Merge "Add initial batch of inputFlinger fuzzers" (868e1c0b) · Commits · e / os / platform_frameworks_native

libs/input/PropertyMap.cpp

+1 −1

Original line number	Diff line number	Diff line
		@@ -75,7 +75,7 @@ bool PropertyMap::tryGetProperty(const std::string& key, int32_t& outValue) cons
		}

		char* end;
		int value = strtol(stringValue.c_str(), &end, 10);
		int32_t value = static_cast<int32_t>(strtol(stringValue.c_str(), &end, 10));
		if (*end != '\0') {
		ALOGW("Property key '%s' has invalid value '%s'. Expected an integer.", key.c_str(),
		stringValue.c_str());

services/inputflinger/tests/fuzzers/Android.bp

+71 −0

Original line number	Diff line number	Diff line
		@@ -46,3 +46,74 @@ cc_fuzz {
		cc: ["android-framework-input@google.com"],
		},
		}

		cc_defaults {
		name: "inputflinger_fuzz_defaults",
		defaults: [
		"inputflinger_defaults",
		],
		include_dirs: [
		"frameworks/native/services/inputflinger",
		],
		shared_libs: [
		"android.hardware.input.classifier@1.0",
		"libbase",
		"libbinder",
		"libcutils",
		"liblog",
		"libutils",
		"libui",
		"libinput",
		"libinputflinger",
		"libinputreader",
		"libinputflinger_base",
		"libstatslog",
		],
		header_libs: [
		"libbatteryservice_headers",
		"libinputreader_headers",
		],
		fuzz_config: {
		cc: ["android-framework-input@google.com"],
		},
		}

		cc_fuzz {
		name: "inputflinger_cursor_input_fuzzer",
		defaults: [
		"inputflinger_fuzz_defaults",
		],
		srcs: [
		"CursorInputFuzzer.cpp",
		],
		}

		cc_fuzz {
		name: "inputflinger_keyboard_input_fuzzer",
		defaults: [
		"inputflinger_fuzz_defaults",
		],
		srcs: [
		"KeyboardInputFuzzer.cpp",
		],
		}

		cc_fuzz {
		name: "inputflinger_multitouch_input_fuzzer",
		defaults: [
		"inputflinger_fuzz_defaults",
		],
		srcs: [
		"MultiTouchInputFuzzer.cpp",
		],
		}

		cc_fuzz {
		name: "inputflinger_switch_input_fuzzer",
		defaults: [
		"inputflinger_fuzz_defaults",
		],
		srcs: [
		"SwitchInputFuzzer.cpp",
		],
		}

services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp

0 → 100644

+96 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <CursorInputMapper.h>
		#include <FuzzContainer.h>
		#include <fuzzer/FuzzedDataProvider.h>

		namespace android {

		static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {
		// Pick a random property to set for the mapper to have set.
		fdp->PickValueInArray<std::function<void()>>(
		{[&]() -> void { fuzzer.addProperty("cursor.mode", "pointer"); },
		[&]() -> void { fuzzer.addProperty("cursor.mode", "navigation"); },
		[&]() -> void {
		fuzzer.addProperty("cursor.mode", fdp->ConsumeRandomLengthString(100).data());
		},
		[&]() -> void {
		fuzzer.addProperty("cursor.orientationAware",
		fdp->ConsumeRandomLengthString(100).data());
		}})();
		}

		extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
		std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);
		FuzzContainer fuzzer(fdp);

		CursorInputMapper& mapper = fuzzer.getMapper<CursorInputMapper>();
		auto policyConfig = fuzzer.getPolicyConfig();

