Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e372148d authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Adding a sample fuzzer using fuzz_service 

fuzz_service is now enabled for rust backends. Adding an example fuzzer
which fuzzes a test service.

Bug: 256874936
Test: m example_service_fuzzer && adb sync && adb shell data/fuzz/x86_64/example_service_fuzzer/example_service_fuzzer
Change-Id: Ifd2b16f92c6a5a735ff21b761ae2c0fe132a232d
parent 38429f00

libs/binder/rust/tests/parcel_fuzzer/random_parcel/fuzz_service_test/Android.bp

0 → 100644
+33 −0
Original line number Diff line number Diff line 
package {

    // See: http://go/android-license-faq

    default_applicable_licenses: ["frameworks_native_license"],

}



aidl_interface {

    name: "testServiceInterface",

    srcs: ["ITestService.aidl"],

    unstable: true,

    backend: {

        rust: {

            enabled: true,

        },

    },

}



rust_fuzz {

    name: "example_service_fuzzer",

    srcs: [

        "service_fuzzer.rs",

    ],

    rustlibs: [

        "libbinder_rs",

        "libbinder_random_parcel_rs",

        "testServiceInterface-rust",

    ],

    fuzz_config: {

        cc: [

            "waghpawan@google.com",

            "smoreland@google.com",

        ],

    },

}

libs/binder/rust/tests/parcel_fuzzer/random_parcel/fuzz_service_test/ITestService.aidl

0 → 100644
+19 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



interface ITestService {

    boolean repeatData(boolean token);

}
 
 No newline at end of file

libs/binder/rust/tests/parcel_fuzzer/random_parcel/fuzz_service_test/service_fuzzer.rs

0 → 100644
+39 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#![allow(missing_docs)]

#![no_main]

#[macro_use]

extern crate libfuzzer_sys;



use binder::{self, BinderFeatures, Interface};

use binder_random_parcel_rs::fuzz_service;

use testServiceInterface::aidl::ITestService::{self, BnTestService};



struct TestService;



impl Interface for TestService {}



impl ITestService::ITestService for TestService {

    fn repeatData(&self, token: bool) -> binder::Result<bool> {

        Ok(token)

    }

}



fuzz_target!(|data: &[u8]| {

    let service = BnTestService::new_binder(TestService, BinderFeatures::default());

    fuzz_service(&mut service.as_binder(), data);

});