Call UsbMidiDescriptorParser::ParseDevice() from fuzzer to improve coverage

Also modifies DecodeBcd() to handle invalid inputs (and removes DCHECKs),
since the inputs may come from an untrusted USB device.

Change-Id: I387ec1fe51b6916fe7c097123936991d67f228aa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2033850
Commit-Queue: Dan McArdle <dmcardle@chromium.org>
Auto-Submit: Dan McArdle <dmcardle@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#738582}

media/midi/usb_midi_descriptor_parser.cc

@@ -59,18 +59,31 @@ class JackMatcher {
   uint8_t id_;
 };
 
-int DecodeBcd(uint8_t byte) {
-  DCHECK_LT((byte & 0xf0) >> 4, 0xa);
-  DCHECK_LT(byte & 0x0f, 0xa);
-  return ((byte & 0xf0) >> 4) * 10 + (byte & 0x0f);
+bool DecodeBcd(uint8_t byte, int* decoded) {
+  // Write decoded decimal value from |byte| into |decoded|. If either nibble in
+  // |byte| exceeds decimal 10, returns false.
+  const uint8_t k_nibble_ten = 0xa;
+  const uint8_t nibble_major = (byte & 0xf0) >> 4;
+  const uint8_t nibble_minor = byte & 0x0f;
+  if (nibble_major >= k_nibble_ten || nibble_minor >= k_nibble_ten) {
+    return false;
+  }
+  *decoded = nibble_major * 10 + nibble_minor;
+  return true;
 }
 
 }  // namespace
 
 std::string UsbMidiDescriptorParser::DeviceInfo::BcdVersionToString(
     uint16_t version) {
-  return base::StringPrintf("%d.%02d", DecodeBcd(version >> 8),
-                            DecodeBcd(version & 0xff));
+  const int byte_1 = version >> 8;
+  const int byte_2 = version & 0xff;
+  int version_major, version_minor;
+  if (!DecodeBcd(byte_1, &version_major) ||
+      !DecodeBcd(byte_2, &version_minor)) {
+    return base::StringPrintf("Invalid BCD $%02x.%02x", byte_1, byte_2);
+  }
+  return base::StringPrintf("%d.%02d", version_major, version_minor);
 }
 
 UsbMidiDescriptorParser::UsbMidiDescriptorParser()

media/midi/usb_midi_descriptor_parser_fuzzer.cc

@@ -12,5 +12,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   std::vector<midi::UsbMidiJack> jacks;
   parser.Parse(nullptr, data, size, &jacks);
 
+  midi::UsbMidiDescriptorParser::DeviceInfo device_info;
+  parser.ParseDeviceInfo(data, size, &device_info);
+
+  std::string version =
+      device_info.BcdVersionToString(device_info.bcd_device_version);
   return 0;
 }

media/midi/usb_midi_descriptor_parser_unittest.cc

@@ -117,6 +117,22 @@ TEST(UsbMidiDescriptorParserTest, ParseDeviceInfo) {
   EXPECT_EQ(0xef, info.product_index);
 }
 
+TEST(UsbMidiDescriptorParserTest, BcdVersionToString) {
+  UsbMidiDescriptorParser::DeviceInfo device_info;
+  {
+    const std::string version = device_info.BcdVersionToString(0x3456);
+    EXPECT_EQ(version, "34.56");
+  }
+  {
+    const std::string invalid_version = device_info.BcdVersionToString(0xb456);
+    EXPECT_EQ(invalid_version, "Invalid BCD $b4.56");
+  }
+  {
+    const std::string invalid_version = device_info.BcdVersionToString(0x345d);
+    EXPECT_EQ(invalid_version, "Invalid BCD $34.5d");
+  }
+}
+
 }  // namespace
 
 }  // namespace midi