1 /* 2 * Copyright (C) 2020 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); you may not 5 * use this file except in compliance with the License. You may obtain a copy of 6 * the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 12 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the 13 * License for the specific language governing permissions and limitations under 14 * the License. 15 */ 16 17 package android.security.cts; 18 19 import com.android.tradefed.device.ITestDevice; 20 import com.android.tradefed.log.LogUtil.CLog; 21 import com.android.compatibility.common.util.CrashUtils; 22 23 import android.platform.test.annotations.AsbSecurityTest; 24 import org.junit.Test; 25 import org.junit.runner.RunWith; 26 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner; 27 28 import static org.junit.Assert.*; 29 import static org.junit.Assume.*; 30 import junit.framework.Assert; 31 import java.util.Arrays; 32 import java.util.ArrayList; 33 34 import static org.junit.Assume.*; 35 import static org.hamcrest.CoreMatchers.*; 36 37 @RunWith(DeviceJUnit4ClassRunner.class) 38 public class TestMedia extends SecurityTestCase { 39 40 41 /****************************************************************************** 42 * To prevent merge conflicts, add tests for N below this comment, before any 43 * existing test methods 44 ******************************************************************************/ 45 46 /****************************************************************************** 47 * To prevent merge conflicts, add tests for O below this comment, before any 48 * existing test methods 49 ******************************************************************************/ 50 51 /** 52 * b/17769851 53 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 54 */ 55 @Test 56 @AsbSecurityTest(cveBugId = 17769851) testPocCVE_2015_6616()57 public void testPocCVE_2015_6616() throws Exception { 58 pocPusher.only64(); 59 String inputFiles[] = {"cve_2015_6616.mp4"}; 60 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2015-6616", 61 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice()); 62 } 63 64 /** 65 * b/37239013 66 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 67 */ 68 @Test 69 @AsbSecurityTest(cveBugId = 37239013) testPocCVE_2017_0697()70 public void testPocCVE_2017_0697() throws Exception { 71 String inputFiles[] = {"cve_2017_0697.mp4"}; 72 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0697", 73 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice()); 74 } 75 76 /** 77 * b/127702368 78 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 79 */ 80 @Test 81 @AsbSecurityTest(cveBugId = 127702368) testPocCVE_2019_2126()82 public void testPocCVE_2019_2126() throws Exception { 83 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2126", null, getDevice()); 84 } 85 86 /** 87 * b/66969349 88 * Vulnerability Behaviour: SIGSEGV in media.codec 89 */ 90 @Test 91 @AsbSecurityTest(cveBugId = 66969349) testPocCVE_2017_13180()92 public void testPocCVE_2017_13180() throws Exception { 93 String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"}; 94 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-13180", null, getDevice(), 95 processPatternStrings); 96 } 97 98 /** 99 * b/111210196 100 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 101 */ 102 @Test 103 @AsbSecurityTest(cveBugId = 111210196) testPocCVE_2019_2228()104 public void testPocCVE_2019_2228() throws Exception { 105 String inputFiles[] = {"cve_2019_2228_ipp.mp4"}; 106 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2228", 107 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice()); 108 } 109 110 /** 111 * b/157650336 112 * Vulnerability Behaviour: SIGSEGV in self / EXIT_VULNERABLE (113) 113 */ 114 @Test 115 @AsbSecurityTest(cveBugId = 157650336) testPocCVE_2020_0450()116 public void testPocCVE_2020_0450() throws Exception { 117 AdbUtils.assumeHasNfc(getDevice()); 118 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0450", null, getDevice()); 119 } 120 121 /** 122 * b/156997193 123 * Vulnerability Behaviour: SIGABRT in self 124 */ 125 @Test 126 @AsbSecurityTest(cveBugId = 156997193) testPocCVE_2020_0409()127 public void testPocCVE_2020_0409() throws Exception { 128 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 129 String binaryName = "CVE-2020-0409"; 130 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 131 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 132 