Add OEMCrypto_SetDecryptHash/GetHashErrorCode fuzzer

Merged from https://widevine-internal-review.googlesource.com/169021
Merged from https://widevine-internal-review.googlesource.com/170030

Change-Id: I209d280b0478620197fc514966af3c93fc2272aa
This commit is contained in:
Ian Benz
2023-03-27 16:13:29 +00:00
committed by Robert Shih
parent 7b592f1990
commit af070601b0

View File

@@ -0,0 +1,74 @@
// Copyright 2023 Google LLC. All Rights Reserved. This file and proprietary
// source code may only be used and distributed under the Widevine
// License Agreement.
#include <array>
#include <vector>
#include "FuzzedDataProvider.h"
#include "OEMCryptoCENC.h"
#include "oemcrypto_fuzz_helper.h"
using namespace wvoec;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
// Redirect printf and log statements from oemcrypto functions to a file to
// reduce noise
RedirectStdoutToFile();
OEMCryptoLicenseAPIFuzz license_api_fuzz;
FuzzedDataProvider fuzzed_data(data, size);
if (fuzzed_data.ConsumeBool()) {
license_api_fuzz.license_messages().set_control(
license_api_fuzz.license_messages().control() |
kControlAllowHashVerification);
}
const uint32_t session_id = license_api_fuzz.session()->session_id();
const std::array<uint8_t, 16> content_key_id{};
const uint32_t frame_number = fuzzed_data.ConsumeIntegral<uint32_t>();
std::array<OEMCrypto_SharedMemory, 1> sample_buffer{};
OEMCrypto_SubSampleDescription subsample;
subsample.num_bytes_clear = 0;
subsample.num_bytes_encrypted = sample_buffer.size();
subsample.subsample_flags =
OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample;
subsample.block_offset = 0;
OEMCrypto_SampleDescription sample;
sample.buffers.input_data = sample_buffer.data();
sample.buffers.input_data_length = sample_buffer.size();
sample.buffers.output_descriptor.type = OEMCrypto_BufferType_Clear;
sample.buffers.output_descriptor.buffer.clear.clear_buffer =
sample_buffer.data();
sample.buffers.output_descriptor.buffer.clear.clear_buffer_length =
sample_buffer.size();
memset(sample.iv, 0, sizeof(sample.iv));
sample.subsamples = &subsample;
sample.subsamples_length = 1;
OEMCrypto_CENCEncryptPatternDesc pattern;
pattern.encrypt = 0;
pattern.skip = 0;
uint32_t failed_frame_number_data;
uint32_t* const failed_frame_number =
fuzzed_data.ConsumeBool() ? &failed_frame_number_data : nullptr;
const std::vector<uint8_t> hash =
fuzzed_data.ConsumeRemainingBytes<uint8_t>();
license_api_fuzz.LoadLicense();
std::vector<uint8_t> key_handle;
GetKeyHandleIntoVector(session_id, content_key_id.data(),
content_key_id.size(), OEMCrypto_CipherMode_CENC,
key_handle);
OEMCrypto_SetDecryptHash(session_id, frame_number, hash.data(), hash.size());
OEMCrypto_DecryptCENC(key_handle.data(), key_handle.size(), &sample, 1,
&pattern);
OEMCrypto_GetHashErrorCode(session_id, failed_frame_number);
return 0;
}