1 /* 2 * Copyright (C) 2019 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 #define FUZZ_LOG_TAG "binder" 17 18 #include "binder.h" 19 #include "parcelables/EmptyParcelable.h" 20 #include "parcelables/GenericDataParcelable.h" 21 #include "parcelables/SingleDataParcelable.h" 22 #include "util.h" 23 24 #include <android/os/IServiceManager.h> 25 #include <binder/ParcelableHolder.h> 26 #include <binder/PersistableBundle.h> 27 #include <binder/Status.h> 28 #include <utils/Flattenable.h> 29 30 #include "../../Utils.h" 31 32 using ::android::HexString; 33 using ::android::status_t; 34 using ::android::binder::unique_fd; 35 36 enum ByteEnum : int8_t {}; 37 enum IntEnum : int32_t {}; 38 enum LongEnum : int64_t {}; 39 40 class ExampleParcelable : public android::Parcelable { 41 public: writeToParcel(android::Parcel *) const42 status_t writeToParcel(android::Parcel* /*parcel*/) const override { 43 FUZZ_LOG() << "should not reach"; 44 abort(); 45 } readFromParcel(const android::Parcel * parcel)46 status_t readFromParcel(const android::Parcel* parcel) override { 47 mExampleExtraField++; 48 return parcel->readInt64(&(this->mExampleUsedData)); 49 } 50 private: 51 int64_t mExampleExtraField = 0; 52 int64_t mExampleUsedData = 0; 53 }; 54 55 struct ExampleFlattenable : public android::Flattenable<ExampleFlattenable> { 56 public: getFlattenedSizeExampleFlattenable57 size_t getFlattenedSize() const { return sizeof(mValue); } getFdCountExampleFlattenable58 size_t getFdCount() const { return 0; } flattenExampleFlattenable59 status_t flatten(void*& /*buffer*/, size_t& /*size*/, int*& /*fds*/, size_t& /*count*/) const { 60 FUZZ_LOG() << "should not reach"; 61 abort(); 62 } unflattenExampleFlattenable63 status_t unflatten(void const*& buffer, size_t& size, int const*& /*fds*/, size_t& /*count*/) { 64 if (size < sizeof(mValue)) { 65 return android::NO_MEMORY; 66 } 67 android::FlattenableUtils::read(buffer, size, mValue); 68 return android::OK; 69 } 70 private: 71 int32_t mValue = 0xFEEDBEEF; 72 }; 73 74 struct ExampleLightFlattenable : public android::LightFlattenablePod<ExampleLightFlattenable> { 75 int32_t mValue = 0; 76 }; 77 78 struct BigStruct { 79 uint8_t data[1337]; 80 }; 81 82 #define PARCEL_READ_WITH_STATUS(T, FUN) \ 83 [](const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { \ 84 FUZZ_LOG() << "about to read " #T " using " #FUN " with status"; \ 85 T t{}; \ 86 status_t status = p.FUN(&t); \ 87 FUZZ_LOG() << #T " status: " << status /* << " value: " << t*/; \ 88 } 89 90 #define PARCEL_READ_NO_STATUS(T, FUN) \ 91 [](const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { \ 92 FUZZ_LOG() << "about to read " #T " using " #FUN " with no status"; \ 93 T t = p.FUN(); \ 94 (void)t; \ 95 FUZZ_LOG() << #T " done " /* << " value: " << t*/; \ 96 } 97 98 #define PARCEL_READ_OPT_STATUS(T, FUN) \ 99 PARCEL_READ_WITH_STATUS(T, FUN), \ 100 PARCEL_READ_NO_STATUS(T, FUN) 101 102 #pragma clang diagnostic push 103 #pragma clang diagnostic ignored "-Wdeprecated-declarations" 104 // clang-format off 105 std::vector<ParcelRead<::android::Parcel>> BINDER_PARCEL_READ_FUNCTIONS { 106 PARCEL_READ_NO_STATUS(size_t, dataSize), 107 PARCEL_READ_NO_STATUS(size_t, dataAvail), 108 PARCEL_READ_NO_STATUS(size_t, dataPosition), 109 PARCEL_READ_NO_STATUS(size_t, dataCapacity), 110 PARCEL_READ_NO_STATUS(::android::binder::Status, enforceNoDataAvail), __anonb0ef96d30102() 111 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 112 // aborts on larger values 113 size_t