testConfig.config.setSignals(signals); 133 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 134 } 135 136 /** 137 * b/161894517 138 * Vulnerability Behaviour: SIGABRT in self 139 */ 140 @Test 141 @AsbSecurityTest(cveBugId = 161894517) testPocCVE_2020_0421()142 public void testPocCVE_2020_0421() throws Exception { 143 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 144 String binaryName = "CVE-2020-0421"; 145 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 146 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 147 testConfig.config.setSignals(signals); 148 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 149 } 150 151 /** 152 * b/132082342 153 * Vulnerability Behaviour: SIGSEGV in self 154 */ 155 @Test 156 @AsbSecurityTest(cveBugId = 132082342) testPocCVE_2019_2133()157 public void testPocCVE_2019_2133() throws Exception { 158 AdbUtils.assumeHasNfc(getDevice()); 159 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2133", null, getDevice()); 160 } 161 162 /** 163 * b/132083376 164 * Vulnerability Behaviour: SIGSEGV in self 165 */ 166 @Test 167 @AsbSecurityTest(cveBugId = 132083376) testPocCVE_2019_2134()168 public void testPocCVE_2019_2134() throws Exception { 169 AdbUtils.assumeHasNfc(getDevice()); 170 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2134", null, getDevice()); 171 } 172 173 /** 174 * b/31470908 175 * Vulnerability Behaviour: SIGSEGV in self 176 */ 177 @Test 178 @AsbSecurityTest(cveBugId = 31470908) testPocCVE_2016_10244()179 public void testPocCVE_2016_10244() throws Exception { 180 String inputFiles[] = {"cve_2016_10244"}; 181 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-10244", 182 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice()); 183 } 184 185 /** 186 * b/27793367 187 * Vulnerability Behaviour: SIGSEGV in media.codec 188 */ 189 @Test 190 @AsbSecurityTest(cveBugId = 27793367) testPocCVE_2016_2485()191 public void testPocCVE_2016_2485() throws Exception { 192 String inputFiles[] = {"cve_2016_2485.raw"}; 193 String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"}; 194 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-2485", 195 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice(), 196 processPatternStrings); 197 } 198 199 /** 200 * b/141890807 201 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 202 */ 203 @Test 204 @AsbSecurityTest(cveBugId = 141890807) testPocCVE_2020_0007()205 public void testPocCVE_2020_0007() throws Exception { 206 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0007", null, getDevice()); 207 } 208 209 /** 210 * b/118372692 211 * Vulnerability Behaviour: SIGSEGV in self 212 */ 213 @Test 214 @AsbSecurityTest(cveBugId = 118372692) testPocCVE_2019_1988()215 public void testPocCVE_2019_1988() throws Exception { 216 assumeThat(getDevice().getProperty("ro.config.low_ram"), not(is("true"))); 217 String inputFiles[] = {"cve_2019_1988.mp4"}; 218 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-1988", 219 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice()); 220 } 221 222 /** 223 * b/63522430 224 * Vulnerability Behaviour: SIGSEGV in media.codec 225 */ 226 @Test 227 @AsbSecurityTest(cveBugId = 63522430) testPocCVE_2017_0817()228 public void testPocCVE_2017_0817() throws Exception { 229 String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"}; 230 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0817", null, getDevice(), 231 processPatternStrings); 232 } 233 234 /** 235 * b/36104177 236 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 237 */ 238 @Test 239 @AsbSecurityTest(cveBugId = 36104177) testPocCVE_2017_0670()240 public void testPocCVE_2017_0670() throws Exception { 241 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0670", null, getDevice()); 242 } 243 244 /** 245 * b/68159767 246 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 247 */ 248 @Test 249 @AsbSecurityTest(cveBugId = 68159767) testPocCVE_2017_13234()250 public void testPocCVE_2017_13234() throws Exception { 251 String inputFiles[] = { "cve_2017_13234.xmf" }; 252 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-13234", 253 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice()); 254 } 255 256 /** 257 * b/64340921 258 * Vulnerability Behaviour: SIGABRT in audioserver 259 */ 260 @Test 261 @AsbSecurityTest(cveBugId = 64340921) testPocCVE_2017_0837()262 public void testPocCVE_2017_0837() throws Exception { 263 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 264 