1 /*
2 * Copyright 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <InputReader.h>
18 #include <MapperHelpers.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include <input/InputDevice.h>
21 #include <chrono>
22 #include <thread>
23
24 namespace android {
25
26 constexpr InputDeviceSensorType kInputDeviceSensorType[] = {
27 InputDeviceSensorType::ACCELEROMETER,
28 InputDeviceSensorType::MAGNETIC_FIELD,
29 InputDeviceSensorType::ORIENTATION,
30 InputDeviceSensorType::GYROSCOPE,
31 InputDeviceSensorType::LIGHT,
32 InputDeviceSensorType::PRESSURE,
33 InputDeviceSensorType::TEMPERATURE,
34 InputDeviceSensorType::PROXIMITY,
35 InputDeviceSensorType::GRAVITY,
36 InputDeviceSensorType::LINEAR_ACCELERATION,
37 InputDeviceSensorType::ROTATION_VECTOR,
38 InputDeviceSensorType::RELATIVE_HUMIDITY,
39 InputDeviceSensorType::AMBIENT_TEMPERATURE,
40 InputDeviceSensorType::MAGNETIC_FIELD_UNCALIBRATED,
41 InputDeviceSensorType::GAME_ROTATION_VECTOR,
42 InputDeviceSensorType::GYROSCOPE_UNCALIBRATED,
43 InputDeviceSensorType::SIGNIFICANT_MOTION,
44 };
45
46 class FuzzInputReader : public InputReaderInterface {
47 public:
FuzzInputReader(std::shared_ptr<EventHubInterface> fuzzEventHub,const sp<InputReaderPolicyInterface> & fuzzPolicy,InputListenerInterface & fuzzListener)48 FuzzInputReader(std::shared_ptr<EventHubInterface> fuzzEventHub,
49 const sp<InputReaderPolicyInterface>& fuzzPolicy,
50 InputListenerInterface& fuzzListener) {
51 reader = std::make_unique<InputReader>(fuzzEventHub, fuzzPolicy, fuzzListener);
52 }
53
dump(std::string & dump)54 void dump(std::string& dump) { reader->dump(dump); }
55
monitor()56 void monitor() { reader->monitor(); }
57
start()58 status_t start() { return reader->start(); }
59
stop()60 status_t stop() { return reader->stop(); }
61
getInputDevices() const62 std::vector<InputDeviceInfo> getInputDevices() const { return reader->getInputDevices(); }
63
getScanCodeState(int32_t deviceId,uint32_t sourceMask,int32_t scanCode)64 int32_t getScanCodeState(int32_t deviceId, uint32_t sourceMask, int32_t scanCode) {
65 return reader->getScanCodeState(deviceId, sourceMask, scanCode);
66 }
67
getKeyCodeState(int32_t deviceId,uint32_t sourceMask,int32_t keyCode)68 int32_t getKeyCodeState(int32_t deviceId, uint32_t sourceMask, int32_t keyCode) {
69 return reader->getKeyCodeState(deviceId, sourceMask, keyCode);
70 }
71
getSwitchState(int32_t deviceId,uint32_t sourceMask,int32_t sw)72 int32_t getSwitchState(int32_t deviceId, uint32_t sourceMask, int32_t sw) {
73 return reader->getSwitchState(deviceId, sourceMask, sw);
74 }
75
toggleCapsLockState(int32_t deviceId)76 void toggleCapsLockState(int32_t deviceId) { reader->toggleCapsLockState(deviceId); }
77
resetLockedModifierState()78 void resetLockedModifierState() { reader->resetLockedModifierState(); }
79
hasKeys(int32_t deviceId,uint32_t sourceMask,const std::vector<int32_t> & keyCodes,uint8_t * outFlags)80 bool hasKeys(int32_t deviceId, uint32_t sourceMask, const std::vector<int32_t>& keyCodes,
81 uint8_t* outFlags) {
82 return reader->hasKeys(deviceId, sourceMask, keyCodes, outFlags);
