Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99f9d44f authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "gralloc: add vendor encode/decode helpers"

parents 4f16d9fb b95c1efc

libs/gralloc/types/Gralloc4.cpp

+70 −0
Original line number Diff line number Diff line
@@ -985,6 +985,76 @@ status_t decodeSmpte2094_40(const hidl_vec<uint8_t>& smpte2094_40, 
                          decodeByteVector);

}



status_t encodeUint32(const MetadataType& metadataType, uint32_t input,

                      hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeInteger);

}



status_t decodeUint32(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                      uint32_t* output) {

    return decode(metadataType, input, output, decodeInteger);

}



status_t encodeInt32(const MetadataType& metadataType, int32_t input,

                     hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeInteger);

}



status_t decodeInt32(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                     int32_t* output) {

    return decode(metadataType, input, output, decodeInteger);

}



status_t encodeUint64(const MetadataType& metadataType, uint64_t input,

                      hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeInteger);

}



status_t decodeUint64(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                      uint64_t* output) {

    return decode(metadataType, input, output, decodeInteger);

}



status_t encodeInt64(const MetadataType& metadataType, int64_t input,

                     hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeInteger);

}



status_t decodeInt64(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                     int64_t* output) {

    return decode(metadataType, input, output, decodeInteger);

}



status_t encodeFloat(const MetadataType& metadataType, float input,

                     hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeInteger);

}



status_t decodeFloat(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                     float* output) {

    return decode(metadataType, input, output, decodeInteger);

}



status_t encodeDouble(const MetadataType& metadataType, double input,

                      hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeInteger);

}



status_t decodeDouble(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                      double* output) {

    return decode(metadataType, input, output, decodeInteger);

}



status_t encodeString(const MetadataType& metadataType, const std::string& input,

                      hidl_vec<uint8_t>* output) {

    return encode(metadataType, input, output, encodeString);

}



status_t decodeString(const MetadataType& metadataType, const hidl_vec<uint8_t>& input,

                      std::string* output) {

    return decode(metadataType, input, output, decodeString);

}



bool isStandardMetadataType(const MetadataType& metadataType) {

    return !std::strncmp(metadataType.name.c_str(), GRALLOC4_STANDARD_METADATA_TYPE,

                         metadataType.name.size());

libs/gralloc/types/fuzzer/gralloctypes.cpp

+21 −1
Original line number Diff line number Diff line
@@ -30,9 +30,10 @@ 
#include "util.h"



using ::android::status_t;

using MetadataType = android::hardware::graphics::mapper::V4_0::IMapper::MetadataType;



#define GRALLOCTYPES_DECODE(T, FUNC) \

    [] (const ::android::hardware::hidl_vec<uint8_t>& vec, uint8_t /*data*/) {\

    [] (const ::android::hardware::hidl_vec<uint8_t>& vec) {\

        FUZZ_LOG() << "about to read " #T " using " #FUNC;\

        T t;\

        status_t err = FUNC(vec, &t);\
@@ -40,6 +41,15 @@ using ::android::status_t; 
        FUZZ_LOG() << #T " done " /* << "err: " << err*/;\

    }



#define GRALLOCTYPES_DECODE_VENDOR_HELPER(T, FUNC) \

    [] (const MetadataType& metadataType, const ::android::hardware::hidl_vec<uint8_t>& vec) {\

        FUZZ_LOG() << "about to read " #T " using " #FUNC;\

        T t;\

        status_t err = FUNC(metadataType, vec, &t);\

        (void) err;\

        FUZZ_LOG() << #T " done " /* << "err: " << err*/;\

    }





// clang-format off

std::vector<GrallocTypesDecode> GRALLOCTYPES_DECODE_FUNCTIONS {
@@ -64,4 +74,14 @@ std::vector<GrallocTypesDecode> GRALLOCTYPES_DECODE_FUNCTIONS { 
    GRALLOCTYPES_DECODE(std::optional<aidl::android::hardware::graphics::common::Cta861_3>, ::android::gralloc4::decodeCta861_3),

    GRALLOCTYPES_DECODE(std::optional<std::vector<uint8_t>>, ::android::gralloc4::decodeSmpte2094_40),

