Merge oemcrypto buffer overflow tests from cdm

Widevine CLs: http://go/wvgerrit/112243 http://go/wvgerrit/110563 http://go/wvgerrit/95483 http://go/wvgerrit/107047 http://go/wvgerrit/111123 http://go/wvgerrit/106224 http://go/wvgerrit/106263 http://go/wvgerrit/106223 http://go/wvgerrit/104223 http://go/wvgerrit/108583 http://go/wvgerrit/111403 http://go/wvgerrit/111623 http://go/wvgerrit/106264 http://go/wvgerrit/110483 http://go/wvgerrit/111944 http://go/wvgerrit/108684 http://go/wvgerrit/104183 http://go/wvgerrit/111443 http://go/wvgerrit/111869 http://go/wvgerrit/108843 http://go/wvgerrit/104363 http://go/wvgerrit/104423 http://go/wvgerrit/104263 http://go/wvgerrit/106584 http://go/wvgerrit/105924 http://go/wvgerrit/104524 http://go/wvgerrit/113023 Bug:175401639 Test: We would like to run these tests on pixel devices from master branch using go/wv-and-dash Change-Id: Ic4188504af64de9ce79941f75ac6feaf29189a4d
2020-12-15 12:13:07 -08:00
parent e851d42eb1
commit 6b548748b2
5 changed files with 2391 additions and 139 deletions
--- a/libwvdrmengine/oemcrypto/test/fuzz_tests/README.md
+++ b/libwvdrmengine/oemcrypto/test/fuzz_tests/README.md
@@ -104,17 +104,13 @@
    oemcrypto_fuzztests.gypi cflags_cc in order to generate additional debug
    information locally.

-*   Build and test fuzz scripts locally using:
+*   Build and test fuzz scripts locally using following commands. The build
+    script builds fuzz binaries for both oemcrypto reference implementation
+    as well as odkitee implementation.

    ```shell
-    $ export CXX=clang++
-    $ export CC=clang
-    $ export GYP_DEFINES="clang=1"
-    $ cd /path/to/cdm/repo
-    $ export PATH_TO_CDM_DIR=.
-    $ gyp --format=ninja --depth=$(pwd) \
-        oemcrypto/test/fuzz_tests/oemcrypto_fuzztests.gyp
-    $ ninja -C out/Default/
+    $ cd PATH_TO_CDM_DIR
+    $ ./oemcrypto/test/fuzz_tests/build_oemcrypto_fuzztests
    $ mkdir /tmp/new_interesting_corpus
    $ ./out/Default/fuzzer_binary /tmp/new_interesting_corpus \
        /path/to/fuzz/seed/corpus/folder
@@ -127,8 +123,9 @@
    $ ./out/Default/fuzzer_binary crash_input_file
    ```
 ## Adding a new OEMCrypto fuzz script
-*   In order to fuzz a new OEMCrypto API in future, a fuzz script can be added to
-    oemcrypto/test/fuzz_tests folder which ends with _fuzz.cc.
+*   In order to fuzz a new OEMCrypto API in future, a fuzz script can be added
+    to oemcrypto/test/fuzz_tests folder which starts with oemcrypto and ends
+    with fuzz.cc(GCB build script for oemcrypto fuzzers expects the format).

 *   In the program, define the function LLVMFuzzerTestOneInput with the following signature:
    ```
@@ -164,50 +161,14 @@

 ### Adding a new fuzz script to the build script:

-*   In order to update build script such as adding a new fuzzer to build script,
-    we need to update the build script in docker image from cloud repository.
-    [Build script.](https://widevine-internal.googlesource.com/cloud/+/refs/heads/master/docker
-    /cloud_build/oemcrypto/release/ubuntu/fuzz/build.sh)
+*   As long as a new fuzz script is added which starts with oemcrypto and ends
+    with fuzz, the build command can be added to build_oemcrypto_fuzztests.
+    GCB script uses build_oemcrypto_fuzztests script to build fuzz binaries
+    and make them available for clusterfuzz to run continuously.

-    Add the new fuzz script name to fuzzers variable and follow steps in README
-    to upload new docker image. Make sure you update the tag to be higher than
-    latest version in GCR.
-
-    Run the following command from your machine to update the docker image tag
-    in the git trigger.
-
-    ```shell
-      stubby call --rpc_creds_file=/tmp/mint.txt \
-      blade:alphasource-ci-proctor-metadata-service-prod \
-      ProctorMetadataService.UpdateTrigger --proto2 <<EOF
-      trigger {
-        cloud_project_number: 257246079067
-        name: "cdm-git-trigger"
-        id: "e8939c9a-d971-4c05-91b5-e0544abf872b"
-        state: LIVE
-        git_trigger {
-          url: "https://widevine-internal.googlesource.com/cdm"
-          branch_name: "master"
-        }
-        build_configs {
-          build {
-            steps {
-              name: "gcr.io/google.com/blockbuster-1154/
-              cloud-build-oemcrypto-release-ubuntu-fuzz:LATEST_TAG_VERSION"
-            }
-          }
-        }
-        result_config {
-          email_config {
-            notify_condition {
-              condition: ON_FAILURE
-            }
-            to_address: "wideving-engprod@google.com"
-          }
-        }
-      }
-      EOF
-    ```
+*   If the new fuzzer cannot follow the naming convention OR GCB script needs
+    to be updated for any other reason, refer to [this section](https://docs.google.com/document/d/1mdSV2irJZz5Y9uYb5DmSIddBjrAIZU9q8G5Q_BGpA4I/edit#heading=h.bu9yfftdonkg)
+    section.

 ## Generate code coverage reports locally

--- a/libwvdrmengine/oemcrypto/test/fuzz_tests/build_oemcrypto_fuzztests
+++ b/libwvdrmengine/oemcrypto/test/fuzz_tests/build_oemcrypto_fuzztests
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -ex
+
+export CXX=clang++
+export CC=clang
+export GYP_DEFINES="$GYP_DEFINES clang=1"
+
+export PATH_TO_CDM_DIR=.
+gyp --format=ninja --depth=$(pwd) oemcrypto/test/fuzz_tests/oemcrypto_fuzztests.gyp
+ninja -C out/Default
+# oemcrypto_odkitee_fuzztests.gypi has flags to instrument all the gyp targets
+# with fuzzer flags.
+gyp --format=ninja --depth=$(pwd) \
+    --include=oemcrypto/test/fuzz_tests/oemcrypto_odkitee_fuzztests.gypi \
+    oemcrypto/test/fuzz_tests/oemcrypto_odkitee_fuzztests.gyp
+ninja -C out/Default