Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 744263bf authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge changes from topic "libmtpFuzzers" am: f9d7ef89 

Original change: https://android-review.googlesource.com/c/platform/frameworks/av/+/2150594



Change-Id: I00cae30d1c98b5af296af2d1df2b0623c75a1893
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 4bd74b90 f9d7ef89

media/mtp/Android.bp

+13 −2
Original line number Diff line number Diff line
@@ -31,8 +31,8 @@ license { 
    ],

}



cc_library_shared {

    name: "libmtp",

cc_defaults {

    name: "libmtp_defaults",

    srcs: [

        "MtpDataPacket.cpp",

        "MtpDebug.cpp",
@@ -71,3 +71,14 @@ cc_library_shared { 
    ],

    header_libs: ["libcutils_headers"],

}



cc_library_shared {

    name: "libmtp",

    defaults: ["libmtp_defaults"],

}



cc_library_shared {

    name: "libmtp_fuzz",

    defaults: ["libmtp_defaults"],

    cflags: ["-DMTP_FUZZER"],

}

media/mtp/MtpDescriptors.h

+12 −0
Original line number Diff line number Diff line
@@ -23,6 +23,17 @@ 


namespace android {



#ifdef MTP_FUZZER

constexpr char FFS_MTP_EP0[] = "/data/local/tmp/usb-ffs/mtp/ep0";

constexpr char FFS_MTP_EP_IN[] = "/data/local/tmp/usb-ffs/mtp/ep1";

constexpr char FFS_MTP_EP_OUT[] = "/data/local/tmp/usb-ffs/mtp/ep2";

constexpr char FFS_MTP_EP_INTR[] = "/data/local/tmp/usb-ffs/mtp/ep3";



constexpr char FFS_PTP_EP0[] = "/data/local/tmp/usb-ffs/ptp/ep0";

constexpr char FFS_PTP_EP_IN[] = "/data/local/tmp/usb-ffs/ptp/ep1";

constexpr char FFS_PTP_EP_OUT[] = "/data/local/tmp/usb-ffs/ptp/ep2";

constexpr char FFS_PTP_EP_INTR[] = "/data/local/tmp/usb-ffs/ptp/ep3";

#else

constexpr char FFS_MTP_EP0[] = "/dev/usb-ffs/mtp/ep0";

constexpr char FFS_MTP_EP_IN[] = "/dev/usb-ffs/mtp/ep1";

constexpr char FFS_MTP_EP_OUT[] = "/dev/usb-ffs/mtp/ep2";
@@ -32,6 +43,7 @@ constexpr char FFS_PTP_EP0[] = "/dev/usb-ffs/ptp/ep0"; 
constexpr char FFS_PTP_EP_IN[] = "/dev/usb-ffs/ptp/ep1";

constexpr char FFS_PTP_EP_OUT[] = "/dev/usb-ffs/ptp/ep2";

constexpr char FFS_PTP_EP_INTR[] = "/dev/usb-ffs/ptp/ep3";

#endif



constexpr int MAX_PACKET_SIZE_FS = 64;

constexpr int MAX_PACKET_SIZE_HS = 512;

media/mtp/tests/MtpFuzzer/Android.bp

+92 −0
Original line number Diff line number Diff line
@@ -57,3 +57,95 @@ cc_fuzz { 
    dictionary: "mtp_fuzzer.dict",

