fs_mgr/libsnapshot/fuzz_utils.h - platform/system/core - Git at Google

 // Copyright (C) 2020 The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.

 #pragma once

 #include <map>
 #include <string>
 #include <string_view>

 #include <google/protobuf/descriptor.h>
 #include <google/protobuf/message.h>
 #include <google/protobuf/repeated_field.h>

 // Utilities for using a protobuf definition to fuzz APIs in a class.
 // Terms:
 // The "fuzzed class" is the C++ class definition whose functions are fuzzed.
 // The "fuzzed object" is an instantiated object of the fuzzed class. It is
 //   typically created and destroyed for each test run.
 // An "action" is an operation on the fuzzed object that may mutate its state.
 //   This typically involves one function call into the fuzzed object.

 namespace android::fuzz {

 // CHECK(value) << msg
 void CheckInternal(bool value, std::string_view msg);

 // Get the oneof descriptor inside Action
 const google::protobuf::OneofDescriptor* GetProtoValueDescriptor(
         const google::protobuf::Descriptor* action_desc);

 template <typename Class>
 using FunctionMapImpl =
         std::map<int, std::function<void(Class*, const google::protobuf::Message& action_proto,
                                          const google::protobuf::FieldDescriptor* field_desc)>>;

 template <typename Class>
 class FunctionMap : public FunctionMapImpl<Class> {
   public:
     void CheckEmplace(typename FunctionMapImpl<Class>::key_type key,
                       typename FunctionMapImpl<Class>::mapped_type&& value) {
         auto [it, inserted] = this->emplace(key, std::move(value));
         CheckInternal(inserted,
                       "Multiple implementation registered for tag number " + std::to_string(key));
     }
 };

 template <typename Action>
 int CheckConsistency() {
     const auto* function_map = Action::GetFunctionMap();
     const auto* action_value_desc = GetProtoValueDescriptor(Action::Proto::GetDescriptor());

     for (int field_index = 0; field_index < action_value_desc->field_count(); ++field_index) {
         const auto* field_desc = action_value_desc->field(field_index);
         CheckInternal(function_map->find(field_desc->number()) != function_map->end(),
                       "Missing impl for function " + field_desc->camelcase_name());
     }
     return 0;
 }

 // Get the field descriptor for the oneof field in the action message. If no oneof field is set,
 // return nullptr.
 template <typename Action>
 const google::protobuf::FieldDescriptor* GetValueFieldDescriptor(
         const typename Action::Proto& action_proto) {
     static auto* action_value_desc = GetProtoValueDescriptor(Action::Proto::GetDescriptor());

     auto* action_refl = Action::Proto::GetReflection();
     if (!action_refl->HasOneof(action_proto, action_value_desc)) {
         return nullptr;
     }
     return action_refl->GetOneofFieldDescriptor(action_proto, action_value_desc);
 }

 template <typename Action>
 void ExecuteActionProto(typename Action::ClassType* module,
                         const typename Action::Proto& action_proto) {
     const auto* field_desc = GetValueFieldDescriptor<Action>(action_proto);
     if (field_desc == nullptr) return;
     auto number = field_desc->number();
     const auto& map = *Action::GetFunctionMap();
     auto it = map.find(number);
     CheckInternal(it != map.end(), "Missing impl for function " + field_desc->camelcase_name());
     const auto& func = it->second;
     func(module, action_proto, field_desc);
 }

 template <typename Action>
 void ExecuteAllActionProtos(
         typename Action::ClassType* module,
         const google::protobuf::RepeatedPtrField<typename Action::Proto>& action_protos) {
     for (const auto& proto : action_protos) {
         ExecuteActionProto<Action>(module, proto);
     }
 }

 // Safely cast message to T. Returns a pointer to message if cast successfully, otherwise nullptr.
 template <typename T>
 const T* SafeCast(const google::protobuf::Message& message) {
     if (message.GetDescriptor() != T::GetDescriptor()) {
         return nullptr;
     }
     return static_cast<const T*>(&message);
 }

