service fuzzer: ignore interface checks
We bypass this half the time in the driver now, but
it's better to bypass it here in Parcel so that we
fuzz how different fields are set at the beginning
of Parcel.
Bug: N/A
Test: servicemanager_fuzzer for several minutes
Change-Id: I17399680c0f5d9239071e9d4fa6bcedb545f7871
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index f95bfa3..2c2a1b6 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -969,12 +969,18 @@
(!len || !memcmp(parcel_interface, interface, len * sizeof (char16_t)))) {
return true;
} else {
- if (!mServiceFuzzing) {
+ if (mServiceFuzzing) {
+ // ignore. Theoretically, this could cause a few false positives, because
+ // people could assume things about getInterfaceDescriptor if they pass
+ // this point, but it would be extremely fragile. It's more important that
+ // we fuzz with the above things read from the Parcel.
+ return true;
+ } else {
ALOGW("**** enforceInterface() expected '%s' but read '%s'",
String8(interface, len).string(),
String8(parcel_interface, parcel_interface_len).string());
+ return false;
}
- return false;
}
}