};



std::vector<GrallocTypesVendorHelperDecode> GRALLOCTYPES_DECODE_VENDOR_HELPER_FUNCTIONS {

    GRALLOCTYPES_DECODE_VENDOR_HELPER(uint32_t, ::android::gralloc4::decodeUint32),

    GRALLOCTYPES_DECODE_VENDOR_HELPER(int32_t, ::android::gralloc4::decodeInt32),

    GRALLOCTYPES_DECODE_VENDOR_HELPER(uint64_t, ::android::gralloc4::decodeUint64),

    GRALLOCTYPES_DECODE_VENDOR_HELPER(int64_t, ::android::gralloc4::decodeInt64),

    GRALLOCTYPES_DECODE_VENDOR_HELPER(float, ::android::gralloc4::decodeFloat),

    GRALLOCTYPES_DECODE_VENDOR_HELPER(double, ::android::gralloc4::decodeDouble),

    GRALLOCTYPES_DECODE_VENDOR_HELPER(std::string, ::android::gralloc4::decodeString),

};

// clang-format on

libs/gralloc/types/fuzzer/gralloctypes.h

+3 −1
Original line number Diff line number Diff line
@@ -20,6 +20,8 @@ 


#include <vector>



using GrallocTypesDecode = std::function<void(const ::android::hardware::hidl_vec<uint8_t>& vec, uint8_t data)>;

using GrallocTypesDecode = std::function<void(const ::android::hardware::hidl_vec<uint8_t>& vec)>;

using GrallocTypesVendorHelperDecode = std::function<void(const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType&, const ::android::hardware::hidl_vec<uint8_t>& vec)>;



extern std::vector<GrallocTypesDecode> GRALLOCTYPES_DECODE_FUNCTIONS;

extern std::vector<GrallocTypesVendorHelperDecode> GRALLOCTYPES_DECODE_VENDOR_HELPER_FUNCTIONS;

libs/gralloc/types/fuzzer/main.cpp

+72 −25
Original line number Diff line number Diff line
@@ -24,52 +24,99 @@ 
#include <cstdlib>

#include <ctime>



using MetadataType = android::hardware::graphics::mapper::V4_0::IMapper::MetadataType;



void doFuzz(

        const std::vector<GrallocTypesDecode>& decodes,

        const std::vector<uint8_t>& input,

        const std::vector<uint8_t>& instructions) {

        const std::vector<GrallocTypesDecode>& decodes, uint8_t instruction,

        const std::vector<uint8_t>& input) {



    ::android::hardware::hidl_vec<uint8_t> vec;

    vec.setToExternal(const_cast<uint8_t*>(input.data()), input.size(), false /*shouldOwn*/);



    // since we are only using a byte to index

    CHECK(decodes.size() <= 255) << decodes.size();

    uint8_t decodeIdx = instruction % decodes.size();



    FUZZ_LOG() << "Instruction: " << instruction << " idx: " << static_cast<size_t>(decodeIdx)

               << " size: " << vec.size();



    decodes[decodeIdx](vec);

}



    for (size_t i = 0; i < instructions.size() - 1; i += 2) {

        uint8_t a = instructions[i];

        uint8_t decodeIdx = a % decodes.size();

size_t fillInMetadataType(const std::vector<uint8_t>& input, MetadataType* outMetadataType) {

    if (input.size() < sizeof(outMetadataType->value) + 1) {

        return 0;

    }

    size_t size = 0;



        uint8_t b = instructions[i + 1];

    outMetadataType->value = *(reinterpret_cast<const int64_t*>(input.data()));

    size += sizeof(outMetadataType->value);



    uint8_t nameLen = *(input.data() + size);

    size += 1;



    if (input.size() < size + nameLen) {

        return 0;

    }

    std::string name(reinterpret_cast<const char*>(input.data()) + size, nameLen);

    outMetadataType->name = name;

    return size + nameLen;

}



        FUZZ_LOG() << "Instruction: " << (i / 2) + 1 << "/" << instructions.size() / 2

                   << " cmd: " << static_cast<size_t>(a) << " (" << static_cast<size_t>(decodeIdx)