 // Cast message to const T&. Abort if type mismatch.
 template <typename T>
 const T& CheckedCast(const google::protobuf::Message& message) {
     const auto* ptr = SafeCast<T>(message);
     CheckInternal(ptr, "Cannot cast " + message.GetDescriptor()->name() + " to " +
                                T::GetDescriptor()->name());
     return *ptr;
 }

 // A templated way to a primitive field from a message using reflection.
 template <typename T>
 struct PrimitiveGetter;
 #define FUZZ_DEFINE_PRIMITIVE_GETTER(type, func_name)                              \
     template <>                                                                    \
     struct PrimitiveGetter<type> {                                                 \
         static constexpr const auto fp = &google::protobuf::Reflection::func_name; \
     }

 FUZZ_DEFINE_PRIMITIVE_GETTER(bool, GetBool);
 FUZZ_DEFINE_PRIMITIVE_GETTER(uint32_t, GetUInt32);
 FUZZ_DEFINE_PRIMITIVE_GETTER(int32_t, GetInt32);
 FUZZ_DEFINE_PRIMITIVE_GETTER(uint64_t, GetUInt64);
 FUZZ_DEFINE_PRIMITIVE_GETTER(int64_t, GetInt64);
 FUZZ_DEFINE_PRIMITIVE_GETTER(double, GetDouble);
 FUZZ_DEFINE_PRIMITIVE_GETTER(float, GetFloat);

 // ActionPerformer extracts arguments from the protobuf message, and then call FuzzFunction
 // with these arguments.
 template <typename FuzzFunction, typename Signature, typename Enabled = void>
 struct ActionPerformerImpl;  // undefined

 template <typename FuzzFunction, typename MessageProto>
 struct ActionPerformerImpl<
         FuzzFunction, void(const MessageProto&),
         typename std::enable_if_t<std::is_base_of_v<google::protobuf::Message, MessageProto>>> {
     static typename FuzzFunction::ReturnType Invoke(
             typename FuzzFunction::ClassType* module, const google::protobuf::Message& action_proto,
             const google::protobuf::FieldDescriptor* field_desc) {
         const MessageProto& arg = CheckedCast<std::remove_reference_t<MessageProto>>(
                 action_proto.GetReflection()->GetMessage(action_proto, field_desc));
         return FuzzFunction::ImplBody(module, arg);
     }
 };

 template <typename FuzzFunction, typename Primitive>
 struct ActionPerformerImpl<FuzzFunction, void(Primitive),
                            typename std::enable_if_t<std::is_arithmetic_v<Primitive>>> {
     static typename FuzzFunction::ReturnType Invoke(
             typename FuzzFunction::ClassType* module, const google::protobuf::Message& action_proto,
             const google::protobuf::FieldDescriptor* field_desc) {
         Primitive arg = std::invoke(PrimitiveGetter<Primitive>::fp, action_proto.GetReflection(),
                                     action_proto, field_desc);
         return FuzzFunction::ImplBody(module, arg);
     }
 };

 template <typename FuzzFunction>
 struct ActionPerformerImpl<FuzzFunction, void()> {
     static typename FuzzFunction::ReturnType Invoke(typename FuzzFunction::ClassType* module,
                                                     const google::protobuf::Message&,
                                                     const google::protobuf::FieldDescriptor*) {
         return FuzzFunction::ImplBody(module);
     }
 };

 template <typename FuzzFunction>
 struct ActionPerformerImpl<FuzzFunction, void(const std::string&)> {
     static typename FuzzFunction::ReturnType Invoke(
             typename FuzzFunction::ClassType* module, const google::protobuf::Message& action_proto,
             const google::protobuf::FieldDescriptor* field_desc) {
         std::string scratch;
         const std::string& arg = action_proto.GetReflection()->GetStringReference(
                 action_proto, field_desc, &scratch);
         return FuzzFunction::ImplBody(module, arg);
     }
 };

 template <typename FuzzFunction>
 struct ActionPerformer : ActionPerformerImpl<FuzzFunction, typename FuzzFunction::Signature> {};