    corpus: ["corpus/*"],

}



cc_defaults {

    name: "mtp_property_fuzzer_defaults",

    srcs: ["mtp_property_fuzzer.cpp"],

    shared_libs: [

        "libmtp",

        "libasyncio",

        "libusbhost",

    ],

    defaults: ["mtp_fuzzer_defaults"],

}



cc_fuzz {

     name: "mtp_device_property_fuzzer",

     defaults: ["mtp_property_fuzzer_defaults"],

     cflags: [

         "-DMTP_DEVICE",

     ],

}



cc_fuzz {

     name: "mtp_host_property_fuzzer",

     defaults: ["mtp_property_fuzzer_defaults"],

     cflags: [

         "-DMTP_HOST",

     ],

}



cc_fuzz {

    name: "mtp_handle_fuzzer",

    srcs: ["mtp_handle_fuzzer.cpp"],

    shared_libs: ["libmtp_fuzz"],

    defaults: ["mtp_fuzzer_defaults"],

    cflags: ["-DMTP_FUZZER"],

}



cc_defaults  {

     name: "mtp_packet_defaults",

     shared_libs: [

        "libmtp",

        "libasyncio",

        "libusbhost",

     ],

     defaults: ["mtp_fuzzer_defaults"],

     cflags: [

         "-DMTP_HOST",

         "-DMTP_DEVICE",

     ],

}



cc_fuzz {

     name: "mtp_packet_fuzzer",

     srcs: ["mtp_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}



cc_fuzz {

     name: "mtp_device_fuzzer",

     srcs: ["mtp_device_fuzzer.cpp"],

     shared_libs: [

        "libmtp",

        "libusbhost",

     ],

     defaults: ["mtp_fuzzer_defaults"],

     cflags: [

         "-DMTP_DEVICE",

     ],

}



cc_fuzz {

     name: "mtp_request_packet_fuzzer",

     srcs: ["mtp_request_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}



cc_fuzz {

     name: "mtp_event_packet_fuzzer",

     srcs: ["mtp_event_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}



cc_fuzz {

     name: "mtp_response_packet_fuzzer",

     srcs: ["mtp_response_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}



cc_fuzz {

     name: "mtp_data_packet_fuzzer",

     srcs: ["mtp_data_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}

media/mtp/tests/MtpFuzzer/MtpPacketFuzzerUtils.h

0 → 100644
+94 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <MtpStringBuffer.h>

#include <fuzzer/FuzzedDataProvider.h>

#include <linux/usbdevice_fs.h>

#include <sys/mman.h>

#include <usbhost/usbhost.h>

#include <MtpTypes.h>



using namespace android;

constexpr UrbPacketDivisionMode kUrbPacketDivisionModes[] = {FIRST_PACKET_ONLY_HEADER,

                                                             FIRST_PACKET_HAS_PAYLOAD};



constexpr size_t kMinSize = 0;

constexpr size_t kMaxSize = 1000;

constexpr size_t kMaxLength = 1000;



class MtpPacketFuzzerUtils {

  protected:

    struct usb_request mUsbRequest;

    struct usbdevfs_urb* mUsbDevFsUrb;

    std::string mPath;



    void fillFd(int32_t& fd, FuzzedDataProvider* fdp) {

        if (fdp->ConsumeBool()) {

            std::string text = fdp->ConsumeRandomLengthString(kMaxLength);

            write(fd, text.c_str(), text.length());

        }

    };



    void fillFilePath(FuzzedDataProvider* fdp) {

       mPath= fdp->ConsumeRandomLengthString(kMaxLength);

    };



    void fillUsbDevFsUrb(FuzzedDataProvider* fdp) {

        mUsbDevFsUrb->type = fdp->ConsumeIntegral<unsigned char>();

        mUsbDevFsUrb->endpoint = fdp->ConsumeIntegral<unsigned char>();

        mUsbDevFsUrb->flags = fdp->ConsumeIntegral<uint32_t>();

        std::vector<uint8_t> buffer =

                fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize));

        mUsbDevFsUrb->buffer = static_cast<void*>(buffer.data());

        mUsbDevFsUrb->buffer_length = buffer.size();

        mUsbDevFsUrb->actual_length = fdp->ConsumeIntegral<uint32_t>();

        mUsbDevFsUrb->start_frame = fdp->ConsumeIntegral<uint32_t>();

        mUsbDevFsUrb->number_of_packets = fdp->ConsumeIntegral<uint32_t>();

        mUsbDevFsUrb->stream_id = fdp->ConsumeIntegral<uint32_t>();

