Merge "inputflinger_input_reader_fuzzer: Bug Fix" (690a8ae4) · Commits · e / os / platform_frameworks_native

services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp

+3 −3

Original line number	Diff line number	Diff line
		@@ -16,11 +16,10 @@

		#include <CursorInputMapper.h>
		#include <FuzzContainer.h>
		#include <fuzzer/FuzzedDataProvider.h>

		namespace android {

		static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {
		static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) {
		// Pick a random property to set for the mapper to have set.
		fdp->PickValueInArray<std::function<void()>>(
		{[&]() -> void { fuzzer.addProperty("cursor.mode", "pointer"); },
		@@ -35,7 +34,8 @@ static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvide
		}

		extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
		std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);
		std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =
		std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);
		FuzzContainer fuzzer(fdp);

		CursorInputMapper& mapper = fuzzer.getMapper<CursorInputMapper>();

services/inputflinger/tests/fuzzers/FuzzContainer.h

+2 −3

Original line number	Diff line number	Diff line
		@@ -20,7 +20,6 @@
		#include <InputMapper.h>
		#include <InputReader.h>
		#include <MapperHelpers.h>
		#include <fuzzer/FuzzedDataProvider.h>

		namespace android {

		@@ -31,10 +30,10 @@ class FuzzContainer {
		std::unique_ptr<FuzzInputReaderContext> mFuzzContext;
		std::unique_ptr<InputDevice> mFuzzDevice;
		InputReaderConfiguration mPolicyConfig;
		std::shared_ptr<FuzzedDataProvider> mFdp;
		std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;

		public:
		FuzzContainer(std::shared_ptr<FuzzedDataProvider> fdp) : mFdp(fdp) {
		FuzzContainer(std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) : mFdp(fdp) {
		// Setup parameters.
		std::string deviceName = mFdp->ConsumeRandomLengthString(16);
		std::string deviceLocation = mFdp->ConsumeRandomLengthString(12);

services/inputflinger/tests/fuzzers/InputReaderFuzzer.cpp

+2 −1

Original line number	Diff line number	Diff line
		@@ -170,7 +170,8 @@ private:
		};

		extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
		std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);
		std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =
		std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

		FuzzInputListener fuzzListener;
		sp<FuzzInputReaderPolicy> fuzzPolicy = sp<FuzzInputReaderPolicy>::make(fdp);

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

+3 −3

Original line number	Diff line number	Diff line
		@@ -16,13 +16,12 @@

		#include <FuzzContainer.h>
		#include <KeyboardInputMapper.h>
		#include <fuzzer/FuzzedDataProvider.h>

		namespace android {

		const int32_t kMaxKeycodes = 100;

		static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {
		static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) {
		// Pick a random property to set for the mapper to have set.
		fdp->PickValueInArray<std::function<void()>>(
		{[&]() -> void { fuzzer.addProperty("keyboard.orientationAware", "1"); },
		@@ -41,7 +40,8 @@ static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvide
		}

		extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
		std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);
		std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =
		std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);
		FuzzContainer fuzzer(fdp);

		KeyboardInputMapper& mapper =

services/inputflinger/tests/fuzzers/MapperHelpers.h

+9 −10

Original line number	Diff line number	Diff line
		@@ -13,13 +13,12 @@
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#pragma once

		#include <InputDevice.h>
		#include <InputMapper.h>
		#include <InputReader.h>
		#include <fuzzer/FuzzedDataProvider.h>
		#include <ThreadSafeFuzzedDataProvider.h>
		#include "android/hardware/input/InputDeviceCountryCode.h"

		using android::hardware::input::InputDeviceCountryCode;
		@@ -114,10 +113,10 @@ class FuzzEventHub : public EventHubInterface {
		InputDeviceIdentifier mIdentifier;
		std::vector<TouchVideoFrame> mVideoFrames;
		PropertyMap mFuzzConfig;
		std::shared_ptr<FuzzedDataProvider> mFdp;
		std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;

		public:
		FuzzEventHub(std::shared_ptr<FuzzedDataProvider> fdp) : mFdp(std::move(fdp)) {}
		FuzzEventHub(std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) : mFdp(std::move(fdp)) {}
		~FuzzEventHub() {}
		void addProperty(std::string key, std::string value) { mFuzzConfig.addProperty(key, value); }

		@@ -264,10 +263,10 @@ public:
		};

		class FuzzPointerController : public PointerControllerInterface {
		std::shared_ptr<FuzzedDataProvider> mFdp;
		std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;

		public:
		FuzzPointerController(std::shared_ptr<FuzzedDataProvider> mFdp) : mFdp(mFdp) {}
		FuzzPointerController(std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp) : mFdp(mFdp) {}
		~FuzzPointerController() {}
		bool getBounds(float* outMinX, float* outMinY, float* outMaxX, float* outMaxY) const override {
		return mFdp->ConsumeBool();
		@@ -290,13 +289,13 @@ public:
		class FuzzInputReaderPolicy : public InputReaderPolicyInterface {
		TouchAffineTransformation mTransform;
		std::shared_ptr<FuzzPointerController> mPointerController;
		std::shared_ptr<FuzzedDataProvider> mFdp;
		std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;

		protected:
		~FuzzInputReaderPolicy() {}

		public:
		FuzzInputReaderPolicy(std::shared_ptr<FuzzedDataProvider> mFdp) : mFdp(mFdp) {
		FuzzInputReaderPolicy(std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp) : mFdp(mFdp) {
		mPointerController = std::make_shared<FuzzPointerController>(mFdp);
		}
		void getReaderConfiguration(InputReaderConfiguration* outConfig) override {}
		@@ -334,13 +333,13 @@ public:
		class FuzzInputReaderContext : public InputReaderContext {
		std::shared_ptr<EventHubInterface> mEventHub;
		sp<InputReaderPolicyInterface> mPolicy;
		std::shared_ptr<FuzzedDataProvider> mFdp;
		std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;

		public:
		FuzzInputReaderContext(std::shared_ptr<EventHubInterface> eventHub,
		const sp<InputReaderPolicyInterface>& policy,
		InputListenerInterface& listener,
		std::shared_ptr<FuzzedDataProvider> mFdp)
		std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp)
		: mEventHub(eventHub), mPolicy(policy), mFdp(mFdp) {}
		~FuzzInputReaderContext() {}
		void updateGlobalMetaState() override {}