Update OEMCrypto_LoadLicense corpus for ODK_Packing_ParsedLicense

- Regenerate corpus files.
- Change nonce endianness.

Merged from https://widevine-internal-review.googlesource.com/177010

Change-Id: I5f288a054325097d6ea696cd755fc0557d0eadd1
This commit is contained in:
Ian Benz
2023-06-14 16:11:12 +00:00
committed by Robert Shih
parent 28e68a866b
commit 5c5433a8d8
48 changed files with 15 additions and 10 deletions

View File

@@ -7,14 +7,14 @@
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
wvoec::RedirectStdoutToFile(); wvoec::RedirectStdoutToFile();
if (size < sizeof(ODK_ParsedLicense) + sizeof(wvoec::MessageData)) { if (size < sizeof(ODK_Packing_ParsedLicense) + sizeof(wvoec::MessageData)) {
return 0; return 0;
} }
wvoec::OEMCryptoLicenseAPIFuzz license_api_fuzz; wvoec::OEMCryptoLicenseAPIFuzz license_api_fuzz;
license_api_fuzz.Initialize(); license_api_fuzz.Initialize();
license_api_fuzz.license_messages().SignAndVerifyRequest(); license_api_fuzz.license_messages().SignAndVerifyRequest();
// Interpreting input fuzz data as unencrypted (core_response + license // Interpreting input fuzz data as unencrypted core_response + response_data +
// message data) from license server. // key_array from license server.
license_api_fuzz.license_messages().InjectFuzzedResponseData(data, size); license_api_fuzz.license_messages().InjectFuzzedResponseData(data, size);
// Convert OEMCrypto_LicenseType in core_response to a valid enum value. // Convert OEMCrypto_LicenseType in core_response to a valid enum value.

View File

@@ -713,12 +713,16 @@ void LicenseRoundTrip::InjectFuzzedTimerLimits(
void LicenseRoundTrip::InjectFuzzedResponseData(const uint8_t* data, void LicenseRoundTrip::InjectFuzzedResponseData(const uint8_t* data,
size_t size) { size_t size) {
// Interpreting fuzz data as unencrypted core_response + message_data // Interpreting fuzz data as unencrypted core_response + response_data +
// key_array
FuzzedData fuzzed_data(data, size); FuzzedData fuzzed_data(data, size);
// Copy core_response from data. // Copy core_response from data.
fuzzed_data.Fill(&core_response_, sizeof(core_response_)); fuzzed_data.Fill(&core_response_, sizeof(core_response_));
// Copy response_data from data.
fuzzed_data.Fill(&response_data_, sizeof(response_data_));
// If key_array_length is more than kMaxNumKeys, we set it to kMaxNumKeys to // If key_array_length is more than kMaxNumKeys, we set it to kMaxNumKeys to
// prevent it from going out of bounds. For corpus, this value is already hard // prevent it from going out of bounds. For corpus, this value is already hard
// coded to 4. // coded to 4.
@@ -756,11 +760,9 @@ void LicenseRoundTrip::InjectFuzzedResponseData(const uint8_t* data,
} }
} }
// Copy response_data from data and set nonce to match one in request to pass // Set nonce to match one in request to pass nonce validations.
// nonce validations.
fuzzed_data.Fill(&response_data_, sizeof(response_data_));
for (uint32_t i = 0; i < num_keys_; ++i) { for (uint32_t i = 0; i < num_keys_; ++i) {
response_data_.keys[i].control.nonce = session()->nonce(); response_data_.keys[i].control.nonce = htonl(session()->nonce());
} }
} }
@@ -950,11 +952,14 @@ OEMCryptoResult LicenseRoundTrip::LoadResponse(Session* session,
const std::string file_name = const std::string file_name =
GetFileName("oemcrypto_load_license_fuzz_seed_corpus"); GetFileName("oemcrypto_load_license_fuzz_seed_corpus");
// Corpus for license response fuzzer should be in the format: // Corpus for license response fuzzer should be in the format:
// core_response + response_data. // core_response + response_data + key_array.
AppendToFile(file_name, reinterpret_cast<const char*>(&core_response_), AppendToFile(file_name, reinterpret_cast<const char*>(&core_response_),
sizeof(ODK_ParsedLicense)); sizeof(core_response_));
AppendToFile(file_name, reinterpret_cast<const char*>(&response_data_), AppendToFile(file_name, reinterpret_cast<const char*>(&response_data_),
sizeof(response_data_)); sizeof(response_data_));
AppendToFile(
file_name, reinterpret_cast<const char*>(core_response_.key_array),
core_response_.key_array_length * sizeof(*core_response_.key_array));
} }
// Some tests adjust the offset to be beyond the length of the message. Here, // Some tests adjust the offset to be beyond the length of the message. Here,