Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8d9326f authored by Michael Ensing's avatar Michael Ensing Committed by Ayushi Khopkar
Browse files

Add initial batch of inputFlinger fuzzers 



This batch of fuzzers is focused on the input Mappers. These fuzzers are
not host_supported, and must be run on-device. Followup CLs containing
additional inputflinger fuzzers will rely on the FuzzContainer.h and
MapperHelpers.h header files.

Fuzzers included:
 - CursorInputFuzzer
 - KeyboardInputFuzzer
 - MultiTouchInputFuzzer
 - SwitchInputFuzzer

Test: Tested on a pixel 3a with HWASAN. Accurate % coverage information is
      not available due to the large number of shared libraries included
      in runs built with hwasan interfering with PC Count information
      (increasing the total PC count to ~682,000).

Summary of updates:

Coverage improvements: 75% to 82%

Design changes:
[1] Refactored
 - CursorInputFuzzer
 - KeyboardInputFuzzer
 - MultiTouchInputFuzzer
 - SwitchInputFuzzer
in order to generate event as a combination of valid and invalid input.

[2] Used FuzzedDataProvider to generate values for events.

Signed-off-by: default avatarMichael Ensing <michael.ensing@leviathansecurity.com>
Change-Id: Id39205c691f54c516f8a452293cb098382019335
parent 26d49f7f

libs/input/PropertyMap.cpp

+1 −1
Original line number Diff line number Diff line
@@ -75,7 +75,7 @@ bool PropertyMap::tryGetProperty(const std::string& key, int32_t& outValue) cons 
    }



    char* end;

    int value = strtol(stringValue.c_str(), &end, 10);

    int32_t value = static_cast<int32_t>(strtol(stringValue.c_str(), &end, 10));

    if (*end != '\0') {

        ALOGW("Property key '%s' has invalid value '%s'.  Expected an integer.", key.c_str(),

              stringValue.c_str());

services/inputflinger/tests/fuzzers/Android.bp

+71 −0
Original line number Diff line number Diff line
@@ -46,3 +46,74 @@ cc_fuzz { 
       cc: ["android-framework-input@google.com"],

    },

}



cc_defaults {

    name: "inputflinger_fuzz_defaults",

    defaults: [

        "inputflinger_defaults",

    ],

    include_dirs: [

        "frameworks/native/services/inputflinger",

    ],

    shared_libs: [

        "android.hardware.input.classifier@1.0",

        "libbase",

        "libbinder",

        "libcutils",

        "liblog",

        "libutils",

        "libui",

        "libinput",

        "libinputflinger",

        "libinputreader",

        "libinputflinger_base",

        "libstatslog",

    ],

    header_libs: [

        "libbatteryservice_headers",

        "libinputreader_headers",

    ],

    fuzz_config: {

       cc: ["android-framework-input@google.com"],

    },

}



cc_fuzz {

    name: "inputflinger_cursor_input_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "CursorInputFuzzer.cpp",

    ],

}



cc_fuzz {

    name: "inputflinger_keyboard_input_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "KeyboardInputFuzzer.cpp",

    ],

}



cc_fuzz {

    name: "inputflinger_multitouch_input_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "MultiTouchInputFuzzer.cpp",

    ],

}



cc_fuzz {

    name: "inputflinger_switch_input_fuzzer",

    defaults: [

        "inputflinger_fuzz_defaults",

    ],

    srcs: [

        "SwitchInputFuzzer.cpp",

    ],

}

services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp

0 → 100644
+96 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <CursorInputMapper.h>

#include <FuzzContainer.h>

#include <fuzzer/FuzzedDataProvider.h>



namespace android {



static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {

    // Pick a random property to set for the mapper to have set.

    fdp->PickValueInArray<std::function<void()>>(

            {[&]() -> void { fuzzer.addProperty("cursor.mode", "pointer"); },

             [&]() -> void { fuzzer.addProperty("cursor.mode", "navigation"); },

             [&]() -> void {

                 fuzzer.addProperty("cursor.mode", fdp->ConsumeRandomLengthString(100).data());

             },

             [&]() -> void {

                 fuzzer.addProperty("cursor.orientationAware",

                                    fdp->ConsumeRandomLengthString(100).data());

