1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "aidl.h"
18 #include "fake_io_delegate.h"
19 #include "options.h"
20
21 #include <fuzzer/FuzzedDataProvider.h>
22 #include <iostream>
23
24 #ifdef FUZZ_LOG
25 constexpr bool kFuzzLog = true;
26 #else
27 constexpr bool kFuzzLog = false;
28 #endif
29
30 using android::aidl::test::FakeIoDelegate;
31
fuzz(const FakeIoDelegate & io,const std::vector<std::string> & args)32 void fuzz(const FakeIoDelegate& io, const std::vector<std::string>& args) {
33 if (kFuzzLog) {
34 std::cout << "cmd: ";
35 for (const std::string& arg : args) {
36 std::cout << arg << " ";
37 }
38 std::cout << std::endl;
39
40 for (const auto& [f, input] : io.InputFiles()) {
41 std::cout << "INPUT " << f << ": " << input << std::endl;
42 }
43 }
44
45 int ret = android::aidl::aidl_entry(Options::From(args), io);
46 if (ret != 0) return;
47
48 if (kFuzzLog) {
49 for (const auto& [f, output] : io.OutputFiles()) {
50 std::cout << "OUTPUT " << f << ": " << std::endl;
51 std::cout << output << std::endl;
52 }
53 }
54 }
55
fuzzLang(const std::string & langOpt,const std::string & content)56 void fuzzLang(const std::string& langOpt, const std::string& content) {
57 FakeIoDelegate io;
58 io.SetFileContents("a/path/Foo.aidl", content);
59
60 std::vector<std::string> args;
61 args.emplace_back("aidl");
62 args.emplace_back("--lang=" + langOpt);
63 args.emplace_back("-b");
64 args.emplace_back("-I .");
65 args.emplace_back("-o out");
66 // corresponding package also in aidl_parser_fuzzer.dict
67 args.emplace_back("a/path/Foo.aidl");
68
69 fuzz(io, args);
70 }
71
fuzzCheckApi(const std::string & a,const std::string & b)72 void fuzzCheckApi(const std::string& a, const std::string& b) {
73 FakeIoDelegate io;
74 io.SetFileContents("a/path/Foo.aidl", a);
75 io.SetFileContents("b/path/Foo.aidl", b);
76
77 std::vector<std::string> args;
78 args.emplace_back("aidl");
79 args.emplace_back("--checkapi");
80 // corresponding package also in aidl_parser_fuzzer.dict
81 args.emplace_back("a/path/");
82 args.emplace_back("b/path/");
83
84 fuzz(io, args);
85 }
86
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)87 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
88 if (size <= 1) return 0; // no use
89
90 // b/145447540, large nested expressions sometimes hit the stack depth limit.
91 // Fuzzing things of this size don't provide any additional meaningful
92 // coverage. This is an approximate value which should allow us to explore all
93 // of the language w/o hitting a stack overflow.
94 if (size > 2000) return 0;
95
96 FuzzedDataProvider provider = FuzzedDataProvider(data, size);
97
98 if (provider.ConsumeBool()) {
99 std::string content = provider.ConsumeRemainingBytesAsString();
100
101 fuzzLang("ndk", content);
102 fuzzLang("cpp", content);
103 fuzzLang("java", content);
104 fuzzLang("rust", content);
105 } else {
106 std::string contentA = provider.ConsumeRandomLengthString();
107 std::string contentB = provider.ConsumeRemainingBytesAsString();
108
109 fuzzCheckApi(contentA, contentB);
110 }
111
112 return 0;
113 }
114