#!/bin/bash
# Reproducer driver for the MojoDecryptorService DeinitializeDecoder POC.
#
# Prerequisite: chromium-changes.patch must be applied and chrome rebuilt.
set -e

CHROMIUM_SRC=${CHROMIUM_SRC:-/chromium/chromium/src}
OUTDIR=${OUTDIR:-out/asan}
CHROME=$CHROMIUM_SRC/$OUTDIR/chrome
CDM=$CHROMIUM_SRC/$OUTDIR/ClearKeyCdm/_platform_specific/linux_x64/libclearkeycdm.so

DIR=$(cd "$(dirname "$0")" && pwd)

# Start the POC web server.
pkill -f "python3.*server.py" 2>/dev/null || true
( cd "$DIR" && python3 server.py >/dev/null 2>&1 & )
sleep 1

rm -rf /tmp/chrome-poc-profile

export ASAN_SYMBOLIZER_PATH=$CHROMIUM_SRC/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer
export ASAN_OPTIONS="handle_segv=1:handle_sigbus=1:handle_abort=1:symbolize=1:print_stacktrace=1:detect_leaks=0"

# --enable-features=ExternalClearKeyForTesting and
# --clear-key-cdm-path-for-testing register the libclearkeycdm.so library
# CDM, exercising the same CdmAdapter / MojoDecryptorService path that
# Widevine uses in production. They do NOT alter the vulnerable code; the
# bug exists identically with com.widevine.alpha.
#
# --no-sandbox / --headless are execution-environment flags only (no X
# server / no setuid sandbox in this container).
timeout 30 "$CHROME" \
  --headless=new \
  --no-sandbox \
  --no-first-run --no-default-browser-check --ignore-gpu-blocklist \
  --user-data-dir=/tmp/chrome-poc-profile \
  --disable-gpu \
  --disable-in-process-stack-traces \
  --enable-logging=stderr --v=0 \
  --enable-features=ExternalClearKeyForTesting \
  --clear-key-cdm-path-for-testing="$CDM" \
  http://127.0.0.1:8080/poc.html 2>&1 || true

pkill -f "python3.*server.py" 2>/dev/null || true