Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 52f0fc4d authored by Steven Moreland's avatar Steven Moreland
Browse files

binder_parcel_fuzz: add setData 

This causes crashes, due to mObjects not getting cleared or similar?
This is not an operation that should be done, but we should add tests
for these cases and fix them.

Bug: 328161314
Test: run fuzzer (crashes quickly)
Change-Id: Ib737e81fbf53a2e1223cbdcde6ed50d1b6f02b24
parent e7feba5d

libs/binder/tests/parcel_fuzzer/binder.cpp

+8 −0
Original line number Diff line number Diff line
@@ -115,6 +115,14 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { 
        p.setDataPosition(pos);

        FUZZ_LOG() << "setDataPosition done";

    },

    [] (const ::android::Parcel& p, FuzzedDataProvider& provider) {

        size_t len = provider.ConsumeIntegralInRange<size_t>(0, 1024);

        std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(len);

        FUZZ_LOG() << "about to setData: " <<(bytes.data() ? HexString(bytes.data(), bytes.size()) : "null");

        // TODO: allow all read and write operations

        (*const_cast<::android::Parcel*>(&p)).setData(bytes.data(), bytes.size());

        FUZZ_LOG() << "setData done";

    },

    PARCEL_READ_NO_STATUS(size_t, allowFds),

    PARCEL_READ_NO_STATUS(size_t, hasFileDescriptors),

    PARCEL_READ_NO_STATUS(std::vector<android::sp<android::IBinder>>, debugReadAllStrongBinders),