Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1dd5f38d authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Adding AIDL fuzzer for SurfaceFlinger

Test: m surfaceflinger_service_fuzzer && adb sync data && adb shell /data/fuzz/arm64/surfaceflinger_service_fuzzer/surfaceflinger_service_fuzzer
Bug: 232439428
Change-Id: I89f3086123114a7e6f48705923d4d7ccf2ffe19b
parent f79fd7c1
Loading
Loading
Loading
Loading
+15 −0
Original line number Diff line number Diff line
@@ -138,3 +138,18 @@ cc_fuzz {
        "surfaceflinger_frametracer_fuzzer.cpp",
    ],
}

cc_fuzz {
    name: "surfaceflinger_service_fuzzer",
    defaults: [
        "surfaceflinger_fuzz_defaults",
        "service_fuzzer_defaults",
        "fuzzer_disable_leaks",
    ],
    srcs: [
        "surfaceflinger_service_fuzzer.cpp",
    ],
    fuzz_config: {
        triage_assignee: "waghpawan@google.com",
    },
}
+32 −0
Original line number Diff line number Diff line
/*
 * Copyright (C) 2023 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <fuzzbinder/libbinder_driver.h>

#include "SurfaceFlinger.h"
#include "SurfaceFlingerDefaultFactory.h"

using namespace android;

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    DefaultFactory factory;
    sp<SurfaceFlinger> flinger = sp<SurfaceFlinger>::make(factory);
    flinger->init();

    sp<SurfaceComposerAIDL> composerAIDL = sp<SurfaceComposerAIDL>::make(flinger);
    fuzzService({flinger, composerAIDL}, FuzzedDataProvider(data, size));
    return 0;
}