        mUsbDevFsUrb->error_count = fdp->ConsumeIntegral<size_t>();

        mUsbDevFsUrb->signr = fdp->ConsumeIntegral<uint32_t>();

        std::vector<uint8_t> userBuffer = (fdp->ConsumeBytes<uint8_t>(

                fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize)));

        mUsbDevFsUrb->usercontext = static_cast<void*>(userBuffer.data());

        mUsbDevFsUrb->iso_frame_desc[0].length = fdp->ConsumeIntegral<uint32_t>();

        mUsbDevFsUrb->iso_frame_desc[0].actual_length = fdp->ConsumeIntegral<uint32_t>();

    };



    void fillUsbRequest(int32_t& fd, FuzzedDataProvider* fdp) {

        fillUsbDevFsUrb(fdp);

        fillFd(fd, fdp);

        std::vector<uint8_t> buffer =

                fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize));

        mUsbRequest.buffer = static_cast<void*>(buffer.data());

        mUsbRequest.buffer_length = buffer.size();

        mUsbRequest.actual_length = fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize);

        mUsbRequest.max_packet_size = fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize);

        mUsbRequest.private_data = static_cast<void*>(mUsbDevFsUrb);

        mUsbRequest.endpoint = fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize);

        std::vector<uint8_t> clientBuffer = (fdp->ConsumeBytes<uint8_t>(

                fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize)));

        mUsbRequest.client_data = static_cast<void*>(clientBuffer.data());

    };



    template <typename Object>

    void writeHandle(Object obj, FuzzedDataProvider* fdp) {

        MtpDevHandle handle;

        std::vector<uint8_t> initData =

                fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize));

        handle.write(initData.data(), initData.size());

        obj->write(&handle);

    };

};

media/mtp/tests/MtpFuzzer/README.md

+186 −0
Original line number Diff line number Diff line
@@ -2,6 +2,15 @@ 


## Table of contents

+ [mtp_fuzzer](#MtpServer)

+ [mtp_host_property_fuzzer](#MtpHostProperty)

+ [mtp_device_property_fuzzer](#MtpDeviceProperty)

+ [mtp_handle_fuzzer](#MtpHandle)

+ [mtp_packet_fuzzer](#MtpPacket)

 + [mtp_device_fuzzer](#MtpDevice)

+ [mtp_request_packet_fuzzer](#MtpRequestPacket)

+ [mtp_event_packet_fuzzer](#MtpEventPacket)

+ [mtp_response_packet_fuzzer](#MtpResponsePacket)

+ [mtp_data_packet_fuzzer](#MtpDataPacket)



# <a name="MtpServer"></a> Fuzzer for MtpServer
@@ -22,3 +31,180 @@ MtpServer supports the following parameters: 
  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_fuzzer/mtp_fuzzer corpus/ -dict=mtp_fuzzer.dict

```



# <a name="MtpHostProperty"></a> Fuzzer for MtpHostProperty



MtpHostProperty supports the following parameters:

1. Feasible Type (parameter name: "kFeasibleTypes")

2. UrbPacket Division Mode (parameter name: "kUrbPacketDivisionModes")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

| `kFeasibleType`| 1. `MTP_TYPE_UNDEFINED`, 2. `MTP_TYPE_INT8`, 3.`MTP_TYPE_UINT8`, 4.`MTP_TYPE_INT16`, 5.`MTP_TYPE_UINT16`, 6.`MTP_TYPE_INT32`, 7.`MTP_TYPE_UINT32`, 8.`MTP_TYPE_INT64`, 9.`MTP_TYPE_UINT64`, 10.`MTP_TYPE_INT128`, 11.`MTP_TYPE_UINT128`, 12.`MTP_TYPE_AINT8`, 13.`MTP_TYPE_AUINT8`, 14.`MTP_TYPE_AINT16`, 15.`MTP_TYPE_AUINT16`, 16.`MTP_TYPE_AINT32`, 17.`MTP_TYPE_AUINT32`, 18.`MTP_TYPE_AINT64`, 19.`MTP_TYPE_AUINT64`, 20.`MTP_TYPE_AINT128`, 21.`MTP_TYPE_AUINT128`, 22.`MTP_TYPE_STR`,| Value obtained from FuzzedDataProvider|

|`kUrbPacketDivisionMode`| 1. `FIRST_PACKET_ONLY_HEADER`, 2. `FIRST_PACKET_HAS_PAYLOAD`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_host_property_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_host_property_fuzzer/mtp_host_property_fuzzer