             }})();

}



extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {

    std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    CursorInputMapper& mapper = fuzzer.getMapper<CursorInputMapper>();

    auto policyConfig = fuzzer.getPolicyConfig();



    // Loop through mapper operations until randomness is exhausted.

    while (fdp->remaining_bytes() > 0) {

        fdp->PickValueInArray<std::function<void()>>({

                [&]() -> void { addProperty(fuzzer, fdp); },

                [&]() -> void {

                    std::string dump;

                    mapper.dump(dump);

                },

                [&]() -> void { mapper.getSources(); },

                [&]() -> void {

                    mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig,

                                     fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    // Need to reconfigure with 0 or you risk a NPE.

                    mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig, 0);

                    InputDeviceInfo info;

                    mapper.populateDeviceInfo(&info);

                },

                [&]() -> void {

                    int32_t type, code;

                    type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)

                                              : fdp->ConsumeIntegral<int32_t>();

                    code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)

                                              : fdp->ConsumeIntegral<int32_t>();



                    // Need to reconfigure with 0 or you risk a NPE.

                    mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig, 0);

                    RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<int32_t>(),

                                      type,

                                      code,

                                      fdp->ConsumeIntegral<int32_t>()};

                    mapper.process(&rawEvent);

                },

                [&]() -> void { mapper.reset(fdp->ConsumeIntegral<nsecs_t>()); },

                [&]() -> void {

                    mapper.getScanCodeState(fdp->ConsumeIntegral<uint32_t>(),

                                            fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    // Need to reconfigure with 0 or you risk a NPE.

                    mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig, 0);

                    mapper.getAssociatedDisplayId();

                },

        })();

    }



    return 0;

}



} // namespace android

services/inputflinger/tests/fuzzers/FuzzContainer.h

0 → 100644
+82 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#pragma once



#include <InputDevice.h>

#include <InputMapper.h>

#include <InputReader.h>

#include <MapperHelpers.h>

#include <fuzzer/FuzzedDataProvider.h>



namespace android {



class FuzzContainer {

    std::shared_ptr<FuzzEventHub> mFuzzEventHub;

    sp<FuzzInputReaderPolicy> mFuzzPolicy;

    std::unique_ptr<FuzzInputListener> mFuzzListener;

    std::unique_ptr<FuzzInputReaderContext> mFuzzContext;

    std::unique_ptr<InputDevice> mFuzzDevice;

    InputReaderConfiguration mPolicyConfig;

    std::shared_ptr<FuzzedDataProvider> mFdp;



public:

    FuzzContainer(std::shared_ptr<FuzzedDataProvider> fdp) : mFdp(fdp) {

        // Setup parameters.

        std::string deviceName = mFdp->ConsumeRandomLengthString(16);

        std::string deviceLocation = mFdp->ConsumeRandomLengthString(12);

        int32_t deviceID = mFdp->ConsumeIntegralInRange<int32_t>(0, 5);

        int32_t deviceGeneration = mFdp->ConsumeIntegralInRange<int32_t>(/*from*/ 0, /*to*/ 5);



        // Create mocked objects.

        mFuzzEventHub = std::make_shared<FuzzEventHub>(mFdp);

        mFuzzPolicy = sp<FuzzInputReaderPolicy>::make(mFdp);

        mFuzzListener = std::make_unique<FuzzInputListener>();

        mFuzzContext = std::make_unique<FuzzInputReaderContext>(mFuzzEventHub, mFuzzPolicy,

                                                                *mFuzzListener, mFdp);



        InputDeviceIdentifier identifier;

        identifier.name = deviceName;

        identifier.location = deviceLocation;

        mFuzzDevice = std::make_unique<InputDevice>(mFuzzContext.get(), deviceID, deviceGeneration,

                                                    identifier);

        mFuzzPolicy->getReaderConfiguration(&mPolicyConfig);

    }



    ~FuzzContainer() {}



    void configureDevice() {

        nsecs_t arbitraryTime = mFdp->ConsumeIntegral<nsecs_t>();

        mFuzzDevice->configure(arbitraryTime, &mPolicyConfig, 0);

        mFuzzDevice->reset(arbitraryTime);

