• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2020 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
5  * use this file except in compliance with the License. You may obtain a copy of
6  * the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12  * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13  * License for the specific language governing permissions and limitations under
14  * the License.
15  */
16 
17 package android.security.cts;
18 
19 import com.android.tradefed.device.ITestDevice;
20 import com.android.tradefed.log.LogUtil.CLog;
21 import com.android.compatibility.common.util.CrashUtils;
22 
23 import android.platform.test.annotations.AsbSecurityTest;
24 import org.junit.Test;
25 import org.junit.runner.RunWith;
26 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
27 
28 import static org.junit.Assert.*;
29 import static org.junit.Assume.*;
30 import junit.framework.Assert;
31 import java.util.Arrays;
32 import java.util.ArrayList;
33 
34 import static org.junit.Assume.*;
35 import static org.hamcrest.CoreMatchers.*;
36 
37 @RunWith(DeviceJUnit4ClassRunner.class)
38 public class TestMedia extends SecurityTestCase {
39 
40 
41     /******************************************************************************
42      * To prevent merge conflicts, add tests for N below this comment, before any
43      * existing test methods
44      ******************************************************************************/
45 
46     /******************************************************************************
47      * To prevent merge conflicts, add tests for O below this comment, before any
48      * existing test methods
49      ******************************************************************************/
50 
51     /**
52      * b/17769851
53      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
54      */
55     @Test
56     @AsbSecurityTest(cveBugId = 17769851)
testPocCVE_2015_6616()57     public void testPocCVE_2015_6616() throws Exception {
58         pocPusher.only64();
59         String inputFiles[] = {"cve_2015_6616.mp4"};
60         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2015-6616",
61                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
62     }
63 
64     /**
65      * b/37239013
66      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
67      */
68     @Test
69     @AsbSecurityTest(cveBugId = 37239013)
testPocCVE_2017_0697()70     public void testPocCVE_2017_0697() throws Exception {
71         String inputFiles[] = {"cve_2017_0697.mp4"};
72         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0697",
73                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
74     }
75 
76     /**
77      * b/127702368
78      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
79      */
80     @Test
81     @AsbSecurityTest(cveBugId = 127702368)
testPocCVE_2019_2126()82     public void testPocCVE_2019_2126() throws Exception {
83         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2126", null, getDevice());
84     }
85 
86     /**
87      * b/66969349
88      * Vulnerability Behaviour: SIGSEGV in media.codec
89      */
90     @Test
91     @AsbSecurityTest(cveBugId = 66969349)
testPocCVE_2017_13180()92     public void testPocCVE_2017_13180() throws Exception {
93         String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"};
94         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-13180", null, getDevice(),
95                 processPatternStrings);
96     }
97 
98     /**
99      * b/111210196
100      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
101      */
102     @Test
103     @AsbSecurityTest(cveBugId = 111210196)
testPocCVE_2019_2228()104     public void testPocCVE_2019_2228() throws Exception {
105         String inputFiles[] = {"cve_2019_2228_ipp.mp4"};
106         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2228",
107                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
108     }
109 
110     /**
111      * b/157650336
112      * Vulnerability Behaviour: SIGSEGV in self / EXIT_VULNERABLE (113)
113      */
114     @Test
115     @AsbSecurityTest(cveBugId = 157650336)
testPocCVE_2020_0450()116     public void testPocCVE_2020_0450() throws Exception {
117         AdbUtils.assumeHasNfc(getDevice());
118         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0450", null, getDevice());
119     }
120 
121     /**
122      * b/156997193
123      * Vulnerability Behaviour: SIGABRT in self
124      */
125     @Test
126     @AsbSecurityTest(cveBugId = 156997193)
testPocCVE_2020_0409()127     public void testPocCVE_2020_0409() throws Exception {
128         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
129         String binaryName = "CVE-2020-0409";
130         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
131         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
132         testConfig.config.setSignals(signals);
133         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
134     }
135 
136     /**
137      * b/161894517
138      * Vulnerability Behaviour: SIGABRT in self
139      */
140     @Test
141     @AsbSecurityTest(cveBugId = 161894517)
testPocCVE_2020_0421()142     public void testPocCVE_2020_0421() throws Exception {