		// Loop through mapper operations until randomness is exhausted.
		while (fdp->remaining_bytes() > 0) {
		fdp->PickValueInArray<std::function<void()>>({
		[&]() -> void { addProperty(fuzzer, fdp); },
		[&]() -> void {
		std::string dump;
		mapper.dump(dump);
		},
		[&]() -> void { mapper.getSources(); },
		[&]() -> void {
		mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig,
		fdp->ConsumeIntegral<int32_t>());
		},
		[&]() -> void {
		// Need to reconfigure with 0 or you risk a NPE.
		mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig, 0);
		InputDeviceInfo info;
		mapper.populateDeviceInfo(&info);
		},
		[&]() -> void {
		int32_t type, code;
		type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)
		: fdp->ConsumeIntegral<int32_t>();
		code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)
		: fdp->ConsumeIntegral<int32_t>();

		// Need to reconfigure with 0 or you risk a NPE.
		mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig, 0);
		RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),
		fdp->ConsumeIntegral<nsecs_t>(),
		fdp->ConsumeIntegral<int32_t>(),
		type,
		code,
		fdp->ConsumeIntegral<int32_t>()};
		mapper.process(&rawEvent);
		},
		[&]() -> void { mapper.reset(fdp->ConsumeIntegral<nsecs_t>()); },
		[&]() -> void {
		mapper.getScanCodeState(fdp->ConsumeIntegral<uint32_t>(),
		fdp->ConsumeIntegral<int32_t>());
		},
		[&]() -> void {
		// Need to reconfigure with 0 or you risk a NPE.
		mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig, 0);
		mapper.getAssociatedDisplayId();
		},
		})();
		}

		return 0;
		}

		} // namespace android

services/inputflinger/tests/fuzzers/FuzzContainer.h

0 → 100644

+82 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#pragma once

		#include <InputDevice.h>
		#include <InputMapper.h>
		#include <InputReader.h>
		#include <MapperHelpers.h>
		#include <fuzzer/FuzzedDataProvider.h>

		namespace android {

		class FuzzContainer {
		std::shared_ptr<FuzzEventHub> mFuzzEventHub;
		sp<FuzzInputReaderPolicy> mFuzzPolicy;
		std::unique_ptr<FuzzInputListener> mFuzzListener;
		std::unique_ptr<FuzzInputReaderContext> mFuzzContext;
		std::unique_ptr<InputDevice> mFuzzDevice;
		InputReaderConfiguration mPolicyConfig;
		std::shared_ptr<FuzzedDataProvider> mFdp;

		public:
		FuzzContainer(std::shared_ptr<FuzzedDataProvider> fdp) : mFdp(fdp) {
		// Setup parameters.
		std::string deviceName = mFdp->ConsumeRandomLengthString(16);
		std::string deviceLocation = mFdp->ConsumeRandomLengthString(12);
		int32_t deviceID = mFdp->ConsumeIntegralInRange<int32_t>(0, 5);
		int32_t deviceGeneration = mFdp->ConsumeIntegralInRange<int32_t>(/from/ 0, /to/ 5);

		// Create mocked objects.
		mFuzzEventHub = std::make_shared<FuzzEventHub>(mFdp);
		mFuzzPolicy = sp<FuzzInputReaderPolicy>::make(mFdp);
		mFuzzListener = std::make_unique<FuzzInputListener>();
		mFuzzContext = std::make_unique<FuzzInputReaderContext>(mFuzzEventHub, mFuzzPolicy,
		*mFuzzListener, mFdp);

		InputDeviceIdentifier identifier;
		identifier.name = deviceName;
		identifier.location = deviceLocation;
		mFuzzDevice = std::make_unique<InputDevice>(mFuzzContext.get(), deviceID, deviceGeneration,
		identifier);
		mFuzzPolicy->getReaderConfiguration(&mPolicyConfig);
		}

		~FuzzContainer() {}

		void configureDevice() {
		nsecs_t arbitraryTime = mFdp->ConsumeIntegral<nsecs_t>();
		mFuzzDevice->configure(arbitraryTime, &mPolicyConfig, 0);
		mFuzzDevice->reset(arbitraryTime);
		}

		void addProperty(std::string key, std::string value) {
		mFuzzEventHub->addProperty(key, value);
		configureDevice();
		}

