diff options
| author | 2024-03-06 12:48:48 +0000 | |
|---|---|---|
| committer | 2024-03-06 12:48:48 +0000 | |
| commit | 9ba1cc574a452978919008c09a2ee62afa11cf34 (patch) | |
| tree | 5a7aba94a13fb9f26172cf3d6213c06ffab0412f | |
| parent | a791e89ff35a0a66b7f886848da44ab590b6aeb1 (diff) | |
| parent | c6b0dfa3358a152c9bfd1fc479753c6ba32b78eb (diff) | |
Merge changes I8929d11e,Ib737e81f into main
* changes:
Parcel: free objects before realloc
binder_parcel_fuzz: add setData
| -rw-r--r-- | libs/binder/Parcel.cpp | 4 | ||||
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/binder.cpp | 8 |
2 files changed, 10 insertions, 2 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 2dd310e9ca..35cea8132d 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -2976,14 +2976,14 @@ status_t Parcel::restartWrite(size_t desired) return continueWrite(desired); } + releaseObjects(); + uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero); if (!data && desired > mDataCapacity) { mError = NO_MEMORY; return NO_MEMORY; } - releaseObjects(); - if (data || desired == 0) { LOG_ALLOC("Parcel %p: restart from %zu to %zu capacity", this, mDataCapacity, desired); if (mDataCapacity > desired) { diff --git a/libs/binder/tests/parcel_fuzzer/binder.cpp b/libs/binder/tests/parcel_fuzzer/binder.cpp index 5c280f4b2c..e378b864f7 100644 --- a/libs/binder/tests/parcel_fuzzer/binder.cpp +++ b/libs/binder/tests/parcel_fuzzer/binder.cpp @@ -115,6 +115,14 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { p.setDataPosition(pos); FUZZ_LOG() << "setDataPosition done"; }, + [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { + size_t len = provider.ConsumeIntegralInRange<size_t>(0, 1024); + std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(len); + FUZZ_LOG() << "about to setData: " <<(bytes.data() ? HexString(bytes.data(), bytes.size()) : "null"); + // TODO: allow all read and write operations + (*const_cast<::android::Parcel*>(&p)).setData(bytes.data(), bytes.size()); + FUZZ_LOG() << "setData done"; + }, PARCEL_READ_NO_STATUS(size_t, allowFds), PARCEL_READ_NO_STATUS(size_t, hasFileDescriptors), PARCEL_READ_NO_STATUS(std::vector<android::sp<android::IBinder>>, debugReadAllStrongBinders), |