commit f1930a127f0c839b1e241b0aac60194f45817731
author Siarhei Vishniakou <svv@google.com> Thu Nov 16 10:28:05 2023 -0800
committer Siarhei Vishniakou <svv@google.com> Tue Dec 12 14:53:29 2023 -0800
tree 2247c29556a4fab57829914b6fe3d32690214f3c
parent bee1f54422b1cc7e12d8df08b5b8ab3f2fb69885

Scramble input windows during fuzzing

Add functionality of scrambling windows for the dispatcher fuzzer.
This allows greater coverage of the dispatcher code.

Also, skip events with ACTION_SCROLL because they might contain an
invalid number of pointers, and they won't correctly be rejected because
we aren't verifying them right now.

Bug: 287342122
Test: FUZZER=inputflinger_input_dispatcher_fuzzer; m $FUZZER && ASAN_OPTIONS=detect_odr_violation=0 $ANDROID_HOST_OUT/fuzz/x86_64/$FUZZER/$FUZZER
Change-Id: I6715ee0327cb5cde76996f1c6a80ceba15030aef

services/inputflinger/tests/fuzzers/InputDispatcherFuzzer.cpp

diff --git a/services/inputflinger/tests/fuzzers/InputDispatcherFuzzer.cpp b/services/inputflinger/tests/fuzzers/InputDispatcherFuzzer.cpp
index 0bd8fb3..dc5a213 100644
--- a/services/inputflinger/tests/fuzzers/InputDispatcherFuzzer.cpp
+++ b/services/inputflinger/tests/fuzzers/InputDispatcherFuzzer.cpp
@@ -65,6 +65,27 @@
     std::map<int32_t /*displayId*/, InputVerifier> mVerifiers;
 };
 
+void scrambleWindow(FuzzedDataProvider& fdp, FakeWindowHandle& window) {
+    const int32_t left = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
+    const int32_t top = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
+    const int32_t width = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
+    const int32_t height = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
+
+    window.setFrame(Rect(left, top, left + width, top + height));
+    window.setSlippery(fdp.ConsumeBool());
+    window.setDupTouchToWallpaper(fdp.ConsumeBool());
+    window.setIsWallpaper(fdp.ConsumeBool());
+    window.setVisible(fdp.ConsumeBool());
+    window.setPreventSplitting(fdp.ConsumeBool());
+    const bool isTrustedOverlay = fdp.ConsumeBool();
+    window.setTrustedOverlay(isTrustedOverlay);
+    if (isTrustedOverlay) {
+        window.setSpy(fdp.ConsumeBool());
+    } else {
+        window.setSpy(false);
+    }
+}
+
 } // namespace
 
 sp<FakeWindowHandle> generateFuzzedWindow(FuzzedDataProvider& fdp, InputDispatcher& dispatcher,
@@ -73,17 +94,9 @@
     std::shared_ptr<FakeApplicationHandle> application = std::make_shared<FakeApplicationHandle>();
     std::string windowName = android::base::StringPrintf("Win") + std::to_string(windowNumber++);
     sp<FakeWindowHandle> window =
-            sp<FakeWindowHandle>::make(application, dispatcher, "Fake", displayId);
+            sp<FakeWindowHandle>::make(application, dispatcher, windowName, displayId);
 
-    const int32_t left = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
-    const int32_t top = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
-    const int32_t width = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
-    const int32_t height = fdp.ConsumeIntegralInRange<int32_t>(0, 100);
-
-    window->setFrame(Rect(left, top, left + width, top + height));
-    window->setSlippery(fdp.ConsumeBool());
-    window->setDupTouchToWallpaper(fdp.ConsumeBool());
-    window->setTrustedOverlay(fdp.ConsumeBool());
+    scrambleWindow(fdp, *window);
     return window;
 }
 
@@ -113,7 +126,14 @@
                     windowsPerDisplay.erase(displayId);
                 }
             },
-            // Could also clone a window, change flags, reposition, etc...
+            // Change flags or move some of the existing windows
+            [&]() -> void {
+                for (auto& window : windows) {
+                    if (fdp.ConsumeBool()) {
+                        scrambleWindow(fdp, *window);
+                    }
+                }
+            },
     })();
 }