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig("CVE-2017-0837", getDevice()); 265 testConfig.config = new CrashUtils.Config().setProcessPatterns("audioserver"); 266 testConfig.config.setSignals(signals); 267 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 268 } 269 270 /** 271 * b/62151041 - Has 4 CVEs filed together 272 */ 273 /** 1. CVE-2017-9047 274 * Vulnerability Behaviour: SIGABRT by -fstack-protector 275 */ 276 @Test 277 @AsbSecurityTest(cveBugId = 62151041) testPocCVE_2018_9466_CVE_2017_9047()278 public void testPocCVE_2018_9466_CVE_2017_9047() throws Exception { 279 String binaryName = "CVE-2018-9466-CVE-2017-9047"; 280 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 281 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 282 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 283 testConfig.config.setSignals(signals); 284 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 285 } 286 287 /** 2. CVE-2017-9048 288 * Vulnerability Behaviour: SIGABRT by -fstack-protector 289 */ 290 @Test 291 @AsbSecurityTest(cveBugId = 62151041) testPocCVE_2018_9466_CVE_2017_9048()292 public void testPocCVE_2018_9466_CVE_2017_9048() throws Exception { 293 String binaryName = "CVE-2018-9466-CVE-2017-9048"; 294 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 295 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 296 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 297 testConfig.config.setSignals(signals); 298 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 299 } 300 301 /** 3. CVE-2017-9049 302 * Vulnerability Behaviour: SIGSEGV in self 303 */ 304 @Test 305 @AsbSecurityTest(cveBugId = 62151041) testPocCVE_2018_9466_CVE_2017_9049()306 public void testPocCVE_2018_9466_CVE_2017_9049() throws Exception { 307 String binaryName = "CVE-2018-9466-CVE-2017-9049"; 308 String inputFiles[] = {"cve_2018_9466_cve_2017_9049.xml"}; 309 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 310 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 311 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 312 testConfig.config.setSignals(signals); 313 testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0]; 314 testConfig.inputFiles = Arrays.asList(inputFiles); 315 testConfig.inputFilesDestination = AdbUtils.TMP_PATH; 316 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 317 } 318 319 /** 4. CVE-2017-9050 320 * Vulnerability Behaviour: SIGSEGV in self 321 */ 322 @Test 323 @AsbSecurityTest(cveBugId = 62151041) testPocCVE_2018_9466_CVE_2017_9050()324 public void testPocCVE_2018_9466_CVE_2017_9050() throws Exception { 325 String binaryName = "CVE-2018-9466-CVE-2017-9049"; 326 String inputFiles[] = {"cve_2018_9466_cve_2017_9050.xml"}; 327 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 328 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 329 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 330 testConfig.config.setSignals(signals); 331 testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0]; 332 testConfig.inputFiles = Arrays.asList(inputFiles); 333 testConfig.inputFilesDestination = AdbUtils.TMP_PATH; 334 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 335 } 336 337 /** 338 * b/23247055 339 * Vulnerability Behaviour: SIGABRT in self 340 */ 341 @Test 342 @AsbSecurityTest(cveBugId = 20674086) testPocCVE_2015_3873()343 public void testPocCVE_2015_3873() throws Exception { 344 String inputFiles[] = {"cve_2015_3873.mp4"}; 345 String binaryName = "CVE-2015-3873"; 346 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 347 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 348 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 349 testConfig.config.setSignals(signals); 350 testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0]; 351 testConfig.inputFiles = Arrays.asList(inputFiles); 352 testConfig.inputFilesDestination = AdbUtils.TMP_PATH; 353 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 354 } 355 356 /** 357 * b/62948670 358 * Vulnerability Behaviour: SIGSEGV in media.codec 359 */ 360 @Test 361 @AsbSecurityTest(cveBugId = 62948670) testPocCVE_2017_0840()362 public void testPocCVE_2017_0840() throws Exception { 363 pocPusher.only32(); 364 String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"}; 365 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0840", null, getDevice(), 366 processPatternStrings); 367 } 368 369 /** 370 * b/69065651 371 * Vulnerability Behaviour: SIGSEGV in media.codec 372 */ 373 @Test 374 @AsbSecurityTest(cveBugId = 