Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e618e292 authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Adding example java binder service fuzzer 

using fuzzService API to fuzz an test service.

Test: m java_binder_service_fuzzer &&
./jazzer_helper.sh --fuzz_target java_binder_service_fuzzer --target_class ServiceFuzzer
Bug: 258075558

Change-Id: If1ff082638eaec04e8ba9c4f8f7321c952b22f82
parent 93068135

core/java/Android.bp

+10 −0
Original line number Diff line number Diff line
@@ -425,6 +425,16 @@ filegroup { 
    ],

}



// This file group is used by service fuzzer

filegroup {

    name: "framework-core-sources-for-fuzzers",

    srcs: [

        "android/os/IInterface.java",

        "android/os/Binder.java",

        "android/os/IBinder.java",

    ],

}



aidl_interface {

    name: "android.os.statsbootstrap_aidl",

    unstable: true,

core/tests/fuzzers/FuzzService/FuzzBinder.java

+1 −1
Original line number Diff line number Diff line
@@ -22,7 +22,7 @@ public class FuzzBinder { 
    }



    // DO NOT REUSE: This API should be called from fuzzer to setup JNI dependencies from

    // libandroid_runtime. THIS IS WORKAROUND. Please file a bug if you need to use this

    // libandroid_runtime. THIS IS WORKAROUND. Please file a bug if you need to use this.

    public static void init() {

        System.loadLibrary("android_runtime");

        registerNatives();

core/tests/fuzzers/java_service_fuzzer/Android.bp

0 → 100644
+40 −0
Original line number Diff line number Diff line 
package {

    default_applicable_licenses: ["frameworks_base_license"],

}



aidl_interface {

    name: "fuzzTestInterface",

    srcs: ["fuzztest/ITestService.aidl"],

    unstable: true,

    backend: {

        java: {

            enabled: true,

        },

    },

}



java_fuzz {

    name: "java_binder_service_fuzzer",

    srcs: [

        "ServiceFuzzer.java",

        "TestService.java",

        ":framework-core-sources-for-fuzzers",

    ],

    static_libs: [

        "jazzer",

        "fuzzTestInterface-java",

        "random_parcel_lib",

    ],

    jni_libs: [

        "librandom_parcel_jni",

        "libc++",

        "libandroid_runtime",

    ],

    libs: [

        "framework",

        "unsupportedappusage",

        "ext",

        "framework-res",

    ],

    native_bridge_supported: true,

}

core/tests/fuzzers/java_service_fuzzer/ServiceFuzzer.java

0 → 100644
+32 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



import com.code_intelligence.jazzer.api.FuzzedDataProvider;



import randomparcel.FuzzBinder;



public class ServiceFuzzer {



    static {

        // Initialize fuzzService and JNI dependencies

        FuzzBinder.init();

    }



    public static void fuzzerTestOneInput(FuzzedDataProvider data) {

        TestService service = new TestService();

        FuzzBinder.fuzzService(service, data.consumeRemainingAsBytes());

    }

}

core/tests/fuzzers/java_service_fuzzer/TestService.java

0 → 100644
+25 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



import fuzztest.ITestService;



public class TestService extends ITestService.Stub {



    @Override

    public boolean repeatData(boolean token) {

        return token;

    }

}