1 /* 2 * Copyright 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef __VTS_PROTO_FUZZER_MUTATOR_H_ 18 #define __VTS_PROTO_FUZZER_MUTATOR_H_ 19 20 #include <functional> 21 #include <memory> 22 #include <string> 23 #include <unordered_map> 24 25 #include "ProtoFuzzerUtils.h" 26 #include "test/vts-testcase/fuzz/iface_fuzzer/proto/ExecutionSpecificationMessage.pb.h" 27 #include "test/vts/proto/ComponentSpecificationMessage.pb.h" 28 29 namespace android { 30 namespace vts { 31 namespace fuzzer { 32 33 using BiasedRandomScalarGen = std::function<uint64_t(Random &rand)>; 34 using Odds = std::pair<uint64_t, uint64_t>; 35 using VarMutateFn = std::function<VarInstance(const VarInstance &)>; 36 using VarRandomGenFn = std::function<VarInstance(const VarSpec &)>; 37 using VarTransformFn = std::function<VariableSpecificationMessage( 38 const VariableSpecificationMessage &)>; 39 40 // Encapsulates heuristic strategy for biased mutation/random generation. 41 struct ProtoFuzzerMutatorConfig { 42 // Generates biased random scalars. 43 BiasedRandomScalarGen scalar_bias_ = [](Random &rand) { return rand.Rand(); }; 44 // Used to decide if enum will be mutated/generated like a scalar. 45 Odds enum_bias_ = {0, 1}; 46 // Odds that a function in an execution is mutated rather than regenerated. 47 Odds func_mutated_ = {100, 1}; 48 // Default size used to randomly generate a vector. 49 size_t default_vector_size_ = 64; 50 }; 51 52 // Provides methods for mutation or random generation. 53 class ProtoFuzzerMutator { 54 public: 55 ProtoFuzzerMutator(Random &, std::unordered_map<std::string, TypeSpec>, 56 ProtoFuzzerMutatorConfig); 57 // Generates a random ExecSpec. 58 ExecSpec RandomGen(const IfaceSpec &, size_t); 59 // Mutates in-place an ExecSpec. 60 void Mutate(const IfaceSpec &, ExecSpec *); 61 // Generates a random FuncSpec. 62 FuncSpec RandomGen(const FuncSpec &); 63 // Mutates a FuncSpec. 64 FuncSpec Mutate(const FuncSpec &); 65 // Generates a random VarInstance. 66 VarInstance RandomGen(const VarSpec &); 67 // Mutates a VarInstance. 68 VarInstance Mutate(const VarInstance &); 69 70 private: 71 // Used for mutation/random generation of VarInstance. 72 VarInstance ArrayRandomGen(const VarSpec &); 73 VarInstance ArrayMutate(const VarInstance &); 74 VarInstance EnumRandomGen(const VarSpec &); 75 VarInstance EnumMutate(const VarInstance &); 76 VarInstance ScalarRandomGen(const VarSpec &); 77 VarInstance ScalarMutate(const VarInstance &); 78 VarInstance StructRandomGen(const VarSpec &); 79 VarInstance StructMutate(const VarInstance &); 80 VarInstance UnionRandomGen(const VarSpec &); 81 VarInstance UnionMutate(const VarInstance &); 82 VarInstance VectorRandomGen(const VarSpec &); 83 VarInstance VectorMutate(const VarInstance &); 84 85 // Used for mutation/random generation of ScalarData. 86 ScalarData RandomGen(const ScalarData &, const std::string &); 87 ScalarData Mutate(const ScalarData &, const string &); 88 // Used for mutation/random generation of variables of fundamental data types 89 // e.g. char, int, double. 90 template <typename T> 91 T RandomGen(T); 92 template <typename T> 93 T Mutate(T); 94 bool RandomGen(bool); 95 bool Mutate(bool); 96 float Mutate(float); 97 double Mutate(double); 98 99 // Looks up predefined type by name. 100 const TypeSpec &FindPredefinedType(std::string); 101 102 // 64-bit random number generator. 103 Random &rand_; 104 // Used to look up definition of a predefined type by its name. 105 std::unordered_map<std::string, TypeSpec> predefined_types_; 106 // Used to delegate mutation/random generation of VariableSpecifationMessage 107 // of different VariableType to mutation/random delegation function for that 108 // VariableType. 109 std::unordered_map<VariableType, VarMutateFn> mutate_fns_; 110 std::unordered_map<VariableType, VarRandomGenFn> random_gen_fns_; 111 // Used for biased mutation/random generation of variables. 112 ProtoFuzzerMutatorConfig mutator_config_; 113 }; 114 115 } // namespace fuzzer 116 } // namespace vts 117 } // namespace android 118 119 #endif // __VTS_PROTO_FUZZER_MUTATOR__ 120