69065651) testPocCVE_2017_13241()375 public void testPocCVE_2017_13241() throws Exception { 376 pocPusher.only32(); 377 String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"}; 378 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-13241", null, getDevice(), 379 processPatternStrings); 380 } 381 382 /** 383 * b/111603051 384 * Vulnerability Behaviour: SIGSEGV in self 385 */ 386 @Test 387 @AsbSecurityTest(cveBugId = 111603051) testPocCVE_2018_9491()388 public void testPocCVE_2018_9491() throws Exception { 389 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9491", null, getDevice()); 390 } 391 392 /** 393 * b/79662501 394 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 395 */ 396 @Test 397 @AsbSecurityTest(cveBugId = 79662501) testPocCVE_2018_9472()398 public void testPocCVE_2018_9472() throws Exception { 399 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9472", null, getDevice()); 400 } 401 402 /** 403 * b/36554207 404 * Vulnerability Behaviour: SIGSEGV in self 405 **/ 406 @Test 407 @AsbSecurityTest(cveBugId = 36554207) testPocCVE_2016_4658()408 public void testPocCVE_2016_4658() throws Exception { 409 String inputFiles[] = {"cve_2016_4658.xml"}; 410 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-4658", 411 AdbUtils.TMP_PATH + inputFiles[0] + " \"range(//namespace::*)\"", inputFiles, 412 AdbUtils.TMP_PATH, getDevice()); 413 } 414 415 /** 416 * b/36554209 417 * Vulnerability Behaviour: SIGSEGV in self 418 **/ 419 @Test 420 @AsbSecurityTest(cveBugId = 36554209) testPocCVE_2016_5131()421 public void testPocCVE_2016_5131() throws Exception { 422 String inputFiles[] = {"cve_2016_5131.xml"}; 423 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2016-5131", 424 AdbUtils.TMP_PATH + inputFiles[0] + " \"name(range-to(///doc))0+0+22\"", inputFiles, 425 AdbUtils.TMP_PATH, getDevice()); 426 } 427 428 /** 429 * b/62800140 430 * Vulnerability Behaviour: SIGSEGV in self 431 */ 432 @Test 433 @AsbSecurityTest(cveBugId = 62800140) testPocCVE_2017_0814()434 public void testPocCVE_2017_0814() throws Exception { 435 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2017-0814", null, getDevice()); 436 } 437 438 /** 439 * b/65540999 440 * Vulnerability Behaviour: Assert failure 441 **/ 442 @Test 443 @AsbSecurityTest(cveBugId = 65540999) testPocCVE_2017_0847()444 public void testPocCVE_2017_0847() throws Exception { 445 String cmdOut = AdbUtils.runCommandLine("ps -eo cmd,gid | grep mediametrics", getDevice()); 446 if (cmdOut.length() > 0) { 447 String[] segment = cmdOut.split("\\s+"); 448 if (segment.length > 1) { 449 if (segment[1].trim().equals("0")) { 450 Assert.fail("mediametrics has root group id"); 451 } 452 } 453 } 454 } 455 456 /** 457 * b/112005441 458 * Vulnerability Behaviour: EXIT_VULNERABLE (113) 459 */ 460 @Test 461 @AsbSecurityTest(cveBugId = 112005441) testPocCVE_2019_9313()462 public void testPocCVE_2019_9313() throws Exception { 463 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-9313", null, getDevice()); 464 } 465 466 /** 467 * b/112159345 468 * Vulnerability Behaviour: SIGSEGV in self 469 **/ 470 @Test 471 @AsbSecurityTest(cveBugId = 112159345) testPocCVE_2018_9527()472 public void testPocCVE_2018_9527() throws Exception { 473 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9527", null, getDevice()); 474 } 475 476 /****************************************************************************** 477 * To prevent merge conflicts, add tests for P below this comment, before any 478 * existing test methods 479 ******************************************************************************/ 480 481 /** 482 * b/158762825 483 * Vulnerability Behaviour: SIGABRT in self 484 */ 485 @Test 486 @AsbSecurityTest(cveBugId = 158762825) testPocCVE_2020_0451()487 public void testPocCVE_2020_0451() throws Exception { 488 assumeFalse(moduleIsPlayManaged("com.google.android.media.swcodec")); 489 String inputFiles[] = {"cve_2020_0451.aac"}; 490 String binaryName = "CVE-2020-0451"; 491 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 492 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 493 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 494 testConfig.config.setSignals(signals); 495 testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0]; 496 testConfig.inputFiles = Arrays.asList(inputFiles); 497 testConfig.inputFilesDestination = AdbUtils.TMP_PATH; 498 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 499 } 500 501 /** 502 * b/112891564 503 * Vulnerability Behaviour: SIGSEGV in self (Android P), 504 * SIGABRT in self (Android Q onward) 505 */ 506 @Test 507 @AsbSecurityTest(cveBugId = 112891564) testPocCVE_2018_9537()508 public void testPocCVE_2018_9537() throws Exception { 509 String binaryName = "CVE-2018-9537"; 510 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 511 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 512 // example of check crash to skip: 513 // Abort message: 'frameworks/av/media/extractors/mkv/MatroskaExtractor.cpp:548 CHECK(mCluster) failed.' 