diff --git a/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_create_and_remove_entitled_key_session_fuzz.cc b/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_create_and_remove_entitled_key_session_fuzz.cc deleted file mode 100644 index 07c0bd44..00000000 --- a/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_create_and_remove_entitled_key_session_fuzz.cc +++ /dev/null @@ -1,32 +0,0 @@ -// Copyright 2022 Google LLC. All Rights Reserved. This file and proprietary -// source code may only be used and distributed under the Widevine -// License Agreement. - -#include "FuzzedDataProvider.h" -#include "OEMCryptoCENC.h" -#include "oemcrypto_fuzz_helper.h" - -extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { - wvoec::RedirectStdoutToFile(); - - wvoec::SessionFuzz session_fuzz; - session_fuzz.Initialize(); - - FuzzedDataProvider fuzzed_data(data, size); - - uint32_t key_session; - uint32_t* const key_session_ptr = - fuzzed_data.ConsumeBool() ? &key_session : nullptr; - - OEMCrypto_CreateEntitledKeySession(session_fuzz.session().session_id(), - key_session_ptr); - - if (key_session_ptr == nullptr || fuzzed_data.ConsumeBool()) { - key_session = fuzzed_data.ConsumeIntegral(); - } - - OEMCrypto_RemoveEntitledKeySession(key_session); - - session_fuzz.Terminate(); - return 0; -} diff --git a/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_entitled_key_session_fuzz.cc b/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_entitled_key_session_fuzz.cc new file mode 100644 index 00000000..78323dd9 --- /dev/null +++ b/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_entitled_key_session_fuzz.cc @@ -0,0 +1,136 @@ +// Copyright 2023 Google LLC. All Rights Reserved. This file and proprietary +// source code may only be used and distributed under the Widevine +// License Agreement. + +#include + +#include "FuzzedDataProvider.h" +#include "OEMCryptoCENC.h" +#include "oemcrypto_fuzz_helper.h" + +namespace { + +enum class ApiMethod { + kOpenSession, + kCloseSession, + kCreateEntitledKeySession, + kReassociateEntitledKeySession, + kRemoveEntitledKeySession, + kMaxValue = kRemoveEntitledKeySession, +}; + +struct Session { + OEMCrypto_SESSION value; + std::vector::const_iterator iterator; +}; + +Session PickSession(FuzzedDataProvider& fuzzed_data, + const std::vector& sessions) { + Session session; + + session.iterator = + sessions.cbegin() + + fuzzed_data.ConsumeIntegralInRange(0, sessions.size()); + + if (session.iterator != sessions.cend()) { + session.value = *session.iterator; + } else { + session.value = fuzzed_data.ConsumeIntegral(); + } + + return session; +} + +} // namespace + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + wvoec::RedirectStdoutToFile(); + + wvoec::SessionUtil session_util; + wvoec::InitializeFuzz(session_util); + + // Contains all open and some closed OEMCrypto sessions. + std::vector oec_sessions; + + // Contains all current and some removed key sessions. + std::vector key_sessions; + + FuzzedDataProvider fuzzed_data(data, size); + + while (fuzzed_data.remaining_bytes() > 0) { + switch (fuzzed_data.ConsumeEnum()) { + case ApiMethod::kOpenSession: { + OEMCrypto_SESSION session = 0; + const OEMCryptoResult result = OEMCrypto_OpenSession(&session); + + if (result == OEMCrypto_SUCCESS) { + oec_sessions.push_back(session); + } + + break; + } + + case ApiMethod::kCloseSession: { + const Session session = PickSession(fuzzed_data, oec_sessions); + + const OEMCryptoResult result = OEMCrypto_CloseSession(session.value); + + if (result == OEMCrypto_SUCCESS && + session.iterator != oec_sessions.cend() && + fuzzed_data.ConsumeBool()) { + oec_sessions.erase(session.iterator); + } + + break; + } + + case ApiMethod::kCreateEntitledKeySession: { + const OEMCrypto_SESSION oec_session = + PickSession(fuzzed_data, oec_sessions).value; + + OEMCrypto_SESSION key_session_data = 0; + OEMCrypto_SESSION* const key_session = + fuzzed_data.ConsumeBool() ? &key_session_data : nullptr; + + const OEMCryptoResult result = + OEMCrypto_CreateEntitledKeySession(oec_session, key_session); + + if (result == OEMCrypto_SUCCESS) { + key_sessions.push_back(*key_session); + } + + break; + } + + case ApiMethod::kReassociateEntitledKeySession: { + const OEMCrypto_SESSION key_session = + PickSession(fuzzed_data, key_sessions).value; + + const OEMCrypto_SESSION oec_session = + PickSession(fuzzed_data, oec_sessions).value; + + OEMCrypto_ReassociateEntitledKeySession(key_session, oec_session); + + break; + } + + case ApiMethod::kRemoveEntitledKeySession: { + const Session key_session = PickSession(fuzzed_data, key_sessions); + + const OEMCryptoResult result = + OEMCrypto_RemoveEntitledKeySession(key_session.value); + + if (result == OEMCrypto_SUCCESS && + key_session.iterator != key_sessions.cend() && + fuzzed_data.ConsumeBool()) { + key_sessions.erase(key_session.iterator); + } + + break; + } + } + } + + OEMCrypto_Terminate(); + return 0; +}