143         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
144         String binaryName = "CVE-2020-0421";
145         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
146         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
147         testConfig.config.setSignals(signals);
148         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
149     }
150 
151     /**
152      * b/132082342
153      * Vulnerability Behaviour: SIGSEGV in self
154      */
155     @Test
156     @AsbSecurityTest(cveBugId = 132082342)
testPocCVE_2019_2133()157     public void testPocCVE_2019_2133() throws Exception {
158         AdbUtils.assumeHasNfc(getDevice());
159         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2133", null, getDevice());
160     }
161 
162     /**
163      * b/132083376
164      * Vulnerability Behaviour: SIGSEGV in self
165      */
166     @Test
167     @AsbSecurityTest(cveBugId = 132083376)
testPocCVE_2019_2134()168     public void testPocCVE_2019_2134() throws Exception {
169         AdbUtils.assumeHasNfc(getDevice());
170         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2134", null, getDevice());
171     }
172 
173     /**
174      * b/31470908
175      * Vulnerability Behaviour: SIGSEGV in self
176      */
177     @Test
178     @AsbSecurityTest(cveBugId = 31470908)
testPocCVE_2016_10244()179     public void testPocCVE_2016_10244() throws Exception {
180         String inputFiles[] = {"cve_2016_10244"};
181         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-10244",
182                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
183     }
184 
185     /**
186      * b/27793367
187      * Vulnerability Behaviour: SIGSEGV in media.codec
188      */
189     @Test
190     @AsbSecurityTest(cveBugId = 27793367)
testPocCVE_2016_2485()191     public void testPocCVE_2016_2485() throws Exception {
192         String inputFiles[] = {"cve_2016_2485.raw"};
193         String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"};
194         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-2485",
195                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice(),
196                 processPatternStrings);
197     }
198 
199     /**
200      * b/141890807
201      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
202      */
203     @Test
204     @AsbSecurityTest(cveBugId = 141890807)
testPocCVE_2020_0007()205     public void testPocCVE_2020_0007() throws Exception {
206         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0007", null, getDevice());
207     }
208 
209     /**
210      * b/118372692
211      * Vulnerability Behaviour: SIGSEGV in self
212      */
213     @Test
214     @AsbSecurityTest(cveBugId = 118372692)
testPocCVE_2019_1988()215     public void testPocCVE_2019_1988() throws Exception {
216         assumeThat(getDevice().getProperty("ro.config.low_ram"), not(is("true")));
217         String inputFiles[] = {"cve_2019_1988.mp4"};
218         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-1988",
219                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
220     }
221 
222     /**
223      * b/63522430
224      * Vulnerability Behaviour: SIGSEGV in media.codec
225      */
226     @Test
227     @AsbSecurityTest(cveBugId = 63522430)
testPocCVE_2017_0817()228     public void testPocCVE_2017_0817() throws Exception {
229         String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"};
230         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0817", null, getDevice(),
231                 processPatternStrings);
232     }
233 
234     /**
235      * b/36104177
236      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
237      */
238     @Test
239     @AsbSecurityTest(cveBugId = 36104177)
testPocCVE_2017_0670()240     public void testPocCVE_2017_0670() throws Exception {
241         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0670", null, getDevice());
242     }
243 
244     /**
245      * b/68159767
246      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
247      */
248     @Test
249     @AsbSecurityTest(cveBugId = 68159767)
testPocCVE_2017_13234()250     public void testPocCVE_2017_13234() throws Exception {
251         String inputFiles[] = { "cve_2017_13234.xmf" };
252         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-13234",
253                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
254     }
255 
256     /**
257      * b/64340921
258      * Vulnerability Behaviour: SIGABRT in audioserver
259      */
260     @Test
261     @AsbSecurityTest(cveBugId = 64340921)
testPocCVE_2017_0837()262     public void testPocCVE_2017_0837() throws Exception {
263         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
264         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig("CVE-2017-0837", getDevice());
265         testConfig.config = new CrashUtils.Config().setProcessPatterns("audioserver");
266         testConfig.config.setSignals(signals);
267         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
268     }
269 
270     /**
271      * b/62151041 - Has 4 CVEs filed together
272      */
273     /** 1. CVE-2017-9047
