commit 1420afd989031a25c5f1081d976989ad730e8cfa
author Fabián Cañas <fabiancanas@google.com> Mon Mar 13 13:00:23 2023 -0400
committer Fabián Cañas <fabiancanas@google.com> Mon Mar 13 13:02:07 2023 -0400
tree 944f9688be6840118b933c91ad0234eee78bc684
parent 19ce0cba3e17c1a1ad4979d73a520872f0db4e04

Fix double close in RecordedTransaction fuzzer

BUG=271692937

Test: The issue is reproducible on devices with HWASan:

SANITIZE_TARGET=hwaddress make binder_recordedTransactionFileFuzz
$ cd ${ANDROID_PRODUCT_OUT}
$ adb root
$ adb sync data
$ adb shell /data/fuzz/$(get_build_var
TARGET_ARCH)/binder_recordedTransactionFileFuzz/binder_recordedTransactionFileFuzz

Without the fix, fdsan fails immediately. With the fix, the fuzzer runs
successfully.

Change-Id: I3972fa0b3d9e56eef001a6c5be8c9beab77571d7

libs/binder/tests/unit_fuzzers/RecordedTransactionFileFuzz.cpp

diff --git a/libs/binder/tests/unit_fuzzers/RecordedTransactionFileFuzz.cpp b/libs/binder/tests/unit_fuzzers/RecordedTransactionFileFuzz.cpp
index 73790fa..e494366 100644
--- a/libs/binder/tests/unit_fuzzers/RecordedTransactionFileFuzz.cpp
+++ b/libs/binder/tests/unit_fuzzers/RecordedTransactionFileFuzz.cpp
@@ -26,7 +26,7 @@
     rewind(intermediateFile);
     int fileNumber = fileno(intermediateFile);
 
-    android::base::unique_fd fd(fileNumber);
+    android::base::unique_fd fd(dup(fileNumber));
 
     auto transaction = android::binder::debug::RecordedTransaction::fromFile(fd);