1 /*
2 * Copyright (C) 2024 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 */
17
18 #include <record_file.h>
19 #include "command.h"
20 #include "fuzzer/FuzzedDataProvider.h"
21 #include "test_util.h"
22
23 using namespace simpleperf;
24 using namespace std;
25 using namespace android;
26
27 class SimplePerfReportFuzzer {
28 public:
SimplePerfReportFuzzer(const uint8_t * data,size_t size)29 SimplePerfReportFuzzer(const uint8_t* data, size_t size) : mFdp(data, size) {
30 /**
31 * Use maximum of 80% of buffer to write in FD and save at least 20% for fuzzing other APIs
32 */
33 const int32_t dataSize = mFdp.ConsumeIntegralInRange<int32_t>(0, (size * 80) / 100);
34 std::vector<uint8_t> dataPointer = mFdp.ConsumeBytes<uint8_t>(dataSize);
35 android::base::WriteFully(mTempfile.fd, dataPointer.data(), dataPointer.size());
36 RegisterDumpRecordCommand();
37 }
38 void process();
39
40 private:
41 FuzzedDataProvider mFdp;
42 TemporaryFile mTempfile;
43 void TestDumpCmd();
44 };
45
TestDumpCmd()46 void SimplePerfReportFuzzer::TestDumpCmd() {
47 std::unique_ptr<Command> dump_cmd = CreateCommandInstance("dump");
48 CaptureStdout capture;
49 capture.Start();
50 dump_cmd->Run({"-i", mTempfile.path, "--dump-etm", "raw,packet,element"});
51 }
52
process()53 void SimplePerfReportFuzzer::process() {
54 std::unique_ptr<RecordFileReader> reader = RecordFileReader::CreateInstance(mTempfile.path);
55 if (!reader.get()) {
56 return;
57 }
58 while (mFdp.remaining_bytes()) {
59 auto InvokeReader = mFdp.PickValueInArray<const std::function<void()>>({
60 [&]() { reader->ReadCmdlineFeature(); },
61 [&]() { reader->ReadBuildIdFeature(); },
62 [&]() { reader->ReadFeatureString(mFdp.ConsumeIntegral<int32_t>() /* feature */); },
63 [&]() {
64 vector<uint8_t> buf;
65 bool error;
66 reader->ReadAuxData(mFdp.ConsumeIntegral<uint32_t>() /* cpu */,
67 mFdp.ConsumeIntegral<uint64_t>() /* aux_offset */,
68 mFdp.ConsumeIntegral<size_t>() /* size */, buf, error);
69 },
70 [&]() { reader->ReadDebugUnwindFeature(); },
71 [&]() { reader->DataSection(); },
72 [&]() {
73 ThreadTree thread_tree;
74 reader->LoadBuildIdAndFileFeatures(thread_tree);
75 },
76 });
77 InvokeReader();
78 }
79 TestDumpCmd();
80 reader->Close();
81 }
82
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)83 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
84 SimplePerfReportFuzzer simplePerfReportFuzzer(data, size);
85 simplePerfReportFuzzer.process();
86 return 0;
87 }
88