drgreen/android_frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Limit values of data position in fuzzer" am: a6d21afb18

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2475021

Change-Id: Ice8f5439599fef60972b06600282a0f94e79ece6
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Pawan Wagh 2023-03-11 01:14:18 +00:00 committed by Automerger Merge Worker
commit 8bde264a40
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
core/tests/fuzzers/ParcelFuzzer/ReadUtils.java
View File

@ -97,7 +97,7 @@ public class ReadUtils {
public static ReadOperation[] READ_OPERATIONS = public static ReadOperation[] READ_OPERATIONS =
new ReadOperation[] { new ReadOperation[] {
(parcel, provider) -> { (parcel, provider) -> {
parcel.setDataPosition(provider.consumeInt()); parcel.setDataPosition(provider.consumeInt(0, Integer.MAX_VALUE));
}, },
(parcel, provider) -> { (parcel, provider) -> {
parcel.setDataCapacity(provider.consumeInt()); parcel.setDataCapacity(provider.consumeInt());
@ -155,6 +155,7 @@ public class ReadUtils {
byte[] array; byte[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new byte[Math.min(MAX_LEN, parcel.readInt())]; array = new byte[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -166,6 +167,7 @@ public class ReadUtils {
char[] array; char[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new char[Math.min(MAX_LEN, parcel.readInt())]; array = new char[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -177,6 +179,7 @@ public class ReadUtils {
int[] array; int[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new int[Math.min(MAX_LEN, parcel.readInt())]; array = new int[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -188,6 +191,7 @@ public class ReadUtils {
double[] array; double[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new double[Math.min(MAX_LEN, parcel.readInt())]; array = new double[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -199,6 +203,7 @@ public class ReadUtils {
float[] array; float[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new float[Math.min(MAX_LEN, parcel.readInt())]; array = new float[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -210,6 +215,7 @@ public class ReadUtils {
boolean[] array; boolean[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new boolean[Math.min(MAX_LEN, parcel.readInt())]; array = new boolean[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -221,6 +227,7 @@ public class ReadUtils {
long[] array; long[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new long[Math.min(MAX_LEN, parcel.readInt())]; array = new long[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -232,6 +239,7 @@ public class ReadUtils {
IBinder[] array; IBinder[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new IBinder[Math.min(MAX_LEN, parcel.readInt())]; array = new IBinder[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -274,6 +282,7 @@ public class ReadUtils {
SingleDataParcelable[] array; SingleDataParcelable[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new SingleDataParcelable[Math.min(MAX_LEN, parcel.readInt())]; array = new SingleDataParcelable[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -293,6 +302,7 @@ public class ReadUtils {
EmptyParcelable[] array; EmptyParcelable[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new EmptyParcelable[Math.min(MAX_LEN, parcel.readInt())]; array = new EmptyParcelable[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -312,6 +322,7 @@ public class ReadUtils {
GenericDataParcelable[] array; GenericDataParcelable[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new GenericDataParcelable[Math.min(MAX_LEN, parcel.readInt())]; array = new GenericDataParcelable[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -334,6 +345,7 @@ public class ReadUtils {
SomeParcelable[] array; SomeParcelable[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new SomeParcelable[Math.min(MAX_LEN, parcel.readInt())]; array = new SomeParcelable[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {
@ -390,6 +402,7 @@ public class ReadUtils {
TestInterface[] array; TestInterface[] array;
if (provider.consumeBoolean()) { if (provider.consumeBoolean()) {
int pos = parcel.dataPosition(); int pos = parcel.dataPosition();
if (pos < 0) return;
array = new TestInterface[Math.min(MAX_LEN, parcel.readInt())]; array = new TestInterface[Math.min(MAX_LEN, parcel.readInt())];
parcel.setDataPosition(pos); parcel.setDataPosition(pos);
} else { } else {