Merge of OEMCrypto fuzz test CLs
---------------------------------------------------------------------- Fix oemcrypto_generic_verify_fuzz mutator signature offset [ Merge of http://go/wvgerrit/165899 ] Merged from https://widevine-internal-review.googlesource.com/165598 Change-Id: I85574fcd62622d2954c306688e04ecfda333c0cb ---------------------------------------------------------------------- Fix regressions in oemcrypto_decrypt_cenc_fuzz [ Merge of http://go/wvgerrit/162151 ] Fix null-dereference of subsamples vector and potential memory leak due to parsing errors. Bug: 260005865 Bug: 260013015 Merged from https://widevine-internal-review.googlesource.com/162081 Change-Id: I91bf1baa726803b2a0073ff3db94e69719d377bb ---------------------------------------------------------------------- Add custom mutator to oemcrypto_generic_verify_fuzz [ Merge of http://go/wvgerrit/161578 ] Enable fuzzing mutations beyond changing the signature length. Merged from https://widevine-internal-review.googlesource.com/159917 Change-Id: I022d752107b788bd45aafb8325e3186ef90336de ---------------------------------------------------------------------- Refactor oemcrypto_decrypt_cenc_fuzz [ Merge of http://go/wvgerrit/161546 ] Refactor to minimize the required corpus length, fuzz the sample input data, and avoid undefined behavior related to filling OEMCrypto_DestBufferDesc::buffer with fuzzed data. Merged from https://widevine-internal-review.googlesource.com/159618 Change-Id: Id9af8b1704d4619ba88ab8de3adb35d5f8bb69f6 ---------------------------------------------------------------------- Refactor oemcrypto_copy_buffer_fuzz [ Merge of http://go/wvgerrit/161307 ] Refactor to minimize the required corpus length, fuzz the output buffer length, and avoid undefined behavior related to filling OEMCrypto_DestBufferDesc::buffer with fuzzed data. Merged from https://widevine-internal-review.googlesource.com/159617 Change-Id: Ieddc6260e5eca641f8409a9b361ca4e5a40d6f52 ---------------------------------------------------------------------- Improve AddressSanitizer coverage for LoadEntitledContentKeys fuzzing [ Merge of http://go/wvgerrit/161397 ] Split fuzzed message into separate buffer so AddressSanitizer can detect out-of-bounds accesses. Merged from https://widevine-internal-review.googlesource.com/161277 ---------------------------------------------------------------------- Avoid copying fuzzed data when separator splitting [ Merge of http://go/wvgerrit/161120 ] Merged from https://widevine-internal-review.googlesource.com/159497 Change-Id: I2b13ff34eee74c8aea9a8176aa711e3e2bc57add ---------------------------------------------------------------------- Fix oemcrypto_opk_dispatcher_fuzz [ Merge of http://go/wvgerrit/161119 ] Set ODK_Message size and add timestamp field to initialization requests. Merged from https://widevine-internal-review.googlesource.com/159897 Change-Id: Ide51d1cb4119a396212d1802411cfa19f5792e9d ---------------------------------------------------------------------- Cover empty buffers in fuzz tests [ Merge of http://go/wvgerrit/161018 ] Update tests that avoid passing empty buffers to OEMCrypto API methods. Merged from https://widevine-internal-review.googlesource.com/159317 Change-Id: If0d8007e3294820654b081fe813a09485e757f1c ---------------------------------------------------------------------- Fix cherry pick of "Improve buffer size distribution in fuzz tests" [ Merge of http://go/wvgerrit/161022 ] Change-Id: I8b0440fe13b513396b5779c25e6a46ac40eaa183 ---------------------------------------------------------------------- Improve buffer size distribution in fuzz tests [ Merge of http://go/wvgerrit/160957 ] When a buffer size is fuzzed, use the modulo operation, instead of std::min, to create an even distribution. Merged from https://widevine-internal-review.googlesource.com/159157 Change-Id: I3c1168c7a7d739793005927a97af18de5df2e4c6 ---------------------------------------------------------------------- Improve AddressSanitizer coverage in fuzz tests [ Merge of http://go/wvgerrit/160464 ] Split fuzzed data into separate buffers so AddressSanitizer can detect all out-of-bounds accesses. Merged from https://widevine-internal-review.googlesource.com/158977 Change-Id: I7ca67409b7c6f96548e21ab41f6caf99f738605d
This commit is contained in:
Rahul Frias
@@ -2,50 +2,12 @@
|
||||
// source code may only be used and distributed under the Widevine Master
|
||||
// License Agreement.
