Update OEMCrypto_LoadLicense corpus for ODK_Packing_ParsedLicense

- Regenerate corpus files.
- Change nonce endianness.

Merged from https://widevine-internal-review.googlesource.com/177010

Change-Id: I5f288a054325097d6ea696cd755fc0557d0eadd1
This commit is contained in:
Ian Benz
2023-06-14 16:11:12 +00:00
committed by Robert Shih
parent 28e68a866b
commit 5c5433a8d8
48 changed files with 15 additions and 10 deletions

View File

@@ -7,14 +7,14 @@
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
wvoec::RedirectStdoutToFile();
if (size < sizeof(ODK_ParsedLicense) + sizeof(wvoec::MessageData)) {
if (size < sizeof(ODK_Packing_ParsedLicense) + sizeof(wvoec::MessageData)) {
return 0;
}
wvoec::OEMCryptoLicenseAPIFuzz license_api_fuzz;
license_api_fuzz.Initialize();
license_api_fuzz.license_messages().SignAndVerifyRequest();
// Interpreting input fuzz data as unencrypted (core_response + license
// message data) from license server.
// Interpreting input fuzz data as unencrypted core_response + response_data +
// key_array from license server.
license_api_fuzz.license_messages().InjectFuzzedResponseData(data, size);
// Convert OEMCrypto_LicenseType in core_response to a valid enum value.

View File

@@ -713,12 +713,16 @@ void LicenseRoundTrip::InjectFuzzedTimerLimits(
void LicenseRoundTrip::InjectFuzzedResponseData(const uint8_t* data,
size_t size) {
// Interpreting fuzz data as unencrypted core_response + message_data
// Interpreting fuzz data as unencrypted core_response + response_data +
// key_array
FuzzedData fuzzed_data(data, size);
// Copy core_response from data.
fuzzed_data.Fill(&core_response_, sizeof(core_response_));
// Copy response_data from data.
fuzzed_data.Fill(&response_data_, sizeof(response_data_));
// If key_array_length is more than kMaxNumKeys, we set it to kMaxNumKeys to
// prevent it from going out of bounds. For corpus, this value is already hard
// coded to 4.
@@ -756,11 +760,9 @@ void LicenseRoundTrip::InjectFuzzedResponseData(const uint8_t* data,
}
}
// Copy response_data from data and set nonce to match one in request to pass
// nonce validations.
fuzzed_data.Fill(&response_data_, sizeof(response_data_));
// Set nonce to match one in request to pass nonce validations.
for (uint32_t i = 0; i < num_keys_; ++i) {
response_data_.keys[i].control.nonce = session()->nonce();
response_data_.keys[i].control.nonce = htonl(session()->nonce());
}
}
@@ -950,11 +952,14 @@ OEMCryptoResult LicenseRoundTrip::LoadResponse(Session* session,
const std::string file_name =
GetFileName("oemcrypto_load_license_fuzz_seed_corpus");
// Corpus for license response fuzzer should be in the format:
// core_response + response_data.
// core_response + response_data + key_array.
AppendToFile(file_name, reinterpret_cast<const char*>(&core_response_),
sizeof(ODK_ParsedLicense));
sizeof(core_response_));
AppendToFile(file_name, reinterpret_cast<const char*>(&response_data_),
sizeof(response_data_));
AppendToFile(
file_name, reinterpret_cast<const char*>(core_response_.key_array),
core_response_.key_array_length * sizeof(*core_response_.key_array));
}
// Some tests adjust the offset to be beyond the length of the message. Here,