 }  // namespace android::fuzz

 // Fuzz existing C++ class, ClassType, with a collection of functions under the name Action.
 //
 // Prerequisite: ActionProto must be defined in Protobuf to describe possible actions:
 // message FooActionProto {
 //     message NoArgs {}
 //     oneof value {
 //         bool do_foo = 1;
 //         NoArgs do_bar = 1;
 //     }
 // }
 // Use it to fuzz a C++ class Foo by doing the following:
 //   FUZZ_CLASS(Foo, FooAction)
 // After linking functions of Foo to FooAction, execute all actions by:
 //   FooAction::ExecuteAll(foo_object, action_protos)
 #define FUZZ_CLASS(Class, Action)                                                                \
     class Action {                                                                               \
       public:                                                                                    \
         using Proto = Action##Proto;                                                             \
         using ClassType = Class;                                                                 \
         using FunctionMap = android::fuzz::FunctionMap<Class>;                                   \
         static FunctionMap* GetFunctionMap() {                                                   \
             static Action::FunctionMap map;                                                      \
             return &map;                                                                         \
         }                                                                                        \
         static void ExecuteAll(Class* module,                                                    \
                                const google::protobuf::RepeatedPtrField<Proto>& action_protos) { \
             [[maybe_unused]] static int consistent = android::fuzz::CheckConsistency<Action>();  \
             android::fuzz::ExecuteAllActionProtos<Action>(module, action_protos);                \
         }                                                                                        \
     }

 #define FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName) Action##_##FunctionName
 #define FUZZ_FUNCTION_TAG_NAME(FunctionName) k##FunctionName

 // Implement an action defined in protobuf. Example:
 // message FooActionProto {
 //     oneof value {
 //         bool do_foo = 1;
 //     }
 // }
 // class Foo { public: void DoAwesomeFoo(bool arg); };
 // FUZZ_OBJECT(FooAction, Foo);
 // FUZZ_FUNCTION(FooAction, DoFoo, void, IFoo* module, bool arg) {
 //   module->DoAwesomeFoo(arg);
 // }
 // The name DoFoo is the camel case name of the action in protobuf definition of FooActionProto.
 #define FUZZ_FUNCTION(Action, FunctionName, Return, ModuleArg, ...)             \
     class FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName) {                      \
       public:                                                                   \
         using ActionType = Action;                                              \
         using ClassType = Action::ClassType;                                    \
         using ReturnType = Return;                                              \
         using Signature = void(__VA_ARGS__);                                    \
         static constexpr const char name[] = #FunctionName;                     \
         static constexpr const auto tag =                                       \
                 Action::Proto::ValueCase::FUZZ_FUNCTION_TAG_NAME(FunctionName); \
         static ReturnType ImplBody(ModuleArg, ##__VA_ARGS__);                   \
                                                                                 \
       private:                                                                  \
         static bool registered_;                                                \
     };                                                                          \
     auto FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName)::registered_ = ([] {    \
         auto tag = FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName)::tag;         \
         auto func = &::android::fuzz::ActionPerformer<FUZZ_FUNCTION_CLASS_NAME( \
                 Action, FunctionName)>::Invoke;                                 \
         Action::GetFunctionMap()->CheckEmplace(tag, func);                      \
         return true;                                                            \
     })();                                                                       \
     Return FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName)::ImplBody(ModuleArg, ##__VA_ARGS__)