                   << ") arg: " << static_cast<size_t>(b) << " size: " << vec.size();

void doFuzzVendorHelper(

        const std::vector<GrallocTypesVendorHelperDecode>& decodes, uint8_t instruction,

        const std::vector<uint8_t>& input) {



    MetadataType metadataType;

    size_t sizeUsed  = fillInMetadataType(input, &metadataType);

    if (sizeUsed <= 0) {

        return;

    }



    ::android::hardware::hidl_vec<uint8_t> vec;

    vec.setToExternal(const_cast<uint8_t*>(input.data() + sizeUsed), input.size() - sizeUsed,

                      false /*shouldOwn*/);



    // since we are only using a byte to index

    CHECK(decodes.size() <= 255) << decodes.size();

    uint8_t decodeIdx = instruction % decodes.size();



    FUZZ_LOG() << "Vendor Helper instruction: " << instruction << " idx: "

               << static_cast<size_t>(decodeIdx) << " size: " << vec.size();



    decodes[decodeIdx](metadataType, vec);

}



        decodes[decodeIdx](vec, b);

void fuzz(uint8_t options, uint8_t instruction, const std::vector<uint8_t>& input) {

    uint8_t option = options & 0x1;



    switch (option) {

        case 0x0:

            doFuzz(GRALLOCTYPES_DECODE_FUNCTIONS, instruction, input);

            break;

        case 0x1:

            doFuzzVendorHelper(GRALLOCTYPES_DECODE_VENDOR_HELPER_FUNCTIONS, instruction, input);

            break;

        default:

            LOG_ALWAYS_FATAL("unknown gralloc types %d", static_cast<int>(option));

    }

}



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    if (size <= 1) return 0;  // no use



    // data to fill out parcel

    size_t inputLen = size / 2;

    std::vector<uint8_t> input(data, data + inputLen);

    data += inputLen;

    size -= inputLen;

    uint8_t options = *data;

    data++;

    size--;



    // data to use to determine what to do

    size_t instructionLen = size;

    std::vector<uint8_t> instructions(data, data + instructionLen);

    data += instructionLen;

    size -= instructionLen;

    uint8_t instruction = *data;

    data++;

    size--;



    CHECK(size == 0) << "size: " << size;

    std::vector<uint8_t> input(data, data + size);



    FUZZ_LOG() << "inputLen: " << inputLen << " instructionLen: " << instructionLen;

    FUZZ_LOG() << "input: " << hexString(input);

    FUZZ_LOG() << "instructions: " << hexString(instructions);



    doFuzz(GRALLOCTYPES_DECODE_FUNCTIONS, input, instructions);

    fuzz(options, instruction, input);

    return 0;

}

libs/gralloc/types/include/gralloctypes/Gralloc4.h

+52 −0
Original line number Diff line number Diff line
@@ -488,6 +488,58 @@ status_t encodeSmpte2094_40(const std::optional<std::vector<uint8_t>>& smpte2094 
status_t decodeSmpte2094_40(const android::hardware::hidl_vec<uint8_t>& smpte2094_40,

                            std::optional<std::vector<uint8_t>>* outSmpte2094_40);



/**

 * The functions below can be used to encode and decode vendor metadata types.

 */

status_t encodeUint32(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        uint32_t input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeUint32(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, uint32_t* output);



status_t encodeInt32(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        int32_t input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeInt32(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, int32_t* output);



status_t encodeUint64(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        uint64_t input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeUint64(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, uint64_t* output);



status_t encodeInt64(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        int64_t input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeInt64(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, int64_t* output);



status_t encodeFloat(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        float input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeFloat(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, float* output);



status_t encodeDouble(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        double input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeDouble(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, double* output);



status_t encodeString(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const std::string& input, android::hardware::hidl_vec<uint8_t>* output);

status_t decodeString(

        const android::hardware::graphics::mapper::V4_0::IMapper::MetadataType& metadataType,

        const android::hardware::hidl_vec<uint8_t>& input, std::string* output);



/**

 * The functions below can be used to parse extendable types.

 */