Merge "Updated system_id_extractor_fuzzer" into main
This commit is contained in:
Treehugger Robot
committed by
Android (Google) Code Review
Android (Google) Code Review
commit
da299dfd47
@@ -36,170 +36,177 @@ static constexpr int32_t kMaxRequestedSecurityLevel = 1;
|
||||
static constexpr int32_t kMinRequestedSecurityLevel = 0;
|
||||
|
||||
class FuzzDeviceFiles : public DeviceFiles {
|
||||
public:
|
||||
public:
|
||||
FuzzDeviceFiles(wvutil::FileSystem *fs, FuzzedDataProvider *fdp)
|
||||
: DeviceFiles(fs), mFdp(fdp) {}
|
||||
: DeviceFiles(fs), fdp_(fdp) {}
|
||||
|
||||
bool Init(CdmSecurityLevel) override { return mFdp->ConsumeBool(); }
|
||||
bool Init(CdmSecurityLevel) override { return fdp_->ConsumeBool(); }
|
||||
|
||||
DeviceFiles::CertificateState
|
||||
RetrieveOemCertificate(std::string *certificate,
|
||||
CryptoWrappedKey * /*wrapped_private_key*/) override {
|
||||
*certificate = mFdp->ConsumeRandomLengthString(kMaxByte);
|
||||
return (DeviceFiles::CertificateState)mFdp->ConsumeIntegralInRange<int32_t>(
|
||||
DeviceFiles::CertificateState RetrieveOemCertificate(
|
||||
std::string *certificate,
|
||||
CryptoWrappedKey * /*wrapped_private_key*/) override {
|
||||
*certificate = fdp_->ConsumeRandomLengthString(kMaxByte);
|
||||
return (DeviceFiles::CertificateState)fdp_->ConsumeIntegralInRange<int32_t>(
|
||||
kMinEnum, kMaxEnum);
|
||||
}
|
||||
|
||||
private:
|
||||
FuzzedDataProvider *mFdp;
|
||||
private:
|
||||
FuzzedDataProvider *fdp_;
|
||||
};
|
||||
|
||||
class FuzzFile : public File {
|
||||
public:
|
||||
FuzzFile(FuzzedDataProvider *fdp) : mFdp(fdp) {}
|
||||
public:
|
||||
FuzzFile(FuzzedDataProvider *fdp) : fdp_(fdp) {}
|
||||
|
||||
ssize_t Read(char *buffer, size_t bytes) {
|
||||
std::vector<char> initData = mFdp->ConsumeBytes<char>(
|
||||
mFdp->ConsumeIntegralInRange<size_t>(kMinByte, bytes));
|
||||
buffer = initData.data();
|
||||
return initData.size();
|
||||
std::vector<char> init_data = fdp_->ConsumeBytes<char>(
|
||||
fdp_->ConsumeIntegralInRange<size_t>(kMinByte, bytes));
|
||||
buffer = init_data.data();
|
||||
return init_data.size();
|
||||
};
|
||||
|
||||
ssize_t Write(const char * /* buffer*/, size_t bytes) {
|
||||
return mFdp->ConsumeIntegralInRange<ssize_t>(kMinByte, bytes);
|
||||
return fdp_->ConsumeIntegralInRange<ssize_t>(kMinByte, bytes);
|
||||
};
|
||||
|
||||
private:
|
||||
FuzzedDataProvider *mFdp;
|
||||
private:
|
||||
FuzzedDataProvider *fdp_;
|
||||
};
|
||||
|
||||
class FuzzFileSystem : public FileSystem {
|
||||
public:
|
||||
FuzzFileSystem(FuzzedDataProvider *fdp) : mFdp(fdp) {}
|
||||
public:
|
||||
FuzzFileSystem(FuzzedDataProvider *fdp) : fdp_(fdp) {}
|
||||
|
||||
std::unique_ptr<File> Open(const std::string &, int) {
|
||||
return std::unique_ptr<File>(new FuzzFile(mFdp));
|
||||
return std::unique_ptr<File>(new FuzzFile(fdp_));
|
||||
}
|
||||
|
||||
bool Exists(const std::string &) { return mFdp->ConsumeBool(); }
|
||||
bool Exists(const std::string &) { return fdp_->ConsumeBool(); }
|
||||
|
||||
bool Remove(const std::string &) { return mFdp->ConsumeBool(); }
|
||||
bool Remove(const std::string &) { return fdp_->ConsumeBool(); }
|
||||
|
||||
ssize_t FileSize(const std::string &) {
|
||||
return mFdp->ConsumeIntegralInRange<ssize_t>(kMinByte, kMaxByte);
|
||||
return fdp_->ConsumeIntegralInRange<ssize_t>(kMinByte, kMaxByte);
|
||||
}
|
||||
|
||||
bool List(const std::string &, std::vector<std::string> *) {
|
||||
return mFdp->ConsumeBool();
