diff --git a/device.mk b/device.mk index 05c2ddfcf8e39a25df782f108306040f99ae140a..502652067ae6cd1616830e77a3b696f18c876400 100644 --- a/device.mk +++ b/device.mk @@ -252,7 +252,8 @@ PRODUCT_BOOT_JARS += \ PRODUCT_PACKAGES += \ ImsServiceBase \ - libshim_vtservice + libshim_vtservice \ + libshim_mtkcam.vendor PRODUCT_COPY_FILES += \ $(LOCAL_PATH)/configs/ims/privapp-permissions-mediatek.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/privapp-permissions-mediatek.xml diff --git a/extract-files.sh b/extract-files.sh index 308194e43a0bd5d91eb6cb93cd5b34f511df1bd2..4a9a5db48533b3f94b52aae910364b7fe7060470 100755 --- a/extract-files.sh +++ b/extract-files.sh @@ -39,6 +39,9 @@ function blob_fixup() { vendor/lib64/libwifi-hal-mtk.so) "$PATCHELF" --set-soname libwifi-hal-mtk.so "$2" ;; + vendor/lib64/libmtkcam_stdutils.so) + "${PATCHELF}" --add-needed "libshim_mtkcam.so" "${2}" + ;; esac } diff --git a/ims/Android.bp b/ims/Android.bp index fff2c4dfbd3a94a20226daf72b2eadbaea2582e6..f523c53d04382aa1e733d8fcd7bedb37eccd0e2d 100644 --- a/ims/Android.bp +++ b/ims/Android.bp @@ -30,6 +30,21 @@ cc_library_shared { ], } +cc_library_shared { + name: "libshim_mtkcam", + vendor_available: true, + srcs: [ + "PropertyMap.cpp", + "PropertyMap_fuzz.cpp", + ], + include_dirs: [ "frameworks/native/include" ], + shared_libs: [ + "libutils", + "libbase", + "liblog", + ], +} + java_library { name: "ImsServiceBase", installable: true, diff --git a/ims/PropertyMap.cpp b/ims/PropertyMap.cpp new file mode 100644 index 0000000000000000000000000000000000000000..a842166761a7df08a04b2341ac97ed5762477ac5 --- /dev/null +++ b/ims/PropertyMap.cpp @@ -0,0 +1,201 @@ +/* + * Copyright (C) 2008 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#define LOG_TAG "PropertyMap" + +#include + +// Enables debug output for the parser. +#define DEBUG_PARSER 0 + +// Enables debug output for parser performance. +#define DEBUG_PARSER_PERFORMANCE 0 + +namespace android { + +static const char* WHITESPACE = " \t\r"; +static const char* WHITESPACE_OR_PROPERTY_DELIMITER = " \t\r="; + +// --- PropertyMap --- + +PropertyMap::PropertyMap() {} + +PropertyMap::~PropertyMap() {} + +void PropertyMap::clear() { + mProperties.clear(); +} + +void PropertyMap::addProperty(const String8& key, const String8& value) { + mProperties.add(key, value); +} + +bool PropertyMap::hasProperty(const String8& key) const { + return mProperties.indexOfKey(key) >= 0; +} + +bool PropertyMap::tryGetProperty(const String8& key, String8& outValue) const { + ssize_t index = mProperties.indexOfKey(key); + if (index < 0) { + return false; + } + + outValue = mProperties.valueAt(index); + return true; +} + +bool PropertyMap::tryGetProperty(const String8& key, bool& outValue) const { + int32_t intValue; + if (!tryGetProperty(key, intValue)) { + return false; + } + + outValue = intValue; + return true; +} + +bool PropertyMap::tryGetProperty(const String8& key, int32_t& outValue) const { + String8 stringValue; + if (!tryGetProperty(key, stringValue) || stringValue.length() == 0) { + return false; + } + + char* end; + int value = strtol(stringValue.string(), &end, 10); + if (*end != '\0') { + ALOGW("Property key '%s' has invalid value '%s'. Expected an integer.", key.string(), + stringValue.string()); + return false; + } + outValue = value; + return true; +} + +bool PropertyMap::tryGetProperty(const String8& key, float& outValue) const { + String8 stringValue; + if (!tryGetProperty(key, stringValue) || stringValue.length() == 0) { + return false; + } + + char* end; + float value = strtof(stringValue.string(), &end); + if (*end != '\0') { + ALOGW("Property key '%s' has invalid value '%s'. Expected a float.", key.string(), + stringValue.string()); + return false; + } + outValue = value; + return true; +} + +void PropertyMap::addAll(const PropertyMap* map) { + for (size_t i = 0; i < map->mProperties.size(); i++) { + mProperties.add(map->mProperties.keyAt(i), map->mProperties.valueAt(i)); + } +} + +android::base::Result> PropertyMap::load(const char* filename) { + std::unique_ptr outMap = std::make_unique(); + if (outMap == nullptr) { + return android::base::Error(NO_MEMORY) << "Error allocating property map."; + } + + Tokenizer* rawTokenizer; + status_t status = Tokenizer::open(String8(filename), &rawTokenizer); + std::unique_ptr tokenizer(rawTokenizer); + if (status) { + ALOGE("Error %d opening property file %s.", status, filename); + } else { +#if DEBUG_PARSER_PERFORMANCE + nsecs_t startTime = systemTime(SYSTEM_TIME_MONOTONIC); +#endif + Parser parser(outMap.get(), tokenizer.get()); + status = parser.parse(); +#if DEBUG_PARSER_PERFORMANCE + nsecs_t elapsedTime = systemTime(SYSTEM_TIME_MONOTONIC) - startTime; + ALOGD("Parsed