|
||||
|
||||
#include "FuzzedDataProvider.h"
|
||||
#include "OEMCryptoCENC.h"
|
||||
#include "log.h"
|
||||
#include "oemcrypto_fuzz_helper.h"
|
||||
#include "oemcrypto_fuzz_structs.h"
|
||||
|
||||
namespace wvoec {
|
||||
// Free dynamic memory allocated by fuzzer script.
|
||||
void FreeOutputBuffers(OEMCrypto_SESSION session_id,
|
||||
OEMCrypto_DestBufferDesc& output_descriptor,
|
||||
int* secure_fd) {
|
||||
switch (output_descriptor.type) {
|
||||
case OEMCrypto_BufferType_Clear: {
|
||||
delete[] output_descriptor.buffer.clear.clear_buffer;
|
||||
break;
|
||||
}
|
||||
case OEMCrypto_BufferType_Secure: {
|
||||
OEMCrypto_FreeSecureBuffer(session_id, &output_descriptor, *secure_fd);
|
||||
break;
|
||||
}
|
||||
case OEMCrypto_BufferType_Direct: {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bool InitializeOutputBuffers(OEMCrypto_SESSION session_id,
|
||||
OEMCrypto_DestBufferDesc& output_descriptor,
|
||||
int* secure_fd, size_t input_buffer_size) {
|
||||
switch (output_descriptor.type) {
|
||||
case OEMCrypto_BufferType_Clear: {
|
||||
output_descriptor.buffer.clear.clear_buffer =
|
||||
new OEMCrypto_SharedMemory[input_buffer_size];
|
||||
return true;
|
||||
}
|
||||
case OEMCrypto_BufferType_Secure: {
|
||||
OEMCryptoResult sts = OEMCrypto_AllocateSecureBuffer(
|
||||
session_id, input_buffer_size, &output_descriptor, secure_fd);
|
||||
return sts == OEMCrypto_SUCCESS;
|
||||
}
|
||||
case OEMCrypto_BufferType_Direct: {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
// Redirect printf and log statements from oemcrypto functions to a file to
|
||||
@@ -54,39 +16,68 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
|
||||
// OEMCrypto_DestBufferDesc and a buffer from which data needs to be copied
|
||||
// are expected as inputs to copy buffer API.
|
||||
// Input fuzzed data is interpreted as
|
||||
// Input fuzzed data is interpreted as:
|
||||
// (OEMCrypto_DestBufferDesc | subsample_flags | input_buffer)
|
||||
OEMCrypto_Copy_Buffer_Fuzz fuzzed_structure;
|
||||
if (size <= sizeof(fuzzed_structure)) {
|
||||
if (size < sizeof(fuzzed_structure)) {
|
||||
return 0;
|
||||
}
|
||||
memcpy(&fuzzed_structure, data, sizeof(fuzzed_structure));
|
||||
FuzzedDataProvider fuzzed_data(data, size);
|
||||
fuzzed_data.ConsumeData(&fuzzed_structure, sizeof(fuzzed_structure));
|
||||
ConvertDataToValidEnum(OEMCrypto_BufferType_MaxValue,
|
||||
&fuzzed_structure.dest_buffer_desc.type);
|
||||
fuzzed_structure.dest_buffer_desc.buffer_config %= MAX_FUZZ_OUTPUT_LENGTH + 1;
|
||||
const std::vector<OEMCrypto_SharedMemory> input_buffer =
|
||||
fuzzed_data.ConsumeRemainingBytes<OEMCrypto_SharedMemory>();
|
||||
|
||||
OEMCryptoLicenseAPIFuzz license_api_fuzz;
|
||||
Session* session = license_api_fuzz.session();
|
||||
// Fuzz input buffer to be copied.
