Merge Android U (ab/10368041)
Bug: 291102124
Merged-In: I40f39f20268fa51c3f5c690e89f8853a5aff0566
Change-Id: Ic2996360fe99f05286bbe22c375053e2c249a762
diff --git a/fuzzing/Android.bp b/fuzzing/Android.bp
index 5c22cb4..857c611 100644
--- a/fuzzing/Android.bp
+++ b/fuzzing/Android.bp
@@ -19,3 +19,4 @@
},
host_supported: true,
}
+
diff --git a/fuzzing/corpus/crash-a5b94d95681291f3057eea7f0233c8f1529b2f59 b/fuzzing/corpus/crash-a5b94d95681291f3057eea7f0233c8f1529b2f59
new file mode 100644
index 0000000..dbab42e
--- /dev/null
+++ b/fuzzing/corpus/crash-a5b94d95681291f3057eea7f0233c8f1529b2f59
Binary files differ
diff --git a/fuzzing/corpus/hardy-octopus b/fuzzing/corpus/hardy-octopus
new file mode 100644
index 0000000..81615e9
--- /dev/null
+++ b/fuzzing/corpus/hardy-octopus
Binary files differ
diff --git a/fuzzing/corpus/header-truncated b/fuzzing/corpus/header-truncated
new file mode 100644
index 0000000..1db29d8
--- /dev/null
+++ b/fuzzing/corpus/header-truncated
Binary files differ
diff --git a/fuzzing/corpus/header-v-1 b/fuzzing/corpus/header-v-1
new file mode 100644
index 0000000..a773d07
--- /dev/null
+++ b/fuzzing/corpus/header-v-1
Binary files differ
diff --git a/fuzzing/corpus/header-v0 b/fuzzing/corpus/header-v0
new file mode 100644
index 0000000..f22ec6a
--- /dev/null
+++ b/fuzzing/corpus/header-v0
Binary files differ
diff --git a/fuzzing/corpus/meson-g12a-sei510-android.dtb b/fuzzing/corpus/meson-g12a-sei510-android.dtb
new file mode 100644
index 0000000..317175d
--- /dev/null
+++ b/fuzzing/corpus/meson-g12a-sei510-android.dtb
Binary files differ
diff --git a/fuzzing/corpus/oob_by_one b/fuzzing/corpus/oob_by_one
new file mode 100644
index 0000000..216523c
--- /dev/null
+++ b/fuzzing/corpus/oob_by_one
Binary files differ
diff --git a/fuzzing/corpus/quirks.dtb b/fuzzing/corpus/quirks.dtb
new file mode 100644
index 0000000..676024a
--- /dev/null
+++ b/fuzzing/corpus/quirks.dtb
Binary files differ
diff --git a/fuzzing/libfdt_fuzzer.c b/fuzzing/libfdt_fuzzer.c
index 89fe3c2..b271714 100644
--- a/fuzzing/libfdt_fuzzer.c
+++ b/fuzzing/libfdt_fuzzer.c
@@ -59,6 +59,24 @@
return phandle != 0 && phandle != UINT32_MAX;
}
+static void walk_node_properties(const void *device_tree, int node) {
+ int property, len = 0;
+
+ fdt_for_each_property_offset(property, device_tree, node) {
+ const struct fdt_property *prop = fdt_get_property_by_offset(device_tree,
+ property, &len);
+ if (!prop)
+ continue;
+ check_mem(prop->data, fdt32_to_cpu(prop->len));
+
+ const char *prop_name = fdt_string(device_tree, prop->nameoff);
+ if (prop_name != NULL) {
+ check_mem(prop_name, strlen(prop_name));
+ }
+ }
+}
+
+
static void walk_device_tree(const void *device_tree, int parent_node) {
int len = 0;
const char *node_name = fdt_get_name(device_tree, parent_node, &len);
@@ -72,6 +90,30 @@
assert(node >= 0); // it should at least find parent_node
}
+ char path_buf[64];
+ if(fdt_get_path(device_tree, parent_node, path_buf, sizeof(path_buf)) == 0) {
+ fdt_path_offset(device_tree, path_buf);
+ }
+
+ fdt_parent_offset(device_tree, parent_node);
+
+ // Exercise sub-node search string functions
+ fdt_subnode_offset(device_tree, parent_node, "a");
