Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 656e0ada authored by Harry Cutts's avatar Harry Cutts
Browse files

inputflinger fuzzers: add function for creating RawEvents 

The exact same logic was being repeated in five different places, so
let's make a helper function for it.

Bug: 264582512
Test: build and run inputflinger_multitouch_input_fuzzer
Change-Id: I870c762fd849dcde338be00918da766911e56c04
parent f0049a04

services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp

+2 −12
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#include <CursorInputMapper.h>

#include <FuzzContainer.h>

#include <MapperHelpers.h>



namespace android {
@@ -65,22 +66,11 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
                    mapper.populateDeviceInfo(info);

                },

                [&]() -> void {

                    int32_t type, code;

                    type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)

                                              : fdp->ConsumeIntegral<int32_t>();

                    code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)

                                              : fdp->ConsumeIntegral<int32_t>();



                    // Need to reconfigure with 0 or you risk a NPE.

                    std::list<NotifyArgs> unused =

                            mapper.reconfigure(fdp->ConsumeIntegral<nsecs_t>(), policyConfig,

                                               InputReaderConfiguration::Change(0));

                    RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<int32_t>(),

                                      type,

                                      code,

                                      fdp->ConsumeIntegral<int32_t>()};

                    RawEvent rawEvent = getFuzzedRawEvent(*fdp);

                    unused += mapper.process(&rawEvent);

                },

                [&]() -> void {

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

+2 −11
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#include <FuzzContainer.h>

#include <KeyboardInputMapper.h>

#include <MapperHelpers.h>



namespace android {
@@ -72,17 +73,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
                    std::list<NotifyArgs> unused = mapper.reset(fdp->ConsumeIntegral<nsecs_t>());

                },

                [&]() -> void {

                    int32_t type, code;

                    type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)

                                              : fdp->ConsumeIntegral<int32_t>();

                    code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)

                                              : fdp->ConsumeIntegral<int32_t>();

                    RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<int32_t>(),

                                      type,

                                      code,

                                      fdp->ConsumeIntegral<int32_t>()};

                    RawEvent rawEvent = getFuzzedRawEvent(*fdp);

                    std::list<NotifyArgs> unused = mapper.process(&rawEvent);

                },

                [&]() -> void {

services/inputflinger/tests/fuzzers/MapperHelpers.h

+17 −12
Original line number Diff line number Diff line
@@ -74,6 +74,22 @@ ToolType getFuzzedToolType(Fdp& fdp) { 
    return static_cast<ToolType>(toolType);

}



template <class Fdp>

RawEvent getFuzzedRawEvent(Fdp& fdp) {

    const int32_t type = fdp.ConsumeBool() ? fdp.PickValueInArray(kValidTypes)

                                           : fdp.template ConsumeIntegral<int32_t>();

    const int32_t code = fdp.ConsumeBool() ? fdp.PickValueInArray(kValidCodes)

                                           : fdp.template ConsumeIntegral<int32_t>();

    return RawEvent{

            .when = fdp.template ConsumeIntegral<nsecs_t>(),

            .readTime = fdp.template ConsumeIntegral<nsecs_t>(),

            .deviceId = fdp.template ConsumeIntegral<int32_t>(),

            .type = type,

            .code = code,

            .value = fdp.template ConsumeIntegral<int32_t>(),

    };

}



class FuzzEventHub : public EventHubInterface {

    InputDeviceIdentifier mIdentifier;

    std::vector<TouchVideoFrame> mVideoFrames;
@@ -118,18 +134,7 @@ public: 
        std::vector<RawEvent> events;

        const size_t count = mFdp->ConsumeIntegralInRange<size_t>(0, kMaxSize);

        for (size_t i = 0; i < count; ++i) {

            int32_t type = mFdp->ConsumeBool() ? mFdp->PickValueInArray(kValidTypes)

                                               : mFdp->ConsumeIntegral<int32_t>();

            int32_t code = mFdp->ConsumeBool() ? mFdp->PickValueInArray(kValidCodes)

                                               : mFdp->ConsumeIntegral<int32_t>();

            events.push_back({

                    .when = mFdp->ConsumeIntegral<nsecs_t>(),

                    .readTime = mFdp->ConsumeIntegral<nsecs_t>(),

                    .deviceId = mFdp->ConsumeIntegral<int32_t>(),

                    .type = type,

                    .code = code,

                    .value = mFdp->ConsumeIntegral<int32_t>(),

            });

            events.push_back(getFuzzedRawEvent(*mFdp));

        }

        return events;

    }

services/inputflinger/tests/fuzzers/MultiTouchInputFuzzer.cpp

+2 −10
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */



#include <FuzzContainer.h>

#include <MapperHelpers.h>

#include <MultiTouchInputMapper.h>



namespace android {
@@ -87,16 +88,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
                    std::list<NotifyArgs> unused = mapper.reset(fdp->ConsumeIntegral<nsecs_t>());

                },

                [&]() -> void {

                    int32_t type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)

                                                      : fdp->ConsumeIntegral<int32_t>();

                    int32_t code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)

                                                      : fdp->ConsumeIntegral<int32_t>();

                    RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<int32_t>(),

                                      type,

                                      code,

                                      fdp->ConsumeIntegral<int32_t>()};

                    RawEvent rawEvent = getFuzzedRawEvent(*fdp);

                    std::list<NotifyArgs> unused = mapper.process(&rawEvent);

                },

                [&]() -> void {

services/inputflinger/tests/fuzzers/SwitchInputFuzzer.cpp

+2 −10
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
 */



#include <FuzzContainer.h>

#include <MapperHelpers.h>

#include <SwitchInputMapper.h>



namespace android {
@@ -36,16 +37,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { 
                },

                [&]() -> void { mapper.getSources(); },

                [&]() -> void {

                    int32_t type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)

                                                      : fdp->ConsumeIntegral<int32_t>();

                    int32_t code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)

                                                      : fdp->ConsumeIntegral<int32_t>();

                    RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<int32_t>(),

                                      type,

                                      code,

                                      fdp->ConsumeIntegral<int32_t>()};

                    RawEvent rawEvent = getFuzzedRawEvent(*fdp);

                    std::list<NotifyArgs> unused = mapper.process(&rawEvent);

                },

                [&]() -> void {