    }



    void addProperty(std::string key, std::string value) {

        mFuzzEventHub->addProperty(key, value);

        configureDevice();

    }



    InputReaderConfiguration& getPolicyConfig() { return mPolicyConfig; }



    template <class T, typename... Args>

    T& getMapper(Args... args) {

        T& mapper = mFuzzDevice->addMapper<T>(mFdp->ConsumeIntegral<int32_t>(), args...);

        configureDevice();

        return mapper;

    }

};



} // namespace android

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

0 → 100644
+110 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <FuzzContainer.h>

#include <KeyboardInputMapper.h>

#include <fuzzer/FuzzedDataProvider.h>



namespace android {



const int32_t kMaxKeycodes = 100;



static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {

    // Pick a random property to set for the mapper to have set.

    fdp->PickValueInArray<std::function<void()>>(

            {[&]() -> void { fuzzer.addProperty("keyboard.orientationAware", "1"); },

             [&]() -> void {

                 fuzzer.addProperty("keyboard.orientationAware",

                                    fdp->ConsumeRandomLengthString(100).data());

             },

             [&]() -> void {

                 fuzzer.addProperty("keyboard.doNotWakeByDefault",

                                    fdp->ConsumeRandomLengthString(100).data());

             },

             [&]() -> void {

                 fuzzer.addProperty("keyboard.handlesKeyRepeat",

                                    fdp->ConsumeRandomLengthString(100).data());

             }})();

}



extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {

    std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    KeyboardInputMapper& mapper =

            fuzzer.getMapper<KeyboardInputMapper>(fdp->ConsumeIntegral<uint32_t>(),

                                                  fdp->ConsumeIntegral<int32_t>());

    auto policyConfig = fuzzer.getPolicyConfig();



    // Loop through mapper operations until randomness is exhausted.

    while (fdp->remaining_bytes() > 0) {

        fdp->PickValueInArray<std::function<void()>>({

                [&]() -> void { addProperty(fuzzer, fdp); },

                [&]() -> void {

                    std::string dump;

                    mapper.dump(dump);

                },

                [&]() -> void {

                    InputDeviceInfo info;

                    mapper.populateDeviceInfo(&info);

                },

                [&]() -> void { mapper.getSources(); },

                [&]() -> void {

                    mapper.configure(fdp->ConsumeIntegral<nsecs_t>(), &policyConfig,

                                     fdp->ConsumeIntegral<uint32_t>());

                },

                [&]() -> void { mapper.reset(fdp->ConsumeIntegral<nsecs_t>()); },

                [&]() -> void {

                    int32_t type, code;

                    type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes)

                                              : fdp->ConsumeIntegral<int32_t>();

                    code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes)

                                              : fdp->ConsumeIntegral<int32_t>();

                    RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<nsecs_t>(),

                                      fdp->ConsumeIntegral<int32_t>(),

                                      type,

                                      code,

                                      fdp->ConsumeIntegral<int32_t>()};

                    mapper.process(&rawEvent);

                },

                [&]() -> void {

                    mapper.getKeyCodeState(fdp->ConsumeIntegral<uint32_t>(),

                                           fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    mapper.getScanCodeState(fdp->ConsumeIntegral<uint32_t>(),

                                            fdp->ConsumeIntegral<int32_t>());

                },

                [&]() -> void {

                    std::vector<int32_t> keyCodes;

                    int32_t numBytes = fdp->ConsumeIntegralInRange<int32_t>(0, kMaxKeycodes);

                    for (int32_t i = 0; i < numBytes; ++i) {

                        keyCodes.push_back(fdp->ConsumeIntegral<int32_t>());

                    }

                    mapper.markSupportedKeyCodes(fdp->ConsumeIntegral<uint32_t>(), keyCodes,

                                                 nullptr);

                },

                [&]() -> void { mapper.getMetaState(); },

                [&]() -> void { mapper.updateMetaState(fdp->ConsumeIntegral<int32_t>()); },

                [&]() -> void { mapper.getAssociatedDisplayId(); },

        })();

    }



    return 0;

}



} // namespace android