Fix OEMCrypto_LoadEntitledContentKeys fuzzer

- Create an entitled key session for OEMCrypto v17 and later.
- Refresh corpus files.

Merged from https://widevine-internal-review.googlesource.com/168897
Merged from https://widevine-internal-review.googlesource.com/169292

Change-Id: Ied9fce445a837e417077381de71d2834f385f120
This commit is contained in:
Ian Benz
2023-03-24 17:50:40 +00:00
committed by Robert Shih
parent 0919fb7ea6
commit 8a9b3c5c75
20 changed files with 15 additions and 7 deletions

View File

@@ -20,6 +20,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return 0;
}
const std::vector<uint8_t> message(inputs[0].data,
inputs[0].data + inputs[0].size);
// Copy data to OEMCrypto_EntitledContentKeyObject array.
std::vector<OEMCrypto_EntitledContentKeyObject> entitled_content_keys(
inputs[1].size / sizeof(OEMCrypto_EntitledContentKeyObject));
@@ -29,18 +32,23 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
sizeof(OEMCrypto_EntitledContentKeyObject));
}
// Load default entitlement license.
OEMCryptoLicenseAPIFuzz license_api_fuzz;
// Setting up state. Load default entitlement license to load entitlement
// keys into sessions key table.
license_api_fuzz.license_messages().set_license_type(
OEMCrypto_EntitlementLicense);
license_api_fuzz.LoadLicense();
// Create entitled key session.
OEMCrypto_SESSION key_session;
const OEMCryptoResult result = OEMCrypto_CreateEntitledKeySession(
license_api_fuzz.session()->session_id(), &key_session);
CheckStatusAndExitFuzzerOnFailure(result, OEMCrypto_SUCCESS);
// Call OEMCrypto_LoadEntitledContentKeys with fuzzed buffers.
const std::vector<uint8_t> message(inputs[0].data,
inputs[0].data + inputs[0].size);
OEMCrypto_LoadEntitledContentKeys(
license_api_fuzz.session()->session_id(), message.data(), message.size(),
entitled_content_keys.size(), entitled_content_keys.data());
OEMCrypto_LoadEntitledContentKeys(key_session, message.data(), message.size(),
entitled_content_keys.size(),
entitled_content_keys.data());
return 0;
}