libs/vr/libpdx/fuzz/helpers.h - platform/frameworks/native - Gitiles

 /*
  * Copyright 2020 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 // Authors: corbin.souffrant@leviathansecurity.com
 //          brian.balling@leviathansecurity.com

 #ifndef LEV_FUZZERS_LIBPDX_HELPERS_H_
 #define LEV_FUZZERS_LIBPDX_HELPERS_H_

 #define UNUSED(expr) \
   do {               \
     (void)(expr);    \
   } while (0)

 #include <fuzzer/FuzzedDataProvider.h>
 #include <pdx/client.h>
 #include <pdx/service.h>
 #include <pdx/service_dispatcher.h>
 #include <pdx/service_endpoint.h>
 #include <sys/eventfd.h>
 #include <memory>
 #include <vector>

 using namespace android::pdx;

 // Vector of operations we can call in the dispatcher.
 static const std::vector<std::function<void(
     const std::unique_ptr<ServiceDispatcher>&, FuzzedDataProvider*)>>
     dispatcher_operations = {
         [](const std::unique_ptr<ServiceDispatcher>& dispatcher,
            FuzzedDataProvider*) -> void { dispatcher->EnterDispatchLoop(); },
         [](const std::unique_ptr<ServiceDispatcher>& dispatcher,
            FuzzedDataProvider*) -> void { dispatcher->ReceiveAndDispatch(); },
         [](const std::unique_ptr<ServiceDispatcher>& dispatcher,
            FuzzedDataProvider* fdp) -> void {
           dispatcher->ReceiveAndDispatch(fdp->ConsumeIntegral<int>());
         }};

 // Most of the fuzzing occurs within the endpoint, which is derived from an
 // abstract class. So we are returning garbage data for most functions besides
 // the ones we added or need to actually use.
 class FuzzEndpoint : public Endpoint {
  public:
   explicit FuzzEndpoint(FuzzedDataProvider* fdp) {
     _fdp = fdp;
     _epoll_fd = eventfd(0, 0);
   }

   ~FuzzEndpoint() { close(_epoll_fd); }

   // Returns an fd that can be used with epoll() to wait for incoming messages
   // from this endpoint.
   int epoll_fd() const { return _epoll_fd; }

   // Associates a Service instance with an endpoint by setting the service
   // context pointer to the address of the Service. Only one Service may be
   // associated with a given endpoint.
   Status<void> SetService(Service* service) {
     _service = service;
     return Status<void>(0);
   }

   // Set the channel context for the given channel.
   Status<void> SetChannel(int channel_id, Channel* channel) {
     UNUSED(channel_id);
     _channel = std::shared_ptr<Channel>(channel);
     return Status<void>(0);
   }

   // Receives a message on the given endpoint file descriptor.
   // This is called by the dispatcher to determine what operations
   // to make, so we are fuzzing the response.
   Status<void> MessageReceive(Message* message) {
     // Create a randomized MessageInfo struct.
     MessageInfo info;
     eventfd_t wakeup_val = 0;
     info.pid = _fdp->ConsumeIntegral<int>();
     info.tid = _fdp->ConsumeIntegral<int>();
     info.cid = _fdp->ConsumeIntegral<int>();
     info.mid = _fdp->ConsumeIntegral<int>();
     info.euid = _fdp->ConsumeIntegral<int>();
     info.egid = _fdp->ConsumeIntegral<int>();
     info.op = _fdp->ConsumeIntegral<int32_t>();
     info.flags = _fdp->ConsumeIntegral<uint32_t>();
     info.service = _service;
     info.channel = _channel.get();
     info.send_len = _fdp->ConsumeIntegral<size_t>();
     info.recv_len = _fdp->ConsumeIntegral<size_t>();
     info.fd_count = _fdp->ConsumeIntegral<size_t>();
     if (_fdp->remaining_bytes() >= 32) {
       std::vector<uint8_t> impulse_vec = _fdp->ConsumeBytes<uint8_t>(32);
       memcpy(info.impulse, impulse_vec.data(), 32);
     }

     *message = Message(info);
     eventfd_read(_epoll_fd, &wakeup_val);

     return Status<void>();
   }

   // Returns a tag that uniquely identifies a specific underlying IPC
   // transport.
   uint32_t GetIpcTag() const { return 0; }

   // Close a channel, signaling the client file object and freeing the channel
   // id. Once closed, the client side of the channel always returns the error
   // ESHUTDOWN and signals the poll/epoll events POLLHUP and POLLFREE.
   Status<void> CloseChannel(int channel_id) {
     UNUSED(channel_id);
     return Status<void>();
   }

