1 /* 2 * Copyright 2020 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef FUZZING_ORPHANS_LIBFFI_FUZZ_FFI_H_ 18 #define FUZZING_ORPHANS_LIBFFI_FUZZ_FFI_H_ 19 20 #include <fuzzer/FuzzedDataProvider.h> 21 #include <ffi.h> 22 #include <cstdarg> 23 #include <vector> 24 25 #if defined(__GNUC__) 26 #define __UNUSED__ __attribute__((__unused__)) 27 #endif 28 29 #define MAX_NUM_ARGS 128 30 #define MAX_NUM_ELEMENTS 16 31 #define MAX_RESP_SIZE 4096 32 33 // TODO(michael.ensing@leviathansecurity.com): 34 // Ideally, we should add/remove supported types based on 35 // arch-specific #defines (listed in ffi_gen.h) 36 #define NUM_TYPES 21 37 ffi_type* ffi_types[] = { 38 &ffi_type_uchar, 39 &ffi_type_schar, 40 &ffi_type_ushort, 41 &ffi_type_sshort, 42 &ffi_type_uint, 43 &ffi_type_sint, 44 &ffi_type_ulong, 45 &ffi_type_slong, 46 &ffi_type_void, 47 &ffi_type_uint8, 48 &ffi_type_sint8, 49 &ffi_type_uint16, 50 &ffi_type_sint16, 51 &ffi_type_uint32, 52 &ffi_type_sint32, 53 &ffi_type_uint64, 54 &ffi_type_sint64, 55 &ffi_type_float, 56 &ffi_type_double, 57 &ffi_type_pointer, 58 &ffi_type_longdouble, 59 // The following types are not available on some architectures 60 // &ffi_type_complex_float, 61 // &ffi_type_complex_double, 62 // &ffi_type_complex_longdouble, 63 // // nullptrs are used to terminate the array. Handle them manually. 64 // nullptr 65 }; 66 67 // Store vectors of allocated objects 68 std::vector<ffi_type*> ffi_alloc_vector; 69 std::vector<void*> raw_alloc_vector; 70 71 72 // Keep a boolean to track if the args have a struct, 73 // which will trigger an abort on java calls 74 bool args_contain_struct = false; 75 76 // Store the current ABI as a global 77 ffi_abi abi = FFI_DEFAULT_ABI; 78 79 // Define the number of possible ffi_abi values 80 // NOTE: Only supported architectures are arm/arm64, x86_64 81 // arm 82 #if defined(ARM) 83 #define MAX_ABI 4 84 // x86_64 85 #elif defined(X86_64) || (defined(__x86_64__) && defined(X86_DARWIN)) 86 #define MAX_ABI 7 87 #else 88 #define MAX_ABI 0 // If we hit this case, do NOT fuzz the abi value. 89 #endif 90 91 // Retrieve the total size (in bytes) of a ffi_type. 92 // Useful for custom structs 93 size_t getTotalSize(ffi_type*); 94 95 // Retrieve a random type from the ffi_types array 96 ffi_type* getRandomType(FuzzedDataProvider*, bool); 97 98 // Generates a custom struct, in ffi_type format 99 ffi_type* generateCustomType(FuzzedDataProvider*); 100 101 // Copies buffer data into a buffer described by the provided ffi_type 102 // (may be a struct or have subobjects) 103 size_t copyArg(ffi_type*, void*, FuzzedDataProvider*); 104 105 // Builds out the arrays of ffi_types and arguments to define a function's 106 // parameters. Returns true on success, false on failure. 107 bool buildArgArrays(ffi_type*[], void*[], size_t, FuzzedDataProvider*); 108 109 // Allocates the necessary space for a new argument buffer for given ffi_type 110 // After allocation, calls copyArg() to fill buffer with data 111 void* genArg(ffi_type*, FuzzedDataProvider*); 112 113 // Functions to perform our library calls 114 void runMainFunctions(ffi_cif&, void*, void**, FuzzedDataProvider*); 115 void runRawFunctions(ffi_cif&, void*, void**, FuzzedDataProvider*); 116 void runJavaFunctions(ffi_cif&, void*, void**, FuzzedDataProvider*); 117 118 // Free any custom struct ffi_type objects 119 // Safe to call on default types. 120 void freeFFI(ffi_type*); 121 122 // Frees all elements that the fuzzer has allocated 123 void freeAll(); 124 125 #endif // FUZZING_ORPHANS_LIBFFI_FUZZ_FFI_H_ 126