
|
||||
output_descriptor.type = fuzzed_output_descriptor.type;
|
||||
switch (output_descriptor.type) {
|
||||
@@ -154,11 +166,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
}
|
||||
|
||||
// Load license and call decrypt_cenc API.
|
||||
license_api_fuzz.LoadLicense();
|
||||
const MessageKeyData& key = license_api_fuzz.session()->license().keys[0];
|
||||
vector<uint8_t> key_handle;
|
||||
GetKeyHandleIntoVector(session_id, key.key_id, key.key_id_length,
|
||||
fuzzed_structure.cipher_mode, key_handle);
|
||||
const wvoec::MessageKeyData& key =
|
||||
license_api_fuzz.session().license().keys[0];
|
||||
std::vector<uint8_t> key_handle;
|
||||
wvoec::GetKeyHandleIntoVector(session_id, key.key_id, key.key_id_length,
|
||||
fuzzed_structure.cipher_mode, key_handle);
|
||||
OEMCrypto_DecryptCENC(key_handle.data(), key_handle.size(),
|
||||
sample_descriptions.data(), sample_descriptions.size(),
|
||||
&fuzzed_structure.pattern);
|
||||
@@ -168,5 +180,3 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
} // namespace wvoec
|
||||
|
||||
Reference in New Issue
Block a user