property file '%s' %d lines in %0.3fms.", + tokenizer->getFilename().string(), tokenizer->getLineNumber(), + elapsedTime / 1000000.0); +#endif + if (status) { + return android::base::Error(BAD_VALUE) << "Could not parse " << filename; + } + } + return std::move(outMap); +} + +// --- PropertyMap::Parser --- + +PropertyMap::Parser::Parser(PropertyMap* map, Tokenizer* tokenizer) + : mMap(map), mTokenizer(tokenizer) {} + +PropertyMap::Parser::~Parser() {} + +status_t PropertyMap::Parser::parse() { + while (!mTokenizer->isEof()) { +#if DEBUG_PARSER + ALOGD("Parsing %s: '%s'.", mTokenizer->getLocation().string(), + mTokenizer->peekRemainderOfLine().string()); +#endif + + mTokenizer->skipDelimiters(WHITESPACE); + + if (!mTokenizer->isEol() && mTokenizer->peekChar() != '#') { + String8 keyToken = mTokenizer->nextToken(WHITESPACE_OR_PROPERTY_DELIMITER); + if (keyToken.isEmpty()) { + ALOGE("%s: Expected non-empty property key.", mTokenizer->getLocation().string()); + return BAD_VALUE; + } + + mTokenizer->skipDelimiters(WHITESPACE); + + if (mTokenizer->nextChar() != '=') { + ALOGE("%s: Expected '=' between property key and value.", + mTokenizer->getLocation().string()); + return BAD_VALUE; + } + + mTokenizer->skipDelimiters(WHITESPACE); + + String8 valueToken = mTokenizer->nextToken(WHITESPACE); + if (valueToken.find("\\", 0) >= 0 || valueToken.find("\"", 0) >= 0) { + ALOGE("%s: Found reserved character '\\' or '\"' in property value.", + mTokenizer->getLocation().string()); + return BAD_VALUE; + } + + mTokenizer->skipDelimiters(WHITESPACE); + if (!mTokenizer->isEol()) { + ALOGE("%s: Expected end of line, got '%s'.", mTokenizer->getLocation().string(), + mTokenizer->peekRemainderOfLine().string()); + return BAD_VALUE; + } + + if (mMap->hasProperty(keyToken)) { + ALOGE("%s: Duplicate property value for key '%s'.", + mTokenizer->getLocation().string(), keyToken.string()); + return BAD_VALUE; + } + + mMap->addProperty(keyToken, valueToken); + } + + mTokenizer->nextLine(); + } + return OK; +} + +} // namespace android diff --git a/ims/PropertyMap_fuzz.cpp b/ims/PropertyMap_fuzz.cpp new file mode 100755 index 0000000000000000000000000000000000000000..afb97a1d47a12c757eb0993a73cb11edd3e3ba80 --- /dev/null +++ b/ims/PropertyMap_fuzz.cpp @@ -0,0 +1,75 @@ +/* + * Copyright 2020 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "android-base/file.h" +#include "fuzzer/FuzzedDataProvider.h" +#include "input/PropertyMap.h" +#include "utils/String8.h" + +static constexpr int MAX_FILE_SIZE = 256; +static constexpr int MAX_STR_LEN = 2048; +static constexpr int MAX_OPERATIONS = 1000; + +static const std::vector> + operations = { + [](FuzzedDataProvider*, android::PropertyMap propertyMap) -> void { + propertyMap.getProperties(); + }, + [](FuzzedDataProvider*, android::PropertyMap propertyMap) -> void { + propertyMap.clear(); + }, + [](FuzzedDataProvider* dataProvider, android::PropertyMap propertyMap) -> void { + std::string keyStr = dataProvider->ConsumeRandomLengthString(MAX_STR_LEN); + android::String8 key = android::String8(keyStr.c_str()); + propertyMap.hasProperty(key); + }, + [](FuzzedDataProvider* dataProvider, android::PropertyMap propertyMap) -> void { + std::string keyStr = dataProvider->ConsumeRandomLengthString(MAX_STR_LEN); + android::String8 key = android::String8(keyStr.c_str()); + android::String8 out; + propertyMap.tryGetProperty(key, out); + }, + [](FuzzedDataProvider* dataProvider, android::PropertyMap /*unused*/) -> void { + TemporaryFile tf; + // Generate file contents + std::string contents = dataProvider->ConsumeRandomLengthString(MAX_FILE_SIZE); + // If we have string contents, dump them into the file. + // Otherwise, just leave it as an empty file. + if (contents.length() > 0) { + const char* bytes = contents.c_str(); + android::base::WriteStringToFd(bytes, tf.fd); + } + android::PropertyMap::load(tf.path); + }, + [](FuzzedDataProvider* dataProvider, android::PropertyMap propertyMap) -> void { + std::string keyStr = dataProvider->ConsumeRandomLengthString(MAX_STR_LEN); + std::string valStr = dataProvider->ConsumeRandomLengthString(MAX_STR_LEN); + android::String8 key = android::String8(keyStr.c_str()); + android::String8 val = android::String8(valStr.c_str()); + propertyMap.addProperty(key, val); + }, +}; +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + FuzzedDataProvider dataProvider(data, size); + android::PropertyMap propertyMap = android::PropertyMap(); + + int opsRun = 0; + while (dataProvider.remaining_bytes() > 0 && opsRun++ < MAX_OPERATIONS) { + uint8_t op = dataProvider.ConsumeIntegralInRange(0, operations.size() - 1); + operations[op](&dataProvider, propertyMap); + } + return 0; +}