Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc2dca77 authored by Michael Ensing's avatar Michael Ensing Committed by Automerger Merge Worker
Browse files

DO NOT MERGE Add inputflinger InputReader fuzzer am: 80c8aff2 

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/1367018

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Iac0e2d1dcb4ed88aab436cc7fc6d37ae59c2124a
parents 3ed8ed0a 80c8aff2

services/inputflinger/tests/fuzzers/Android.bp

+30 −0
Original line number Diff line number Diff line
@@ -80,3 +80,33 @@ cc_fuzz { 
        "SwitchInputFuzzer.cpp",

    ],

}



cc_fuzz {

    name: "inputflinger_input_reader_device_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "InputReaderDeviceFuzzer.cpp",

    ],

}



cc_fuzz {

    name: "inputflinger_blocking_queue_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "BlockingQueueFuzzer.cpp",

    ],

}



cc_fuzz {

    name: "inputflinger_input_classifier_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "InputClassifierFuzzer.cpp",

    ],

}

services/inputflinger/tests/fuzzers/BlockingQueueFuzzer.cpp

0 → 100644
+69 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <fuzzer/FuzzedDataProvider.h>

#include <thread>

#include "BlockingQueue.h"



// Chosen to be a number large enough for variation in fuzzer runs, but not consume too much memory.

static constexpr size_t MAX_CAPACITY = 1024;



namespace android {



extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {

    FuzzedDataProvider fdp(data, size);

    size_t capacity = fdp.ConsumeIntegralInRange<size_t>(1, MAX_CAPACITY);

    size_t filled = 0;

    BlockingQueue<int32_t> queue(capacity);



    while (fdp.remaining_bytes() > 0) {

        fdp.PickValueInArray<std::function<void()>>({

                [&]() -> void {

                    size_t numPushes = fdp.ConsumeIntegralInRange<size_t>(0, capacity + 1);

                    for (size_t i = 0; i < numPushes; i++) {

                        queue.push(fdp.ConsumeIntegral<int32_t>());

                    }

                    filled = std::min(capacity, filled + numPushes);

                },

                [&]() -> void {

                    // Pops blocks if it is empty, so only pop up to num elements inserted.

                    size_t numPops = fdp.ConsumeIntegralInRange<size_t>(0, filled);

                    for (size_t i = 0; i < numPops; i++) {

                        queue.pop();

                    }

                    filled > numPops ? filled -= numPops : filled = 0;

                },

                [&]() -> void {

                    queue.clear();

                    filled = 0;

                },

                [&]() -> void {

                    int32_t eraseElement = fdp.ConsumeIntegral<int32_t>();

                    queue.erase([&](int32_t element) {

                        if (element == eraseElement) {

                            filled--;

                            return true;

                        }

                        return false;

                    });

                },

        })();

    }



    return 0;

}



} // namespace android

services/inputflinger/tests/fuzzers/InputClassifierFuzzer.cpp

0 → 100644
+120 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <MapperHelpers.h>

#include <fuzzer/FuzzedDataProvider.h>

#include "InputClassifier.h"

#include "InputClassifierConverter.h"



namespace android {



static constexpr int32_t MAX_AXES = 64;



// Used by two fuzz operations and a bit lengthy, so pulled out into a function.

NotifyMotionArgs generateFuzzedMotionArgs(FuzzedDataProvider &fdp) {

    // Create a basic motion event for testing

    PointerProperties properties;

    properties.id = 0;

    properties.toolType = AMOTION_EVENT_TOOL_TYPE_FINGER;

    PointerCoords coords;

    coords.clear();

    for (int32_t i = 0; i < fdp.ConsumeIntegralInRange<int32_t>(0, MAX_AXES); i++) {

        coords.setAxisValue(fdp.ConsumeIntegral<int32_t>(), fdp.ConsumeFloatingPoint<float>());

    }



    nsecs_t downTime = 2;

