diff options
4 files changed, 26 insertions, 1 deletions
diff --git a/libs/binder/rust/tests/parcel_fuzzer/random_parcel/Android.bp b/libs/binder/rust/tests/parcel_fuzzer/random_parcel/Android.bp index 6fe4fcd876..43a309409d 100644 --- a/libs/binder/rust/tests/parcel_fuzzer/random_parcel/Android.bp +++ b/libs/binder/rust/tests/parcel_fuzzer/random_parcel/Android.bp @@ -14,6 +14,8 @@ rust_bindgen { "--size_t-is-usize", "--allowlist-function", "createRandomParcel", + "--allowlist-function", + "fuzzRustService", ], shared_libs: [ "libc++", diff --git a/libs/binder/rust/tests/parcel_fuzzer/random_parcel/src/lib.rs b/libs/binder/rust/tests/parcel_fuzzer/random_parcel/src/lib.rs index ee3b6f813a..1bbd6742f2 100644 --- a/libs/binder/rust/tests/parcel_fuzzer/random_parcel/src/lib.rs +++ b/libs/binder/rust/tests/parcel_fuzzer/random_parcel/src/lib.rs @@ -16,7 +16,8 @@ use binder::binder_impl::Parcel; use binder::unstable_api::{AParcel, AsNative}; -use binder_random_parcel_bindgen::createRandomParcel; +use binder::SpIBinder; +use binder_random_parcel_bindgen::{createRandomParcel, fuzzRustService}; use std::os::raw::c_void; /// This API creates a random parcel to be used by fuzzers @@ -31,3 +32,13 @@ pub fn create_random_parcel(fuzzer_data: &[u8]) -> Parcel { } parcel } + +/// This API automatically fuzzes provided service +pub fn fuzz_service(binder: &mut SpIBinder, fuzzer_data: &[u8]) { + let ptr = binder.as_native_mut() as *mut c_void; + unsafe { + // Safety: `SpIBinder::as_native_mut` and `slice::as_ptr` always + // return valid pointers. + fuzzRustService(ptr, fuzzer_data.as_ptr(), fuzzer_data.len()); + } +} diff --git a/libs/binder/rust/tests/parcel_fuzzer/random_parcel/wrappers/RandomParcelWrapper.hpp b/libs/binder/rust/tests/parcel_fuzzer/random_parcel/wrappers/RandomParcelWrapper.hpp index 167a64e548..831bd5660c 100644 --- a/libs/binder/rust/tests/parcel_fuzzer/random_parcel/wrappers/RandomParcelWrapper.hpp +++ b/libs/binder/rust/tests/parcel_fuzzer/random_parcel/wrappers/RandomParcelWrapper.hpp @@ -19,4 +19,7 @@ extern "C" { // This API is used by rust to fill random parcel. void createRandomParcel(void* aParcel, const uint8_t* data, size_t len); + + // This API is used by fuzzers to automatically fuzz aidl services + void fuzzRustService(void* binder, const uint8_t* data, size_t len); }
\ No newline at end of file diff --git a/libs/binder/tests/parcel_fuzzer/libbinder_ndk_driver.cpp b/libs/binder/tests/parcel_fuzzer/libbinder_ndk_driver.cpp index 462ef9a5e9..a1fb70131e 100644 --- a/libs/binder/tests/parcel_fuzzer/libbinder_ndk_driver.cpp +++ b/libs/binder/tests/parcel_fuzzer/libbinder_ndk_driver.cpp @@ -29,3 +29,12 @@ void fuzzService(AIBinder* binder, FuzzedDataProvider&& provider) { } } // namespace android + +extern "C" { +// This API is used by fuzzers to automatically fuzz aidl services +void fuzzRustService(void* binder, const uint8_t* data, size_t len) { + AIBinder* aiBinder = static_cast<AIBinder*>(binder); + FuzzedDataProvider provider(data, len); + android::fuzzService(aiBinder, std::move(provider)); +} +} // extern "C" |