Skip to content

Commit f54ab06

Browse files
author
Akhilesh Sanikop
committed
inputflinger: Restricted invalid MotionEvent button enum values
Fixes an issue by passing valid MotionEvent buttons through NotifyMotionArgs() in FuzzedInputStream.h. Added IfThisThenThat Lint to remind the actionButton to sync Test: m frameworks/native/services/inputflinger/tests/fuzzers Bug: 392345690 Flag: EXEMPT bugfix in fuzzer Change-Id: I7c2108a255114b24e6544aa930696079e4f06b77
1 parent 56f5ad2 commit f54ab06

2 files changed

Lines changed: 13 additions & 7 deletions

File tree

include/android/input.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -862,7 +862,7 @@ enum {
862862
AMOTION_EVENT_BUTTON_FORWARD = 1 << 4,
863863
AMOTION_EVENT_BUTTON_STYLUS_PRIMARY = 1 << 5,
864864
AMOTION_EVENT_BUTTON_STYLUS_SECONDARY = 1 << 6,
865-
// LINT.ThenChange(/frameworks/native/libs/input/rust/input.rs)
865+
// LINT.ThenChange(/frameworks/native/libs/input/rust/input.rs,/frameworks/native/services/inputflinger/tests/fuzzers/FuzzedInputStream.h)
866866
};
867867

868868
/**

services/inputflinger/tests/fuzzers/FuzzedInputStream.h

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@ namespace android {
2121
static constexpr int32_t MAX_RANDOM_POINTERS = 4;
2222
static constexpr int32_t MAX_RANDOM_DEVICES = 4;
2323

24+
// The maximum value that we use for the action button field of NotifyMotionArgs. (We allow multiple
25+
// bits to be set for this since we're just trying to generate a fuzzed event stream that doesn't
26+
// cause crashes when enum values are converted to Rust — we don't necessarily want it to be valid.)
27+
//
28+
// AMOTION_EVENT_BUTTON_STYLUS_SECONDARY should be replaced with whatever AMOTION_EVENT_BUTTON_
29+
// value is highest if the enum is edited.
30+
static constexpr int8_t MAX_ACTION_BUTTON_VALUE = (AMOTION_EVENT_BUTTON_STYLUS_SECONDARY << 1) - 1;
31+
2432
int getFuzzedMotionAction(FuzzedDataProvider& fdp) {
2533
int actionMasked = fdp.PickValueInArray<int>({
2634
AMOTION_EVENT_ACTION_DOWN, AMOTION_EVENT_ACTION_UP, AMOTION_EVENT_ACTION_MOVE,
@@ -185,18 +193,16 @@ NotifyMotionArgs generateFuzzedMotionArgs(IdGenerator& idGenerator, FuzzedDataPr
185193
fdp.ConsumeIntegralInRange<nsecs_t>(currentTime - 5E9, currentTime + 5E9);
186194
const nsecs_t readTime = downTime;
187195
const nsecs_t eventTime = fdp.ConsumeIntegralInRange<nsecs_t>(downTime, downTime + 1E9);
196+
const int32_t actionButton = fdp.ConsumeIntegralInRange<int32_t>(0, MAX_ACTION_BUTTON_VALUE);
188197

189198
const float cursorX = fdp.ConsumeIntegralInRange<int>(-10000, 10000);
190199
const float cursorY = fdp.ConsumeIntegralInRange<int>(-10000, 10000);
191200
return NotifyMotionArgs(idGenerator.nextId(), eventTime, readTime, deviceId, source, displayId,
192-
POLICY_FLAG_PASS_TO_USER, action,
193-
/*actionButton=*/fdp.ConsumeIntegral<int32_t>(),
201+
POLICY_FLAG_PASS_TO_USER, action, actionButton,
194202
getFuzzedFlags(fdp, action), AMETA_NONE, getFuzzedButtonState(fdp),
195203
MotionClassification::NONE, AMOTION_EVENT_EDGE_FLAG_NONE, pointerCount,
196-
pointerProperties.data(), pointerCoords.data(),
197-
/*xPrecision=*/0,
198-
/*yPrecision=*/0, cursorX, cursorY, downTime,
199-
/*videoFrames=*/{});
204+
pointerProperties.data(), pointerCoords.data(), /*xPrecision=*/0,
205+
/*yPrecision=*/0, cursorX, cursorY, downTime, /*videoFrames=*/{});
200206
}
201207

202208
} // namespace android

0 commit comments

Comments
 (0)