Add fuzzer for drmFactory Service (00935f46) · Commits · e / os / android_frameworks_av

drm/mediadrm/plugins/clearkey/aidl/Android.bp

+75 −0

Original line number	Diff line number	Diff line
		@@ -69,3 +69,78 @@ phony {
		"android.hardware.drm-service.clearkey",
		],
		}

		cc_defaults {
		name: "fuzz_aidl_clearkey_service_defaults",

		srcs: [
		"CreatePluginFactories.cpp",
		"CryptoPlugin.cpp",
		"DrmFactory.cpp",
		"DrmPlugin.cpp",
		],

		relative_install_path: "hw",

		cflags: ["-Wall", "-Werror", "-Wthread-safety"],

		include_dirs: ["frameworks/av/include"],

		shared_libs: [
		"libbase",
		"libbinder_ndk",
		"libcrypto",
		"liblog",
		"libprotobuf-cpp-lite",
		"libutils",
		"android.hardware.drm-V1-ndk",
		],

		static_libs: [
		"android.hardware.common-V2-ndk",
		"libclearkeybase_fuzz",
		],

		local_include_dirs: ["include"],

		sanitize: {
		integer_overflow: true,
		},
		}

		cc_fuzz {
		name: "android.hardware.drm-service.clearkey.aidl_fuzzer",
		defaults: [
		"fuzz_aidl_clearkey_service_defaults",
		],
		static_libs: [
		"libbase",
		"libbinder_random_parcel",
		"libcutils",
		"liblog",
		"libutils",
		],
		target: {
		android: {
		shared_libs: [
		"libbinder_ndk",
		"libbinder",
		],
		},
		host: {
		static_libs: [
		"libbinder_ndk",
		"libbinder",
		],
		},
		darwin: {
		enabled: false,
		},
		},
		srcs: ["fuzzer.cpp"],
		fuzz_config: {
		cc: [
		"hamzeh@google.com",
		],
		},
		}
		No newline at end of file

0 → 100644

+35 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/
		#include <fuzzbinder/libbinder_ndk_driver.h>
		#include <fuzzer/FuzzedDataProvider.h>

		#include "CreatePluginFactories.h"

		#include <android/binder_manager.h>
		#include <android/binder_process.h>

		using ::aidl::android::hardware::drm::clearkey::createDrmFactory;
		using ::aidl::android::hardware::drm::clearkey::DrmFactory;

		using android::fuzzService;
		using ndk::SharedRefBase;

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		std::shared_ptr<DrmFactory> drmFactory = createDrmFactory();
		fuzzService(drmFactory->asBinder().get(), FuzzedDataProvider(data, size));

		return 0;
		}

+51 −0

Original line number	Diff line number	Diff line
		@@ -97,3 +97,54 @@ cc_library_static {
		integer_overflow: true,
		},
		}

		cc_library_static {
		name: "libclearkeydevicefiles-protos.common_fuzz",

		proto: {
		export_proto_headers: true,
		type: "lite",
		},
		srcs: ["protos/DeviceFiles.proto"],
		}

		cc_library_static {
		name: "libclearkeybase_fuzz",

		srcs: [
		"AesCtrDecryptor.cpp",
		"Base64.cpp",
		"Buffer.cpp",
		"ClearKeyUUID.cpp",
		"DeviceFiles.cpp",
		"InitDataParser.cpp",
		"JsonWebKey.cpp",
		"MemoryFileSystem.cpp",
		"Session.cpp",
		"SessionLibrary.cpp",
		"Utils.cpp",
		],

		cflags: ["-Wall", "-Werror"],

		include_dirs: ["frameworks/av/include"],

		shared_libs: [
		"libutils",
		"libcrypto",
		],

		whole_static_libs: [
		"libjsmn",
		"libclearkeydevicefiles-protos.common_fuzz",
		],

		export_include_dirs: [
		"include",
		"include/clearkeydrm",
		],

		sanitize: {
		integer_overflow: true,
		},
		}