Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3fa088f authored by Pawan Wagh's avatar Pawan Wagh Committed by Gerrit Code Review
Browse files

Merge "Fuzz AParcel_marshal and AParcel_unmarshal APIs"

parents 2adb9ddf 391613ca
Loading
Loading
Loading
Loading
+18 −0
Original line number Diff line number Diff line
@@ -199,5 +199,23 @@ std::vector<ParcelRead<NdkParcelAdapter>> BINDER_NDK_PARCEL_READ_FUNCTIONS{
            binder_status_t status = genericDataParcelable.readFromParcel(p.aParcel());
            FUZZ_LOG() << "status: " << status;
        },
        [](const NdkParcelAdapter& p, FuzzedDataProvider& provider) {
            FUZZ_LOG() << "about to marshal AParcel";
            size_t start = provider.ConsumeIntegral<size_t>();
            // limit 1MB to avoid OOM issues
            size_t len = provider.ConsumeIntegralInRange<size_t>(0, 1000000);
            uint8_t buffer[len];
            binder_status_t status = AParcel_marshal(p.aParcel(), buffer, start, len);
            FUZZ_LOG() << "status: " << status;
        },
        [](const NdkParcelAdapter& /*p*/, FuzzedDataProvider& provider) {
            FUZZ_LOG() << "about to unmarshal AParcel";
            size_t len = provider.ConsumeIntegralInRange<size_t>(0, provider.remaining_bytes());
            std::vector<uint8_t> parcelData = provider.ConsumeBytes<uint8_t>(len);
            const uint8_t* buffer = parcelData.data();
            binder_status_t status = AParcel_unmarshal(AParcel_create(), buffer, len);
            FUZZ_LOG() << "status: " << status;
        },

};
// clang-format on