 // Implement a simple action by linking it to the function with the same name. Example:
 // message FooActionProto {
 //     message NoArgs {}
 //     oneof value {
 //         NoArgs do_bar = 1;
 //     }
 // }
 // class Foo { public void DoBar(); };
 // FUZZ_OBJECT(FooAction, Foo);
 // FUZZ_FUNCTION(FooAction, DoBar);
 // The name DoBar is the camel case name of the action in protobuf definition of FooActionProto, and
 // also the name of the function of Foo.
 #define FUZZ_SIMPLE_FUNCTION(Action, FunctionName)                            \
     FUZZ_FUNCTION(Action, FunctionName,                                       \
                   decltype(std::declval<Action::ClassType>().FunctionName()), \
                   Action::ClassType* module) {                                \
         return module->FunctionName();                                        \
     }
	// Copyright (C) 2020 The Android Open Source Project
	//
	// Licensed under the Apache License, Version 2.0 (the "License");
	// you may not use this file except in compliance with the License.
	// You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing, software
	// distributed under the License is distributed on an "AS IS" BASIS,
	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	// See the License for the specific language governing permissions and
	// limitations under the License.

	#pragma once

	#include <map>
	#include <string>
	#include <string_view>

	#include <google/protobuf/descriptor.h>
	#include <google/protobuf/message.h>
	#include <google/protobuf/repeated_field.h>

	// Utilities for using a protobuf definition to fuzz APIs in a class.
	// Terms:
	// The "fuzzed class" is the C++ class definition whose functions are fuzzed.
	// The "fuzzed object" is an instantiated object of the fuzzed class. It is
	// typically created and destroyed for each test run.
	// An "action" is an operation on the fuzzed object that may mutate its state.
	// This typically involves one function call into the fuzzed object.

	namespace android::fuzz {

	// CHECK(value) << msg
	void CheckInternal(bool value, std::string_view msg);

	// Get the oneof descriptor inside Action
	const google::protobuf::OneofDescriptor* GetProtoValueDescriptor(
	const google::protobuf::Descriptor* action_desc);

	template <typename Class>
	using FunctionMapImpl =
	std::map<int, std::function<void(Class*, const google::protobuf::Message& action_proto,
	const google::protobuf::FieldDescriptor* field_desc)>>;

	template <typename Class>
	class FunctionMap : public FunctionMapImpl<Class> {
	public:
	void CheckEmplace(typename FunctionMapImpl<Class>::key_type key,
	typename FunctionMapImpl<Class>::mapped_type&& value) {
	auto [it, inserted] = this->emplace(key, std::move(value));
	CheckInternal(inserted,
	"Multiple implementation registered for tag number " + std::to_string(key));
	}
	};

	template <typename Action>
	int CheckConsistency() {
	const auto* function_map = Action::GetFunctionMap();
	const auto* action_value_desc = GetProtoValueDescriptor(Action::Proto::GetDescriptor());

	for (int field_index = 0; field_index < action_value_desc->field_count(); ++field_index) {
	const auto* field_desc = action_value_desc->field(field_index);
	CheckInternal(function_map->find(field_desc->number()) != function_map->end(),
	"Missing impl for function " + field_desc->camelcase_name());
	}
	return 0;
	}

	// Get the field descriptor for the oneof field in the action message. If no oneof field is set,
	// return nullptr.
	template <typename Action>
	const google::protobuf::FieldDescriptor* GetValueFieldDescriptor(
	const typename Action::Proto& action_proto) {
	static auto* action_value_desc = GetProtoValueDescriptor(Action::Proto::GetDescriptor());

	auto* action_refl = Action::Proto::GetReflection();
	if (!action_refl->HasOneof(action_proto, action_value_desc)) {
	return nullptr;
	}
	return action_refl->GetOneofFieldDescriptor(action_proto, action_value_desc);
	}

	template <typename Action>
	void ExecuteActionProto(typename Action::ClassType* module,
	const typename Action::Proto& action_proto) {
	const auto* field_desc = GetValueFieldDescriptor<Action>(action_proto);
	if (field_desc == nullptr) return;
	auto number = field_desc->number();
	const auto& map = *Action::GetFunctionMap();
	auto it = map.find(number);
	CheckInternal(it != map.end(), "Missing impl for function " + field_desc->camelcase_name());
	const auto& func = it->second;
	func(module, action_proto, field_desc);
	}

	template <typename Action>
	void ExecuteAllActionProtos(
	typename Action::ClassType* module,
	const google::protobuf::RepeatedPtrField<typename Action::Proto>& action_protos) {
	for (const auto& proto : action_protos) {
	ExecuteActionProto<Action>(module, proto);
	}
	}

