Setting up crash type in test fuzzer

Setting up crash type in fuzzer as this test fuzzer
should always find a crash in TestService. Exiting on
incorrect number of args won't be catched by infra.

Test: atest fuzz_service_test
Test: m test_service_fuzzer_should_crash && ./test_service_fuzzer_should_crash
Bug: N/A
Change-Id: I48053bada6fe67cfa6f3b6d30fc27dbf6afe28f8

1 files changed, 8 insertions, 2 deletions

diff --git a/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp b/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp
index ba1a6a1ccd..d2fa581822 100644
--- a/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp
+++ b/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp
@@ -35,6 +35,7 @@ enum class CrashType {
     ON_ROOT_AID,
     ON_DUMP_TRANSACT,
     ON_SHELL_CMD_TRANSACT,
+    CRASH_ALWAYS,
 };
 
 // This service is to verify that fuzzService is functioning properly
@@ -112,8 +113,10 @@ CrashType gCrashType = CrashType::NONE;
 
 extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
     if (*argc < 2) {
-        printf("You must specify at least one argument\n");
-        exit(0); // success because this is a crash test
+        // This fuzzer is also used as test fuzzer to check infra pipeline.
+        // It should always run and find a crash in TestService.
+        gCrashType = CrashType::CRASH_ALWAYS;
+        return 0;
     }
 
     std::string arg = std::string((*argv)[1]);
@@ -146,6 +149,9 @@ extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (gCrashType == CrashType::CRASH_ALWAYS) {
+        LOG_ALWAYS_FATAL("Expected crash, This fuzzer will always crash.");
+    }
     auto service = sp<TestService>::make(gCrashType);
     fuzzService(service, FuzzedDataProvider(data, size));
     return 0;