83 }
84
requestRefreshConfiguration(ConfigurationChanges changes)85 void requestRefreshConfiguration(ConfigurationChanges changes) {
86 reader->requestRefreshConfiguration(changes);
87 }
88
vibrate(int32_t deviceId,const VibrationSequence & sequence,ssize_t repeat,int32_t token)89 void vibrate(int32_t deviceId, const VibrationSequence& sequence, ssize_t repeat,
90 int32_t token) {
91 reader->vibrate(deviceId, sequence, repeat, token);
92 }
93
cancelVibrate(int32_t deviceId,int32_t token)94 void cancelVibrate(int32_t deviceId, int32_t token) { reader->cancelVibrate(deviceId, token); }
95
isVibrating(int32_t deviceId)96 bool isVibrating(int32_t deviceId) { return reader->isVibrating(deviceId); }
97
getVibratorIds(int32_t deviceId)98 std::vector<int32_t> getVibratorIds(int32_t deviceId) {
99 return reader->getVibratorIds(deviceId);
100 }
101
getBatteryCapacity(int32_t deviceId)102 std::optional<int32_t> getBatteryCapacity(int32_t deviceId) {
103 return reader->getBatteryCapacity(deviceId);
104 }
105
getBatteryStatus(int32_t deviceId)106 std::optional<int32_t> getBatteryStatus(int32_t deviceId) {
107 return reader->getBatteryStatus(deviceId);
108 }
109
getBatteryDevicePath(int32_t deviceId)110 std::optional<std::string> getBatteryDevicePath(int32_t deviceId) {
111 return reader->getBatteryDevicePath(deviceId);
112 }
113
getLights(int32_t deviceId)114 std::vector<InputDeviceLightInfo> getLights(int32_t deviceId) {
115 return reader->getLights(deviceId);
116 }
117
getSensors(int32_t deviceId)118 std::vector<InputDeviceSensorInfo> getSensors(int32_t deviceId) {
119 return reader->getSensors(deviceId);
120 }
121
getTouchpadHardwareProperties(int32_t deviceId)122 std::optional<HardwareProperties> getTouchpadHardwareProperties(int32_t deviceId) {
123 return reader->getTouchpadHardwareProperties(deviceId);
124 }
125
canDispatchToDisplay(int32_t deviceId,ui::LogicalDisplayId displayId)126 bool canDispatchToDisplay(int32_t deviceId, ui::LogicalDisplayId displayId) {
127 return reader->canDispatchToDisplay(deviceId, displayId);
128 }
129
enableSensor(int32_t deviceId,InputDeviceSensorType sensorType,std::chrono::microseconds samplingPeriod,std::chrono::microseconds maxBatchReportLatency)130 bool enableSensor(int32_t deviceId, InputDeviceSensorType sensorType,
131 std::chrono::microseconds samplingPeriod,
132 std::chrono::microseconds maxBatchReportLatency) {
133 return reader->enableSensor(deviceId, sensorType, samplingPeriod, maxBatchReportLatency);
134 }
135
disableSensor(int32_t deviceId,InputDeviceSensorType sensorType)136 void disableSensor(int32_t deviceId, InputDeviceSensorType sensorType) {
137 return reader->disableSensor(deviceId, sensorType);
138 }
139
flushSensor(int32_t deviceId,InputDeviceSensorType sensorType)140 void flushSensor(int32_t deviceId, InputDeviceSensorType sensorType) {
141 return reader->flushSensor(deviceId, sensorType);
142 }
143
setLightColor(int32_t deviceId,int32_t lightId,int32_t color)144 bool setLightColor(int32_t deviceId, int32_t lightId, int32_t color) {
145 return reader->setLightColor(deviceId, lightId, color);
