commit f61c0471dedc68b367931cad9e04edf9a24ee05a
author Harry Cutts <hcutts@google.com> Mon Jul 10 14:45:15 2023 +0000
committer Harry Cutts <hcutts@google.com> Wed Jul 19 09:58:34 2023 +0000
tree fc1d0b4a49425eaae7ad4cb2add6ba3cd38f2330
parent 2455b77d1bc34c479f099dfed35c2318212b048f

inputflinger fuzzers: Remove FuzzContainer

As discussed on the touchpad fuzzer CL [0], FuzzContainer was hiding
quite a bit of internal state and making fuzzers harder to understand.
Its constructor appeared to be deduplicating code, but looking more
closely, it wasn't really helping that much, especially for the most
common cases. Replace it with a few static methods, making it clearer
how state is being changed in the fuzzers.

[0] Change ID Ic22ac0f29d433fdf3c17331df620a39937ebd7eb

Bug: 245989146
Test: build and briefly run all modified fuzzers
      $ SANITIZE_TARGET=hwaddress make ${FUZZER_NAME}
      $ cd $ANDROID_PRODUCT_OUT
      $ adb root
      $ adb sync data
      $ adb shell /data/fuzz/$(get_build_var TARGET_ARCH)/${FUZZER_NAME}/${FUZZER_NAME}

Change-Id: I6e28b1f5ec62dc2d084173c1eb461c4bb699678b

services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp

diff --git a/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp b/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp
index 54977df..922cbdf 100644
--- a/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp
+++ b/services/inputflinger/tests/fuzzers/KeyboardInputFuzzer.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#include <FuzzContainer.h>
+#include <InputDevice.h>
 #include <InputReaderBase.h>
 #include <KeyboardInputMapper.h>
 #include <MapperHelpers.h>
@@ -23,38 +23,43 @@
 
 const int32_t kMaxKeycodes = 100;
 
-static void addProperty(FuzzContainer& fuzzer, std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) {
+static void addProperty(FuzzEventHub& eventHub, std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp) {
     // Pick a random property to set for the mapper to have set.
     fdp->PickValueInArray<std::function<void()>>(
-            {[&]() -> void { fuzzer.addProperty("keyboard.orientationAware", "1"); },
+            {[&]() -> void { eventHub.addProperty("keyboard.orientationAware", "1"); },
              [&]() -> void {
-                 fuzzer.addProperty("keyboard.orientationAware",
-                                    fdp->ConsumeRandomLengthString(100).data());
+                 eventHub.addProperty("keyboard.orientationAware",
+                                      fdp->ConsumeRandomLengthString(100).data());
              },
              [&]() -> void {
-                 fuzzer.addProperty("keyboard.doNotWakeByDefault",
-                                    fdp->ConsumeRandomLengthString(100).data());
+                 eventHub.addProperty("keyboard.doNotWakeByDefault",
+                                      fdp->ConsumeRandomLengthString(100).data());
              },
              [&]() -> void {
-                 fuzzer.addProperty("keyboard.handlesKeyRepeat",
-                                    fdp->ConsumeRandomLengthString(100).data());
+                 eventHub.addProperty("keyboard.handlesKeyRepeat",
+                                      fdp->ConsumeRandomLengthString(100).data());
              }})();
 }
 
 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
     std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =
             std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);
-    FuzzContainer fuzzer(fdp);
 
-    KeyboardInputMapper& mapper =
-            fuzzer.getMapper<KeyboardInputMapper>(InputReaderConfiguration{},
-                                                  fdp->ConsumeIntegral<uint32_t>(),
-                                                  fdp->ConsumeIntegral<int32_t>());
+    // Create mocked objects to support the fuzzed input mapper.
+    std::shared_ptr<FuzzEventHub> eventHub = std::make_shared<FuzzEventHub>(fdp);
+    FuzzInputReaderContext context(eventHub, fdp);
+    InputDevice device = getFuzzedInputDevice(*fdp, &context);
+
+    KeyboardInputMapper& mapper = getMapperForDevice<
+            ThreadSafeFuzzedDataProvider,
+            KeyboardInputMapper>(*fdp.get(), device, InputReaderConfiguration{},
+                                 /*source=*/fdp->ConsumeIntegral<uint32_t>(),
+                                 /*keyboardType=*/fdp->ConsumeIntegral<int32_t>());
 
     // Loop through mapper operations until randomness is exhausted.
     while (fdp->remaining_bytes() > 0) {
         fdp->PickValueInArray<std::function<void()>>({
-                [&]() -> void { addProperty(fuzzer, fdp); },
+                [&]() -> void { addProperty(*eventHub.get(), fdp); },
                 [&]() -> void {
                     std::string dump;
                     mapper.dump(dump);