Skip to content

Commit cae288b

Browse files
author
Steven Moreland
committed
binder_parcel_fuzzer: add markSensitive coverage
Small change to improve fuzzing coverage on Parcel. Bug: 369404061 Test: binder_parcel_fuzzer Change-Id: I4acabf22dc4e7d2ad0b416f2dd02d8e04b1e5736
1 parent b2361af commit cae288b

2 files changed

Lines changed: 15 additions & 0 deletions

File tree

libs/binder/tests/parcel_fuzzer/binder.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,11 @@ std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS {
121121
PARCEL_READ_NO_STATUS(size_t, hasFileDescriptors),
122122
PARCEL_READ_NO_STATUS(std::vector<android::sp<android::IBinder>>, debugReadAllStrongBinders),
123123
PARCEL_READ_NO_STATUS(std::vector<int>, debugReadAllFileDescriptors),
124+
[] (const ::android::Parcel& p, FuzzedDataProvider&) {
125+
FUZZ_LOG() << "about to markSensitive";
126+
p.markSensitive();
127+
FUZZ_LOG() << "markSensitive done";
128+
},
124129
[] (const ::android::Parcel& p, FuzzedDataProvider& provider) {
125130
std::string interface = provider.ConsumeRandomLengthString();
126131
FUZZ_LOG() << "about to enforceInterface: " << interface;

libs/binder/tests/parcel_fuzzer/random_parcel.cpp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,13 @@ void fillRandomParcel(Parcel* outputParcel, FuzzedDataProvider&& provider,
4040
const uint8_t fuzzerParcelOptions = provider.ConsumeIntegral<uint8_t>();
4141
const bool resultShouldBeView = fuzzerParcelOptions & 1;
4242
const bool resultShouldBeRpc = fuzzerParcelOptions & 2;
43+
const bool resultShouldMarkSensitive = fuzzerParcelOptions & 4;
44+
45+
auto sensitivity_guard = binder::impl::make_scope_guard([&]() {
46+
if (resultShouldMarkSensitive) {
47+
outputParcel->markSensitive();
48+
}
49+
});
4350

4451
Parcel* p;
4552
if (resultShouldBeView) {
@@ -49,6 +56,9 @@ void fillRandomParcel(Parcel* outputParcel, FuzzedDataProvider&& provider,
4956
} else {
5057
p = outputParcel; // directly fill out the output Parcel
5158
}
59+
60+
// must be last guard, so outputParcel gets setup as view before
61+
// other guards
5262
auto viewify_guard = binder::impl::make_scope_guard([&]() {
5363
if (resultShouldBeView) {
5464
outputParcel->makeDangerousViewOf(p);

0 commit comments

Comments
 (0)