1 /*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <fuzzbinder/libbinder_ndk_driver.h>
17
18 #include <fuzzbinder/libbinder_driver.h>
19 #include <fuzzbinder/random_parcel.h>
20
21 // libbinder_ndk doesn't export this header which breaks down its API for NDK
22 // and APEX users, but we need access to it to fuzz.
23 #include "../../ndk/ibinder_internal.h"
24
25 using android::IBinder;
26 using android::sp;
27
28 namespace android {
29
fuzzService(const std::vector<ndk::SpAIBinder> & binders,FuzzedDataProvider && provider)30 void fuzzService(const std::vector<ndk::SpAIBinder>& binders, FuzzedDataProvider&& provider) {
31 std::vector<sp<IBinder>> cppBinders;
32 for (const auto& binder : binders) {
33 cppBinders.push_back(binder.get()->getBinder());
34 }
35
36 fuzzService(cppBinders, std::move(provider));
37 }
38
fuzzService(AIBinder * binder,FuzzedDataProvider && provider)39 void fuzzService(AIBinder* binder, FuzzedDataProvider&& provider) {
40 fuzzService(binder->getBinder(), std::move(provider));
41 }
42
43 } // namespace android
44
45 extern "C" {
46 // This API is used by fuzzers to automatically fuzz aidl services
fuzzRustService(void ** binders,size_t numBinders,const uint8_t * data,size_t len)47 void fuzzRustService(void** binders, size_t numBinders, const uint8_t* data, size_t len) {
48 std::vector<sp<IBinder>> cppBinders;
49 for (size_t binderIndex = 0; binderIndex < numBinders; ++binderIndex) {
50 AIBinder* aiBinder = static_cast<AIBinder*>(binders[binderIndex]);
51 cppBinders.push_back(aiBinder->getBinder());
52 }
53
54 FuzzedDataProvider provider(data, len);
55 android::fuzzService(cppBinders, std::move(provider));
56 }
57 } // extern "C"
58