	// Safely cast message to T. Returns a pointer to message if cast successfully, otherwise nullptr.
	template <typename T>
	const T* SafeCast(const google::protobuf::Message& message) {
	if (message.GetDescriptor() != T::GetDescriptor()) {
	return nullptr;
	}
	return static_cast<const T*>(&message);
	}

	// Cast message to const T&. Abort if type mismatch.
	template <typename T>
	const T& CheckedCast(const google::protobuf::Message& message) {
	const auto* ptr = SafeCast<T>(message);
	CheckInternal(ptr, "Cannot cast " + message.GetDescriptor()->name() + " to " +
	T::GetDescriptor()->name());
	return *ptr;
	}

	// A templated way to a primitive field from a message using reflection.
	template <typename T>
	struct PrimitiveGetter;
	#define FUZZ_DEFINE_PRIMITIVE_GETTER(type, func_name) \
	template <> \
	struct PrimitiveGetter<type> { \
	static constexpr const auto fp = &google::protobuf::Reflection::func_name; \
	}

	FUZZ_DEFINE_PRIMITIVE_GETTER(bool, GetBool);
	FUZZ_DEFINE_PRIMITIVE_GETTER(uint32_t, GetUInt32);
	FUZZ_DEFINE_PRIMITIVE_GETTER(int32_t, GetInt32);
	FUZZ_DEFINE_PRIMITIVE_GETTER(uint64_t, GetUInt64);
	FUZZ_DEFINE_PRIMITIVE_GETTER(int64_t, GetInt64);
	FUZZ_DEFINE_PRIMITIVE_GETTER(double, GetDouble);
	FUZZ_DEFINE_PRIMITIVE_GETTER(float, GetFloat);

	// ActionPerformer extracts arguments from the protobuf message, and then call FuzzFunction
	// with these arguments.
	template <typename FuzzFunction, typename Signature, typename Enabled = void>
	struct ActionPerformerImpl; // undefined

	template <typename FuzzFunction, typename MessageProto>
	struct ActionPerformerImpl<
	FuzzFunction, void(const MessageProto&),
	typename std::enable_if_t<std::is_base_of_v<google::protobuf::Message, MessageProto>>> {
	static typename FuzzFunction::ReturnType Invoke(
	typename FuzzFunction::ClassType* module, const google::protobuf::Message& action_proto,
	const google::protobuf::FieldDescriptor* field_desc) {
	const MessageProto& arg = CheckedCast<std::remove_reference_t<MessageProto>>(
	action_proto.GetReflection()->GetMessage(action_proto, field_desc));
	return FuzzFunction::ImplBody(module, arg);
	}
	};

	template <typename FuzzFunction, typename Primitive>
	struct ActionPerformerImpl<FuzzFunction, void(Primitive),
	typename std::enable_if_t<std::is_arithmetic_v<Primitive>>> {
	static typename FuzzFunction::ReturnType Invoke(
	typename FuzzFunction::ClassType* module, const google::protobuf::Message& action_proto,
	const google::protobuf::FieldDescriptor* field_desc) {
	Primitive arg = std::invoke(PrimitiveGetter<Primitive>::fp, action_proto.GetReflection(),
	action_proto, field_desc);
	return FuzzFunction::ImplBody(module, arg);
	}
	};

	template <typename FuzzFunction>
	struct ActionPerformerImpl<FuzzFunction, void()> {
	static typename FuzzFunction::ReturnType Invoke(typename FuzzFunction::ClassType* module,
	const google::protobuf::Message&,
	const google::protobuf::FieldDescriptor*) {
	return FuzzFunction::ImplBody(module);
	}
	};

	template <typename FuzzFunction>
	struct ActionPerformerImpl<FuzzFunction, void(const std::string&)> {
	static typename FuzzFunction::ReturnType Invoke(
	typename FuzzFunction::ClassType* module, const google::protobuf::Message& action_proto,
	const google::protobuf::FieldDescriptor* field_desc) {
	std::string scratch;
	const std::string& arg = action_proto.GetReflection()->GetStringReference(
	action_proto, field_desc, &scratch);
	return FuzzFunction::ImplBody(module, arg);
	}
	};

	template <typename FuzzFunction>
	struct ActionPerformer : ActionPerformerImpl<FuzzFunction, typename FuzzFunction::Signature> {};

