[RESTRICT AUTOMERGE] Updated the CTS test for Android Security b/112891564 Bug: 112891564 Bug: 117433881 Test: sts-tradefed run sts-engbuild-no-spl-lock -m CtsSecurityBulletinHostTestCases -t android.security.cts.TestMedia#testPocCVE_2018_9537 Change-Id: Ibd19c44325ecbcd6db791ceea1e9567e6f0c29bf
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/Android.mk index 761e5eb..cbcf650 100644 --- a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/Android.mk +++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/Android.mk
@@ -31,4 +31,5 @@ LOCAL_ARM_MODE := arm LOCAL_CFLAGS := -Wall -Werror -DCHECK_OVERFLOW +LOCAL_CFLAGS += -DENABLE_SELECTIVE_OVERLOADING include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/poc.cpp index 96d9ef2..0fdaba4 100644 --- a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/poc.cpp +++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9537/poc.cpp
@@ -13,10 +13,25 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +#include <signal.h> #include <stdlib.h> #include <string.h> +#include <unistd.h> +#include "../includes/memutils.h" #include "aacdecoder_lib.h" +char enable_selective_overload = ENABLE_NONE; + +bool testComplete = false; +struct sigaction new_action, old_action; +void sigsegv_handler(int signum, siginfo_t *info, void *context) { + if (!testComplete && info->si_signo != SIGSEGV) { + (*old_action.sa_sigaction)(signum, info, context); + } else { + _exit(0); + } +} + constexpr uint8_t kNumberOfLayers = 1; constexpr uint8_t kMaxChannelCount = 8; constexpr uint32_t kNumFillElements = 1200; @@ -174,6 +189,12 @@ return EXIT_FAILURE; } + sigemptyset(&new_action.sa_mask); + new_action.sa_flags = SA_SIGINFO; + new_action.sa_sigaction = sigsegv_handler; + sigaction(SIGSEGV, &new_action, &old_action); + + enable_selective_overload = ENABLE_ALL; if (codec->initDecoder()) { /* Allocate memory for bitstream buffer */ UINT rawDataSize = kAdtsHeaderLength + kAacStreamLength @@ -200,7 +221,9 @@ codec->decodeFrames(rawData, rawDataSize); free(rawData); } + enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK; delete codec; + testComplete = true; return EXIT_SUCCESS; }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9537.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9537.java new file mode 100644 index 0000000..df360d0 --- /dev/null +++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9537.java
@@ -0,0 +1,47 @@ +/* + * Copyright (C) 2021 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.security.cts; + +import android.platform.test.annotations.AsbSecurityTest; +import com.android.compatibility.common.util.CrashUtils; +import com.android.tradefed.testtype.DeviceJUnit4ClassRunner; +import org.junit.runner.RunWith; +import org.junit.Test; + +@RunWith(DeviceJUnit4ClassRunner.class) +public class CVE_2018_9537 extends SecurityTestCase { + + /** + * b/112891564 + * Vulnerability Behaviour: SIGSEGV in self (Android P), + * SIGABRT in self (Android Q onward) + */ + @AsbSecurityTest(cveBugId = 112891564) + @Test + public void testPocCVE_2018_9537() throws Exception { + String binaryName = "CVE-2018-9537"; + String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; + AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); + // example of check crash to skip: + // Abort message: 'frameworks/av/media/extractors/mkv/MatroskaExtractor.cpp:548 CHECK(mCluster) failed.' + testConfig.config = new CrashUtils.Config() + .setProcessPatterns(binaryName) + .appendAbortMessageExcludes("CHECK\\(.*?\\)"); + testConfig.config.setSignals(signals); + AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); + } +}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java index f13d0db..1f9e158 100644 --- a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java +++ b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
@@ -604,26 +604,6 @@ AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); } - /** - * b/112891564 - * Vulnerability Behaviour: SIGSEGV in self (Android P), - * SIGABRT in self (Android Q onward) - */ - @Test - @AsbSecurityTest(cveBugId = 112891564) - public void testPocCVE_2018_9537() throws Exception { - String binaryName = "CVE-2018-9537"; - String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT}; - AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); - // example of check crash to skip: - // Abort message: 'frameworks/av/media/extractors/mkv/MatroskaExtractor.cpp:548 CHECK(mCluster) failed.' - testConfig.config = new CrashUtils.Config() - .setProcessPatterns(binaryName) - .appendAbortMessageExcludes("CHECK\\(.*?\\)"); - testConfig.config.setSignals(signals); - AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); - } - /****************************************************************************** * To prevent merge conflicts, add tests for Q below this comment, before any * existing test methods