pos = provider.ConsumeIntegralInRange<size_t>(0, INT32_MAX); 114 FUZZ_LOG() << "about to setDataPosition: " << pos; 115 p.setDataPosition(pos); 116 FUZZ_LOG() << "setDataPosition done"; 117 }, __anonb0ef96d30202() 118 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 119 size_t len = provider.ConsumeIntegralInRange<size_t>(0, 1024); 120 std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(len); 121 FUZZ_LOG() << "about to setData: " <<(bytes.data() ? HexString(bytes.data(), bytes.size()) : "null"); 122 // TODO: allow all read and write operations 123 (*const_cast<::android::Parcel*>(&p)).setData(bytes.data(), bytes.size()); 124 FUZZ_LOG() << "setData done"; 125 }, 126 PARCEL_READ_NO_STATUS(size_t, allowFds), 127 PARCEL_READ_NO_STATUS(size_t, hasFileDescriptors), 128 PARCEL_READ_NO_STATUS(std::vector<android::sp<android::IBinder>>, debugReadAllStrongBinders), 129 PARCEL_READ_NO_STATUS(std::vector<int>, debugReadAllFileDescriptors), __anonb0ef96d30302() 130 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 131 std::string interface = provider.ConsumeRandomLengthString(); 132 FUZZ_LOG() << "about to enforceInterface: " << interface; 133 bool b = p.enforceInterface(::android::String16(interface.c_str())); 134 FUZZ_LOG() << "enforced interface: " << b; 135 }, __anonb0ef96d30402() 136 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 137 FUZZ_LOG() << "about to checkInterface"; 138 android::sp<android::IBinder> aBinder = new android::BBinder(); 139 bool b = p.checkInterface(aBinder.get()); 140 FUZZ_LOG() << "checked interface: " << b; 141 }, 142 PARCEL_READ_NO_STATUS(size_t, objectsCount), 143 PARCEL_READ_NO_STATUS(status_t, errorCheck), __anonb0ef96d30502() 144 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 145 // Read at least a bit. Unbounded allocation would OOM. 146 size_t len = provider.ConsumeIntegralInRange<size_t>(0, 1024); 147 FUZZ_LOG() << "about to read void*"; 148 std::vector<uint8_t> data(len); 149 status_t status = p.read(data.data(), len); 150 FUZZ_LOG() << "read status: " << status; 151 }, __anonb0ef96d30602() 152 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 153 size_t len = provider.ConsumeIntegral<size_t>(); 154 FUZZ_LOG() << "about to readInplace"; 155 const void* r = p.readInplace(len); 156 FUZZ_LOG() << "readInplace done. pointer: " << r << " bytes: " << (r ? HexString(r, len) : "null"); 157 }, 158 PARCEL_READ_OPT_STATUS(int32_t, readInt32), 159 PARCEL_READ_OPT_STATUS(uint32_t, readUint32), 160 PARCEL_READ_OPT_STATUS(int64_t, readInt64), 161 PARCEL_READ_OPT_STATUS(uint64_t, readUint64), 162 PARCEL_READ_OPT_STATUS(float, readFloat), 163 PARCEL_READ_OPT_STATUS(double, readDouble), 164 PARCEL_READ_OPT_STATUS(bool, readBool), 165 PARCEL_READ_OPT_STATUS(char16_t, readChar), 166 PARCEL_READ_OPT_STATUS(int8_t, readByte), 167 168 PARCEL_READ_WITH_STATUS(std::string, readUtf8FromUtf16), 169 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::string>, readUtf8FromUtf16), 170 PARCEL_READ_WITH_STATUS(std::optional<std::string>, readUtf8FromUtf16), __anonb0ef96d30702() 171 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 172 FUZZ_LOG() << "about to read c-str"; 173 const char* str = p.readCString(); 174 FUZZ_LOG() << "read c-str: " << (str ? str : "<empty string>"); 175 }, 176 PARCEL_READ_OPT_STATUS(android::String8, readString8), __anonb0ef96d30802() 177 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 178 FUZZ_LOG() << "about to readString8Inplace"; 179 size_t outLen = 0; 180 const