Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d1b46c6 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge changes Id58fc8e8,Ic5657e0e 

* changes:
  libbinder fuzzer: print data from inplace reads
  libbinder fuzzer: read flattenable
parents 287827d2 6065c057

libs/binder/fuzzer/binder.cpp

+38 −4
Original line number Diff line number Diff line
@@ -37,6 +37,29 @@ private: 
    int64_t mExampleUsedData = 0;

};



struct ExampleFlattenable : public android::Flattenable<ExampleFlattenable> {

public:

    size_t getFlattenedSize() const { return sizeof(mValue); }

    size_t getFdCount() const { return 0; }

    status_t flatten(void*& /*buffer*/, size_t& /*size*/, int*& /*fds*/, size_t& /*count*/) const {

        FUZZ_LOG() << "should not reach";

        abort();

    }

    status_t unflatten(void const*& buffer, size_t& size, int const*& /*fds*/, size_t& /*count*/) {

        if (size < sizeof(mValue)) {

            return android::NO_MEMORY;

        }

        android::FlattenableUtils::read(buffer, size, mValue);

        return android::OK;

    }

private:

    int32_t mValue = 0xFEEDBEEF;

};



struct ExampleLightFlattenable : public android::LightFlattenablePod<ExampleLightFlattenable> {

    int32_t mValue = 0;

};



#define PARCEL_READ_WITH_STATUS(T, FUN) \

    [] (const ::android::Parcel& p, uint8_t /*data*/) {\

        FUZZ_LOG() << "about to read " #T " using " #FUN " with status";\
@@ -102,7 +125,7 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { 
    [] (const ::android::Parcel& p, uint8_t len) {

        FUZZ_LOG() << "about to readInplace";

        const void* r = p.readInplace(len);

        FUZZ_LOG() << "readInplace done. pointer: " << r;

        FUZZ_LOG() << "readInplace done. pointer: " << r << " bytes: " << hexString(r, len);

    },

    PARCEL_READ_OPT_STATUS(int32_t, readInt32),

    PARCEL_READ_OPT_STATUS(uint32_t, readUint32),
@@ -129,7 +152,8 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { 
        FUZZ_LOG() << "about to readString16Inplace";

        size_t outLen = 0;

        const char16_t* str = p.readString16Inplace(&outLen);

        FUZZ_LOG() << "readString16Inplace: " << (str ? "non-null" : "null") << " size: " << outLen;

        FUZZ_LOG() << "readString16Inplace: " << hexString(str, sizeof(char16_t) * outLen)

                   << " size: " << outLen;

    },

    PARCEL_READ_WITH_STATUS(android::sp<android::IBinder>, readStrongBinder),

    PARCEL_READ_WITH_STATUS(android::sp<android::IBinder>, readNullableStrongBinder),
@@ -173,8 +197,18 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { 
    // PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<std::unique_ptr<std::string>>>, readUtf8VectorFromUtf16Vector),

    // PARCEL_READ_WITH_STATUS(std::vector<std::string>, readUtf8VectorFromUtf16Vector),



    // TODO: read(Flattenable<T>)

    // TODO: read(LightFlattenable<T>)

    [] (const android::Parcel& p, uint8_t /*len*/) {

        FUZZ_LOG() << "about to read flattenable";

        ExampleFlattenable f;

        status_t status = p.read(f);

        FUZZ_LOG() << "read flattenable: " << status;

    },

    [] (const android::Parcel& p, uint8_t /*len*/) {

        FUZZ_LOG() << "about to read lite flattenable";

        ExampleLightFlattenable f;

        status_t status = p.read(f);

        FUZZ_LOG() << "read lite flattenable: " << status;

    },



    // TODO(b/131868573): can force read of arbitrarily sized vector

    // TODO: resizeOutVector

libs/binder/fuzzer/util.cpp

+9 −3
Original line number Diff line number Diff line
@@ -21,11 +21,17 @@ 
#include <iomanip>

#include <sstream>



std::string hexString(const std::vector<uint8_t>& hash) {

std::string hexString(const void* bytes, size_t len) {

    if (bytes == nullptr) return "<null>";



    std::ostringstream s;

    s << std::hex << std::setfill('0');

    for (uint8_t i : hash) {

        s << std::setw(2) << static_cast<int>(i);

    for (size_t i = 0; i < len; i++) {

        s << std::setw(2) << static_cast<int>(

            static_cast<const uint8_t*>(bytes)[i]);

    }

    return s.str();

}

std::string hexString(const std::vector<uint8_t>& bytes) {

    return hexString(bytes.data(), bytes.size());

}

libs/binder/fuzzer/util.h

+2 −1
Original line number Diff line number Diff line
@@ -45,4 +45,5 @@ private: 
    std::stringstream mOs;

};



std::string hexString(const std::vector<uint8_t>& hash);
 
std::string hexString(const void* bytes, size_t len);

std::string hexString(const std::vector<uint8_t>& bytes);