   // Update the event bits for the given channel (given by id), using the
   // given clear and set masks.
   Status<void> ModifyChannelEvents(int channel_id, int clear_mask,
                                    int set_mask) {
     UNUSED(channel_id);
     UNUSED(clear_mask);
     UNUSED(set_mask);
     return Status<void>();
   }

   // Create a new channel and push it as a file descriptor to the process
   // sending the |message|. |flags| may be set to O_NONBLOCK and/or
   // O_CLOEXEC to control the initial behavior of the new file descriptor (the
   // sending process may change these later using fcntl()). The internal
   // Channel instance associated with this channel is set to |channel|,
   // which may be nullptr. The new channel id allocated for this channel is
   // returned in |channel_id|, which may also be nullptr if not needed.
   Status<RemoteChannelHandle> PushChannel(Message* message, int flags,
                                           Channel* channel, int* channel_id) {
     UNUSED(message);
     UNUSED(flags);
     UNUSED(channel);
     UNUSED(channel_id);
     return Status<RemoteChannelHandle>();
   }

   // Check whether the |ref| is a reference to a channel to the service
   // represented by the |endpoint|. If the channel reference in question is
   // valid, the Channel object is returned in |channel| when non-nullptr and
   // the channel ID is returned through the Status object.
   Status<int> CheckChannel(const Message* message, ChannelReference ref,
                            Channel** channel) {
     UNUSED(message);
     UNUSED(ref);
     UNUSED(channel);
     return Status<int>();
   }

   // Replies to the message with a return code.
   Status<void> MessageReply(Message* message, int return_code) {
     UNUSED(message);
     UNUSED(return_code);
     return Status<void>();
   }

   // Replies to the message with a file descriptor.
   Status<void> MessageReplyFd(Message* message, unsigned int push_fd) {
     UNUSED(message);
     UNUSED(push_fd);
     return Status<void>();
   }

   // Replies to the message with a local channel handle.
   Status<void> MessageReplyChannelHandle(Message* message,
                                          const LocalChannelHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<void>();
   }

   // Replies to the message with a borrowed local channel handle.
   Status<void> MessageReplyChannelHandle(Message* message,
                                          const BorrowedChannelHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<void>();
   }

   // Replies to the message with a remote channel handle.
   Status<void> MessageReplyChannelHandle(Message* message,
                                          const RemoteChannelHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<void>();
   }

   // Reads message data into an array of memory buffers.
   Status<size_t> ReadMessageData(Message* message, const iovec* vector,
                                  size_t vector_length) {
     UNUSED(message);
     UNUSED(vector);
     UNUSED(vector_length);
     return Status<size_t>();
   }

   // Sends reply data for message.
   Status<size_t> WriteMessageData(Message* message, const iovec* vector,
                                   size_t vector_length) {
     UNUSED(message);
     UNUSED(vector);
     UNUSED(vector_length);
     return Status<size_t>();
   }

   // Records a file descriptor into the message buffer and returns the
   // remapped reference to be sent to the remote process.
   Status<FileReference> PushFileHandle(Message* message,
                                        const LocalHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<FileReference>();
   }

   Status<FileReference> PushFileHandle(Message* message,
                                        const BorrowedHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<FileReference>();
   }

   Status<FileReference> PushFileHandle(Message* message,
                                        const RemoteHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<FileReference>();
   }

   Status<ChannelReference> PushChannelHandle(Message* message,
                                              const LocalChannelHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<ChannelReference>();
   }

   Status<ChannelReference> PushChannelHandle(
       Message* message, const BorrowedChannelHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<ChannelReference>();
   }

   Status<ChannelReference> PushChannelHandle(
       Message* message, const RemoteChannelHandle& handle) {
     UNUSED(message);
     UNUSED(handle);
     return Status<ChannelReference>();
   }

   // Obtains a file descriptor/channel handle from a message for the given
   // reference.
   LocalHandle GetFileHandle(Message* message, FileReference ref) const {
     UNUSED(message);
     UNUSED(ref);
     return LocalHandle();
   }

   LocalChannelHandle GetChannelHandle(Message* message,
                                       ChannelReference ref) const {
     UNUSED(message);
     UNUSED(ref);
     return LocalChannelHandle();
   }

   // Transport-specific message state management.
   void* AllocateMessageState() { return nullptr; }

   void FreeMessageState(void* state) { UNUSED(state); }

   // Cancels the endpoint, unblocking any receiver threads waiting for a
   // message.
   Status<void> Cancel() { return Status<void>(); }

  private:
   FuzzedDataProvider* _fdp;
   std::shared_ptr<Channel> _channel;
   Service* _service;
   int _epoll_fd;
 };