char* str = p.readString8Inplace(&outLen); 181 std::string bytes = str ? HexString(str, sizeof(char) * (outLen + 1)) : "null"; 182 FUZZ_LOG() << "readString8Inplace: " << bytes << " size: " << outLen; 183 }, 184 PARCEL_READ_OPT_STATUS(android::String16, readString16), 185 PARCEL_READ_WITH_STATUS(std::unique_ptr<android::String16>, readString16), 186 PARCEL_READ_WITH_STATUS(std::optional<android::String16>, readString16), __anonb0ef96d30902() 187 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 188 FUZZ_LOG() << "about to readString16Inplace"; 189 size_t outLen = 0; 190 const char16_t* str = p.readString16Inplace(&outLen); 191 std::string bytes = str ? HexString(str, sizeof(char16_t) * (outLen + 1)) : "null"; 192 FUZZ_LOG() << "readString16Inplace: " << bytes << " size: " << outLen; 193 }, 194 PARCEL_READ_WITH_STATUS(android::sp<android::IBinder>, readStrongBinder), 195 PARCEL_READ_WITH_STATUS(android::sp<android::IBinder>, readNullableStrongBinder), 196 197 PARCEL_READ_WITH_STATUS(std::vector<ByteEnum>, readEnumVector), 198 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<ByteEnum>>, readEnumVector), 199 PARCEL_READ_WITH_STATUS(std::optional<std::vector<ByteEnum>>, readEnumVector), 200 PARCEL_READ_WITH_STATUS(std::vector<IntEnum>, readEnumVector), 201 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<IntEnum>>, readEnumVector), 202 PARCEL_READ_WITH_STATUS(std::optional<std::vector<IntEnum>>, readEnumVector), 203 PARCEL_READ_WITH_STATUS(std::vector<LongEnum>, readEnumVector), 204 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<LongEnum>>, readEnumVector), 205 PARCEL_READ_WITH_STATUS(std::optional<std::vector<LongEnum>>, readEnumVector), 206 207 // only reading one parcelable type for now 208 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<std::unique_ptr<ExampleParcelable>>>, readParcelableVector), 209 PARCEL_READ_WITH_STATUS(std::optional<std::vector<std::optional<ExampleParcelable>>>, readParcelableVector), 210 PARCEL_READ_WITH_STATUS(std::vector<ExampleParcelable>, readParcelableVector), 211 PARCEL_READ_WITH_STATUS(ExampleParcelable, readParcelable), 212 PARCEL_READ_WITH_STATUS(std::unique_ptr<ExampleParcelable>, readParcelable), 213 PARCEL_READ_WITH_STATUS(std::optional<ExampleParcelable>, readParcelable), 214 215 // only reading one binder type for now 216 PARCEL_READ_WITH_STATUS(android::sp<android::os::IServiceManager>, readStrongBinder), 217 PARCEL_READ_WITH_STATUS(android::sp<android::os::IServiceManager>, readNullableStrongBinder), 218 PARCEL_READ_WITH_STATUS(std::vector<android::sp<android::os::IServiceManager>>, readStrongBinderVector), 219 PARCEL_READ_WITH_STATUS(std::optional<std::vector<android::sp<android::os::IServiceManager>>>, readStrongBinderVector), 220 221 PARCEL_READ_WITH_STATUS(::std::unique_ptr<std::vector<android::sp<android::IBinder>>>, readStrongBinderVector), 222 PARCEL_READ_WITH_STATUS(::std::optional<std::vector<android::sp<android::IBinder>>>, readStrongBinderVector), 223 PARCEL_READ_WITH_STATUS(std::vector<android::sp<android::IBinder>>, readStrongBinderVector), 224 225 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<int8_t>>, readByteVector), 226 PARCEL_READ_WITH_STATUS(std::optional<std::vector<int8_t>>, readByteVector), 227 PARCEL_READ_WITH_STATUS(std::vector<int8_t>, readByteVector), 228 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<uint8_t>>, readByteVector), 229 PARCEL_READ_WITH_STATUS(std::optional<std::vector<uint8_t>>, readByteVector), 230 