```



# <a name="MtpDeviceProperty"></a> Fuzzer for MtpDeviceProperty



MtpDeviceProperty supports the following parameters:

1. Feasible Type (parameter name: "kFeasibleType")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

| `kFeasibleType`| 1. `MTP_TYPE_UNDEFINED`, 2. `MTP_TYPE_INT8`, 3.`MTP_TYPE_UINT8`, 4.`MTP_TYPE_INT16`, 5.`MTP_TYPE_UINT16`, 6.`MTP_TYPE_INT32`, 7.`MTP_TYPE_UINT32`, 8.`MTP_TYPE_INT64`, 9.`MTP_TYPE_UINT64`, 10.`MTP_TYPE_INT128`, 11.`MTP_TYPE_UINT128`, 12.`MTP_TYPE_AINT8`, 13.`MTP_TYPE_AUINT8`, 14.`MTP_TYPE_AINT16`, 15.`MTP_TYPE_AUINT16`, 16.`MTP_TYPE_AINT32`, 17.`MTP_TYPE_AUINT32`, 18.`MTP_TYPE_AINT64`, 19.`MTP_TYPE_AUINT64`, 20.`MTP_TYPE_AINT128`, 21.`MTP_TYPE_AUINT128`, 22.`MTP_TYPE_STR`,| Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_device_property_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_device_property_fuzzer/mtp_device_property_fuzzer

```



# <a name="MtpHandle"></a>Fuzzer for MtpHandle



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_handle_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_handle_fuzzer/mtp_handle_fuzzer

```



# <a name="MtpPacket"></a> Fuzzer for MtpPacket



MtpPacket supports the following parameters:

1. bufferSize (parameter name: "size")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`bufferSize`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_packet_fuzzer/mtp_packet_fuzzer

```



# <a name="MtpDevice"></a> Fuzzer for MtpDevice



MtpDevice supports the following parameters:

1. Device Name (parameter name: "deviceName")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`deviceName`| `String` |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_device_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_device_fuzzer/mtp_device_fuzzer

```



# <a name="MtpRequestPacket"></a> Fuzzer for MtpRequestPacket



MtpRequestPacket supports the following parameters:

1. Data (parameter name: "data")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`data`| Vector of positive Integer |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_request_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_request_packet_fuzzer/mtp_request_packet_fuzzer

```



# <a name="MtpEventPacket"></a> Fuzzer for MtpEventPacket



MtpEventPacket supports the following parameters:

1. Size (parameter name: "size")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_event_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_event_packet_fuzzer/mtp_event_packet_fuzzer

```



# <a name="MtpResponsePacket"></a> Fuzzer for MtpResponsePacket



MtpResponsePacket supports the following parameters:

1. Size (parameter name: "size")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_response_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_response_packet_fuzzer/mtp_response_packet_fuzzer

```



# <a name="MtpDataPacket"></a> Fuzzer for MtpDataPacket



MtpDataPacket supports the following parameters:

1. UrbPacket Division Mode (parameter name: "kUrbPacketDivisionModes")

2. Size (parameter name: "size")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`kUrbPacketDivisionMode`| 1. `FIRST_PACKET_ONLY_HEADER`, 2. `FIRST_PACKET_HAS_PAYLOAD`, |Value obtained from FuzzedDataProvider|

|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_data_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_data_packet_fuzzer/mtp_data_packet_fuzzer

```