• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "ProtoFuzzerMutator.h"
18 #include <iostream>
19 
20 using std::endl;
21 using std::cerr;
22 using std::cout;
23 using std::make_unique;
24 using std::unordered_map;
25 using namespace std::placeholders;
26 
27 namespace android {
28 namespace vts {
29 namespace fuzzer {
30 
ProtoFuzzerMutator(Random & rand,unordered_map<string,TypeSpec> predefined_types,ProtoFuzzerMutatorConfig mutator_config)31 ProtoFuzzerMutator::ProtoFuzzerMutator(
32     Random &rand, unordered_map<string, TypeSpec> predefined_types,
33     ProtoFuzzerMutatorConfig mutator_config)
34     : rand_(rand),
35       predefined_types_(predefined_types),
36       mutator_config_(mutator_config) {
37   // Default function used for mutation/random generation. Used for types for
38   // which the notion of mutation/random generation is not defined, e.g.
39   // TYPE_HANDLE, TYPE_HIDL_CALLBACK.
40   VarTransformFn default_transform =
41       [](const VariableSpecificationMessage &var_spec) {
42         return VariableSpecificationMessage{var_spec};
43       };
44 
45   // Initialize random_gen_fns_ and mutate_fns_ tables.
46   random_gen_fns_[TYPE_ARRAY] =
47       std::bind(&ProtoFuzzerMutator::ArrayRandomGen, this, _1);
48   mutate_fns_[TYPE_ARRAY] =
49       std::bind(&ProtoFuzzerMutator::ArrayMutate, this, _1);
50 
51   random_gen_fns_[TYPE_ENUM] =
52       std::bind(&ProtoFuzzerMutator::EnumRandomGen, this, _1);
53   mutate_fns_[TYPE_ENUM] = std::bind(&ProtoFuzzerMutator::EnumMutate, this, _1);
54 
55   random_gen_fns_[TYPE_HANDLE] = default_transform;
56   mutate_fns_[TYPE_HANDLE] = default_transform;
57 
58   random_gen_fns_[TYPE_HIDL_CALLBACK] = default_transform;
59   mutate_fns_[TYPE_HIDL_CALLBACK] = default_transform;
60 
61   random_gen_fns_[TYPE_HIDL_INTERFACE] = default_transform;
62   mutate_fns_[TYPE_HIDL_INTERFACE] = default_transform;
63 
64   // Interpret masks as enums.
65   random_gen_fns_[TYPE_MASK] =
66       std::bind(&ProtoFuzzerMutator::EnumRandomGen, this, _1);
67   mutate_fns_[TYPE_MASK] = std::bind(&ProtoFuzzerMutator::EnumMutate, this, _1);
68 
69   random_gen_fns_[TYPE_POINTER] = default_transform;
70   mutate_fns_[TYPE_POINTER] = default_transform;
71 
72   random_gen_fns_[TYPE_SCALAR] =
73       std::bind(&ProtoFuzzerMutator::ScalarRandomGen, this, _1);
74   mutate_fns_[TYPE_SCALAR] =
75       std::bind(&ProtoFuzzerMutator::ScalarMutate, this, _1);
76 
77   random_gen_fns_[TYPE_STRING] =
78       std::bind(&ProtoFuzzerMutator::StringRandomGen, this, _1);
79   mutate_fns_[TYPE_STRING] =
80       std::bind(&ProtoFuzzerMutator::StringMutate, this, _1);
81 
82   random_gen_fns_[TYPE_STRUCT] =
83       std::bind(&ProtoFuzzerMutator::StructRandomGen, this, _1);
84   mutate_fns_[TYPE_STRUCT] =
85       std::bind(&ProtoFuzzerMutator::StructMutate, this, _1);
86 
87   random_gen_fns_[TYPE_UNION] =
88       std::bind(&ProtoFuzzerMutator::UnionRandomGen, this, _1);
89   mutate_fns_[TYPE_UNION] =
90       std::bind(&ProtoFuzzerMutator::UnionMutate, this, _1);
91 
92   random_gen_fns_[TYPE_VECTOR] =
93       std::bind(&ProtoFuzzerMutator::VectorRandomGen, this, _1);
94   mutate_fns_[TYPE_VECTOR] =
95       std::bind(&ProtoFuzzerMutator::VectorMutate, this, _1);
96 }
97 
98 // TODO(trong): add a mutator config option which controls how an interface is
99 // selected.
RandomSelectIface(const IfaceDescTbl & tbl)100 const CompSpec *ProtoFuzzerMutator::RandomSelectIface(const IfaceDescTbl &tbl) {
101   size_t rand_idx = rand_(tbl.size());
102   auto it = tbl.begin();
103   std::advance(it, rand_idx);
104   return it->second.comp_spec_;
105 }
106 
RandomGen(const IfaceDescTbl & tbl,size_t num_calls)107 ExecSpec ProtoFuzzerMutator::RandomGen(const IfaceDescTbl &tbl,
108                                        size_t num_calls) {
109   ExecSpec result{};
110   for (size_t i = 0; i < num_calls; ++i) {
111     const CompSpec *comp_spec = RandomSelectIface(tbl);
112     string iface_name = comp_spec->component_name();
113     const IfaceSpec &iface_spec = comp_spec->interface();
114 
115     // Generate a random interface function call.