PARCEL_READ_WITH_STATUS(std::vector<uint8_t>, readByteVector), 231 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<int32_t>>, readInt32Vector), 232 PARCEL_READ_WITH_STATUS(std::optional<std::vector<int32_t>>, readInt32Vector), 233 PARCEL_READ_WITH_STATUS(std::vector<int32_t>, readInt32Vector), 234 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<int64_t>>, readInt64Vector), 235 PARCEL_READ_WITH_STATUS(std::optional<std::vector<int64_t>>, readInt64Vector), 236 PARCEL_READ_WITH_STATUS(std::vector<int64_t>, readInt64Vector), 237 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<uint64_t>>, readUint64Vector), 238 PARCEL_READ_WITH_STATUS(std::optional<std::vector<uint64_t>>, readUint64Vector), 239 PARCEL_READ_WITH_STATUS(std::vector<uint64_t>, readUint64Vector), 240 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<float>>, readFloatVector), 241 PARCEL_READ_WITH_STATUS(std::optional<std::vector<float>>, readFloatVector), 242 PARCEL_READ_WITH_STATUS(std::vector<float>, readFloatVector), 243 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<double>>, readDoubleVector), 244 PARCEL_READ_WITH_STATUS(std::optional<std::vector<double>>, readDoubleVector), 245 PARCEL_READ_WITH_STATUS(std::vector<double>, readDoubleVector), 246 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<bool>>, readBoolVector), 247 PARCEL_READ_WITH_STATUS(std::optional<std::vector<bool>>, readBoolVector), 248 PARCEL_READ_WITH_STATUS(std::vector<bool>, readBoolVector), 249 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<char16_t>>, readCharVector), 250 PARCEL_READ_WITH_STATUS(std::optional<std::vector<char16_t>>, readCharVector), 251 PARCEL_READ_WITH_STATUS(std::vector<char16_t>, readCharVector), 252 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<std::unique_ptr<android::String16>>>, readString16Vector), 253 PARCEL_READ_WITH_STATUS(std::optional<std::vector<std::optional<android::String16>>>, readString16Vector), 254 PARCEL_READ_WITH_STATUS(std::vector<android::String16>, readString16Vector), 255 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<std::unique_ptr<std::string>>>, readUtf8VectorFromUtf16Vector), 256 PARCEL_READ_WITH_STATUS(std::optional<std::vector<std::optional<std::string>>>, readUtf8VectorFromUtf16Vector), 257 PARCEL_READ_WITH_STATUS(std::vector<std::string>, readUtf8VectorFromUtf16Vector), 258 259 #define COMMA , 260 PARCEL_READ_WITH_STATUS(std::array<uint8_t COMMA 3>, readFixedArray), 261 PARCEL_READ_WITH_STATUS(std::optional<std::array<uint8_t COMMA 3>>, readFixedArray), 262 PARCEL_READ_WITH_STATUS(std::array<char16_t COMMA 3>, readFixedArray), 263 PARCEL_READ_WITH_STATUS(std::optional<std::array<char16_t COMMA 3>>, readFixedArray), 264 PARCEL_READ_WITH_STATUS(std::array<std::string COMMA 3>, readFixedArray), 265 PARCEL_READ_WITH_STATUS(std::optional<std::array<std::optional<std::string> COMMA 3>>, readFixedArray), 266 PARCEL_READ_WITH_STATUS(std::array<android::String16 COMMA 3>, readFixedArray), 267 PARCEL_READ_WITH_STATUS(std::optional<std::array<std::optional<android::String16> COMMA 3>>, readFixedArray), 268 PARCEL_READ_WITH_STATUS(std::array<android::sp<android::IBinder> COMMA 3>, readFixedArray), 269 PARCEL_READ_WITH_STATUS(std::optional<std::array<android::sp<android::IBinder> COMMA 3>>, readFixedArray), 270 PARCEL_READ_WITH_STATUS(std::array<ExampleParcelable COMMA 3>, readFixedArray), 271 PARCEL_READ_WITH_STATUS(std::optional<std::array<std::optional<ExampleParcelable> COMMA 3>>, readFixedArray), 272 