+ fdt_get_property(device_tree, parent_node, "reg", &len);
+
+ // Check for a stringlist node called 'stringlist' (added to corpus)
+ const int sl_count = fdt_stringlist_count(device_tree,
+ parent_node, "stringlist");
+ if (sl_count > 0) {
+ for (int i = 0; i < sl_count; i++) {
+ fdt_stringlist_get(device_tree, parent_node, "stringlist", i, &len);
+ }
+
+ fdt_stringlist_search(device_tree, parent_node, "stringlist", "a");
+ }
+
+ walk_node_properties(device_tree, parent_node);
+
// recursively walk the node's children
for (int node = fdt_first_subnode(device_tree, parent_node); node >= 0;
node = fdt_next_subnode(device_tree, node)) {
@@ -80,15 +122,49 @@
}
+static void walk_mem_rsv(const void *device_tree) {
+ const int n = fdt_num_mem_rsv(device_tree);
+ uint64_t address, size;
+
+ for (int i = 0; i < n; i++) {
+ fdt_get_mem_rsv(device_tree, i, &address, &size);
+ }
+}
+
+
// Information on device tree is available in external/dtc/Documentation/
// folder.
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+ int rc;
+
// Non-zero return values are reserved for future use.
if (size < FDT_V17_SIZE) return 0;
- if (fdt_check_full(data, size) != 0) return 0;
+ // Produce coverage of checking function
+ rc = fdt_check_full(data, size);
+ fdt_strerror(rc);
+ // Don't continue if the library rejected the input
+ if (rc != 0) return 0;
+
+ // Cover reading functions
walk_device_tree(data, /* parent_node */ 0);
+ walk_mem_rsv(data);
+
+ // Cover phandle functions
+ uint32_t phandle;
+ fdt_generate_phandle(data, &phandle);
+
+ // Try and get a path by alias
+ fdt_path_offset(data, "a");
+
+ // Try to get an alias
+ fdt_get_alias(data, "a");
+
+ // Exercise common search functions
+ fdt_node_offset_by_compatible(data, 0, "a");
+ fdt_node_offset_by_prop_value(data, 0, "x", "42", 3);
return 0;
}
+
diff --git a/libfdt/fdt_ro.c b/libfdt/fdt_ro.c
index 87d736b..a62ec78 100644
--- a/libfdt/fdt_ro.c
+++ b/libfdt/fdt_ro.c
@@ -10,6 +10,14 @@
#include "libfdt_internal.h"
+/* Check if a buffer contains a nul-terminated string.
+ * Used for checking property values which should be strings.
+ */
+static bool is_nul_string(const char *buf, const size_t buf_len) {
+ return buf_len > 0 && buf[buf_len - 1] == '\0' &&
+ strnlen(buf, buf_len) == buf_len - 1;
+}
+
static int fdt_nodename_eq_(const void *fdt, int offset,
const char *s, int len)
{
@@ -531,13 +539,27 @@
const char *fdt_get_alias_namelen(const void *fdt,
const char *name, int namelen)
{
+ const char *prop;
int aliasoffset;
+ int prop_len;
aliasoffset = fdt_path_offset(fdt, "/aliases");
if (aliasoffset < 0)
return NULL;
- return fdt_getprop_namelen(fdt, aliasoffset, name, namelen, NULL);
+ prop = fdt_getprop_namelen(fdt, aliasoffset, name, namelen, &prop_len);
+ if (prop && !can_assume(VALID_INPUT)) {
+ /* Validate the alias value. From the devicetree spec v0.3:
+ * "An alias value is a device path and is encoded as a string.
+ * The value representes the full path to a node, ..."
+ * A full path must start at the root to prevent recursion.
+ */
+ if (prop_len == 0 || *prop != '/' || !is_nul_string(prop, prop_len)) {
+ prop = NULL;
+ }
+ }
+
+ return prop;
}
const char *fdt_get_alias(const void *fdt, const char *name)