1 /*
2 * Copyright 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <MapperHelpers.h>
18 #include <fuzzer/FuzzedDataProvider.h>
19 #include "FuzzedInputStream.h"
20 #include "InputCommonConverter.h"
21 #include "InputProcessor.h"
22
23 namespace android {
24
25 namespace {
26
27 constexpr int32_t MAX_RANDOM_DISPLAYS = 4;
28
29 }
30
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)31 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
32 FuzzedDataProvider fdp(data, size);
33
34 std::unique_ptr<FuzzInputListener> mFuzzListener = std::make_unique<FuzzInputListener>();
35 std::unique_ptr<InputProcessorInterface> mClassifier =
36 std::make_unique<InputProcessor>(*mFuzzListener);
37 IdGenerator idGenerator(IdGenerator::Source::OTHER);
38
39 while (fdp.remaining_bytes() > 0) {
40 fdp.PickValueInArray<std::function<void()>>({
41 [&]() -> void {
42 // SendToNextStage_NotifyKeyArgs
43 const nsecs_t eventTime =
44 fdp.ConsumeIntegralInRange<nsecs_t>(0,
45 systemTime(SYSTEM_TIME_MONOTONIC));
46 const nsecs_t readTime = fdp.ConsumeIntegralInRange<
47 nsecs_t>(eventTime, std::numeric_limits<nsecs_t>::max());
48 mClassifier->notifyKey({/*sequenceNum=*/fdp.ConsumeIntegral<int32_t>(),
49 eventTime, readTime,
50 /*deviceId=*/fdp.ConsumeIntegral<int32_t>(),
51 AINPUT_SOURCE_KEYBOARD, ui::LogicalDisplayId::DEFAULT,
52 /*policyFlags=*/fdp.ConsumeIntegral<uint32_t>(),
53 AKEY_EVENT_ACTION_DOWN,
54 /*flags=*/fdp.ConsumeIntegral<int32_t>(), AKEYCODE_HOME,
55 /*scanCode=*/fdp.ConsumeIntegral<int32_t>(), AMETA_NONE,
56 /*downTime=*/fdp.ConsumeIntegral<nsecs_t>()});
57 },
58 [&]() -> void {
59 // SendToNextStage_NotifyMotionArgs
60 mClassifier->notifyMotion(
61 generateFuzzedMotionArgs(idGenerator, fdp, MAX_RANDOM_DISPLAYS));
62 },
63 [&]() -> void {
64 // SendToNextStage_NotifySwitchArgs
65 mClassifier->notifySwitch({/*sequenceNum=*/fdp.ConsumeIntegral<int32_t>(),
66 /*eventTime=*/fdp.ConsumeIntegral<nsecs_t>(),
67 /*policyFlags=*/fdp.ConsumeIntegral<uint32_t>(),
68 /*switchValues=*/fdp.ConsumeIntegral<uint32_t>(),
69 /*switchMask=*/fdp.ConsumeIntegral<uint32_t>()});
70 },
71 [&]() -> void {
72 // SendToNextStage_NotifyDeviceResetArgs
73 mClassifier->notifyDeviceReset({/*sequenceNum=*/fdp.ConsumeIntegral<int32_t>(),
74 /*eventTime=*/fdp.ConsumeIntegral<nsecs_t>(),
75 /*deviceId=*/fdp.ConsumeIntegral<int32_t>()});
76 },
77 [&]() -> void {
78 // InputClassifierConverterTest
79 const NotifyMotionArgs motionArgs =
80 generateFuzzedMotionArgs(idGenerator, fdp, MAX_RANDOM_DISPLAYS);
81 aidl::android::hardware::input::common::MotionEvent motionEvent =
82 notifyMotionArgsToHalMotionEvent(motionArgs);
83 },
84 })();
85 }
86 return 0;
87 }
88
89 } // namespace android
90