PARCEL_READ_WITH_STATUS(std::array<ByteEnum COMMA 3>, readFixedArray), 273 PARCEL_READ_WITH_STATUS(std::optional<std::array<ByteEnum COMMA 3>>, readFixedArray), 274 PARCEL_READ_WITH_STATUS(std::array<IntEnum COMMA 3>, readFixedArray), 275 PARCEL_READ_WITH_STATUS(std::optional<std::array<IntEnum COMMA 3>>, readFixedArray), 276 PARCEL_READ_WITH_STATUS(std::array<LongEnum COMMA 3>, readFixedArray), 277 PARCEL_READ_WITH_STATUS(std::optional<std::array<LongEnum COMMA 3>>, readFixedArray), 278 // nested arrays 279 PARCEL_READ_WITH_STATUS(std::array<std::array<uint8_t COMMA 3> COMMA 4>, readFixedArray), 280 PARCEL_READ_WITH_STATUS(std::optional<std::array<std::array<uint8_t COMMA 3> COMMA 4>>, readFixedArray), 281 PARCEL_READ_WITH_STATUS(std::array<ExampleParcelable COMMA 3>, readFixedArray), 282 PARCEL_READ_WITH_STATUS(std::optional<std::array<std::array<std::optional<ExampleParcelable> COMMA 3> COMMA 4>>, readFixedArray), 283 #undef COMMA 284 __anonb0ef96d30a02() 285 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 286 FUZZ_LOG() << "about to read flattenable"; 287 ExampleFlattenable f; 288 status_t status = p.read(f); 289 FUZZ_LOG() << "read flattenable: " << status; 290 }, __anonb0ef96d30b02() 291 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 292 FUZZ_LOG() << "about to read lite flattenable"; 293 ExampleLightFlattenable f; 294 status_t status = p.read(f); 295 FUZZ_LOG() << "read lite flattenable: " << status; 296 }, 297 298 PARCEL_READ_WITH_STATUS(std::vector<uint8_t>, resizeOutVector), 299 PARCEL_READ_WITH_STATUS(std::optional<std::vector<uint8_t>>, resizeOutVector), 300 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<uint8_t>>, resizeOutVector), 301 PARCEL_READ_WITH_STATUS(std::vector<BigStruct>, resizeOutVector), 302 PARCEL_READ_WITH_STATUS(std::optional<std::vector<BigStruct>>, resizeOutVector), 303 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<BigStruct>>, resizeOutVector), 304 305 PARCEL_READ_NO_STATUS(int32_t, readExceptionCode), __anonb0ef96d30c02() 306 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 307 FUZZ_LOG() << "about to readNativeHandle"; 308 native_handle_t* t = p.readNativeHandle(); 309 FUZZ_LOG() << "readNativeHandle: " << t; 310 if (t != nullptr) { 311 FUZZ_LOG() << "about to free readNativeHandle"; 312 native_handle_close(t); 313 native_handle_delete(t); 314 FUZZ_LOG() << "readNativeHandle freed"; 315 } 316 }, 317 PARCEL_READ_NO_STATUS(int, readFileDescriptor), 318 PARCEL_READ_NO_STATUS(int, readParcelFileDescriptor), 319 PARCEL_READ_WITH_STATUS(unique_fd, readUniqueFileDescriptor), 320 321 PARCEL_READ_WITH_STATUS(std::unique_ptr<std::vector<unique_fd>>, 322 readUniqueFileDescriptorVector), 323 PARCEL_READ_WITH_STATUS(std::optional<std::vector<unique_fd>>, readUniqueFileDescriptorVector), 324 PARCEL_READ_WITH_STATUS(std::vector<unique_fd>, readUniqueFileDescriptorVector), 325 __anonb0ef96d30d02() 326 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 327 size_t len = provider.ConsumeIntegral<size_t>(); 328 FUZZ_LOG() << "about to readBlob"; 329 ::android::Parcel::ReadableBlob blob; 330 status_t status = p.readBlob(len, &blob); 331 FUZZ_LOG() << "readBlob status: " << status; 332 }, __anonb0ef96d30e02() 333 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 334 FUZZ_LOG() << "about to readObject"; 335 bool nullMetaData = provider.ConsumeBool(); 336 const void* obj = static_cast<const void*>(p.readObject(nullMetaData)); 337 FUZZ_LOG() << "readObject: " << obj; 338 }, 339 