Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9b366602 authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Tests for dump and shell cmd transactions 

Adding tests for Dump and Shell cmd transactions
in TestServiceFuzzer by overriding onTrasact. Tests Verify that
DUMP_TRANSACTION and SHELL_CMD_TRANSACTION codes are beinge hit.

Test: atest -c fuzz_service_test
Test: atest -c binderRecordReplayTest
Bug: 295191685
Change-Id: I779ab49471fef3ac466e06f3e8a6b544087586b0
parent 04c90eb5

libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp

+16 −0
Original line number Diff line number Diff line
@@ -33,6 +33,8 @@ enum class CrashType { 
    ON_KNOWN_UID,

    ON_SYSTEM_AID,

    ON_ROOT_AID,

    ON_DUMP_TRANSACT,

    ON_SHELL_CMD_TRANSACT,

};



// This service is to verify that fuzzService is functioning properly
@@ -92,6 +94,16 @@ public: 
        return Status::ok();

    }



    status_t onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) override {

        if (mCrash == CrashType::ON_DUMP_TRANSACT && code == DUMP_TRANSACTION) {

            LOG_ALWAYS_FATAL("Expected crash, DUMP.");

        } else if (mCrash == CrashType::ON_SHELL_CMD_TRANSACT &&

                   code == SHELL_COMMAND_TRANSACTION) {

            LOG_ALWAYS_FATAL("Expected crash, SHELL_CMD.");

        }

        return BnTestService::onTransact(code, data, reply, flags);

    }



private:

    CrashType mCrash;

};
@@ -121,6 +133,10 @@ extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) { 
        gCrashType = CrashType::ON_ROOT_AID;

    } else if (arg == "BINDER") {

        gCrashType = CrashType::ON_BINDER;

    } else if (arg == "DUMP") {

        gCrashType = CrashType::ON_DUMP_TRANSACT;

    } else if (arg == "SHELL_CMD") {

        gCrashType = CrashType::ON_SHELL_CMD_TRANSACT;

    } else {

        printf("INVALID ARG\n");

        exit(0); // success because this is a crash test

libs/binder/tests/parcel_fuzzer/test_fuzzer/run_fuzz_service_test.sh

+1 −1
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ then 
    exit 1

fi



for CRASH_TYPE in PLAIN KNOWN_UID AID_SYSTEM AID_ROOT BINDER; do

for CRASH_TYPE in PLAIN KNOWN_UID AID_SYSTEM AID_ROOT BINDER DUMP SHELL_CMD; do

    echo "INFO: Running fuzzer : test_service_fuzzer_should_crash $CRASH_TYPE"



    ./test_service_fuzzer_should_crash "$CRASH_TYPE" -max_total_time=30 &>"$FUZZER_OUT"