116     FuncCall rand_call{};
117     rand_call.set_hidl_interface_name(iface_name);
118     size_t num_apis = iface_spec.api_size();
119     size_t rand_api_idx = rand_(num_apis);
120     FuncSpec rand_api = RandomGen(iface_spec.api(rand_api_idx));
121     *rand_call.mutable_api() = rand_api;
122     *result.add_function_call() = rand_call;
123   }
124   return result;
125 }
126 
Mutate(const IfaceDescTbl & tbl,ExecSpec * exec_spec)127 void ProtoFuzzerMutator::Mutate(const IfaceDescTbl &tbl, ExecSpec *exec_spec) {
128   // Mutate a randomly chosen function call with probability
129   // odds_for/(odds_for + odds_against).
130   uint64_t odds_for = mutator_config_.func_mutated_.first;
131   uint64_t odds_against = mutator_config_.func_mutated_.second;
132   uint64_t rand_num = rand_(odds_for + odds_against);
133 
134   if (rand_num < odds_for) {
135     // Mutate a random function in execution.
136     size_t idx = rand_(exec_spec->function_call_size());
137     const FuncSpec &rand_api = exec_spec->function_call(idx).api();
138     *exec_spec->mutable_function_call(idx)->mutable_api() = Mutate(rand_api);
139   } else {
140     // Generate a random function call in place of randomly chosen function in
141     // execution.
142     const CompSpec *comp_spec = RandomSelectIface(tbl);
143     string iface_name = comp_spec->component_name();
144     const IfaceSpec &iface_spec = comp_spec->interface();
145 
146     size_t func_idx = rand_(exec_spec->function_call_size());
147     size_t blueprint_idx = rand_(iface_spec.api_size());
148     FuncCall *func_call = exec_spec->mutable_function_call(func_idx);
149     func_call->set_hidl_interface_name(iface_name);
150     *func_call->mutable_api() = RandomGen(iface_spec.api(blueprint_idx));
151   }
152 }
153 
RandomGen(const FuncSpec & func_spec)154 FuncSpec ProtoFuzzerMutator::RandomGen(const FuncSpec &func_spec) {
155   FuncSpec result{func_spec};
156   // We'll repopulate arg field.
157   result.clear_arg();
158   result.clear_return_type_hidl();
159   for (const auto &var_spec : func_spec.arg()) {
160     VarInstance rand_var_spec = RandomGen(var_spec);
161     auto *new_var = result.add_arg();
162     new_var->Swap(&rand_var_spec);
163   }
164   return result;
165 }
166 
Mutate(const FuncSpec & func_spec)167 FuncSpec ProtoFuzzerMutator::Mutate(const FuncSpec &func_spec) {
168   FuncSpec result{func_spec};
169   size_t num_args = result.arg_size();
170   if (num_args > 0) {
171     size_t rand_arg_idx = rand_(num_args);
172     VarInstance rand_arg = Mutate(result.arg(rand_arg_idx));
173     result.mutable_arg(rand_arg_idx)->Swap(&rand_arg);
174   }
175   return result;
176 }
177 
Transform(const VariableSpecificationMessage & var_spec,unordered_map<VariableType,VarTransformFn> & transform_fns)178 static VariableSpecificationMessage Transform(
179     const VariableSpecificationMessage &var_spec,
180     unordered_map<VariableType, VarTransformFn> &transform_fns) {
181   auto type = var_spec.type();
182   auto transform_fn = transform_fns.find(type);
183   if (transform_fn == transform_fns.end()) {
184     cerr << "Transformation function not found for type: " << type << endl;
185     exit(1);
186   }
187   return transform_fn->second(var_spec);
188 }
189 
RandomGen(const VarSpec & var_spec)190 VarInstance ProtoFuzzerMutator::RandomGen(const VarSpec &var_spec) {
191   return Transform(var_spec, random_gen_fns_);
192 }
193 
Mutate(const VarInstance & var_instance)194 VarInstance ProtoFuzzerMutator::Mutate(const VarInstance &var_instance) {
195   return Transform(var_instance, mutate_fns_);
196 }
197 
FindPredefinedType(string name)198 const TypeSpec &ProtoFuzzerMutator::FindPredefinedType(string name) {
199   auto type_spec = predefined_types_.find(name);
200   if (type_spec == predefined_types_.end()) {
201     cerr << "Predefined type not found: " << name << endl;
202     exit(1);
203   }
204   return type_spec->second;
205 }
206 
207 }  // namespace fuzzer
208 }  // namespace vts
209 }  // namespace android
210