PARCEL_READ_NO_STATUS(uid_t, readCallingWorkSourceUid), 340 PARCEL_READ_NO_STATUS(size_t, getOpenAshmemSize), 341 342 // additional parcelable objects defined in libbinder __anonb0ef96d30f02() 343 [] (const ::android::Parcel& p, FuzzedDataProvider& provider) { 344 using ::android::os::ParcelableHolder; 345 using ::android::Parcelable; 346 FUZZ_LOG() << "about to read ParcelableHolder using readParcelable with status"; 347 Parcelable::Stability stability = provider.ConsumeBool() 348 ? Parcelable::Stability::STABILITY_LOCAL 349 : Parcelable::Stability::STABILITY_VINTF; 350 ParcelableHolder t = ParcelableHolder(stability); 351 status_t status = p.readParcelable(&t); 352 FUZZ_LOG() << "ParcelableHolder status: " << status; 353 }, 354 PARCEL_READ_WITH_STATUS(android::os::PersistableBundle, readParcelable), __anonb0ef96d31002() 355 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 356 FUZZ_LOG() << "about to call hasFileDescriptorsInRange() with status"; 357 size_t offset = p.readUint32(); 358 size_t length = p.readUint32(); 359 bool result; 360 status_t status = p.hasFileDescriptorsInRange(offset, length, &result); 361 FUZZ_LOG() << " status: " << status << " result: " << result; 362 }, __anonb0ef96d31102() 363 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 364 FUZZ_LOG() << "about to call hasBinders() with status"; 365 bool result; 366 status_t status = p.hasBinders(&result); 367 FUZZ_LOG() << " status: " << status << " result: " << result; 368 }, __anonb0ef96d31202() 369 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 370 FUZZ_LOG() << "about to call hasBindersInRange() with status"; 371 size_t offset = p.readUint32(); 372 size_t length = p.readUint32(); 373 bool result; 374 status_t status = p.hasBindersInRange(offset, length, &result); 375 FUZZ_LOG() << " status: " << status << " result: " << result; 376 }, __anonb0ef96d31302() 377 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 378 FUZZ_LOG() << "about to call compareDataInRange() with status"; 379 size_t thisOffset = p.readUint32(); 380 size_t otherOffset = p.readUint32(); 381 size_t length = p.readUint32(); 382 int result; 383 status_t status = p.compareDataInRange(thisOffset, p, otherOffset, length, &result); 384 FUZZ_LOG() << " status: " << status << " result: " << result; 385 }, __anonb0ef96d31402() 386 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 387 FUZZ_LOG() << "about to call readFromParcel() with status for EmptyParcelable"; 388 parcelables::EmptyParcelable emptyParcelable{}; 389 status_t status = emptyParcelable.readFromParcel(&p); 390 FUZZ_LOG() << " status: " << status; 391 }, __anonb0ef96d31502() 392 [] (const ::android::Parcel& p , FuzzedDataProvider& /*provider*/) { 393 FUZZ_LOG() << "about to call readFromParcel() with status for SingleDataParcelable"; 394 parcelables::SingleDataParcelable singleDataParcelable; 395 status_t status = singleDataParcelable.readFromParcel(&p); 396 FUZZ_LOG() << " status: " << status; 397 }, __anonb0ef96d31602() 398 [] (const ::android::Parcel& p, FuzzedDataProvider& /*provider*/) { 399 FUZZ_LOG() << "about to call readFromParcel() with status for GenericDataParcelable"; 400 parcelables::GenericDataParcelable genericDataParcelable; 401 status_t status = genericDataParcelable.readFromParcel(&p); 402 FUZZ_LOG() << " status: " << status; 403 std::string toString = genericDataParcelable.toString(); 404 FUZZ_LOG() << " toString() result: " << toString; 405 }, 406 }; 407 // clang-format on 408 #pragma clang diagnostic pop 409