widevine-partner/android
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fuzz OEMCrypto_CopyBuffer subsample_flags parameter

Browse Source 
Merge from Widevine repo of http://go/wvgerrit/159341

Test: tested with http://go/ag/20420224

Change-Id: Ia5f15e9053c7e7be6ea3687c123ad5e36796573e
This commit is contained in:
Ian Benz
2022-11-08 13:56:44 -08:00
committed by Fred Gylys-Colwell
parent 579b9144b5
commit 5a9b8a9c81
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_copy_buffer_fuzz.cc
View File

@@ -51,17 +51,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
// Redirect printf and log statements from oemcrypto functions to a file to // Redirect printf and log statements from oemcrypto functions to a file to
// reduce noise // reduce noise
RedirectStdoutToFile(); RedirectStdoutToFile();
uint8_t subsample_flags;
// OEMCrypto_DestBufferDesc and a buffer from which data needs to be copied // OEMCrypto_DestBufferDesc and a buffer from which data needs to be copied
// are expected as inputs to copy buffer API. // are expected as inputs to copy buffer API.
// Input fuzzed data is interpreted as // Input fuzzed data is interpreted as
// (OEMCrypto_DestBufferDesc | subsample_flags | input_buffer) // (OEMCrypto_DestBufferDesc | subsample_flags | input_buffer)
if (size <= sizeof(OEMCrypto_Copy_Buffer_Fuzz)) { OEMCrypto_Copy_Buffer_Fuzz fuzzed_structure;
if (size <= sizeof(fuzzed_structure)) {
return 0; return 0;
} }
OEMCrypto_Copy_Buffer_Fuzz fuzzed_structure;
// Fuzz dest_buffer_desc.
memcpy(&fuzzed_structure, data, sizeof(fuzzed_structure)); memcpy(&fuzzed_structure, data, sizeof(fuzzed_structure));
ConvertDataToValidEnum(OEMCrypto_BufferType_MaxValue, ConvertDataToValidEnum(OEMCrypto_BufferType_MaxValue,
&fuzzed_structure.dest_buffer_desc.type); &fuzzed_structure.dest_buffer_desc.type);
@@ -86,7 +84,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
} }
OEMCrypto_CopyBuffer(session->session_id(), data + sizeof(fuzzed_structure), OEMCrypto_CopyBuffer(session->session_id(), data + sizeof(fuzzed_structure),
input_buffer_size, &fuzzed_structure.dest_buffer_desc, input_buffer_size, &fuzzed_structure.dest_buffer_desc,
subsample_flags); fuzzed_structure.subsample_flags);
FreeOutputBuffers(session->session_id(), fuzzed_structure.dest_buffer_desc, FreeOutputBuffers(session->session_id(), fuzzed_structure.dest_buffer_desc,
&secure_fd); &secure_fd);
return 0; return 0;