From de455707e681b55a578836b10117ae2b7d44956c Mon Sep 17 00:00:00 2001
From: Will Coster <willcoster@google.com>
Date: Tue, 10 Nov 2020 14:26:17 -0800
Subject: [PATCH] Add a fuzzer for OTA package verification

This is a pretty simplistic approach, it just shoves random data at the
verifier. The OTA format isn't too complicated so this should hopefully
be sufficient to let the fuzzer exercise the potentially interesting
parsing code.

Test: Let the fuzzer run on device for awhile:
      1) FUZZ=libinstall_verify_package_fuzzer
      2) SANITIZE_TARGET=hwaddress make ${FUZZ}
      3) cd ${ANDROID_PRODUCT_OUT} && adb root && adb sync data
      4) adb shell /data/fuzz/arm64/${FUZZ}/${FUZZ}
Change-Id: Icac6bde017b497d9f92c06191eb29e107ba9c0a7
---
 tests/Android.bp                     | 20 +++++++++++++++
 tests/fuzz/verify_package_fuzzer.cpp | 37 ++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 tests/fuzz/verify_package_fuzzer.cpp

diff --git a/tests/Android.bp b/tests/Android.bp
index a9a088a3..19f2a6c6 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -201,3 +201,23 @@ cc_test_host {
         },
     },
 }
+
+cc_fuzz {
+    name: "libinstall_verify_package_fuzzer",
+    defaults: [
+        "recovery_test_defaults",
+    ],
+
+    srcs: ["fuzz/verify_package_fuzzer.cpp"],
+
+    corpus: [
+      "testdata/otasigned*.zip",
+    ],
+
+    static_libs: [
+        "libotautil",
+        "libinstall",
+        "librecovery_ui",
+        "libminui",
+    ],
+}
diff --git a/tests/fuzz/verify_package_fuzzer.cpp b/tests/fuzz/verify_package_fuzzer.cpp
new file mode 100644
index 00000000..baa44e07
--- /dev/null
+++ b/tests/fuzz/verify_package_fuzzer.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fuzzer/FuzzedDataProvider.h"
+
+#include "install/install.h"
+#include "install/package.h"
+#include "recovery_ui/stub_ui.h"
+
+std::unique_ptr<Package> CreatePackage(std::vector<uint8_t>& content) {
+  return Package::CreateMemoryPackage(content, [](float) -> void {});
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  FuzzedDataProvider data_provider(data, size);
+  auto package_contents = data_provider.ConsumeRemainingBytes<uint8_t>();
+  if (package_contents.size() == 0) {
+    return 0;
+  }
+  auto package = CreatePackage(package_contents);
+  StubRecoveryUI ui;
+  verify_package(package.get(), &ui);
+  return 0;
+}