/* * Copyright (C) 2021 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. * */ #include #include #include "keymaster4_common.h" namespace android::hardware::keymaster::V4_0::fuzzer { using android::hardware::keymaster::V4_0::SecurityLevel; using android::hardware::keymaster::V4_0::VerificationToken; using android::hardware::keymaster::V4_0::support::deserializeVerificationToken; using android::hardware::keymaster::V4_0::support::serializeVerificationToken; constexpr SecurityLevel kSecurityLevel[]{ SecurityLevel::SOFTWARE, SecurityLevel::TRUSTED_ENVIRONMENT, SecurityLevel::STRONGBOX, }; constexpr size_t kMaxVectorSize = 100; constexpr size_t kMaxCharacters = 100; class KeyMaster4UtilsFuzzer { public: void process(const uint8_t* data, size_t size); private: void invokeKeyMasterUtils(); std::unique_ptr mFdp = nullptr; }; void KeyMaster4UtilsFuzzer::invokeKeyMasterUtils() { support::getOsVersion(); support::getOsPatchlevel(); while (mFdp->remaining_bytes() > 0) { auto keymaster_function = mFdp->PickValueInArray>({ [&]() { VerificationToken token; token.challenge = mFdp->ConsumeIntegral(); token.timestamp = mFdp->ConsumeIntegral(); token.securityLevel = mFdp->PickValueInArray(kSecurityLevel); size_t vectorSize = mFdp->ConsumeIntegralInRange(0, kMaxVectorSize); token.mac.resize(vectorSize); for (size_t n = 0; n < vectorSize; ++n) { token.mac[n] = mFdp->ConsumeIntegral(); } std::optional> serialized = serializeVerificationToken(token); if (serialized.has_value()) { std::optional deserialized = deserializeVerificationToken(serialized.value()); } }, [&]() { std::vector dataVector; size_t size = mFdp->ConsumeIntegralInRange(0, sizeof(hw_auth_token_t)); dataVector = mFdp->ConsumeBytes(size); support::blob2hidlVec(dataVector.data(), dataVector.size()); support::blob2hidlVec(dataVector); HardwareAuthToken authToken = support::hidlVec2AuthToken(dataVector); hidl_vec volatile hidlVector = support::authToken2HidlVec(authToken); }, [&]() { std::string str = mFdp->ConsumeRandomLengthString(kMaxCharacters); support::blob2hidlVec(str); }, }); keymaster_function(); } return; } void KeyMaster4UtilsFuzzer::process(const uint8_t* data, size_t size) { mFdp = std::make_unique(data, size); invokeKeyMasterUtils(); } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { KeyMaster4UtilsFuzzer kmUtilsFuzzer; kmUtilsFuzzer.process(data, size); return 0; } } // namespace android::hardware::keymaster::V4_0::fuzzer