1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <StatusFuzzFunctions.h>
18 #include <binder/Parcel.h>
19 #include <binder/Status.h>
20 #include <commonFuzzHelpers.h>
21 #include <fuzzer/FuzzedDataProvider.h>
22 #include <utils/String8.h>
23 #include <cstdint>
24 #include <sstream>
25 #include <string>
26
27 namespace android {
28 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)29 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
30 FuzzedDataProvider fdp(data, size);
31
32 int32_t exceptionCode = fdp.ConsumeIntegral<int32_t>();
33 std::string message_str = fdp.ConsumeRandomLengthString(fdp.remaining_bytes());
34 String8 message(message_str.c_str());
35
36 Parcel parcel;
37 std::vector<uint8_t> buf = fdp.ConsumeBytes<uint8_t>(
38 fdp.ConsumeIntegralInRange<size_t>(0, fdp.remaining_bytes() - 1));
39 parcel.write(buf.data(), buf.size());
40 binder::Status status = binder::Status::fromExceptionCode(exceptionCode, message);
41
42 while (fdp.remaining_bytes() > 0) {
43 callArbitraryFunction(&fdp, gStatusOperations, &status, &parcel);
44 }
45 return 0;
46 }
47 } // namespace android
48