274      * Vulnerability Behaviour: SIGABRT by -fstack-protector
275      */
276     @Test
277     @AsbSecurityTest(cveBugId = 62151041)
testPocCVE_2018_9466_CVE_2017_9047()278     public void testPocCVE_2018_9466_CVE_2017_9047() throws Exception {
279         String binaryName = "CVE-2018-9466-CVE-2017-9047";
280         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
281         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
282         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
283         testConfig.config.setSignals(signals);
284         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
285     }
286 
287     /** 2. CVE-2017-9048
288      * Vulnerability Behaviour: SIGABRT by -fstack-protector
289      */
290     @Test
291     @AsbSecurityTest(cveBugId = 62151041)
testPocCVE_2018_9466_CVE_2017_9048()292     public void testPocCVE_2018_9466_CVE_2017_9048() throws Exception {
293         String binaryName = "CVE-2018-9466-CVE-2017-9048";
294         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
295         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
296         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
297         testConfig.config.setSignals(signals);
298         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
299     }
300 
301     /** 3. CVE-2017-9049
302      * Vulnerability Behaviour: SIGSEGV in self
303      */
304     @Test
305     @AsbSecurityTest(cveBugId = 62151041)
testPocCVE_2018_9466_CVE_2017_9049()306     public void testPocCVE_2018_9466_CVE_2017_9049() throws Exception {
307         String binaryName = "CVE-2018-9466-CVE-2017-9049";
308         String inputFiles[] = {"cve_2018_9466_cve_2017_9049.xml"};
309         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
310         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
311         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
312         testConfig.config.setSignals(signals);
313         testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0];
314         testConfig.inputFiles = Arrays.asList(inputFiles);
315         testConfig.inputFilesDestination  = AdbUtils.TMP_PATH;
316         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
317     }
318 
319     /** 4. CVE-2017-9050
320      * Vulnerability Behaviour: SIGSEGV in self
321      */
322     @Test
323     @AsbSecurityTest(cveBugId = 62151041)
testPocCVE_2018_9466_CVE_2017_9050()324     public void testPocCVE_2018_9466_CVE_2017_9050() throws Exception {
325         String binaryName = "CVE-2018-9466-CVE-2017-9049";
326         String inputFiles[] = {"cve_2018_9466_cve_2017_9050.xml"};
327         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
328         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
329         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
330         testConfig.config.setSignals(signals);
331         testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0];
332         testConfig.inputFiles = Arrays.asList(inputFiles);
333         testConfig.inputFilesDestination  = AdbUtils.TMP_PATH;
334         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
335     }
336 
337     /**
338      * b/23247055
339      * Vulnerability Behaviour: SIGABRT in self
340      */
341     @Test
342     @AsbSecurityTest(cveBugId = 20674086)
testPocCVE_2015_3873()343     public void testPocCVE_2015_3873() throws Exception {
344         String inputFiles[] = {"cve_2015_3873.mp4"};
345         String binaryName = "CVE-2015-3873";
346         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
347         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
348         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
349         testConfig.config.setSignals(signals);
350         testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0];
351         testConfig.inputFiles = Arrays.asList(inputFiles);
352         testConfig.inputFilesDestination  = AdbUtils.TMP_PATH;
353         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
354     }
355 
356     /**
357      * b/62948670
358      * Vulnerability Behaviour: SIGSEGV in media.codec
359      */
360     @Test
361     @AsbSecurityTest(cveBugId = 62948670)
testPocCVE_2017_0840()362     public void testPocCVE_2017_0840() throws Exception {
363         pocPusher.only32();
364         String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"};
365         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0840", null, getDevice(),
366                 processPatternStrings);
367     }
368 
369     /**
370      * b/69065651
371      * Vulnerability Behaviour: SIGSEGV in media.codec
372      */
373     @Test
374     @AsbSecurityTest(cveBugId = 69065651)
testPocCVE_2017_13241()375     public void testPocCVE_2017_13241() throws Exception {
376         pocPusher.only32();
377         String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"};
378         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-13241", null, getDevice(),
379                 processPatternStrings);
380     }
381 
382     /**
383      * b/111603051
384      * Vulnerability Behaviour: SIGSEGV in self
385      */
386     @Test
387     @AsbSecurityTest(cveBugId = 111603051)
testPocCVE_2018_9491()388     public void testPocCVE_2018_9491() throws Exception {
