Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7bed039a authored by kunal rai's avatar kunal rai Committed by Devendra Singhi
Browse files

Added mtp_event_packet_fuzzer 

Test: ./mtp_event_packet_fuzzer
Bug: 234679864

Change-Id: I1eb083fdbd1554706bf68e78d7f335b9d90289c9
parent 04123048

media/mtp/tests/MtpFuzzer/Android.bp

+6 −0
Original line number Diff line number Diff line
@@ -131,3 +131,9 @@ cc_fuzz { 
     srcs: ["mtp_request_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}



cc_fuzz {

     name: "mtp_event_packet_fuzzer",

     srcs: ["mtp_event_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}

media/mtp/tests/MtpFuzzer/README.md

+21 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
+ [mtp_packet_fuzzer](#MtpPacket)

 + [mtp_device_fuzzer](#MtpDevice)

+ [mtp_request_packet_fuzzer](#MtpRequestPacket)

+ [mtp_event_packet_fuzzer](#MtpEventPacket)



# <a name="MtpServer"></a> Fuzzer for MtpServer
@@ -143,3 +144,23 @@ MtpRequestPacket supports the following parameters: 
  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_request_packet_fuzzer/mtp_request_packet_fuzzer

```



# <a name="MtpEventPacket"></a> Fuzzer for MtpEventPacket



MtpEventPacket supports the following parameters:

1. Size (parameter name: "size")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_event_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_event_packet_fuzzer/mtp_event_packet_fuzzer

```

media/mtp/tests/MtpFuzzer/mtp_event_packet_fuzzer.cpp

0 → 100644
+69 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <MtpDevHandle.h>

#include <MtpEventPacket.h>

#include <MtpPacketFuzzerUtils.h>

#include <fuzzer/FuzzedDataProvider.h>



using namespace android;



class MtpEventPacketFuzzer : MtpPacketFuzzerUtils {

  public:

    MtpEventPacketFuzzer(const uint8_t* data, size_t size) : mFdp(data, size) {

        mUsbDevFsUrb = (struct usbdevfs_urb*)malloc(sizeof(struct usbdevfs_urb) +

                                                   sizeof(struct usbdevfs_iso_packet_desc));

    };

    ~MtpEventPacketFuzzer() { free(mUsbDevFsUrb); };

    void process();



  private:

    FuzzedDataProvider mFdp;

};



void MtpEventPacketFuzzer::process() {

    MtpEventPacket mtpEventPacket;

    while (mFdp.remaining_bytes() > 0) {

        auto mtpEventAPI = mFdp.PickValueInArray<const std::function<void()>>({

                [&]() { mtpEventPacket.allocate(mFdp.ConsumeIntegralInRange(kMinSize, kMaxSize)); },

                [&]() { mtpEventPacket.reset(); },

                [&]() { writeHandle(&mtpEventPacket, &mFdp); },

                [&]() {

                    fillFilePath(&mFdp);

                    int32_t fd = memfd_create(mPath.c_str(), MFD_ALLOW_SEALING);

                    fillUsbRequest(fd, &mFdp);

                    mUsbRequest.dev = usb_device_new(mPath.c_str(), fd);

                    mtpEventPacket.sendRequest(&mUsbRequest);

                    usb_device_close(mUsbRequest.dev);

                },

                [&]() {

                    fillFilePath(&mFdp);

                    int32_t fd = memfd_create(mPath.c_str(), MFD_ALLOW_SEALING);

                    fillFd(fd, &mFdp);

                    struct usb_device* device = usb_device_new(mPath.c_str(), fd);

                    mtpEventPacket.readResponse(device);

                    usb_device_close(device);

                },

        });

        mtpEventAPI();

    }

}



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    MtpEventPacketFuzzer mtpEventPacketFuzzer(data, size);

    mtpEventPacketFuzzer.process();

    return 0;

}