		InputReaderConfiguration& getPolicyConfig() { return mPolicyConfig; }

		template <class T, typename... Args>
		T& getMapper(Args... args) {
		T& mapper = mFuzzDevice->addMapper<T>(mFdp->ConsumeIntegral<int32_t>(), args...);
		configureDevice();
		return mapper;
		}
		};

		} // namespace android

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

0 → 100644

+110 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2022 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <FuzzContainer.h>
		#include <KeyboardInputMapper.h>
		#include <fuzzer/FuzzedDataProvider.h>

		namespace android {

		const int32_t kMaxKeycodes = 100;

		static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {
		// Pick a random property to set for the mapper to have set.
		fdp->PickValueInArray<std::function<void()>>(
		{[&]() -> void { fuzzer.addProperty("keyboard.orientationAware", "1"); },
		[&]() -> void {
		fuzzer.addProperty("keyboard.orientationAware",
		fdp->ConsumeRandomLengthString(100).data());
		},
		[&]() -> void {
		fuzzer.addProperty("keyboard.doNotWakeByDefault",
		fdp->ConsumeRandomLengthString(100).data());
		},
		[&]() -> void {
		fuzzer.addProperty("keyboard.handlesKeyRepeat",
		fdp->ConsumeRandomLengthString(100).data());
		}})();
		}

		extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
		std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);
		FuzzContainer fuzzer(fdp);

		KeyboardInputMapper& mapper =
		fuzzer.getMapper<KeyboardInputMapper>(fdp->ConsumeIntegral<uint32_t>(),
		fdp->ConsumeIntegral<int32_t>());
		auto policyConfig = fuzzer.getPolicyConfig();

		// Loop through mapper operations until randomness is exhausted.
		while (fdp->remaining_bytes() > 0) {
		fdp->PickValueInArray<std::function<void()>>({
		[&]() -> void { addProperty(fuzzer, fdp); },
		[&]() -> void {
		std::string dump;
		mapper.dump(dump);
		},
		[&]() -> void {
		InputDeviceInfo info;
		mapper.populateDeviceInfo(&info);
		},
		[&]() -> void { mapper.getSources(); },
		[&]() -> void {
		mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig,
		fdp->ConsumeIntegral<uint32_t>());
		},
		[&]() -> void { mapper.reset(fdp->ConsumeIntegral<nsecs_t>()); },
		[&]() -> void {
		int32_t type, code;
		type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)
		: fdp->ConsumeIntegral<int32_t>();
		code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)
		: fdp->ConsumeIntegral<int32_t>();
		RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),
		fdp->ConsumeIntegral<nsecs_t>(),
		fdp->ConsumeIntegral<int32_t>(),
		type,
		code,
		fdp->ConsumeIntegral<int32_t>()};
		mapper.process(&rawEvent);
		},
		[&]() -> void {
		mapper.getKeyCodeState(fdp->ConsumeIntegral<uint32_t>(),
		fdp->ConsumeIntegral<int32_t>());
		},
		[&]() -> void {
		mapper.getScanCodeState(fdp->ConsumeIntegral<uint32_t>(),
		fdp->ConsumeIntegral<int32_t>());
		},
		[&]() -> void {
		std::vector<int32_t> keyCodes;
		int32_t numBytes = fdp->ConsumeIntegralInRange<int32_t>(0, kMaxKeycodes);
		for (int32_t i = 0; i < numBytes; ++i) {
		keyCodes.push_back(fdp->ConsumeIntegral<int32_t>());
		}
		mapper.markSupportedKeyCodes(fdp->ConsumeIntegral<uint32_t>(), keyCodes,
		nullptr);
		},
		[&]() -> void { mapper.getMetaState(); },
		[&]() -> void { mapper.updateMetaState(fdp->ConsumeIntegral<int32_t>()); },
		[&]() -> void { mapper.getAssociatedDisplayId(); },
		})();
		}

		return 0;
		}

		} // namespace android