Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e36d8359 authored by Harry Cutts's avatar Harry Cutts
Browse files

inputflinger fuzzers: remove FuzzContainer.getPolicyConfig 

Because FuzzInputReaderPolicy::getReaderConfiguration does nothing, any
calls to getPolicyConfig can be replaced with default
InputReaderConfiguration structs. This makes it clearer where where a
fuzzer is getting its configuration from, and therefore makes it easier
to understand the fuzzer without having to dig into FuzzContainer and
FuzzInputReaderPolicy.

InputReaderPolicyInterface::getReaderConfiguration is not called by any
of the code being fuzzed, so it's unlikely that
FuzzInputReaderPolicy::getReaderConfiguration will need to be modified
to return a non-default InputReaderConfiguration in future.

Bug: 245989146
Test: build and briefly run all modified fuzzers
      $ SANITIZE_TARGET=hwaddress make ${FUZZER_NAME}
      $ cd $ANDROID_PRODUCT_OUT
      $ adb root
      $ adb sync data
      $ adb shell /data/fuzz/$(get_build_var TARGET_ARCH)/${FUZZER_NAME}/${FUZZER_NAME}
Change-Id: If933e1ce81439831b24c61dde1c2d24ed1a00942
parent ccb75e89

services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp

+2 −1
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#include <CursorInputMapper.h>

#include <FuzzContainer.h>

#include <InputReaderBase.h>

#include <MapperHelpers.h>



namespace android {
@@ -39,7 +40,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    auto policyConfig = fuzzer.getPolicyConfig();

    InputReaderConfiguration policyConfig;

    CursorInputMapper& mapper = fuzzer.getMapper<CursorInputMapper>(policyConfig);



    // Loop through mapper operations until randomness is exhausted.

services/inputflinger/tests/fuzzers/FuzzContainer.h

+3 −8
Original line number Diff line number Diff line
@@ -25,11 +25,9 @@ namespace android { 


class FuzzContainer {

    std::shared_ptr<FuzzEventHub> mFuzzEventHub;

    sp<FuzzInputReaderPolicy> mFuzzPolicy;

    FuzzInputListener mFuzzListener;

    std::unique_ptr<FuzzInputReaderContext> mFuzzContext;

    std::unique_ptr<InputDevice> mFuzzDevice;

    InputReaderConfiguration mPolicyConfig;

    std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;



public:
@@ -42,8 +40,8 @@ public: 


        // Create mocked objects.

        mFuzzEventHub = std::make_shared<FuzzEventHub>(mFdp);

        mFuzzPolicy = sp<FuzzInputReaderPolicy>::make(mFdp);

        mFuzzContext = std::make_unique<FuzzInputReaderContext>(mFuzzEventHub, mFuzzPolicy,

        sp<FuzzInputReaderPolicy> policy = sp<FuzzInputReaderPolicy>::make(mFdp);

        mFuzzContext = std::make_unique<FuzzInputReaderContext>(mFuzzEventHub, policy,

                                                                mFuzzListener, mFdp);



        InputDeviceIdentifier identifier;
@@ -51,7 +49,6 @@ public: 
        identifier.location = deviceLocation;

        mFuzzDevice = std::make_unique<InputDevice>(mFuzzContext.get(), deviceID, deviceGeneration,

                                                    identifier);

        mFuzzPolicy->getReaderConfiguration(&mPolicyConfig);

    }



    ~FuzzContainer() {}
@@ -59,7 +56,7 @@ public: 
    void configureDevice() {

        nsecs_t arbitraryTime = mFdp->ConsumeIntegral<nsecs_t>();

        std::list<NotifyArgs> out;

        out += mFuzzDevice->configure(arbitraryTime, mPolicyConfig, /*changes=*/{});

        out += mFuzzDevice->configure(arbitraryTime, /*readerConfig=*/{}, /*changes=*/{});

        out += mFuzzDevice->reset(arbitraryTime);

        for (const NotifyArgs& args : out) {

            mFuzzListener.notify(args);
@@ -71,8 +68,6 @@ public: 
        configureDevice();

    }



    InputReaderConfiguration& getPolicyConfig() { return mPolicyConfig; }



    void setAbsoluteAxisInfo(int axis, const RawAbsoluteAxisInfo& axisInfo) {

        mFuzzEventHub->setAbsoluteAxisInfo(mFuzzDevice->getId(), axis, axisInfo);

    }

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

+4 −3
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */



#include <FuzzContainer.h>

#include <InputReaderBase.h>

#include <KeyboardInputMapper.h>

#include <MapperHelpers.h>
@@ -45,9 +46,9 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    auto policyConfig = fuzzer.getPolicyConfig();

    KeyboardInputMapper& mapper =

            fuzzer.getMapper<KeyboardInputMapper>(policyConfig, fdp->ConsumeIntegral<uint32_t>(),

            fuzzer.getMapper<KeyboardInputMapper>(InputReaderConfiguration{},

                                                  fdp->ConsumeIntegral<uint32_t>(),

                                                  fdp->ConsumeIntegral<int32_t>());



    // Loop through mapper operations until randomness is exhausted.
@@ -65,7 +66,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
                [&]() -> void { mapper.getSources(); },

                [&]() -> void {

                    std::list<NotifyArgs> unused =

                            mapper.reconfigure(fdp->ConsumeIntegral<nsecs_t>(), policyConfig,

                            mapper.reconfigure(fdp->ConsumeIntegral<nsecs_t>(), /*readerConfig=*/{},

                                               InputReaderConfiguration::Change(

                                                       fdp->ConsumeIntegral<uint32_t>()));

                },

services/inputflinger/tests/fuzzers/MultiTouchInputFuzzer.cpp

+2 −1
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */



#include <FuzzContainer.h>

#include <InputReaderBase.h>

#include <MapperHelpers.h>

#include <MultiTouchInputMapper.h>
@@ -62,7 +63,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    auto policyConfig = fuzzer.getPolicyConfig();

    InputReaderConfiguration policyConfig;

    MultiTouchInputMapper& mapper = fuzzer.getMapper<MultiTouchInputMapper>(policyConfig);



    // Loop through mapper operations until randomness is exhausted.

services/inputflinger/tests/fuzzers/SwitchInputFuzzer.cpp

+2 −2
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */



#include <FuzzContainer.h>

#include <InputReaderBase.h>

#include <MapperHelpers.h>

#include <SwitchInputMapper.h>
@@ -25,8 +26,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    auto policyConfig = fuzzer.getPolicyConfig();

    SwitchInputMapper& mapper = fuzzer.getMapper<SwitchInputMapper>(policyConfig);

    SwitchInputMapper& mapper = fuzzer.getMapper<SwitchInputMapper>(InputReaderConfiguration{});



    // Loop through mapper operations until randomness is exhausted.

    while (fdp->remaining_bytes() > 0) {