Added mtp_packet_fuzzer (9f5eeed5) · Commits · e / os / android_frameworks_av

media/mtp/tests/MtpFuzzer/Android.bp

+20 −0

Original line number	Diff line number	Diff line
		@@ -92,3 +92,23 @@ cc_fuzz {
		defaults: ["mtp_fuzzer_defaults"],
		cflags: ["-DMTP_FUZZER"],
		}

		cc_defaults {
		name: "mtp_packet_defaults",
		shared_libs: [
		"libmtp",
		"libasyncio",
		"libusbhost",
		],
		defaults: ["mtp_fuzzer_defaults"],
		cflags: [
		"-DMTP_HOST",
		"-DMTP_DEVICE",
		],
		}

		cc_fuzz {
		name: "mtp_packet_fuzzer",
		srcs: ["mtp_packet_fuzzer.cpp"],
		defaults: ["mtp_packet_defaults"],
		}

media/mtp/tests/MtpFuzzer/README.md

+21 −0

Original line number	Diff line number	Diff line
		@@ -5,6 +5,7 @@
		+ [mtp_host_property_fuzzer](#MtpHostProperty)
		+ [mtp_device_property_fuzzer](#MtpDeviceProperty)
		+ [mtp_handle_fuzzer](#MtpHandle)
		+ [mtp_packet_fuzzer](#MtpPacket)

		# <a name="MtpServer"></a> Fuzzer for MtpServer

		@@ -80,3 +81,23 @@ MtpDeviceProperty supports the following parameters:
		$ adb sync data
		$ adb shell /data/fuzz/arm64/mtp_handle_fuzzer/mtp_handle_fuzzer
		```

		# <a name="MtpPacket"></a> Fuzzer for MtpPacket

		MtpPacket supports the following parameters:
		1. bufferSize (parameter name: "size")

		\| Parameter\| Valid Values \|Configured Value\|
		\|-------------\|----------\|----- \|
		\|`bufferSize`\| Integer `1` to `1000`, \|Value obtained from FuzzedDataProvider\|

		#### Steps to run
		1. Build the fuzzer
		```
		$ mm -j$(nproc) mtp_packet_fuzzer
		```
		2. Run on device
		```
		$ adb sync data
		$ adb shell /data/fuzz/arm64/mtp_packet_fuzzer/mtp_packet_fuzzer
		```

media/mtp/tests/MtpFuzzer/mtp_packet_fuzzer.cpp

0 → 100644

+88 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <MtpDevHandle.h>
		#include <MtpPacket.h>
		#include <MtpPacketFuzzerUtils.h>
		#include <fuzzer/FuzzedDataProvider.h>

		using namespace android;

		class MtpPacketFuzzer : MtpPacketFuzzerUtils {
		public:
		MtpPacketFuzzer(const uint8_t* data, size_t size) : mFdp(data, size) {
		mUsbDevFsUrb = (struct usbdevfs_urb*)malloc(sizeof(struct usbdevfs_urb) +
		sizeof(struct usbdevfs_iso_packet_desc));
		};
		~MtpPacketFuzzer() { free(mUsbDevFsUrb); };
		void process();

		private:
		FuzzedDataProvider mFdp;
		};

		void MtpPacketFuzzer::process() {
		MtpPacket mtpPacket(mFdp.ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize)); /bufferSize/
		while (mFdp.remaining_bytes() > 0) {
		auto mtpPacketAPI = mFdp.PickValueInArray<const std::function<void()>>({
		[&]() {
		mtpPacket.allocate(mFdp.ConsumeIntegralInRange<size_t>(kMinSize, kMaxSize));
		},
		[&]() { mtpPacket.reset(); },
		[&]() { mtpPacket.getContainerType(); },
		[&]() { mtpPacket.getContainerCode(); },
		[&]() { mtpPacket.dump(); },
		[&]() { mtpPacket.getTransactionID(); },
		[&]() {
		mtpPacket.setContainerCode(
		mFdp.ConsumeIntegralInRange<int32_t>(kMinSize, kMaxSize));
		},
		[&]() {
		mtpPacket.setTransactionID(
		mFdp.ConsumeIntegralInRange<int32_t>(kMinSize, kMaxSize));
		},
		[&]() {
		mtpPacket.getParameter(
		mFdp.ConsumeIntegralInRange<int32_t>(kMinSize, kMaxSize));
		},
		[&]() {
		mtpPacket.setParameter(
		mFdp.ConsumeIntegralInRange<int32_t>(kMinSize, kMaxSize),
		mFdp.ConsumeIntegralInRange<int32_t>(kMinSize, kMaxSize));
		},
		[&]() {
		MtpPacket testMtpPacket(
		mFdp.ConsumeIntegralInRange<int32_t>(kMinSize, kMaxSize));
		testMtpPacket.copyFrom(mtpPacket);
		},
		[&]() {
		fillFilePath(&mFdp);
		int32_t fd = memfd_create(mPath.c_str(), MFD_ALLOW_SEALING);
		fillUsbRequest(fd, &mFdp);
		mUsbRequest.dev = usb_device_new(mPath.c_str(), fd);
		mtpPacket.transfer(&mUsbRequest);
		usb_device_close(mUsbRequest.dev);
		},
		});
		mtpPacketAPI();
		}
		}

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		MtpPacketFuzzer mtpPacketFuzzer(data, size);
		mtpPacketFuzzer.process();
		return 0;
		}