Add OEMCrypto_SetDecryptHash/GetHashErrorCode fuzzer
Merged from https://widevine-internal-review.googlesource.com/169021 Merged from https://widevine-internal-review.googlesource.com/170030 Change-Id: I209d280b0478620197fc514966af3c93fc2272aa
This commit is contained in:
@@ -0,0 +1,74 @@
|
||||
// Copyright 2023 Google LLC. All Rights Reserved. This file and proprietary
|
||||
// source code may only be used and distributed under the Widevine
|
||||
// License Agreement.
|
||||
|
||||
#include <array>
|
||||
#include <vector>
|
||||
|
||||
#include "FuzzedDataProvider.h"
|
||||
#include "OEMCryptoCENC.h"
|
||||
#include "oemcrypto_fuzz_helper.h"
|
||||
|
||||
using namespace wvoec;
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
// Redirect printf and log statements from oemcrypto functions to a file to
|
||||
// reduce noise
|
||||
RedirectStdoutToFile();
|
||||
|
||||
OEMCryptoLicenseAPIFuzz license_api_fuzz;
|
||||
FuzzedDataProvider fuzzed_data(data, size);
|
||||
|
||||
if (fuzzed_data.ConsumeBool()) {
|
||||
license_api_fuzz.license_messages().set_control(
|
||||
license_api_fuzz.license_messages().control() |
|
||||
kControlAllowHashVerification);
|
||||
}
|
||||
|
||||
const uint32_t session_id = license_api_fuzz.session()->session_id();
|
||||
const std::array<uint8_t, 16> content_key_id{};
|
||||
const uint32_t frame_number = fuzzed_data.ConsumeIntegral<uint32_t>();
|
||||
std::array<OEMCrypto_SharedMemory, 1> sample_buffer{};
|
||||
|
||||
OEMCrypto_SubSampleDescription subsample;
|
||||
subsample.num_bytes_clear = 0;
|
||||
subsample.num_bytes_encrypted = sample_buffer.size();
|
||||
subsample.subsample_flags =
|
||||
OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample;
|
||||
subsample.block_offset = 0;
|
||||
|
||||
OEMCrypto_SampleDescription sample;
|
||||
sample.buffers.input_data = sample_buffer.data();
|
||||
sample.buffers.input_data_length = sample_buffer.size();
|
||||
sample.buffers.output_descriptor.type = OEMCrypto_BufferType_Clear;
|
||||
sample.buffers.output_descriptor.buffer.clear.clear_buffer =
|
||||
sample_buffer.data();
|
||||
sample.buffers.output_descriptor.buffer.clear.clear_buffer_length =
|
||||
sample_buffer.size();
|
||||
memset(sample.iv, 0, sizeof(sample.iv));
|
||||
sample.subsamples = &subsample;
|
||||
sample.subsamples_length = 1;
|
||||
|
||||
OEMCrypto_CENCEncryptPatternDesc pattern;
|
||||
pattern.encrypt = 0;
|
||||
pattern.skip = 0;
|
||||
|
||||
uint32_t failed_frame_number_data;
|
||||
uint32_t* const failed_frame_number =
|
||||
fuzzed_data.ConsumeBool() ? &failed_frame_number_data : nullptr;
|
||||
|
||||
const std::vector<uint8_t> hash =
|
||||
fuzzed_data.ConsumeRemainingBytes<uint8_t>();
|
||||
|
||||
license_api_fuzz.LoadLicense();
|
||||
std::vector<uint8_t> key_handle;
|
||||
GetKeyHandleIntoVector(session_id, content_key_id.data(),
|
||||
content_key_id.size(), OEMCrypto_CipherMode_CENC,
|
||||
key_handle);
|
||||
OEMCrypto_SetDecryptHash(session_id, frame_number, hash.data(), hash.size());
|
||||
OEMCrypto_DecryptCENC(key_handle.data(), key_handle.size(), &sample, 1,
|
||||
&pattern);
|
||||
OEMCrypto_GetHashErrorCode(session_id, failed_frame_number);
|
||||
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user