    NotifyMotionArgs motionArgs(fdp.ConsumeIntegral<uint32_t>() /*sequenceNum*/,

                                downTime /*eventTime*/, fdp.ConsumeIntegral<int32_t>() /*deviceId*/,

                                AINPUT_SOURCE_ANY, ADISPLAY_ID_DEFAULT,

                                fdp.ConsumeIntegral<uint32_t>() /*policyFlags*/,

                                AMOTION_EVENT_ACTION_DOWN,

                                fdp.ConsumeIntegral<int32_t>() /*actionButton*/,

                                fdp.ConsumeIntegral<int32_t>() /*flags*/, AMETA_NONE,

                                fdp.ConsumeIntegral<int32_t>() /*buttonState*/,

                                MotionClassification::NONE, AMOTION_EVENT_EDGE_FLAG_NONE,

                                1 /*pointerCount*/, &properties, &coords,

                                fdp.ConsumeFloatingPoint<float>() /*xPrecision*/,

                                fdp.ConsumeFloatingPoint<float>() /*yPrecision*/,

                                AMOTION_EVENT_INVALID_CURSOR_POSITION,

                                AMOTION_EVENT_INVALID_CURSOR_POSITION, downTime,

                                {} /*videoFrames*/);

    return motionArgs;

}



extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {

    FuzzedDataProvider fdp(data, size);



    sp<FuzzInputListener> mFuzzListener = new FuzzInputListener();

    sp<InputClassifierInterface> mClassifier = new InputClassifier(mFuzzListener);



    while (fdp.remaining_bytes() > 0) {

        fdp.PickValueInArray<std::function<void()>>({

                [&]() -> void {

                    // SendToNextStage_NotifyConfigurationChangedArgs

                    NotifyConfigurationChangedArgs

                            args(fdp.ConsumeIntegral<uint32_t>() /*sequenceNum*/,

                                 fdp.ConsumeIntegral<nsecs_t>() /*eventTime*/);

                    mClassifier->notifyConfigurationChanged(&args);

                },

                [&]() -> void {

                    // SendToNextStage_NotifyKeyArgs

                    NotifyKeyArgs keyArgs(fdp.ConsumeIntegral<uint32_t>() /*sequenceNum*/,

                                          fdp.ConsumeIntegral<nsecs_t>() /*eventTime*/,

                                          fdp.ConsumeIntegral<int32_t>() /*deviceId*/,

                                          AINPUT_SOURCE_KEYBOARD, ADISPLAY_ID_DEFAULT,

                                          fdp.ConsumeIntegral<uint32_t>() /*policyFlags*/,

                                          AKEY_EVENT_ACTION_DOWN,

                                          fdp.ConsumeIntegral<int32_t>() /*flags*/, AKEYCODE_HOME,

                                          fdp.ConsumeIntegral<int32_t>() /*scanCode*/, AMETA_NONE,

                                          fdp.ConsumeIntegral<nsecs_t>() /*downTime*/);



                    mClassifier->notifyKey(&keyArgs);

                },

                [&]() -> void {

                    // SendToNextStage_NotifyMotionArgs

                    NotifyMotionArgs motionArgs = generateFuzzedMotionArgs(fdp);

                    mClassifier->notifyMotion(&motionArgs);

                },

                [&]() -> void {

                    // SendToNextStage_NotifySwitchArgs

                    NotifySwitchArgs switchArgs(fdp.ConsumeIntegral<uint32_t>() /*sequenceNum*/,

                                                fdp.ConsumeIntegral<nsecs_t>() /*eventTime*/,

                                                fdp.ConsumeIntegral<uint32_t>() /*policyFlags*/,

                                                fdp.ConsumeIntegral<uint32_t>() /*switchValues*/,

                                                fdp.ConsumeIntegral<uint32_t>() /*switchMask*/);



                    mClassifier->notifySwitch(&switchArgs);

                },

                [&]() -> void {

                    // SendToNextStage_NotifyDeviceResetArgs

                    NotifyDeviceResetArgs resetArgs(fdp.ConsumeIntegral<uint32_t>() /*sequenceNum*/,

                                                    fdp.ConsumeIntegral<nsecs_t>() /*eventTime*/,

                                                    fdp.ConsumeIntegral<int32_t>() /*deviceId*/);



                    mClassifier->notifyDeviceReset(&resetArgs);