|
||||
size_t input_buffer_size = size - sizeof(fuzzed_structure);
|
||||
const uint32_t session_id = license_api_fuzz.session()->session_id();
|
||||
|
||||
// Initialize output buffer.
|
||||
OEMCrypto_DestBufferDesc dest_buffer_desc;
|
||||
int secure_fd = 0;
|
||||
// Create output buffer pointers. If secure buffer is not supported, we
|
||||
// explicitly convert to clear buffer and fuzz.
|
||||
if (!InitializeOutputBuffers(session->session_id(),
|
||||
fuzzed_structure.dest_buffer_desc, &secure_fd,
|
||||
input_buffer_size)) {
|
||||
LOGI(
|
||||
"[OEMCrypto decrypt CENC fuzz] Secure buffers are not supported. Use "
|
||||
"clear buffer instead.");
|
||||
fuzzed_structure.dest_buffer_desc.type = OEMCrypto_BufferType_Clear;
|
||||
InitializeOutputBuffers(session->session_id(),
|
||||
fuzzed_structure.dest_buffer_desc, &secure_fd,
|
||||
input_buffer_size);
|
||||
dest_buffer_desc.type = fuzzed_structure.dest_buffer_desc.type;
|
||||
switch (dest_buffer_desc.type) {
|
||||
case OEMCrypto_BufferType_Clear:
|
||||
dest_buffer_desc.buffer.clear.clear_buffer =
|
||||
new OEMCrypto_SharedMemory[fuzzed_structure.dest_buffer_desc
|
||||
.buffer_config];
|
||||
dest_buffer_desc.buffer.clear.clear_buffer_length =
|
||||
fuzzed_structure.dest_buffer_desc.buffer_config;
|
||||
break;
|
||||
|
||||
case OEMCrypto_BufferType_Secure:
|
||||
if (OEMCrypto_AllocateSecureBuffer(
|
||||
session_id, fuzzed_structure.dest_buffer_desc.buffer_config,
|
||||
&dest_buffer_desc, &secure_fd) != OEMCrypto_SUCCESS) {
|
||||
return 0;
|
||||
}
|
||||
break;
|
||||
|
||||
case OEMCrypto_BufferType_Direct:
|
||||
dest_buffer_desc.buffer.direct.is_video =
|
||||
fuzzed_structure.dest_buffer_desc.buffer_config & 1;
|
||||
break;
|
||||
}
|
||||
OEMCrypto_CopyBuffer(session->session_id(), data + sizeof(fuzzed_structure),
|
||||
input_buffer_size, &fuzzed_structure.dest_buffer_desc,
|
||||
fuzzed_structure.subsample_flags);
|
||||
FreeOutputBuffers(session->session_id(), fuzzed_structure.dest_buffer_desc,
|
||||
&secure_fd);
|
||||
|
||||
OEMCrypto_CopyBuffer(session_id, input_buffer.data(), input_buffer.size(),
|
||||
&dest_buffer_desc, fuzzed_structure.subsample_flags);
|
||||
|
||||
// Free output buffer.
|
||||
switch (dest_buffer_desc.type) {
|
||||
case OEMCrypto_BufferType_Clear:
|
||||
delete[] dest_buffer_desc.buffer.clear.clear_buffer;
|
||||
break;
|
||||
|
||||
case OEMCrypto_BufferType_Secure:
|
||||
OEMCrypto_FreeSecureBuffer(session_id, &dest_buffer_desc, secure_fd);
|
||||
break;
|
||||
|
||||
case OEMCrypto_BufferType_Direct:
|
||||
break;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
} // namespace wvoec
|
||||
|
||||
Reference in New Issue
Block a user