1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #define FUZZ_LOG_TAG "main"
17
18 #include "binder.h"
19 #include "binder_ndk.h"
20 #include "hwbinder.h"
21 #include "util.h"
22
23 #include <iostream>
24
25 #include <android-base/logging.h>
26 #include <binder/RpcSession.h>
27 #include <fuzzbinder/random_parcel.h>
28 #include <fuzzer/FuzzedDataProvider.h>
29
30 #include <cstdlib>
31 #include <ctime>
32 #include <sys/resource.h>
33 #include <sys/time.h>
34
35 using android::fillRandomParcel;
36 using android::RpcSession;
37 using android::sp;
38
fillRandomParcel(::android::hardware::Parcel * p,FuzzedDataProvider && provider)39 void fillRandomParcel(::android::hardware::Parcel* p, FuzzedDataProvider&& provider) {
40 // TODO: functionality to create random parcels for libhwbinder parcels
41 std::vector<uint8_t> input = provider.ConsumeRemainingBytes<uint8_t>();
42 p->setData(input.data(), input.size());
43 }
fillRandomParcel(NdkParcelAdapter * p,FuzzedDataProvider && provider)44 static void fillRandomParcel(NdkParcelAdapter* p, FuzzedDataProvider&& provider) {
45 // fill underlying parcel using functions to fill random libbinder parcel
46 fillRandomParcel(p->parcel(), std::move(provider));
47 }
48
49 template <typename P>
doFuzz(const char * backend,const std::vector<ParcelRead<P>> & reads,FuzzedDataProvider && provider)50 void doFuzz(const char* backend, const std::vector<ParcelRead<P>>& reads,
51 FuzzedDataProvider&& provider) {
52 // Allow some majority of the bytes to be dedicated to telling us what to
53 // do. The fixed value added here represents that we want to test doing a
54 // lot of 'instructions' even on really short parcels.
55 size_t maxInstructions = 20 + (provider.remaining_bytes() * 2 / 3);
56 // but don't always use that many instructions. We want to allow the fuzzer
57 // to explore large parcels with few instructions if it wants to.
58 std::vector<uint8_t> instructions = provider.ConsumeBytes<uint8_t>(
59 provider.ConsumeIntegralInRange<size_t>(0, maxInstructions));
60
61 P p;
62 if constexpr (std::is_same_v<P, android::Parcel>) {
63 if (provider.ConsumeBool()) {
64 auto session = sp<RpcSession>::make();
65 CHECK(session->addNullDebuggingClient());
66 p.markForRpc(session);
67 fillRandomParcelData(&p, std::move(provider));
68 } else {
69 fillRandomParcel(&p, std::move(provider));
70 }
71 } else {
72 fillRandomParcel(&p, std::move(provider));
73 }
74
75 // since we are only using a byte to index
76 CHECK(reads.size() <= 255) << reads.size();
77
78 FUZZ_LOG() << "backend: " << backend;
79 FUZZ_LOG() << "input: " << hexString(p.data(), p.dataSize());
80 FUZZ_LOG() << "instructions: " << hexString(instructions);
81
82 for (size_t i = 0; i + 1 < instructions.size(); i += 2) {
83 uint8_t a = instructions[i];
84 uint8_t readIdx = a % reads.size();
85
86 uint8_t b = instructions[i + 1];
87
88 FUZZ_LOG() << "Instruction: " << (i / 2) + 1 << "/" << instructions.size() / 2
89 << " cmd: " << static_cast<size_t>(a) << " (" << static_cast<size_t>(readIdx)
90 << ") arg: " << static_cast<size_t>(b) << " size: " << p.dataSize()
91 << " avail: " << p.dataAvail() << " pos: " << p.dataPosition()
92 << " cap: " << p.dataCapacity();
93
94 reads[readIdx](p, b);
95 }
96 }
97
getHardMemoryLimit()98 size_t getHardMemoryLimit() {
99 struct rlimit limit;
100 CHECK(0 == getrlimit(RLIMIT_AS, &limit)) << errno;
101 return limit.rlim_max;
102 }
103
setMemoryLimit(size_t cur,size_t max)104 void setMemoryLimit(size_t cur, size_t max) {
105 const struct rlimit kLimit = {
106 .rlim_cur = cur,
107 .rlim_max = max,
108 };
109 CHECK(0 == setrlimit(RLIMIT_AS, &kLimit)) << errno;
110 }
111
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)112 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
113 static constexpr size_t kMemLimit = 1 * 1024 * 1024;
114 size_t hardLimit = getHardMemoryLimit();
115 setMemoryLimit(std::min(kMemLimit, hardLimit), hardLimit);
116
117 if (size <= 1) return 0; // no use
118
119 // avoid timeouts, see b/142617274, b/142473153
120 if (size > 50000) return 0;
121
122 FuzzedDataProvider provider = FuzzedDataProvider(data, size);
123
124 const std::function<void(FuzzedDataProvider &&)> fuzzBackend[3] = {
125 [](FuzzedDataProvider&& provider) {
126 doFuzz<::android::hardware::Parcel>("hwbinder", HWBINDER_PARCEL_READ_FUNCTIONS,
127 std::move(provider));
128 },
129 [](FuzzedDataProvider&& provider) {
130 doFuzz<::android::Parcel>("binder", BINDER_PARCEL_READ_FUNCTIONS,
131 std::move(provider));
132 },
133 [](FuzzedDataProvider&& provider) {
134 doFuzz<NdkParcelAdapter>("binder_ndk", BINDER_NDK_PARCEL_READ_FUNCTIONS,
135 std::move(provider));
136 },
137 };
138
139 provider.PickValueInArray(fuzzBackend)(std::move(provider));
140
141 setMemoryLimit(hardLimit, hardLimit);
142
143 return 0;
144 }
145