binder_parcel_fuzzer: split out random_parcel.h
This creates libbinder_random_parcel which can create a random libbinder
parcel, complete with random fds/random binder objects, for use in other
fuzzers.
Future considerations:
- also export NdkBinderParcelAdapter, for use fuzzing libbinder_ndk
users
- implement similar functionality for libhwbinder
Bug: N/A
Test: binder_parcel_fuzzer
Change-Id: I4943c5e8b6662a8155dc42109eda245f35eedef8
diff --git a/libs/binder/parcel_fuzzer/Android.bp b/libs/binder/parcel_fuzzer/Android.bp
index 1a67898..c5b3d80 100644
--- a/libs/binder/parcel_fuzzer/Android.bp
+++ b/libs/binder/parcel_fuzzer/Android.bp
@@ -18,6 +18,7 @@
],
static_libs: [
"libbase",
+ "libbinder_random_parcel",
"libcgrouprc",
"libcgrouprc_format",
"libcutils",
@@ -47,3 +48,20 @@
// produced, you may find uncommenting the below line very useful.
// cflags: ["-DENABLE_LOG_FUZZ"],
}
+
+cc_library_static {
+ name: "libbinder_random_parcel",
+ host_supported: true,
+ srcs: [
+ "random_fd.cpp",
+ "random_parcel.cpp",
+ ],
+ shared_libs: [
+ "libbase",
+ "libbinder",
+ "libcutils",
+ "libutils",
+ ],
+ local_include_dirs: ["include_random_parcel"],
+ export_include_dirs: ["include_random_parcel"],
+}
diff --git a/libs/binder/parcel_fuzzer/random_fd.h b/libs/binder/parcel_fuzzer/include_random_parcel/fuzzbinder/random_fd.h
similarity index 100%
rename from libs/binder/parcel_fuzzer/random_fd.h
rename to libs/binder/parcel_fuzzer/include_random_parcel/fuzzbinder/random_fd.h
diff --git a/libs/binder/parcel_fuzzer/random_parcel.h b/libs/binder/parcel_fuzzer/include_random_parcel/fuzzbinder/random_parcel.h
similarity index 88%
rename from libs/binder/parcel_fuzzer/random_parcel.h
rename to libs/binder/parcel_fuzzer/include_random_parcel/fuzzbinder/random_parcel.h
index 2923c47..b92a6a9 100644
--- a/libs/binder/parcel_fuzzer/random_parcel.h
+++ b/libs/binder/parcel_fuzzer/include_random_parcel/fuzzbinder/random_parcel.h
@@ -16,12 +16,9 @@
#pragma once
-#include "binder_ndk.h"
-
#include <binder/Parcel.h>
#include <fuzzer/FuzzedDataProvider.h>
namespace android {
void fillRandomParcel(Parcel* p, FuzzedDataProvider&& provider);
-void fillRandomParcel(NdkParcelAdapter* p, FuzzedDataProvider&& provider);
} // namespace android
diff --git a/libs/binder/parcel_fuzzer/main.cpp b/libs/binder/parcel_fuzzer/main.cpp
index 46bf417..386c70b 100644
--- a/libs/binder/parcel_fuzzer/main.cpp
+++ b/libs/binder/parcel_fuzzer/main.cpp
@@ -18,10 +18,10 @@
#include "binder.h"
#include "binder_ndk.h"
#include "hwbinder.h"
-#include "random_parcel.h"
#include "util.h"
#include <android-base/logging.h>
+#include <fuzzbinder/random_parcel.h>
#include <fuzzer/FuzzedDataProvider.h>
#include <cstdlib>
@@ -30,9 +30,14 @@
using android::fillRandomParcel;
void fillRandomParcel(::android::hardware::Parcel* p, FuzzedDataProvider&& provider) {
+ // TODO: functionality to create random parcels for libhwbinder parcels
std::vector<uint8_t> input = provider.ConsumeRemainingBytes<uint8_t>();
p->setData(input.data(), input.size());
}
+static void fillRandomParcel(NdkParcelAdapter* p, FuzzedDataProvider&& provider) {
+ // fill underlying parcel using functions to fill random libbinder parcel
+ fillRandomParcel(p->parcel(), std::move(provider));
+}
template <typename P>
void doFuzz(const char* backend, const std::vector<ParcelRead<P>>& reads,
diff --git a/libs/binder/parcel_fuzzer/random_fd.cpp b/libs/binder/parcel_fuzzer/random_fd.cpp
index eb80ece..cef6adb 100644
--- a/libs/binder/parcel_fuzzer/random_fd.cpp
+++ b/libs/binder/parcel_fuzzer/random_fd.cpp
@@ -14,7 +14,7 @@
* limitations under the License.
*/
-#include "random_fd.h"
+#include <fuzzbinder/random_fd.h>
#include <fcntl.h>
diff --git a/libs/binder/parcel_fuzzer/random_parcel.cpp b/libs/binder/parcel_fuzzer/random_parcel.cpp
index 3dae904..9ca4c8a 100644
--- a/libs/binder/parcel_fuzzer/random_parcel.cpp
+++ b/libs/binder/parcel_fuzzer/random_parcel.cpp
@@ -14,20 +14,15 @@
* limitations under the License.
*/
-#include "random_parcel.h"
-
-#include "random_fd.h"
+#include <fuzzbinder/random_parcel.h>
#include <android-base/logging.h>
#include <binder/IServiceManager.h>
+#include <fuzzbinder/random_fd.h>
#include <utils/String16.h>
namespace android {
-void fillRandomParcel(NdkParcelAdapter* p, FuzzedDataProvider&& provider) {
- fillRandomParcel(p->parcel(), std::move(provider));
-}
-
class NamedBinder : public BBinder {
public:
NamedBinder(const String16& descriptor) : mDescriptor(descriptor) {}