Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 61401772 authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Adding AIDL fuzzer for CameraService 

Fuzzing CameraService using fuzzService API

Test: m camera_service_aidl_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/camera_service_aidl_fuzzer/camera_service_aidl_fuzzer
Bug: 232439428
Change-Id: I473aa5f8a817cf503180ffb86419761a90bfcf20
parent 823009fc

services/camera/libcameraservice/libcameraservice_fuzzer/Android.bp

+27 −5
Original line number Original line Diff line number Diff line
@@ -29,11 +29,8 @@ package { 
    ],

    ],

}

}





cc_fuzz {

cc_defaults {

    name: "camera_service_fuzzer",

    name: "camera_service_fuzzer_defaults",

    srcs: [

        "camera_service_fuzzer.cpp",

    ],

    header_libs: [

    header_libs: [

        "libmedia_headers",

        "libmedia_headers",

    ],

    ],
@@ -73,3 +70,28 @@ cc_fuzz { 




    },

    },

}

}



cc_fuzz {

    name: "camera_service_fuzzer",

    srcs: [

        "camera_service_fuzzer.cpp",

    ],

    defaults: [

        "camera_service_fuzzer_defaults"

    ],

}



cc_fuzz {

    name: "camera_service_aidl_fuzzer",

    srcs: [

        "camera_service_aidl_fuzzer.cpp",

    ],

    defaults: [

        "camera_service_fuzzer_defaults",

        "service_fuzzer_defaults",

        "fuzzer_disable_leaks",

    ],

    fuzz_config: {

        triage_assignee: "waghpawan@google.com",

    },

}

services/camera/libcameraservice/libcameraservice_fuzzer/camera_service_aidl_fuzzer.cpp

0 → 100644
+28 −0
Original line number Original line Diff line number Diff line 
/*

 * Copyright 2023 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <fuzzbinder/libbinder_driver.h>

#include <CameraService.h>



using android::fuzzService;

using android::sp;

using android::CameraService;



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    auto service = sp<CameraService>::make();

    fuzzService(service, FuzzedDataProvider(data, size));

    return 0;

}