 #endif  // LEV_FUZZERS_LIBPDX_HELPERS_H_
	/*
	* Copyright 2020 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	// Authors: corbin.souffrant@leviathansecurity.com
	// brian.balling@leviathansecurity.com

	#ifndef LEV_FUZZERS_LIBPDX_HELPERS_H_
	#define LEV_FUZZERS_LIBPDX_HELPERS_H_

	#define UNUSED(expr) \
	do { \
	(void)(expr); \
	} while (0)

	#include <fuzzer/FuzzedDataProvider.h>
	#include <pdx/client.h>
	#include <pdx/service.h>
	#include <pdx/service_dispatcher.h>
	#include <pdx/service_endpoint.h>
	#include <sys/eventfd.h>
	#include <memory>
	#include <vector>

	using namespace android::pdx;

	// Vector of operations we can call in the dispatcher.
	static const std::vector<std::function<void(
	const std::unique_ptr<ServiceDispatcher>&, FuzzedDataProvider*)>>
	dispatcher_operations = {
	[](const std::unique_ptr<ServiceDispatcher>& dispatcher,
	FuzzedDataProvider*) -> void { dispatcher->EnterDispatchLoop(); },
	[](const std::unique_ptr<ServiceDispatcher>& dispatcher,
	FuzzedDataProvider*) -> void { dispatcher->ReceiveAndDispatch(); },
	[](const std::unique_ptr<ServiceDispatcher>& dispatcher,
	FuzzedDataProvider* fdp) -> void {
	dispatcher->ReceiveAndDispatch(fdp->ConsumeIntegral<int>());
	}};

	// Most of the fuzzing occurs within the endpoint, which is derived from an
	// abstract class. So we are returning garbage data for most functions besides
	// the ones we added or need to actually use.
	class FuzzEndpoint : public Endpoint {
	public:
	explicit FuzzEndpoint(FuzzedDataProvider* fdp) {
	_fdp = fdp;
	_epoll_fd = eventfd(0, 0);
	}

	~FuzzEndpoint() { close(_epoll_fd); }

	// Returns an fd that can be used with epoll() to wait for incoming messages
	// from this endpoint.
	int epoll_fd() const { return _epoll_fd; }

	// Associates a Service instance with an endpoint by setting the service
	// context pointer to the address of the Service. Only one Service may be
	// associated with a given endpoint.
	Status<void> SetService(Service* service) {
	_service = service;
	return Status<void>(0);
	}

	// Set the channel context for the given channel.
	Status<void> SetChannel(int channel_id, Channel* channel) {
	UNUSED(channel_id);
	_channel = std::shared_ptr<Channel>(channel);
	return Status<void>(0);
	}

	// Receives a message on the given endpoint file descriptor.
	// This is called by the dispatcher to determine what operations
	// to make, so we are fuzzing the response.
	Status<void> MessageReceive(Message* message) {
	// Create a randomized MessageInfo struct.
	MessageInfo info;
	eventfd_t wakeup_val = 0;
	info.pid = _fdp->ConsumeIntegral<int>();
	info.tid = _fdp->ConsumeIntegral<int>();
	info.cid = _fdp->ConsumeIntegral<int>();
	info.mid = _fdp->ConsumeIntegral<int>();
	info.euid = _fdp->ConsumeIntegral<int>();
	info.egid = _fdp->ConsumeIntegral<int>();
	info.op = _fdp->ConsumeIntegral<int32_t>();
	info.flags = _fdp->ConsumeIntegral<uint32_t>();
	info.service = _service;
	info.channel = _channel.get();
	info.send_len = _fdp->ConsumeIntegral<size_t>();
	info.recv_len = _fdp->ConsumeIntegral<size_t>();
	info.fd_count = _fdp->ConsumeIntegral<size_t>();
	if (_fdp->remaining_bytes() >= 32) {
	std::vector<uint8_t> impulse_vec = _fdp->ConsumeBytes<uint8_t>(32);
	memcpy(info.impulse, impulse_vec.data(), 32);
	}

	*message = Message(info);
	eventfd_read(_epoll_fd, &wakeup_val);

	return Status<void>();
	}

	// Returns a tag that uniquely identifies a specific underlying IPC
	// transport.
	uint32_t GetIpcTag() const { return 0; }

	// Close a channel, signaling the client file object and freeing the channel
	// id. Once closed, the client side of the channel always returns the error
	// ESHUTDOWN and signals the poll/epoll events POLLHUP and POLLFREE.
	Status<void> CloseChannel(int channel_id) {
	UNUSED(channel_id);
	return Status<void>();
	}

