From 7dd69fd635eed4abe3b119204c2ceabafc110ae9 Mon Sep 17 00:00:00 2001 From: Pawan Wagh Date: Wed, 16 Aug 2023 22:00:43 +0000 Subject: Setting up crash type in test fuzzer Setting up crash type in fuzzer as this test fuzzer should always find a crash in TestService. Exiting on incorrect number of args won't be catched by infra. Test: atest fuzz_service_test Test: m test_service_fuzzer_should_crash && ./test_service_fuzzer_should_crash Bug: N/A Change-Id: I48053bada6fe67cfa6f3b6d30fc27dbf6afe28f8 --- .../tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp b/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp index ba1a6a1ccd..d2fa581822 100644 --- a/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp +++ b/libs/binder/tests/parcel_fuzzer/test_fuzzer/TestServiceFuzzer.cpp @@ -35,6 +35,7 @@ enum class CrashType { ON_ROOT_AID, ON_DUMP_TRANSACT, ON_SHELL_CMD_TRANSACT, + CRASH_ALWAYS, }; // This service is to verify that fuzzService is functioning properly @@ -112,8 +113,10 @@ CrashType gCrashType = CrashType::NONE; extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) { if (*argc < 2) { - printf("You must specify at least one argument\n"); - exit(0); // success because this is a crash test + // This fuzzer is also used as test fuzzer to check infra pipeline. + // It should always run and find a crash in TestService. + gCrashType = CrashType::CRASH_ALWAYS; + return 0; } std::string arg = std::string((*argv)[1]); @@ -146,6 +149,9 @@ extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) { } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + if (gCrashType == CrashType::CRASH_ALWAYS) { + LOG_ALWAYS_FATAL("Expected crash, This fuzzer will always crash."); + } auto service = sp::make(gCrashType); fuzzService(service, FuzzedDataProvider(data, size)); return 0; -- cgit v1.2.3-59-g8ed1b