514 testConfig.config = new CrashUtils.Config() 515 .setProcessPatterns(binaryName) 516 .appendAbortMessageExcludes("CHECK\\(.*?\\)"); 517 testConfig.config.setSignals(signals); 518 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 519 } 520 521 /****************************************************************************** 522 * To prevent merge conflicts, add tests for Q below this comment, before any 523 * existing test methods 524 ******************************************************************************/ 525 526 /** 527 * b/143464314 528 * Vulnerability Behaviour: SIGSEGV in self / EXIT_VULNERABLE (113) 529 */ 530 @Test 531 @AsbSecurityTest(cveBugId = 143464314) testPocCVE_2020_0213()532 public void testPocCVE_2020_0213() throws Exception { 533 assumeFalse(moduleIsPlayManaged("com.google.android.media.swcodec")); 534 String inputFiles[] = {"cve_2020_0213.hevc", "cve_2020_0213_info.txt"}; 535 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0213", 536 AdbUtils.TMP_PATH + inputFiles[0] + " " + AdbUtils.TMP_PATH + inputFiles[1], 537 inputFiles, AdbUtils.TMP_PATH, getDevice()); 538 } 539 540 /** 541 * b/166268541 542 * Vulnerability Behaviour: SIGSEGV in media.swcodec 543 */ 544 @Test 545 @AsbSecurityTest(cveBugId = 166268541) testPocCVE_2020_0470()546 public void testPocCVE_2020_0470() throws Exception { 547 String inputFiles[] = {"cve_2020_0470.mp4"}; 548 String processPatternStrings[] = {"media\\.swcodec"}; 549 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0470", 550 AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice(), 551 processPatternStrings); 552 } 553 554 /** 555 * b/120426980 556 * Vulnerability Behaviour: SIGABRT in self 557 */ 558 @Test 559 @AsbSecurityTest(cveBugId = 120426980) testPocCVE_2019_9362()560 public void testPocCVE_2019_9362() throws Exception { 561 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 562 String binaryName = "CVE-2019-9362"; 563 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 564 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 565 testConfig.config.setSignals(signals); 566 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 567 } 568 569 /** 570 * b/112661742 571 * Vulnerability Behaviour: SIGABRT in self 572 */ 573 @Test 574 @AsbSecurityTest(cveBugId = 112661742) testPocCVE_2019_9308()575 public void testPocCVE_2019_9308() throws Exception { 576 String inputFiles[] = {"cve_2019_9308.mp4"}; 577 String binaryName = "CVE-2019-9308"; 578 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 579 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 580 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 581 testConfig.config.setSignals(signals); 582 testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0]; 583 testConfig.inputFiles = Arrays.asList(inputFiles); 584 testConfig.inputFilesDestination = AdbUtils.TMP_PATH; 585 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 586 } 587 588 /** 589 * b/112662995 590 * Vulnerability Behaviour: SIGABRT in self 591 */ 592 @Test 593 @AsbSecurityTest(cveBugId = 112662995) testPocCVE_2019_9357()594 public void testPocCVE_2019_9357() throws Exception { 595 String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; 596 String binaryName = "CVE-2019-9357"; 597 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 598 testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName); 599 testConfig.config.setSignals(signals); 600 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 601 } 602 603 /** 604 * b/109891727 605 * Vulnerability Behaviour: SIGSEGV in media.codec 606 */ 607 @Test 608 @AsbSecurityTest(cveBugId = 109891727) testPocCVE_2019_9347()609 public void testPocCVE_2019_9347() throws Exception { 610 pocPusher.only32(); 611 String processPatternStrings[] = {"media\\.codec", "omx@\\d+?\\.\\d+?-service"}; 612 AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-9347", null, getDevice(), 613 processPatternStrings); 614 } 615 } 616