389         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9491", null, getDevice());
390     }
391 
392     /**
393      * b/79662501
394      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
395      */
396     @Test
397     @AsbSecurityTest(cveBugId = 79662501)
testPocCVE_2018_9472()398     public void testPocCVE_2018_9472() throws Exception {
399         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9472", null, getDevice());
400     }
401 
402     /**
403      * b/36554207
404      * Vulnerability Behaviour: SIGSEGV in self
405      **/
406     @Test
407     @AsbSecurityTest(cveBugId = 36554207)
testPocCVE_2016_4658()408     public void testPocCVE_2016_4658() throws Exception {
409         String inputFiles[] = {"cve_2016_4658.xml"};
410         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-4658",
411                 AdbUtils.TMP_PATH + inputFiles[0] + " \"range(//namespace::*)\"", inputFiles,
412                 AdbUtils.TMP_PATH, getDevice());
413     }
414 
415     /**
416      * b/36554209
417      * Vulnerability Behaviour: SIGSEGV in self
418      **/
419     @Test
420     @AsbSecurityTest(cveBugId = 36554209)
testPocCVE_2016_5131()421     public void testPocCVE_2016_5131() throws Exception {
422         String inputFiles[] = {"cve_2016_5131.xml"};
423         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-5131",
424                 AdbUtils.TMP_PATH + inputFiles[0] + " \"name(range-to(///doc))0+0+22\"", inputFiles,
425                 AdbUtils.TMP_PATH, getDevice());
426     }
427 
428     /**
429      * b/62800140
430      * Vulnerability Behaviour: SIGSEGV in self
431      */
432     @Test
433     @AsbSecurityTest(cveBugId = 62800140)
testPocCVE_2017_0814()434     public void testPocCVE_2017_0814() throws Exception {
435         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0814", null, getDevice());
436     }
437 
438     /**
439      * b/65540999
440      * Vulnerability Behaviour: Assert failure
441      **/
442     @Test
443     @AsbSecurityTest(cveBugId = 65540999)
testPocCVE_2017_0847()444     public void testPocCVE_2017_0847() throws Exception {
445         String cmdOut = AdbUtils.runCommandLine("ps -eo cmd,gid | grep mediametrics", getDevice());
446         if (cmdOut.length() > 0) {
447             String[] segment = cmdOut.split("\\s+");
448             if (segment.length > 1) {
449                 if (segment[1].trim().equals("0")) {
450                     Assert.fail("mediametrics has root group id");
451                 }
452             }
453         }
454     }
455 
456     /**
457      * b/112005441
458      * Vulnerability Behaviour: EXIT_VULNERABLE (113)
459      */
460     @Test
461     @AsbSecurityTest(cveBugId = 112005441)
testPocCVE_2019_9313()462     public void testPocCVE_2019_9313() throws Exception {
463         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-9313", null, getDevice());
464     }
465 
466     /**
467      * b/112159345
468      * Vulnerability Behaviour: SIGSEGV in self
469      **/
470     @Test
471     @AsbSecurityTest(cveBugId = 112159345)
testPocCVE_2018_9527()472     public void testPocCVE_2018_9527() throws Exception {
473         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9527", null, getDevice());
474     }
475 
476     /******************************************************************************
477      * To prevent merge conflicts, add tests for P below this comment, before any
478      * existing test methods
479      ******************************************************************************/
480 
481     /**
482      * b/158762825
483      * Vulnerability Behaviour: SIGABRT in self
484      */
485     @Test
486     @AsbSecurityTest(cveBugId = 158762825)
testPocCVE_2020_0451()487     public void testPocCVE_2020_0451() throws Exception {
488         assumeFalse(moduleIsPlayManaged("com.google.android.media.swcodec"));
489         String inputFiles[] = {"cve_2020_0451.aac"};
490         String binaryName = "CVE-2020-0451";
491         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
492         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
493         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
494         testConfig.config.setSignals(signals);
495         testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0];
496         testConfig.inputFiles = Arrays.asList(inputFiles);
497         testConfig.inputFilesDestination = AdbUtils.TMP_PATH;
498         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
499     }
500 
501     /**
502      * b/112891564
503      * Vulnerability Behaviour: SIGSEGV in self (Android P),
504      *                          SIGABRT in self (Android Q onward)
505      */
506     @Test
507     @AsbSecurityTest(cveBugId = 112891564)
testPocCVE_2018_9537()508     public void testPocCVE_2018_9537() throws Exception {
509         String binaryName = "CVE-2018-9537";
510         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
511         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
512         // example of check crash to skip:
513         // Abort message: 'frameworks/av/media/extractors/mkv/MatroskaExtractor.cpp:548 CHECK(mCluster) failed.'
