Merge "Add additional 2 binder fuzzers" am: 13adf29374 (1c556f64) · Commits · e / os / android_frameworks_native

libs/binder/tests/fuzzers/Android.bp

+15 −0

Original line number	Diff line number	Diff line
		@@ -69,3 +69,18 @@ cc_fuzz {
		defaults: ["binder_fuzz_defaults"],
		srcs: ["TextOutputFuzz.cpp"],
		}

		cc_fuzz {
		name: "binder_bufferedTextOutputFuzz",
		include_dirs: [
		"frameworks/native/libs/binder",
		],
		defaults: ["binder_fuzz_defaults"],
		srcs: ["BufferedTextOutputFuzz.cpp"],
		}

		cc_fuzz {
		name: "binder_memoryDealerFuzz",
		defaults: ["binder_fuzz_defaults"],
		srcs: ["MemoryDealerFuzz.cpp"],
		}

libs/binder/tests/fuzzers/BufferedTextOutputFuzz.cpp

0 → 100644

+72 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <commonFuzzHelpers.h>
		#include <fuzzer/FuzzedDataProvider.h>
		#include <string>
		#include <vector>
		#include "BufferedTextOutput.h"

		namespace android {

		class FuzzBufferedTextOutput : public BufferedTextOutput {
		public:
		FuzzBufferedTextOutput(uint32_t flags) : BufferedTextOutput(flags) {}
		virtual status_t writeLines(const struct iovec& buf, size_t) {
		size_t len = buf.iov_len;
		void* tmp_buf = malloc(len);

		if (tmp_buf == NULL) {
		return status_t();
		}

		// This will attempt to read data from iov_base to ensure valid params were passed.
		memcpy(tmp_buf, buf.iov_base, len);
		free(tmp_buf);
		return status_t();
		}
		};

		// Fuzzer entry point.
		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		FuzzedDataProvider fdp(data, size);
		uint32_t flags = fdp.ConsumeIntegral<uint32_t>();
		size_t push_count = 0;
		std::shared_ptr<BufferedTextOutput> bTextOutput(new FuzzBufferedTextOutput(flags));

		while (fdp.remaining_bytes() > 0) {
		fdp.PickValueInArray<std::function<void()>>({
		[&]() -> void {
		bTextOutput->pushBundle();
		push_count++;
		},
		[&]() -> void {
		std::string txt = fdp.ConsumeRandomLengthString(fdp.remaining_bytes());
		size_t len = fdp.ConsumeIntegralInRange<size_t>(0, txt.length());
		bTextOutput->print(txt.c_str(), len);
		},
		[&]() -> void {
		if (push_count == 0) return;

		bTextOutput->popBundle();
		push_count--;
		},
		})();
		}

		return 0;
		}
		} // namespace android

libs/binder/tests/fuzzers/MemoryDealerFuzz.cpp

0 → 100644

+77 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <binder/MemoryDealer.h>
		#include <commonFuzzHelpers.h>
		#include <fuzzer/FuzzedDataProvider.h>
		#include <string>
		#include <unordered_set>

		namespace android {

		static constexpr size_t kMaxBufferSize = 10000;
		static constexpr size_t kMaxDealerSize = 1024 * 512;
		static constexpr size_t kMaxAllocSize = 1024;

		// Fuzzer entry point.
		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		if (size > kMaxBufferSize) {
		return 0;
		}

		FuzzedDataProvider fdp(data, size);
		size_t dSize = fdp.ConsumeIntegralInRange<size_t>(0, kMaxDealerSize);
		std::string name = fdp.ConsumeRandomLengthString(fdp.remaining_bytes());
		uint32_t flags = fdp.ConsumeIntegral<uint32_t>();
		sp<MemoryDealer> dealer = new MemoryDealer(dSize, name.c_str(), flags);

		// This is used to track offsets that have been freed already to avoid an expected fatal log.
		std::unordered_set<size_t> free_list;

		while (fdp.remaining_bytes() > 0) {
		fdp.PickValueInArray<std::function<void()>>({
		[&]() -> void { dealer->getAllocationAlignment(); },
		[&]() -> void { dealer->getMemoryHeap(); },
		[&]() -> void {
		size_t offset = fdp.ConsumeIntegral<size_t>();

		// Offset has already been freed, so return instead.
		if (free_list.find(offset) != free_list.end()) return;

		dealer->deallocate(offset);
		free_list.insert(offset);
		},
		[&]() -> void {
		std::string randString = fdp.ConsumeRandomLengthString(fdp.remaining_bytes());
		dealer->dump(randString.c_str());
		},
		[&]() -> void {
		size_t allocSize = fdp.ConsumeIntegralInRange<size_t>(0, kMaxAllocSize);
		sp<IMemory> allocated = dealer->allocate(allocSize);
		// If the allocation was successful, try to write to it
		if (allocated != nullptr && allocated->unsecurePointer() != nullptr) {
		memset(allocated->unsecurePointer(), 1, allocated->size());

		// Clear the address from freelist since it has been allocated over again.
		free_list.erase(allocated->offset());
		}
		},
		})();
		}

		return 0;
		}
		} // namespace android