b07e339b53
SerializedFlushToState::PopNextUnreadLog() was calling AddMinHeapEntry() to replenish the element that was just popped off of the heap, however AddMinHeapEntry() also manages reference counts for the buffers, and this resulting in the following scenario: PopNextUnreadLog() returns a pointer referencing log buffer #1 AddMinHeapEntry() sees that all logs from buffer #1 has been read, so it decrements the reference count The caller of PopNextUnreadLog() uses the result which references invalid memory. This calls CheckForNewLogs() within HasUnreadLogs() instead of requiring a separate call, which fixes an additional issue where continuing from the loop in SerializedLogBuffer::FlushTo() may not pick up subsequent logs in a given log buffer, since CheckForNewLogs() wouldn't be called. This was exacerbated by the above change. This adds a test to check the reference counts for this case and fixes an argument mismatch in SerializedFlushToStateTest. This adds the corpus that surfaced the issue. Bug: 159753229 Bug: 159783005 Test: these unit tests, run fuzzer without error Change-Id: Ib2636dfc14293b7e2cd00876b9def6e9dbbff4ce
50 lines
1.2 KiB
Text
50 lines
1.2 KiB
Text
/*
|
|
* Copyright 2019 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
cc_defaults {
|
|
name: "log_fuzzer_defaults",
|
|
static_libs: [
|
|
"libbase",
|
|
"libcutils",
|
|
"libselinux",
|
|
"liblog",
|
|
"liblogd",
|
|
"libcutils",
|
|
"libz",
|
|
"libzstd",
|
|
],
|
|
cflags: ["-Wextra"],
|
|
host_supported: true,
|
|
}
|
|
|
|
cc_fuzz {
|
|
name: "log_buffer_log_fuzzer",
|
|
defaults: ["log_fuzzer_defaults"],
|
|
srcs: [
|
|
"log_buffer_log_fuzzer.cpp",
|
|
],
|
|
}
|
|
|
|
cc_fuzz {
|
|
name: "serialized_log_buffer_fuzzer",
|
|
defaults: ["log_fuzzer_defaults"],
|
|
srcs: [
|
|
"serialized_log_buffer_fuzzer.cpp",
|
|
],
|
|
corpus: [
|
|
"corpus/logentry_use_after_compress",
|
|
]
|
|
}
|