Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c08b14c authored by kunal rai's avatar kunal rai Committed by Devendra Singhi
Browse files

Added mtp_response_packet_fuzzer 

Test: ./mtp_response_packet_fuzzer
Bug: 234679864
Change-Id: I78eaad874518731ceade151c4eb33801a9acef11
parent 7bed039a

media/mtp/tests/MtpFuzzer/Android.bp

+6 −0
Original line number Diff line number Diff line
@@ -137,3 +137,9 @@ cc_fuzz { 
     srcs: ["mtp_event_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}



cc_fuzz {

     name: "mtp_response_packet_fuzzer",

     srcs: ["mtp_response_packet_fuzzer.cpp"],

     defaults: ["mtp_packet_defaults"],

}

media/mtp/tests/MtpFuzzer/README.md

+21 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
 + [mtp_device_fuzzer](#MtpDevice)

+ [mtp_request_packet_fuzzer](#MtpRequestPacket)

+ [mtp_event_packet_fuzzer](#MtpEventPacket)

+ [mtp_response_packet_fuzzer](#MtpResponsePacket)



# <a name="MtpServer"></a> Fuzzer for MtpServer
@@ -164,3 +165,23 @@ MtpEventPacket supports the following parameters: 
  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_event_packet_fuzzer/mtp_event_packet_fuzzer

```



# <a name="MtpResponsePacket"></a> Fuzzer for MtpResponsePacket



MtpResponsePacket supports the following parameters:

1. Size (parameter name: "size")



| Parameter| Valid Values |Configured Value|

|-------------|----------|----- |

|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|



#### Steps to run

1. Build the fuzzer

```

  $ mm -j$(nproc) mtp_response_packet_fuzzer

```

2. Run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/mtp_response_packet_fuzzer/mtp_response_packet_fuzzer

```

media/mtp/tests/MtpFuzzer/mtp_response_packet_fuzzer.cpp

0 → 100644
+64 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <MtpDevHandle.h>

#include <MtpPacketFuzzerUtils.h>

#include <MtpResponsePacket.h>

#include <fuzzer/FuzzedDataProvider.h>



using namespace android;



class MtpResponsePacketFuzzer : MtpPacketFuzzerUtils {

  public:

    MtpResponsePacketFuzzer(const uint8_t* data, size_t size) : mFdp(data, size) {

        mUsbDevFsUrb = (struct usbdevfs_urb*)malloc(sizeof(struct usbdevfs_urb) +

                                                   sizeof(struct usbdevfs_iso_packet_desc));

    };

    ~MtpResponsePacketFuzzer() { free(mUsbDevFsUrb); };

    void process();



  private:

    FuzzedDataProvider mFdp;

};



void MtpResponsePacketFuzzer::process() {

    MtpResponsePacket mtpResponsePacket;

    while (mFdp.remaining_bytes() > 0) {

        auto mtpResponseAPI = mFdp.PickValueInArray<const std::function<void()>>({

                [&]() {

                    mtpResponsePacket.allocate(

                            mFdp.ConsumeIntegralInRange(kMinSize, kMaxSize)); /*size*/

                },

                [&]() { mtpResponsePacket.reset(); },

                [&]() { writeHandle(&mtpResponsePacket, &mFdp); },

                [&]() {

                    fillFilePath(&mFdp);

                    int32_t fd = memfd_create(mPath.c_str(), MFD_ALLOW_SEALING);

                    fillUsbRequest(fd, &mFdp);

                    mUsbRequest.dev = usb_device_new(mPath.c_str(), fd);

                    mtpResponsePacket.read(&mUsbRequest);

                    usb_device_close(mUsbRequest.dev);

                },

        });

        mtpResponseAPI();

    }

}



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    MtpResponsePacketFuzzer mtpResponsePacketFuzzer(data, size);

    mtpResponsePacketFuzzer.process();

    return 0;

}