Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ddfaac0f authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "libbinder fuzzer driver: uid corpus continuity" am: 4afa2c39 am: 91b3126c am: cbd84325 

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2607731



Change-Id: Idb47990b4d5397f37cc1ab9621a9d35b9dbe5fde
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 08540a4f cbd84325

libs/binder/tests/parcel_fuzzer/libbinder_driver.cpp

+5 −1
Original line number Original line Diff line number Diff line
@@ -33,9 +33,13 @@ void fuzzService(const std::vector<sp<IBinder>>& binders, FuzzedDataProvider&& p 
            .extraFds = {},

            .extraFds = {},

    };

    };





    // Always take so that a perturbation of just the one ConsumeBool byte will always

    // take the same path, but with a different UID. Without this, the fuzzer needs to

    // guess both the change in value and the shift at the same time.

    int64_t maybeSetUid = provider.ConsumeIntegral<int64_t>();

    if (provider.ConsumeBool()) {

    if (provider.ConsumeBool()) {

        // set calling uid

        // set calling uid

        IPCThreadState::self()->restoreCallingIdentity(provider.ConsumeIntegral<int64_t>());

        IPCThreadState::self()->restoreCallingIdentity(maybeSetUid);

    }

    }





    while (provider.remaining_bytes() > 0) {

    while (provider.remaining_bytes() > 0) {