|
||||
return fdp_->ConsumeBool();
|
||||
}
|
||||
|
||||
private:
|
||||
FuzzedDataProvider *mFdp;
|
||||
private:
|
||||
FuzzedDataProvider *fdp_;
|
||||
};
|
||||
|
||||
class FuzzCryptoSession : public CryptoSession {
|
||||
public:
|
||||
public:
|
||||
FuzzCryptoSession(metrics::CryptoMetrics *metrics, FuzzedDataProvider *fdp)
|
||||
: CryptoSession(metrics) {
|
||||
mFdp = fdp;
|
||||
fdp_ = fdp;
|
||||
}
|
||||
|
||||
~FuzzCryptoSession() override {}
|
||||
|
||||
bool IsOpen() override { return mFdp->ConsumeBool(); }
|
||||
bool IsOpen() override { return fdp_->ConsumeBool(); }
|
||||
|
||||
bool GetCachedSystemId(uint32_t * /*system_id*/) override {
|
||||
return mFdp->ConsumeBool();
|
||||
return fdp_->ConsumeBool();
|
||||
}
|
||||
|
||||
void SetSystemId(uint32_t /*system_id*/) override {}
|
||||
CdmSecurityLevel GetSecurityLevel(RequestedSecurityLevel /*level*/) override {
|
||||
return (CdmSecurityLevel)mFdp->ConsumeIntegralInRange(kMinEnum, kMaxEnum);
|
||||
return (CdmSecurityLevel)fdp_->ConsumeIntegralInRange(kMinEnum, kMaxEnum);
|
||||
}
|
||||
|
||||
CdmResponseType
|
||||
GetProvisioningMethod(RequestedSecurityLevel /*level*/,
|
||||
CdmClientTokenType *tokenType) override {
|
||||
*tokenType =
|
||||
(CdmClientTokenType)mFdp->ConsumeIntegralInRange(kMinEnum, kMaxEnum);
|
||||
CdmResponseType GetProvisioningMethod(
|
||||
RequestedSecurityLevel /*level*/,
|
||||
CdmClientTokenType *token_type) override {
|
||||
*token_type =
|
||||
(CdmClientTokenType)fdp_->ConsumeIntegralInRange(kMinEnum, kMaxEnum);
|
||||
return CdmResponseType(
|
||||
mFdp->PickValueInArray<CdmResponseEnum>(kCdmResponseEnums));
|
||||
fdp_->PickValueInArray<CdmResponseEnum>(kCdmResponseEnums));
|
||||
}
|
||||
|
||||
CdmResponseType GetTokenFromKeybox(RequestedSecurityLevel /*level*/,
|
||||
std::string *keyData) override {
|
||||
*keyData = mFdp->ConsumeRandomLengthString(kMaxByte);
|
||||
std::string *key_data) override {
|
||||
*key_data = fdp_->ConsumeRandomLengthString(kMaxByte);
|
||||
return CdmResponseType(
|
||||
mFdp->PickValueInArray<CdmResponseEnum>(kCdmResponseEnums));
|
||||
fdp_->PickValueInArray<CdmResponseEnum>(kCdmResponseEnums));
|
||||
}
|
||||
|
||||
CdmResponseType GetTokenFromOemCert(RequestedSecurityLevel /*level*/,
|
||||
std::string *oemCert) override {
|
||||
*oemCert = mFdp->ConsumeRandomLengthString(kMaxByte);
|
||||
std::string *oem_cert) override {
|
||||
*oem_cert = fdp_->ConsumeRandomLengthString(kMaxByte);
|
||||
return CdmResponseType(
|
||||
mFdp->PickValueInArray<CdmResponseEnum>(kCdmResponseEnums));
|
||||
fdp_->PickValueInArray<CdmResponseEnum>(kCdmResponseEnums));
|
||||
}
|
||||
void SetSystemIdBase(uint32_t /* system_id*/) {}
|
||||
|
||||
private:
|
||||
FuzzedDataProvider *mFdp;
|
||||
private:
|
||||
FuzzedDataProvider *fdp_;
|
||||
};
|
||||
|
||||
class SystemIdExtractorFuzzer {
|
||||
public:
|
||||
public:
|
||||
SystemIdExtractorFuzzer(const uint8_t *data, size_t size)
|
||||
: mFdp(data, size){};
|
||||
void process();
|
||||
: fdp_(data, size){};
|
||||
void Process();
|
||||
|
||||
private:
|
||||
FuzzedDataProvider mFdp;
|
||||
private:
|
||||
FuzzedDataProvider fdp_;
|
||||
};
|
||||
|
||||
void SystemIdExtractorFuzzer::process() {
|
||||
void SystemIdExtractorFuzzer::Process() {
|
||||
FuzzFileSystem fuzz_file_system(&fdp_);
|
||||
metrics::CryptoMetrics crypto_metrics;
|
||||
FuzzDeviceFiles device_files(&fuzz_file_system, &fdp_);
|
||||
|
||||
FuzzFileSystem fuzzFileSystem(&mFdp);
