Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eea5be04 authored by Aditya Wazir's avatar Aditya Wazir Committed by Ayushi Khopkar
Browse files

inputflinger_input_reader_fuzzer: Bug Fix 

Resolved OOB read getting triggered due to FuzzedDataProvider's
shared_ptr which is used among different classes. Implemented
ThreadSafe instance of FuzzedDataProvider as bug-fix.

Test: ./inputflinger_input_reader_fuzzer clusterfuzz-testcase
-minimized-inputflinger_input_reader_fuzzer-6227827124207616
Test: ./inputflinger_input_reader_fuzzer clusterfuzz-testcase
-minimized-inputflinger_input_reader_fuzzer-5394273856782336

Bug: 253728999
Bug: 254590389

Change-Id: I42d53d1d7da18c8085d381c939bedf14fe18dc87
(cherry picked from commit 08aa517eee8e7cdf65bf0bd303239e25ed1d50e8)
parent abd856ff

services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp

+3 −3
Original line number Diff line number Diff line
@@ -16,11 +16,10 @@ 


#include <CursorInputMapper.h>

#include <FuzzContainer.h>

#include <fuzzer/FuzzedDataProvider.h>



namespace android {



static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {

static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) {

    // Pick a random property to set for the mapper to have set.

    fdp->PickValueInArray<std::function<void()>>(

            {[&]() -> void { fuzzer.addProperty("cursor.mode", "pointer"); },
@@ -35,7 +34,8 @@ static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvide 
}



extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {

    std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);

    std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =

            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    CursorInputMapper& mapper = fuzzer.getMapper<CursorInputMapper>();

services/inputflinger/tests/fuzzers/FuzzContainer.h

+2 −3
Original line number Diff line number Diff line
@@ -20,7 +20,6 @@ 
#include <InputMapper.h>

#include <InputReader.h>

#include <MapperHelpers.h>

#include <fuzzer/FuzzedDataProvider.h>



namespace android {
@@ -31,10 +30,10 @@ class FuzzContainer { 
    std::unique_ptr<FuzzInputReaderContext> mFuzzContext;

    std::unique_ptr<InputDevice> mFuzzDevice;

    InputReaderConfiguration mPolicyConfig;

    std::shared_ptr<FuzzedDataProvider> mFdp;

    std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;



public:

    FuzzContainer(std::shared_ptr<FuzzedDataProvider> fdp) : mFdp(fdp) {

    FuzzContainer(std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) : mFdp(fdp) {

        // Setup parameters.

        std::string deviceName = mFdp->ConsumeRandomLengthString(16);

        std::string deviceLocation = mFdp->ConsumeRandomLengthString(12);

services/inputflinger/tests/fuzzers/InputReaderFuzzer.cpp

+2 −1
Original line number Diff line number Diff line
@@ -166,7 +166,8 @@ private: 
};



extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {

    std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);

    std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =

            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);



    FuzzInputListener fuzzListener;

    sp<FuzzInputReaderPolicy> fuzzPolicy = sp<FuzzInputReaderPolicy>::make(fdp);

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

+3 −3
Original line number Diff line number Diff line
@@ -16,13 +16,12 @@ 


#include <FuzzContainer.h>

#include <KeyboardInputMapper.h>

#include <fuzzer/FuzzedDataProvider.h>



namespace android {



const int32_t kMaxKeycodes = 100;



static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvider> fdp) {

static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) {

    // Pick a random property to set for the mapper to have set.

    fdp->PickValueInArray<std::function<void()>>(

            {[&]() -> void { fuzzer.addProperty("keyboard.orientationAware", "1"); },
@@ -41,7 +40,8 @@ static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<FuzzedDataProvide 
}



extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {

    std::shared_ptr<FuzzedDataProvider> fdp = std::make_shared<FuzzedDataProvider>(data, size);

    std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =

            std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);

    FuzzContainer fuzzer(fdp);



    KeyboardInputMapper& mapper =

services/inputflinger/tests/fuzzers/MapperHelpers.h

+9 −10
Original line number Diff line number Diff line
@@ -13,13 +13,12 @@ 
 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#pragma once



#include <InputDevice.h>

#include <InputMapper.h>

#include <InputReader.h>

#include <fuzzer/FuzzedDataProvider.h>

#include <ThreadSafeFuzzedDataProvider.h>

#include "android/hardware/input/InputDeviceCountryCode.h"



using android::hardware::input::InputDeviceCountryCode;
@@ -114,10 +113,10 @@ class FuzzEventHub : public EventHubInterface { 
    InputDeviceIdentifier mIdentifier;

    std::vector<TouchVideoFrame> mVideoFrames;

    PropertyMap mFuzzConfig;

    std::shared_ptr<FuzzedDataProvider> mFdp;

    std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;



public:

    FuzzEventHub(std::shared_ptr<FuzzedDataProvider> fdp) : mFdp(std::move(fdp)) {}

    FuzzEventHub(std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) : mFdp(std::move(fdp)) {}

    ~FuzzEventHub() {}

    void addProperty(std::string key, std::string value) { mFuzzConfig.addProperty(key, value); }
@@ -263,10 +262,10 @@ public: 
};



class FuzzPointerController : public PointerControllerInterface {

    std::shared_ptr<FuzzedDataProvider> mFdp;

    std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;



public:

    FuzzPointerController(std::shared_ptr<FuzzedDataProvider> mFdp) : mFdp(mFdp) {}

    FuzzPointerController(std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp) : mFdp(mFdp) {}

    ~FuzzPointerController() {}

    bool getBounds(float* outMinX, float* outMinY, float* outMaxX, float* outMaxY) const override {

        return mFdp->ConsumeBool();
@@ -289,13 +288,13 @@ public: 
class FuzzInputReaderPolicy : public InputReaderPolicyInterface {

    TouchAffineTransformation mTransform;

    std::shared_ptr<FuzzPointerController> mPointerController;

    std::shared_ptr<FuzzedDataProvider> mFdp;

    std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;



protected:

    ~FuzzInputReaderPolicy() {}



public:

    FuzzInputReaderPolicy(std::shared_ptr<FuzzedDataProvider> mFdp) : mFdp(mFdp) {

    FuzzInputReaderPolicy(std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp) : mFdp(mFdp) {

        mPointerController = std::make_shared<FuzzPointerController>(mFdp);

    }

    void getReaderConfiguration(InputReaderConfiguration* outConfig) override {}
@@ -333,13 +332,13 @@ public: 
class FuzzInputReaderContext : public InputReaderContext {

    std::shared_ptr<EventHubInterface> mEventHub;

    sp<InputReaderPolicyInterface> mPolicy;

    std::shared_ptr<FuzzedDataProvider> mFdp;

    std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp;



public:

    FuzzInputReaderContext(std::shared_ptr<EventHubInterface> eventHub,

                           const sp<InputReaderPolicyInterface>& policy,

                           InputListenerInterface& listener,

                           std::shared_ptr<FuzzedDataProvider> mFdp)

                           std::shared_ptr<ThreadSafeFuzzedDataProvider> mFdp)

          : mEventHub(eventHub), mPolicy(policy), mFdp(mFdp) {}

    ~FuzzInputReaderContext() {}

    void updateGlobalMetaState() override {}