146 }
147
setLightPlayerId(int32_t deviceId,int32_t lightId,int32_t playerId)148 bool setLightPlayerId(int32_t deviceId, int32_t lightId, int32_t playerId) {
149 return reader->setLightPlayerId(deviceId, lightId, playerId);
150 }
151
getLightColor(int32_t deviceId,int32_t lightId)152 std::optional<int32_t> getLightColor(int32_t deviceId, int32_t lightId) {
153 return reader->getLightColor(deviceId, lightId);
154 }
155
getLightPlayerId(int32_t deviceId,int32_t lightId)156 std::optional<int32_t> getLightPlayerId(int32_t deviceId, int32_t lightId) {
157 return reader->getLightPlayerId(deviceId, lightId);
158 }
159
getKeyCodeForKeyLocation(int32_t deviceId,int32_t locationKeyCode) const160 int32_t getKeyCodeForKeyLocation(int32_t deviceId, int32_t locationKeyCode) const {
161 return reader->getKeyCodeForKeyLocation(deviceId, locationKeyCode);
162 }
163
getBluetoothAddress(int32_t deviceId) const164 std::optional<std::string> getBluetoothAddress(int32_t deviceId) const {
165 return reader->getBluetoothAddress(deviceId);
166 }
167
getSysfsRootPath(int32_t deviceId) const168 std::filesystem::path getSysfsRootPath(int32_t deviceId) const {
169 return reader->getSysfsRootPath(deviceId);
170 }
171
sysfsNodeChanged(const std::string & sysfsNodePath)172 void sysfsNodeChanged(const std::string& sysfsNodePath) {
173 reader->sysfsNodeChanged(sysfsNodePath);
174 }
175
getLastUsedInputDeviceId()176 DeviceId getLastUsedInputDeviceId() override { return reader->getLastUsedInputDeviceId(); }
177
notifyMouseCursorFadedOnTyping()178 void notifyMouseCursorFadedOnTyping() override { reader->notifyMouseCursorFadedOnTyping(); }
179
setKernelWakeEnabled(int32_t deviceId,bool enabled)180 bool setKernelWakeEnabled(int32_t deviceId, bool enabled) override {
181 return reader->setKernelWakeEnabled(deviceId, enabled);
182 }
183
184 private:
185 std::unique_ptr<InputReaderInterface> reader;
186 };
187
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)188 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) {
189 std::shared_ptr<ThreadSafeFuzzedDataProvider> fdp =
190 std::make_shared<ThreadSafeFuzzedDataProvider>(data, size);
191
192 FuzzInputListener fuzzListener;
193 sp<FuzzInputReaderPolicy> fuzzPolicy = sp<FuzzInputReaderPolicy>::make(fdp);
194 std::shared_ptr<FuzzEventHub> fuzzEventHub = std::make_shared<FuzzEventHub>(fdp);
195 std::unique_ptr<FuzzInputReader> reader =
196 std::make_unique<FuzzInputReader>(fuzzEventHub, fuzzPolicy, fuzzListener);
197 size_t patternCount = fdp->ConsumeIntegralInRange<size_t>(1, 260);
198 VibrationSequence pattern(patternCount);
199 for (size_t i = 0; i < patternCount; ++i) {
200 VibrationElement element(i);
201 element.addChannel(/*vibratorId=*/fdp->ConsumeIntegral<int32_t>(),
202 /*amplitude=*/fdp->ConsumeIntegral<uint8_t>());
203 pattern.addElement(element);
204 }
205 reader->vibrate(fdp->ConsumeIntegral<int32_t>(), pattern,
206 /*repeat=*/fdp->ConsumeIntegral<ssize_t>(),
207 /*token=*/fdp->ConsumeIntegral<int32_t>());
208 reader->start();
209
210 // Loop through mapper operations until randomness is exhausted.