|
||||
metrics::CryptoMetrics cryptoMetrics;
|
||||
FuzzDeviceFiles deviceFiles(&fuzzFileSystem, &mFdp);
|
||||
|
||||
RequestedSecurityLevel securityLevel =
|
||||
(RequestedSecurityLevel)mFdp.ConsumeIntegralInRange(
|
||||
RequestedSecurityLevel security_level =
|
||||
(RequestedSecurityLevel)fdp_.ConsumeIntegralInRange(
|
||||
kMinRequestedSecurityLevel, kMaxRequestedSecurityLevel);
|
||||
|
||||
std::unique_ptr<FuzzCryptoSession> cryptoSessions =
|
||||
std::make_unique<FuzzCryptoSession>(&cryptoMetrics, &mFdp);
|
||||
std::unique_ptr<FuzzCryptoSession> crypto_sessions =
|
||||
std::make_unique<FuzzCryptoSession>(&crypto_metrics, &fdp_);
|
||||
|
||||
std::unique_ptr<SystemIdExtractor> systemIdExtractor =
|
||||
std::make_unique<SystemIdExtractor>(securityLevel, cryptoSessions.get(),
|
||||
&fuzzFileSystem);
|
||||
std::unique_ptr<SystemIdExtractor> system_id_extractor =
|
||||
std::make_unique<SystemIdExtractor>(security_level, crypto_sessions.get(),
|
||||
&fuzz_file_system);
|
||||
|
||||
while (mFdp.remaining_bytes()) {
|
||||
auto invokeSystemIdExtractorAPI = mFdp.PickValueInArray<
|
||||
const std::function<void()>>({
|
||||
[&]() {
|
||||
uint32_t systemId;
|
||||
systemId = mFdp.ConsumeIntegralInRange<uint32_t>(kMinByte, kMaxByte);
|
||||
systemIdExtractor->ExtractSystemId(&systemId);
|
||||
},
|
||||
[&]() {
|
||||
uint32_t systemId;
|
||||
systemId = mFdp.ConsumeIntegralInRange<uint32_t>(kMinByte, kMaxByte);
|
||||
const std::string keyData = mFdp.ConsumeRandomLengthString(kMaxByte);
|
||||
systemIdExtractor->ExtractSystemIdFromKeyboxData(keyData, &systemId);
|
||||
},
|
||||
[&]() {
|
||||
uint32_t systemId;
|
||||
systemId = mFdp.ConsumeIntegralInRange<uint32_t>(kMinByte, kMaxByte);
|
||||
const std::string oemCert = mFdp.ConsumeRandomLengthString(kMaxByte);
|
||||
systemIdExtractor->ExtractSystemIdFromOemCert(oemCert, &systemId);
|
||||
},
|
||||
[&]() { systemIdExtractor->SetDeviceFilesForTesting(&deviceFiles); },
|
||||
});
|
||||
invokeSystemIdExtractorAPI();
|
||||
while (fdp_.remaining_bytes()) {
|
||||
auto invoke_system_id_extractor_API =
|
||||
fdp_.PickValueInArray<const std::function<void()>>({
|
||||
[&]() {
|
||||
uint32_t system_id;
|
||||
system_id =
|
||||
fdp_.ConsumeIntegralInRange<uint32_t>(kMinByte, kMaxByte);
|
||||
system_id_extractor->ExtractSystemId(&system_id);
|
||||
},
|
||||
[&]() {
|
||||
uint32_t system_id;
|
||||
system_id =
|
||||
fdp_.ConsumeIntegralInRange<uint32_t>(kMinByte, kMaxByte);
|
||||
const std::string key_data =
|
||||
fdp_.ConsumeRandomLengthString(kMaxByte);
|
||||
system_id_extractor->ExtractSystemIdFromKeyboxData(key_data,
|
||||
&system_id);
|
||||
},
|
||||
[&]() {
|
||||
uint32_t system_id;
|
||||
system_id =
|
||||
fdp_.ConsumeIntegralInRange<uint32_t>(kMinByte, kMaxByte);
|
||||
const std::string oem_cert =
|
||||
fdp_.ConsumeRandomLengthString(kMaxByte);
|
||||
system_id_extractor->ExtractSystemIdFromOemCert(oem_cert, &system_id);
|
||||
},
|
||||
[&]() {
|
||||
system_id_extractor->SetDeviceFilesForTesting(&device_files);
|
||||
},
|
||||
});
|
||||
invoke_system_id_extractor_API();
|
||||
}
|
||||
}
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||
SystemIdExtractorFuzzer systemIdExtractorFuzzer(data, size);
|
||||
systemIdExtractorFuzzer.process();
|
||||
SystemIdExtractorFuzzer system_id_extractor_fuzzer(data, size);
|
||||
system_id_extractor_fuzzer.Process();
|
||||
return 0;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user