diff options
5 files changed, 25 insertions, 55 deletions
diff --git a/services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp b/services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp index 8098ef2edd..993f6a8e5c 100644 --- a/services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp +++ b/services/inputflinger/tests/fuzzers/CursorInputFuzzer.cpp @@ -16,6 +16,7 @@ #include <CursorInputMapper.h> #include <FuzzContainer.h> +#include <MapperHelpers.h> namespace android { @@ -65,22 +66,11 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { mapper.populateDeviceInfo(info); }, [&]() -> void { - int32_t type, code; - type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes) - : fdp->ConsumeIntegral<int32_t>(); - code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes) - : fdp->ConsumeIntegral<int32_t>(); - // Need to reconfigure with 0 or you risk a NPE. std::list<NotifyArgs> unused = mapper.reconfigure(fdp->ConsumeIntegral<nsecs_t>(), policyConfig, InputReaderConfiguration::Change(0)); - RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<int32_t>(), - type, - code, - fdp->ConsumeIntegral<int32_t>()}; + RawEvent rawEvent = getFuzzedRawEvent(*fdp); unused += mapper.process(&rawEvent); }, [&]() -> void { diff --git a/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp b/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp index 616e870811..d11e8ae24a 100644 --- a/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp +++ b/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp @@ -16,6 +16,7 @@ #include <FuzzContainer.h> #include <KeyboardInputMapper.h> +#include <MapperHelpers.h> namespace android { @@ -72,17 +73,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { std::list<NotifyArgs> unused = mapper.reset(fdp->ConsumeIntegral<nsecs_t>()); }, [&]() -> void { - int32_t type, code; - type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes) - : fdp->ConsumeIntegral<int32_t>(); - code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes) - : fdp->ConsumeIntegral<int32_t>(); - RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<int32_t>(), - type, - code, - fdp->ConsumeIntegral<int32_t>()}; + RawEvent rawEvent = getFuzzedRawEvent(*fdp); std::list<NotifyArgs> unused = mapper.process(&rawEvent); }, [&]() -> void { diff --git a/services/inputflinger/tests/fuzzers/MapperHelpers.h b/services/inputflinger/tests/fuzzers/MapperHelpers.h index 1e44e0fba0..698daf555a 100644 --- a/services/inputflinger/tests/fuzzers/MapperHelpers.h +++ b/services/inputflinger/tests/fuzzers/MapperHelpers.h @@ -74,6 +74,22 @@ ToolType getFuzzedToolType(Fdp& fdp) { return static_cast<ToolType>(toolType); } +template <class Fdp> +RawEvent getFuzzedRawEvent(Fdp& fdp) { + const int32_t type = fdp.ConsumeBool() ? fdp.PickValueInArray(kValidTypes) + : fdp.template ConsumeIntegral<int32_t>(); + const int32_t code = fdp.ConsumeBool() ? fdp.PickValueInArray(kValidCodes) + : fdp.template ConsumeIntegral<int32_t>(); + return RawEvent{ + .when = fdp.template ConsumeIntegral<nsecs_t>(), + .readTime = fdp.template ConsumeIntegral<nsecs_t>(), + .deviceId = fdp.template ConsumeIntegral<int32_t>(), + .type = type, + .code = code, + .value = fdp.template ConsumeIntegral<int32_t>(), + }; +} + class FuzzEventHub : public EventHubInterface { InputDeviceIdentifier mIdentifier; std::vector<TouchVideoFrame> mVideoFrames; @@ -118,18 +134,7 @@ public: std::vector<RawEvent> events; const size_t count = mFdp->ConsumeIntegralInRange<size_t>(0, kMaxSize); for (size_t i = 0; i < count; ++i) { - int32_t type = mFdp->ConsumeBool() ? mFdp->PickValueInArray(kValidTypes) - : mFdp->ConsumeIntegral<int32_t>(); - int32_t code = mFdp->ConsumeBool() ? mFdp->PickValueInArray(kValidCodes) - : mFdp->ConsumeIntegral<int32_t>(); - events.push_back({ - .when = mFdp->ConsumeIntegral<nsecs_t>(), - .readTime = mFdp->ConsumeIntegral<nsecs_t>(), - .deviceId = mFdp->ConsumeIntegral<int32_t>(), - .type = type, - .code = code, - .value = mFdp->ConsumeIntegral<int32_t>(), - }); + events.push_back(getFuzzedRawEvent(*mFdp)); } return events; } diff --git a/services/inputflinger/tests/fuzzers/MultiTouchInputFuzzer.cpp b/services/inputflinger/tests/fuzzers/MultiTouchInputFuzzer.cpp index 212462d700..494b0efe79 100644 --- a/services/inputflinger/tests/fuzzers/MultiTouchInputFuzzer.cpp +++ b/services/inputflinger/tests/fuzzers/MultiTouchInputFuzzer.cpp @@ -15,6 +15,7 @@ */ #include <FuzzContainer.h> +#include <MapperHelpers.h> #include <MultiTouchInputMapper.h> namespace android { @@ -87,16 +88,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { std::list<NotifyArgs> unused = mapper.reset(fdp->ConsumeIntegral<nsecs_t>()); }, [&]() -> void { - int32_t type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes) - : fdp->ConsumeIntegral<int32_t>(); - int32_t code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes) - : fdp->ConsumeIntegral<int32_t>(); - RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<int32_t>(), - type, - code, - fdp->ConsumeIntegral<int32_t>()}; + RawEvent rawEvent = getFuzzedRawEvent(*fdp); std::list<NotifyArgs> unused = mapper.process(&rawEvent); }, [&]() -> void { diff --git a/services/inputflinger/tests/fuzzers/SwitchInputFuzzer.cpp b/services/inputflinger/tests/fuzzers/SwitchInputFuzzer.cpp index 590207ea22..381e7b5f8f 100644 --- a/services/inputflinger/tests/fuzzers/SwitchInputFuzzer.cpp +++ b/services/inputflinger/tests/fuzzers/SwitchInputFuzzer.cpp @@ -15,6 +15,7 @@ */ #include <FuzzContainer.h> +#include <MapperHelpers.h> #include <SwitchInputMapper.h> namespace android { @@ -36,16 +37,7 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { }, [&]() -> void { mapper.getSources(); }, [&]() -> void { - int32_t type = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidTypes) - : fdp->ConsumeIntegral<int32_t>(); - int32_t code = fdp->ConsumeBool() ? fdp->PickValueInArray(kValidCodes) - : fdp->ConsumeIntegral<int32_t>(); - RawEvent rawEvent{fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<nsecs_t>(), - fdp->ConsumeIntegral<int32_t>(), - type, - code, - fdp->ConsumeIntegral<int32_t>()}; + RawEvent rawEvent = getFuzzedRawEvent(*fdp); std::list<NotifyArgs> unused = mapper.process(&rawEvent); }, [&]() -> void { |