android/libwvdrmengine/oemcrypto/test/fuzz_tests/oemcrypto_copy_buffer_fuzz.cc

// Copyright 2020 Google LLC. All Rights Reserved. This file and proprietary
// source code may only be used and distributed under the Widevine Master
// License Agreement.

#include "FuzzedDataProvider.h"
#include "OEMCryptoCENC.h"
#include "oemcrypto_fuzz_helper.h"
#include "oemcrypto_fuzz_structs.h"

namespace wvoec {

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  // Redirect printf and log statements from oemcrypto functions to a file to
  // reduce noise
  RedirectStdoutToFile();

  // OEMCrypto_DestBufferDesc and a buffer from which data needs to be copied
  // are expected as inputs to copy buffer API.
  // Input fuzzed data is interpreted as:
  // (OEMCrypto_DestBufferDesc | subsample_flags | input_buffer)
  OEMCrypto_Copy_Buffer_Fuzz fuzzed_structure;
  if (size < sizeof(fuzzed_structure)) {
    return 0;
  }
  FuzzedDataProvider fuzzed_data(data, size);
  fuzzed_data.ConsumeData(&fuzzed_structure, sizeof(fuzzed_structure));
  ConvertDataToValidEnum(OEMCrypto_BufferType_MaxValue,
                         &fuzzed_structure.dest_buffer_desc.type);
  fuzzed_structure.dest_buffer_desc.buffer_config %= MAX_FUZZ_OUTPUT_LENGTH + 1;
  const std::vector<OEMCrypto_SharedMemory> input_buffer =
      fuzzed_data.ConsumeRemainingBytes<OEMCrypto_SharedMemory>();

  OEMCryptoLicenseAPIFuzz license_api_fuzz;
  const uint32_t session_id = license_api_fuzz.session()->session_id();

  // Initialize output buffer.
  OEMCrypto_DestBufferDesc dest_buffer_desc;
  int secure_fd = 0;
  dest_buffer_desc.type = fuzzed_structure.dest_buffer_desc.type;
  switch (dest_buffer_desc.type) {
    case OEMCrypto_BufferType_Clear:
      dest_buffer_desc.buffer.clear.clear_buffer =
          new OEMCrypto_SharedMemory[fuzzed_structure.dest_buffer_desc
                                         .buffer_config];
      dest_buffer_desc.buffer.clear.clear_buffer_length =
          fuzzed_structure.dest_buffer_desc.buffer_config;
      break;

    case OEMCrypto_BufferType_Secure:
      if (OEMCrypto_AllocateSecureBuffer(
              session_id, fuzzed_structure.dest_buffer_desc.buffer_config,
              &dest_buffer_desc, &secure_fd) != OEMCrypto_SUCCESS) {
        return 0;
      }
      break;

    case OEMCrypto_BufferType_Direct:
      dest_buffer_desc.buffer.direct.is_video =
          fuzzed_structure.dest_buffer_desc.buffer_config & 1;
      break;
  }

  OEMCrypto_CopyBuffer(session_id, input_buffer.data(), input_buffer.size(),
                       &dest_buffer_desc, fuzzed_structure.subsample_flags);

  // Free output buffer.
  switch (dest_buffer_desc.type) {
    case OEMCrypto_BufferType_Clear:
      delete[] dest_buffer_desc.buffer.clear.clear_buffer;
      break;

    case OEMCrypto_BufferType_Secure:
      OEMCrypto_FreeSecureBuffer(session_id, &dest_buffer_desc, secure_fd);
      break;

    case OEMCrypto_BufferType_Direct:
      break;
  }

  return 0;
}

}  // namespace wvoec