Add an AIDL fuzzer for health service (34b47964) · Commits · e / os / android_hardware_interfaces

health/aidl/default/Android.bp

+67 −0

Original line number	Diff line number	Diff line
		@@ -159,3 +159,70 @@ cc_binary {
		init_rc: ["android.hardware.health-service.example_recovery.rc"],
		overrides: ["charger.recovery"],
		}

		// AIDL Fuzz version of libhealth2impl.
		cc_library_static {
		name: "fuzz_libhealth_aidl_impl",
		defaults: [
		"libhealth_aidl_common_defaults",
		"libhealth_aidl_charger_defaults",
		],
		recovery_available: true,
		export_include_dirs: ["include"],
		export_static_lib_headers: [
		"libbatterymonitor",
		],
		srcs: [
		"ChargerUtils.cpp",
		"health-convert.cpp",
		"HalHealthLoop.cpp",
		"Health.cpp",
		"LinkedCallback.cpp",
		],
		target: {
		recovery: {
		exclude_srcs: [
		"ChargerUtils.cpp",
		],
		},
		},
		}

		cc_fuzz {
		name: "android.hardware.health-service.aidl_fuzzer",
		defaults: [
		"libhealth_aidl_impl_user",
		],
		static_libs: [
		"android.hardware.health-V1-ndk",
		"libbase",
		"libbinder_random_parcel",
		"libcutils",
		"liblog",
		"libutils",
		"fuzz_libhealth_aidl_impl",
		],
		target: {
		android: {
		shared_libs: [
		"libbinder_ndk",
		"libbinder",
		],
		},
		host: {
		static_libs: [
		"libbinder_ndk",
		"libbinder",
		],
		},
		darwin: {
		enabled: false,
		},
		},
		srcs: ["fuzzer.cpp"],
		fuzz_config: {
		cc: [
		"hamzeh@google.com",
		],
		},
		}

0 → 100644

+36 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/
		#include <fuzzbinder/libbinder_ndk_driver.h>
		#include <fuzzer/FuzzedDataProvider.h>

		#include <android-base/logging.h>
		#include <android/binder_interface_utils.h>
		#include <health-impl/Health.h>
		#include <health/utils.h>

		using aidl::android::hardware::health::Health;
		using android::fuzzService;
		using ndk::SharedRefBase;

		extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
		auto config = std::make_unique<healthd_config>();
		::android::hardware::health::InitHealthdConfig(config.get());
		auto binder = ndk::SharedRefBase::make<Health>("default", std::move(config));

		fuzzService(binder->asBinder().get(), FuzzedDataProvider(data, size));

		return 0;
		}
		No newline at end of file