diff options
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/Android.bp | 18 | ||||
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/EmptyParcelable.aidl | 18 | ||||
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/GenericDataParcelable.aidl | 24 | ||||
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/SingleDataParcelable.aidl | 19 | ||||
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/binder.cpp | 21 | ||||
| -rw-r--r-- | libs/binder/tests/parcel_fuzzer/binder_ndk.cpp | 22 |
6 files changed, 122 insertions, 0 deletions
diff --git a/libs/binder/tests/parcel_fuzzer/Android.bp b/libs/binder/tests/parcel_fuzzer/Android.bp index 2ca6ebdbd2..0210237ed8 100644 --- a/libs/binder/tests/parcel_fuzzer/Android.bp +++ b/libs/binder/tests/parcel_fuzzer/Android.bp @@ -7,6 +7,22 @@ package { default_applicable_licenses: ["frameworks_native_license"], } +aidl_interface { + name: "binderReadParcelIface", + host_supported: true, + unstable: true, + srcs: [ + "EmptyParcelable.aidl", + "SingleDataParcelable.aidl", + "GenericDataParcelable.aidl", + ], + backend: { + java: { + enabled: false, + }, + }, +} + cc_fuzz { name: "binder_parcel_fuzzer", host_supported: true, @@ -29,6 +45,8 @@ cc_fuzz { "libcutils", "libhidlbase", "liblog", + "binderReadParcelIface-cpp", + "binderReadParcelIface-ndk", ], target: { diff --git a/libs/binder/tests/parcel_fuzzer/EmptyParcelable.aidl b/libs/binder/tests/parcel_fuzzer/EmptyParcelable.aidl new file mode 100644 index 0000000000..96d6223d3d --- /dev/null +++ b/libs/binder/tests/parcel_fuzzer/EmptyParcelable.aidl @@ -0,0 +1,18 @@ +/* + * Copyright (C) 2022 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +parcelable EmptyParcelable{ +}
\ No newline at end of file diff --git a/libs/binder/tests/parcel_fuzzer/GenericDataParcelable.aidl b/libs/binder/tests/parcel_fuzzer/GenericDataParcelable.aidl new file mode 100644 index 0000000000..fc2542b36c --- /dev/null +++ b/libs/binder/tests/parcel_fuzzer/GenericDataParcelable.aidl @@ -0,0 +1,24 @@ +/* + * Copyright (C) 2022 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +parcelable GenericDataParcelable { + int data; + float majorVersion; + float minorVersion; + IBinder binder; + ParcelFileDescriptor fileDescriptor; + int[] array; +}
\ No newline at end of file diff --git a/libs/binder/tests/parcel_fuzzer/SingleDataParcelable.aidl b/libs/binder/tests/parcel_fuzzer/SingleDataParcelable.aidl new file mode 100644 index 0000000000..d62891b26a --- /dev/null +++ b/libs/binder/tests/parcel_fuzzer/SingleDataParcelable.aidl @@ -0,0 +1,19 @@ +/* + * Copyright (C) 2022 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +parcelable SingleDataParcelable{ + int data; +}
\ No newline at end of file diff --git a/libs/binder/tests/parcel_fuzzer/binder.cpp b/libs/binder/tests/parcel_fuzzer/binder.cpp index 7059d30bb4..9dac2c98a7 100644 --- a/libs/binder/tests/parcel_fuzzer/binder.cpp +++ b/libs/binder/tests/parcel_fuzzer/binder.cpp @@ -16,6 +16,9 @@ #define FUZZ_LOG_TAG "binder" #include "binder.h" +#include "EmptyParcelable.h" +#include "GenericDataParcelable.h" +#include "SingleDataParcelable.h" #include "util.h" #include <android-base/hex.h> @@ -354,6 +357,24 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { status_t status = p.compareDataInRange(thisOffset, p, otherOffset, length, &result); FUZZ_LOG() << " status: " << status << " result: " << result; }, + [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { + FUZZ_LOG() << "about to call readFromParcel() with status for EmptyParcelable"; + EmptyParcelable emptyParcelable{}; + status_t status = emptyParcelable.readFromParcel(&p); + FUZZ_LOG() << " status: " << status; + }, + [] (const ::android::Parcel& p , FuzzedDataProvider& /*provider*/) { + FUZZ_LOG() << "about to call readFromParcel() with status for SingleDataParcelable"; + SingleDataParcelable singleDataParcelable; + status_t status = singleDataParcelable.readFromParcel(&p); + FUZZ_LOG() <<" status: " << status; + }, + [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { + FUZZ_LOG() << "about to call readFromParcel() with status for GenericDataParcelable"; + GenericDataParcelable genericDataParcelable; + status_t status = genericDataParcelable.readFromParcel(&p); + FUZZ_LOG() <<" status: " << status; + }, }; // clang-format on #pragma clang diagnostic pop diff --git a/libs/binder/tests/parcel_fuzzer/binder_ndk.cpp b/libs/binder/tests/parcel_fuzzer/binder_ndk.cpp index 26d67704b2..af773a02f7 100644 --- a/libs/binder/tests/parcel_fuzzer/binder_ndk.cpp +++ b/libs/binder/tests/parcel_fuzzer/binder_ndk.cpp @@ -16,6 +16,9 @@ #define FUZZ_LOG_TAG "binder_ndk" #include "binder_ndk.h" +#include "aidl/EmptyParcelable.h" +#include "aidl/GenericDataParcelable.h" +#include "aidl/SingleDataParcelable.h" #include <android/binder_parcel_utils.h> #include <android/binder_parcelable_utils.h> @@ -177,5 +180,24 @@ std::vector<ParcelRead<NdkParcelAdapter>> BINDER_NDK_PARCEL_READ_FUNCTIONS{ PARCEL_READ(std::array<ndk::ScopedFileDescriptor COMMA 3>, ndk::AParcel_readData), PARCEL_READ(std::array<std::shared_ptr<ISomeInterface> COMMA 3>, ndk::AParcel_readData), #undef COMMA + + [](const NdkParcelAdapter& p, FuzzedDataProvider& /*provider*/) { + FUZZ_LOG() << "about to read parcel using readFromParcel for EmptyParcelable"; + aidl::EmptyParcelable emptyParcelable; + binder_status_t status = emptyParcelable.readFromParcel(p.aParcel()); + FUZZ_LOG() << "status: " << status; + }, + [](const NdkParcelAdapter& p, FuzzedDataProvider& /*provider*/) { + FUZZ_LOG() << "about to read parcel using readFromParcel for SingleDataParcelable"; + aidl::SingleDataParcelable singleDataParcelable; + binder_status_t status = singleDataParcelable.readFromParcel(p.aParcel()); + FUZZ_LOG() << "status: " << status; + }, + [](const NdkParcelAdapter& p, FuzzedDataProvider& /*provider*/) { + FUZZ_LOG() << "about to read parcel using readFromParcel for GenericDataParcelable"; + aidl::GenericDataParcelable genericDataParcelable; + binder_status_t status = genericDataParcelable.readFromParcel(p.aParcel()); + FUZZ_LOG() << "status: " << status; + }, }; // clang-format on |