Fix bugs impacting fuzzing coverage

- Update ConvertDataToValidEnum to not use FuzzedDataProvider since it
  causes unexpected parsing results.
- Add OEMCryptoLicenseAPIFuzz::LoadLicenseWithGenericCryptoKeys so that
  generic crypto fuzz tests can load appropriate keys.
- Remove custom mutator from oemcrypto_generic_verify_fuzz because it
  provides minimal additional coverage.
- Refresh affected corpus files.

Merged from https://widevine-internal-review.googlesource.com/168557
Merged from https://widevine-internal-review.googlesource.com/171191
Merged from https://widevine-internal-review.googlesource.com/172170
Merged from https://widevine-internal-review.googlesource.com/172250

Change-Id: Ie676a36cbf4c12bdda9566fad3590a7b69168d9c
This commit is contained in:
Ian Benz
2023-03-21 01:45:50 +00:00
committed by Robert Shih
parent 55ef762c08
commit 57b391c8b9
300 changed files with 81 additions and 139 deletions

View File

@@ -20,7 +20,7 @@ wvoec::OEMCryptoLicenseAPIFuzz& license_api_fuzz =
extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
wvoec::RedirectStdoutToFile();
license_api_fuzz.Initialize();
license_api_fuzz.LoadLicense();
license_api_fuzz.LoadLicenseWithGenericCryptoKeys();
return 0;
}
@@ -33,18 +33,19 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
FuzzedDataProvider fuzzed_data(data, size);
fuzzed_data.ConsumeData(&fuzzed_structure, sizeof(fuzzed_structure));
wvoec::ConvertDataToValidEnum(OEMCrypto_CipherMode_MaxValue,
&fuzzed_structure.cipher_mode);
fuzzed_structure.cipher_mode);
wvoec::ConvertDataToValidEnum(OEMCrypto_Algorithm_MaxValue,
&fuzzed_structure.algorithm);
fuzzed_structure.algorithm);
// Copy clear buffer from input data.
const std::vector<uint8_t> clear_buffer =
fuzzed_data.ConsumeRemainingBytes<uint8_t>();
// Select key and sign.
wvoec::Session& session = license_api_fuzz.session();
std::vector<uint8_t> key_handle;
wvoec::GetKeyHandleIntoVector(session.session_id(),
session.license().keys[0].key_id,
session.license().keys[0].key_id_length,
session.license().keys[2].key_id,
session.license().keys[2].key_id_length,
fuzzed_structure.cipher_mode, key_handle);
size_t signature_length = 0;
OEMCrypto_Generic_Sign(key_handle.data(), key_handle.size(),