	// Update the event bits for the given channel (given by id), using the
	// given clear and set masks.
	Status<void> ModifyChannelEvents(int channel_id, int clear_mask,
	int set_mask) {
	UNUSED(channel_id);
	UNUSED(clear_mask);
	UNUSED(set_mask);
	return Status<void>();
	}

	// Create a new channel and push it as a file descriptor to the process
	// sending the \|message\|. \|flags\| may be set to O_NONBLOCK and/or
	// O_CLOEXEC to control the initial behavior of the new file descriptor (the
	// sending process may change these later using fcntl()). The internal
	// Channel instance associated with this channel is set to \|channel\|,
	// which may be nullptr. The new channel id allocated for this channel is
	// returned in \|channel_id\|, which may also be nullptr if not needed.
	Status<RemoteChannelHandle> PushChannel(Message* message, int flags,
	Channel* channel, int* channel_id) {
	UNUSED(message);
	UNUSED(flags);
	UNUSED(channel);
	UNUSED(channel_id);
	return Status<RemoteChannelHandle>();
	}

	// Check whether the \|ref\| is a reference to a channel to the service
	// represented by the \|endpoint\|. If the channel reference in question is
	// valid, the Channel object is returned in \|channel\| when non-nullptr and
	// the channel ID is returned through the Status object.
	Status<int> CheckChannel(const Message* message, ChannelReference ref,
	Channel** channel) {
	UNUSED(message);
	UNUSED(ref);
	UNUSED(channel);
	return Status<int>();
	}

	// Replies to the message with a return code.
	Status<void> MessageReply(Message* message, int return_code) {
	UNUSED(message);
	UNUSED(return_code);
	return Status<void>();
	}

	// Replies to the message with a file descriptor.
	Status<void> MessageReplyFd(Message* message, unsigned int push_fd) {
	UNUSED(message);
	UNUSED(push_fd);
	return Status<void>();
	}

	// Replies to the message with a local channel handle.
	Status<void> MessageReplyChannelHandle(Message* message,
	const LocalChannelHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<void>();
	}

	// Replies to the message with a borrowed local channel handle.
	Status<void> MessageReplyChannelHandle(Message* message,
	const BorrowedChannelHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<void>();
	}

	// Replies to the message with a remote channel handle.
	Status<void> MessageReplyChannelHandle(Message* message,
	const RemoteChannelHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<void>();
	}

	// Reads message data into an array of memory buffers.
	Status<size_t> ReadMessageData(Message* message, const iovec* vector,
	size_t vector_length) {
	UNUSED(message);
	UNUSED(vector);
	UNUSED(vector_length);
	return Status<size_t>();
	}

	// Sends reply data for message.
	Status<size_t> WriteMessageData(Message* message, const iovec* vector,
	size_t vector_length) {
	UNUSED(message);
	UNUSED(vector);
	UNUSED(vector_length);
	return Status<size_t>();
	}

	// Records a file descriptor into the message buffer and returns the
	// remapped reference to be sent to the remote process.
	Status<FileReference> PushFileHandle(Message* message,
	const LocalHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<FileReference>();
	}

	Status<FileReference> PushFileHandle(Message* message,
	const BorrowedHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<FileReference>();
	}

	Status<FileReference> PushFileHandle(Message* message,
	const RemoteHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<FileReference>();
	}

	Status<ChannelReference> PushChannelHandle(Message* message,
	const LocalChannelHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<ChannelReference>();
	}

	Status<ChannelReference> PushChannelHandle(
	Message* message, const BorrowedChannelHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<ChannelReference>();
	}

	Status<ChannelReference> PushChannelHandle(
	Message* message, const RemoteChannelHandle& handle) {
	UNUSED(message);
	UNUSED(handle);
	return Status<ChannelReference>();
	}

	// Obtains a file descriptor/channel handle from a message for the given
	// reference.
	LocalHandle GetFileHandle(Message* message, FileReference ref) const {
	UNUSED(message);
	UNUSED(ref);
	return LocalHandle();
	}

	LocalChannelHandle GetChannelHandle(Message* message,
	ChannelReference ref) const {
	UNUSED(message);
	UNUSED(ref);
	return LocalChannelHandle();
	}

	// Transport-specific message state management.
	void* AllocateMessageState() { return nullptr; }

	void FreeMessageState(void* state) { UNUSED(state); }

	// Cancels the endpoint, unblocking any receiver threads waiting for a
	// message.
	Status<void> Cancel() { return Status<void>(); }

	private:
	FuzzedDataProvider* _fdp;
	std::shared_ptr<Channel> _channel;
	Service* _service;
	int _epoll_fd;
	};

	#endif // LEV_FUZZERS_LIBPDX_HELPERS_H_