Merge "Adding example java binder service fuzzer" (a8e835c4) · Commits · e / os / android_frameworks_base

core/java/Android.bp

+10 −0

Original line number	Diff line number	Diff line
		@@ -425,6 +425,16 @@ filegroup {
		],
		}

		// This file group is used by service fuzzer
		filegroup {
		name: "framework-core-sources-for-fuzzers",
		srcs: [
		"android/os/IInterface.java",
		"android/os/Binder.java",
		"android/os/IBinder.java",
		],
		}

		aidl_interface {
		name: "android.os.statsbootstrap_aidl",
		unstable: true,

+1 −1

Original line number	Diff line number	Diff line
		@@ -22,7 +22,7 @@ public class FuzzBinder {
		}

		// DO NOT REUSE: This API should be called from fuzzer to setup JNI dependencies from
		// libandroid_runtime. THIS IS WORKAROUND. Please file a bug if you need to use this
		// libandroid_runtime. THIS IS WORKAROUND. Please file a bug if you need to use this.
		public static void init() {
		System.loadLibrary("android_runtime");
		registerNatives();

0 → 100644

+40 −0

Original line number	Diff line number	Diff line
		package {
		default_applicable_licenses: ["frameworks_base_license"],
		}

		aidl_interface {
		name: "fuzzTestInterface",
		srcs: ["fuzztest/ITestService.aidl"],
		unstable: true,
		backend: {
		java: {
		enabled: true,
		},
		},
		}

		java_fuzz {
		name: "java_binder_service_fuzzer",
		srcs: [
		"ServiceFuzzer.java",
		"TestService.java",
		":framework-core-sources-for-fuzzers",
		],
		static_libs: [
		"jazzer",
		"fuzzTestInterface-java",
		"random_parcel_lib",
		],
		jni_libs: [
		"librandom_parcel_jni",
		"libc++",
		"libandroid_runtime",
		],
		libs: [
		"framework",
		"unsupportedappusage",
		"ext",
		"framework-res",
		],
		native_bridge_supported: true,
		}

0 → 100644

+32 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		import com.code_intelligence.jazzer.api.FuzzedDataProvider;

		import randomparcel.FuzzBinder;

		public class ServiceFuzzer {

		static {
		// Initialize fuzzService and JNI dependencies
		FuzzBinder.init();
		}

		public static void fuzzerTestOneInput(FuzzedDataProvider data) {
		TestService service = new TestService();
		FuzzBinder.fuzzService(service, data.consumeRemainingAsBytes());
		}
		}

0 → 100644

+25 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		import fuzztest.ITestService;

		public class TestService extends ITestService.Stub {

		@Override
		public boolean repeatData(boolean token) {
		return token;
		}
		}