211 while (fdp->remaining_bytes() > 0) {
212 fdp->PickValueInArray<std::function<void()>>({
213 [&]() -> void {
214 std::string dump;
215 reader->dump(dump);
216 },
217 [&]() -> void { reader->monitor(); },
218 [&]() -> void { reader->getInputDevices(); },
219 [&]() -> void {
220 reader->getScanCodeState(fdp->ConsumeIntegral<int32_t>(),
221 fdp->ConsumeIntegral<uint32_t>(),
222 fdp->ConsumeIntegral<int32_t>());
223 },
224 [&]() -> void {
225 reader->getKeyCodeState(fdp->ConsumeIntegral<int32_t>(),
226 fdp->ConsumeIntegral<uint32_t>(),
227 fdp->ConsumeIntegral<int32_t>());
228 },
229 [&]() -> void {
230 reader->getSwitchState(fdp->ConsumeIntegral<int32_t>(),
231 fdp->ConsumeIntegral<uint32_t>(),
232 fdp->ConsumeIntegral<int32_t>());
233 },
234 [&]() -> void { reader->toggleCapsLockState(fdp->ConsumeIntegral<int32_t>()); },
235 [&]() -> void { reader->resetLockedModifierState(); },
236 [&]() -> void {
237 size_t count = fdp->ConsumeIntegralInRange<size_t>(1, 1024);
238 std::vector<uint8_t> outFlags(count);
239 std::vector<int32_t> keyCodes;
240 for (size_t i = 0; i < count; ++i) {
241 keyCodes.push_back(fdp->ConsumeIntegral<int32_t>());
242 }
243 reader->hasKeys(fdp->ConsumeIntegral<int32_t>(),
244 fdp->ConsumeIntegral<uint32_t>(), keyCodes, outFlags.data());
245 },
246 [&]() -> void {
247 reader->requestRefreshConfiguration(
248 InputReaderConfiguration::Change(fdp->ConsumeIntegral<uint32_t>()));
249 },
250 [&]() -> void {
251 reader->cancelVibrate(fdp->ConsumeIntegral<int32_t>(),
252 fdp->ConsumeIntegral<int32_t>());
253 },
254 [&]() -> void {
255 reader->canDispatchToDisplay(fdp->ConsumeIntegral<int32_t>(),
256 ui::LogicalDisplayId{
257 fdp->ConsumeIntegral<int32_t>()});
258 },
259 [&]() -> void {
260 reader->getKeyCodeForKeyLocation(fdp->ConsumeIntegral<int32_t>(),
261 fdp->ConsumeIntegral<int32_t>());
262 },
263 [&]() -> void { reader->getBatteryCapacity(fdp->ConsumeIntegral<int32_t>()); },
264 [&]() -> void { reader->getBatteryStatus(fdp->ConsumeIntegral<int32_t>()); },
265 [&]() -> void { reader->getBatteryDevicePath(fdp->ConsumeIntegral<int32_t>()); },
266 [&]() -> void { reader->getLights(fdp->ConsumeIntegral<int32_t>()); },
267 [&]() -> void { reader->getSensors(fdp->ConsumeIntegral<int32_t>()); },
268 [&]() -> void {
269 reader->getLightPlayerId(fdp->ConsumeIntegral<int32_t>(),
270 fdp->ConsumeIntegral<int32_t>());
271 },
272 [&]() -> void {
273 reader->getLightColor(fdp->ConsumeIntegral<int32_t>(),
274 fdp->ConsumeIntegral<int32_t>());
275 },
276 [&]() -> void {
277 reader->setLightPlayerId(fdp->ConsumeIntegral<int32_t>(),
278 fdp->ConsumeIntegral<int32_t>(),
279 fdp->ConsumeIntegral<int32_t>());
280 },
281 [&]() -> void {
282 reader->setLightColor(fdp->ConsumeIntegral<int32_t>(),
283 fdp->ConsumeIntegral<int32_t>(),
284 fdp->ConsumeIntegral<int32_t>());
285 },
286 [&]() -> void {
287 reader->flushSensor(fdp->ConsumeIntegral<int32_t>(),
288 fdp->PickValueInArray<InputDeviceSensorType>(
289 kInputDeviceSensorType));
290 },
291 [&]() -> void {
292 reader->disableSensor(fdp->ConsumeIntegral<int32_t>(),
293 fdp->PickValueInArray<InputDeviceSensorType>(
294 kInputDeviceSensorType));
295 },
296 [&]() -> void {
297 reader->enableSensor(fdp->ConsumeIntegral<int32_t>(),
298 fdp->PickValueInArray<InputDeviceSensorType>(
299 kInputDeviceSensorType),
300 std::chrono::microseconds(fdp->ConsumeIntegral<size_t>()),
301 std::chrono::microseconds(fdp->ConsumeIntegral<size_t>()));
302 },
303 [&]() -> void { reader->getBluetoothAddress(fdp->ConsumeIntegral<int32_t>()); },
304 [&]() -> void { reader->getSysfsRootPath(fdp->ConsumeIntegral<int32_t>()); },
305 })();
306 }
307
308 reader->stop();
309 return 0;
310 }
311
312 } // namespace android
313