                },

                [&]() -> void {

                    // InputClassifierConverterTest

                    const NotifyMotionArgs motionArgs = generateFuzzedMotionArgs(fdp);

                    hardware::input::common::V1_0::MotionEvent motionEvent =

                            notifyMotionArgsToHalMotionEvent(motionArgs);

                },

        })();

    }

    return 0;

}



} // namespace android

services/inputflinger/tests/fuzzers/InputReaderDeviceFuzzer.cpp

0 → 100644
+103 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2020 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <InputReader.h>

#include <MapperHelpers.h>

#include <fuzzer/FuzzedDataProvider.h>

#include <chrono>

#include <thread>



namespace android {



extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {

    std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);



    sp<FuzzInputListener> fuzzListener = new FuzzInputListener();

    sp<FuzzInputReaderPolicy> fuzzPolicy = new FuzzInputReaderPolicy(fdp);

    std::shared_ptr<FuzzEventHub> fuzzEventHub = std::make_shared<FuzzEventHub>(fdp);

    std::unique_ptr<InputReader> reader =

            std::make_unique<InputReader>(fuzzEventHub, fuzzPolicy, fuzzListener);



    fuzzEventHub->addEvents(fdp);

    reader->start();



    // Loop through mapper operations until randomness is exhausted.

    while (fdp->remaining_bytes() > 0) {

        fdp->PickValueInArray<std::function<void()>>({

                [&]() -> void {

                    std::string dump;

                    reader->dump(dump);

                },

                [&]() -> void { reader->monitor(); },

                [&]() -> void { fuzzEventHub->addEvents(fdp); },

                [&]() -> void {

                    std::vector<InputDeviceInfo> inputDevices;

                    reader->getInputDevices(inputDevices);

                },

                [&]() -> void { reader->isInputDeviceEnabled(fdp->ConsumeIntegral<int32_t>()); },

                [&]() -> void {

                    reader->getScanCodeState(fdp->ConsumeIntegral<int32_t>(),

                                             fdp->ConsumeIntegral<uint32_t>(),

                                             fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    reader->getKeyCodeState(fdp->ConsumeIntegral<int32_t>(),

                                            fdp->ConsumeIntegral<uint32_t>(),

                                            fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    reader->getSwitchState(fdp->ConsumeIntegral<int32_t>(),

                                           fdp->ConsumeIntegral<uint32_t>(),

                                           fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void { reader->toggleCapsLockState(fdp->ConsumeIntegral<int32_t>()); },

                [&]() -> void {

                    size_t count = fdp->ConsumeIntegralInRange<size_t>(1, 1024);

                    uint8_t* outFlags = new uint8_t[count];

                    reader->hasKeys(fdp->ConsumeIntegral<int32_t>(),

                                    fdp->ConsumeIntegral<uint32_t>(), count, nullptr, outFlags);

                    delete[] outFlags;

                },

                [&]() -> void {

                    reader->requestRefreshConfiguration(fdp->ConsumeIntegral<uint32_t>());

                },

                [&]() -> void {

                    // 260 is slightly higher than the maximum intended size of 256.

                    size_t count = fdp->ConsumeIntegralInRange<size_t>(0, 260);

                    nsecs_t pattern[count];



                    for (size_t i = 0; i < count; i++) pattern[i] = fdp->ConsumeIntegral<nsecs_t>();



                    reader->vibrate(fdp->ConsumeIntegral<int32_t>(), pattern, count,

                                    fdp->ConsumeIntegral<ssize_t>(),

                                    fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    reader->cancelVibrate(fdp->ConsumeIntegral<int32_t>(),

                                          fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    reader->canDispatchToDisplay(fdp->ConsumeIntegral<int32_t>(),

                                                 fdp->ConsumeIntegral<int32_t>());

                },

        })();

    }



    reader->stop();

    return 0;

}



} // namespace android