Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2fabebd8 authored by Michael Ensing's avatar Michael Ensing
Browse files

Fix CHECK failure in libosi-allocation-tracker fuzzer 



If the allocatior had not been initialized prior to a call to
allocation_tracker_notify_alloc, the function would immediately
return the provided pointer, but not track it (as the tracker is not
initialized). On fuzzer loop teardown, allocation_tracker_notify_free
is called, cannot find the pointer/id pair in its map, and asserts.

Test: Ran compiled fuzzer with crashfile before and after change to
      verify crash had been fixed
      (`./libosi_fuzz_allocation_tracker ./corpus/ -runs=0`)
Signed-off-by: default avatarMichael Ensing <michael.ensing@leviathansecurity.com>
Change-Id: I42e2759aa6efb9b6733509e298a552600e874f82
parent 987c8df3

system/osi/test/fuzzers/allocation_tracker/Android.bp

+3 −0
Original line number Diff line number Diff line
@@ -11,4 +11,7 @@ cc_fuzz { 
    static_libs: [

        "libosi",

    ],

    corpus: [

        "corpus/checkfail-regression-156805580",

    ],

}

system/osi/test/fuzzers/allocation_tracker/corpus/checkfail-regression-156805580

0 → 100644
+1 −0
Original line number Diff line number Diff line 
ǿ￿렊

system/osi/test/fuzzers/allocation_tracker/fuzz_allocation_tracker.cc

+11 −1
Original line number Diff line number Diff line
@@ -20,6 +20,13 @@ 
#define MAX_NUM_FUNCTIONS 512

#define MAX_BUF_SIZE 256



// Add a tracker_initialized bool to track if we initialized or not

// (This is to handle a call to allocation_tracker_notify_alloc immediately

// returning the provided pointer if the allocator is not ready, and

// notify_free on the same ptr failing as the allocator did not

// track that allocation)

bool tracker_initialized = false;



struct alloc_struct {

  allocator_id_t alloc_id;

  void* ptr;
@@ -47,6 +54,7 @@ void callArbitraryFunction(std::vector<alloc_struct>* alloc_vector, 
    // Init

    case 1:

      allocation_tracker_init();

      tracker_initialized = true;

      return;

    case 2:

      // NOTE: This will print to stderr if allocations exist. May clutter logs
@@ -70,8 +78,10 @@ void callArbitraryFunction(std::vector<alloc_struct>* alloc_vector, 
      alloc.ptr =

          allocation_tracker_notify_alloc(alloc.alloc_id, tmp_ptr, size);

      // Put our id/ptr pair in our tracking vector to be freed later

      if (alloc.ptr) {

      if (tracker_initialized && alloc.ptr) {

        alloc_vector->push_back(alloc);

      } else {

        free(tmp_ptr);

      }

    }

      return;