514         testConfig.config = new CrashUtils.Config()
515                 .setProcessPatterns(binaryName)
516                 .appendAbortMessageExcludes("CHECK\\(.*?\\)");
517         testConfig.config.setSignals(signals);
518         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
519     }
520 
521     /******************************************************************************
522      * To prevent merge conflicts, add tests for Q below this comment, before any
523      * existing test methods
524      ******************************************************************************/
525 
526     /**
527      * b/143464314
528      * Vulnerability Behaviour: SIGSEGV in self / EXIT_VULNERABLE (113)
529      */
530     @Test
531     @AsbSecurityTest(cveBugId = 143464314)
testPocCVE_2020_0213()532     public void testPocCVE_2020_0213() throws Exception {
533         assumeFalse(moduleIsPlayManaged("com.google.android.media.swcodec"));
534         String inputFiles[] = {"cve_2020_0213.hevc", "cve_2020_0213_info.txt"};
535         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0213",
536             AdbUtils.TMP_PATH + inputFiles[0] + " " + AdbUtils.TMP_PATH + inputFiles[1],
537             inputFiles, AdbUtils.TMP_PATH, getDevice());
538     }
539 
540     /**
541      * b/166268541
542      * Vulnerability Behaviour: SIGSEGV in media.swcodec
543      */
544     @Test
545     @AsbSecurityTest(cveBugId = 166268541)
testPocCVE_2020_0470()546     public void testPocCVE_2020_0470() throws Exception {
547         String inputFiles[] = {"cve_2020_0470.mp4"};
548         String processPatternStrings[] = {"media\\.swcodec"};
549         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0470",
550                 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice(),
551                 processPatternStrings);
552     }
553 
554     /**
555      * b/120426980
556      * Vulnerability Behaviour: SIGABRT in self
557      */
558     @Test
559     @AsbSecurityTest(cveBugId = 120426980)
testPocCVE_2019_9362()560     public void testPocCVE_2019_9362() throws Exception {
561         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
562         String binaryName = "CVE-2019-9362";
563         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
564         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
565         testConfig.config.setSignals(signals);
566         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
567     }
568 
569     /**
570      * b/112661742
571      * Vulnerability Behaviour: SIGABRT in self
572      */
573     @Test
574     @AsbSecurityTest(cveBugId = 112661742)
testPocCVE_2019_9308()575     public void testPocCVE_2019_9308() throws Exception {
576         String inputFiles[] = {"cve_2019_9308.mp4"};
577         String binaryName = "CVE-2019-9308";
578         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
579         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
580         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
581         testConfig.config.setSignals(signals);
582         testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0];
583         testConfig.inputFiles = Arrays.asList(inputFiles);
584         testConfig.inputFilesDestination = AdbUtils.TMP_PATH;
585         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
586     }
587 
588     /**
589      * b/112662995
590      * Vulnerability Behaviour: SIGABRT in self
591      */
592     @Test
593     @AsbSecurityTest(cveBugId = 112662995)
testPocCVE_2019_9357()594     public void testPocCVE_2019_9357() throws Exception {
595         String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
596         String binaryName = "CVE-2019-9357";
597         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
598         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
599         testConfig.config.setSignals(signals);
600         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
601     }
602 
603     /**
604      * b/109891727
605      * Vulnerability Behaviour: SIGSEGV in media.codec
606      */
607     @Test
608     @AsbSecurityTest(cveBugId = 109891727)
testPocCVE_2019_9347()609     public void testPocCVE_2019_9347() throws Exception {
610         pocPusher.only32();
611         String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"};
612         AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-9347", null, getDevice(),
613                 processPatternStrings);
614     }
615 }
616