Merge "Add package info into METADATA."
diff --git a/fuzzing/Android.bp b/fuzzing/Android.bp
index 09b1f4a..5c22cb4 100644
--- a/fuzzing/Android.bp
+++ b/fuzzing/Android.bp
@@ -11,10 +11,11 @@
static_libs: [
"libfdt",
],
- host_supported: true,
+ corpus: ["corpus/*"],
fuzz_config: {
cc: [
"ptosi@google.com",
],
},
+ host_supported: true,
}
diff --git a/fuzzing/libfdt_fuzzer.c b/fuzzing/libfdt_fuzzer.c
index 227e711..98e03c8 100644
--- a/fuzzing/libfdt_fuzzer.c
+++ b/fuzzing/libfdt_fuzzer.c
@@ -1,18 +1,66 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Ensure assert() catches logical errors during fuzzing */
+#ifdef NDEBUG
+#undef NDEBUG
+#endif
+
+#include <inttypes.h>
#include <assert.h>
+#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
+#include <ctype.h>
+
+#include <sanitizer/asan_interface.h>
+#include <sanitizer/msan_interface.h>
#include "libfdt.h"
#include "libfdt_env.h"
-void walk_device_tree(const void *device_tree, int parent_node) {
+/* check memory region is valid, for the purpose of tooling such as asan */
+static void check_mem(const void *mem, size_t len) {
+
+ assert(mem);
+
+#if __has_feature(memory_sanitizer)
+ /* dumps if check fails */
+ __msan_check_mem_is_initialized((void *)mem, len);
+#endif
+
+#if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
+ assert(!__asan_region_is_poisoned((void *)mem, len));
+#else
+ const volatile uint8_t *mem8 = mem;
+
+ /* Read each byte of memory for instrumentation */
+ for(size_t i = 0; i < len; i++) {
+ (void)mem8[i];
+ }
+#endif
+}
+
+
+static void walk_device_tree(const void *device_tree, int parent_node) {
int len = 0;
const char *node_name = fdt_get_name(device_tree, parent_node, &len);
if (node_name != NULL) {
- // avoid clang complaining about unused variable node_name and force
- // ASan to validate string pointer in strlen call.
- assert(strlen(node_name) == len);
+ check_mem(node_name, len);
}
uint32_t phandle = fdt_get_phandle(device_tree, parent_node);
@@ -27,6 +75,7 @@
}
}
+
// Information on device tree is available in external/dtc/Documentation/
// folder.
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
@@ -35,8 +84,7 @@
if (fdt_check_full(data, size) != 0) return 0;
- int root_node_offset = 0;
- walk_device_tree(data, root_node_offset);
+ walk_device_tree(data, /* parent_node */ 0);
return 0;
}