	} // namespace android::fuzz

	// Fuzz existing C++ class, ClassType, with a collection of functions under the name Action.
	//
	// Prerequisite: ActionProto must be defined in Protobuf to describe possible actions:
	// message FooActionProto {
	// message NoArgs {}
	// oneof value {
	// bool do_foo = 1;
	// NoArgs do_bar = 1;
	// }
	// }
	// Use it to fuzz a C++ class Foo by doing the following:
	// FUZZ_CLASS(Foo, FooAction)
	// After linking functions of Foo to FooAction, execute all actions by:
	// FooAction::ExecuteAll(foo_object, action_protos)
	#define FUZZ_CLASS(Class, Action) \
	class Action { \
	public: \
	using Proto = Action##Proto; \
	using ClassType = Class; \
	using FunctionMap = android::fuzz::FunctionMap<Class>; \
	static FunctionMap* GetFunctionMap() { \
	static Action::FunctionMap map; \
	return &map; \
	} \
	static void ExecuteAll(Class* module, \
	const google::protobuf::RepeatedPtrField<Proto>& action_protos) { \
	[[maybe_unused]] static int consistent = android::fuzz::CheckConsistency<Action>(); \
	android::fuzz::ExecuteAllActionProtos<Action>(module, action_protos); \
	} \
	}

	#define FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName) Action##_##FunctionName
	#define FUZZ_FUNCTION_TAG_NAME(FunctionName) k##FunctionName

	// Implement an action defined in protobuf. Example:
	// message FooActionProto {
	// oneof value {
	// bool do_foo = 1;
	// }
	// }
	// class Foo { public: void DoAwesomeFoo(bool arg); };
	// FUZZ_OBJECT(FooAction, Foo);
	// FUZZ_FUNCTION(FooAction, DoFoo, void, IFoo* module, bool arg) {
	// module->DoAwesomeFoo(arg);
	// }
	// The name DoFoo is the camel case name of the action in protobuf definition of FooActionProto.
	#define FUZZ_FUNCTION(Action, FunctionName, Return, ModuleArg, ...) \
	class FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName) { \
	public: \
	using ActionType = Action; \
	using ClassType = Action::ClassType; \
	using ReturnType = Return; \
	using Signature = void(__VA_ARGS__); \
	static constexpr const char name[] = #FunctionName; \
	static constexpr const auto tag = \
	Action::Proto::ValueCase::FUZZ_FUNCTION_TAG_NAME(FunctionName); \
	static ReturnType ImplBody(ModuleArg, ##__VA_ARGS__); \
	\
	private: \
	static bool registered_; \
	}; \
	auto FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName)::registered_ = ([] { \
	auto tag = FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName)::tag; \
	auto func = &::android::fuzz::ActionPerformer<FUZZ_FUNCTION_CLASS_NAME( \
	Action, FunctionName)>::Invoke; \
	Action::GetFunctionMap()->CheckEmplace(tag, func); \
	return true; \
	})(); \
	Return FUZZ_FUNCTION_CLASS_NAME(Action, FunctionName)::ImplBody(ModuleArg, ##__VA_ARGS__)

	// Implement a simple action by linking it to the function with the same name. Example:
	// message FooActionProto {
	// message NoArgs {}
	// oneof value {
	// NoArgs do_bar = 1;
	// }
	// }
	// class Foo { public void DoBar(); };
	// FUZZ_OBJECT(FooAction, Foo);
	// FUZZ_FUNCTION(FooAction, DoBar);
	// The name DoBar is the camel case name of the action in protobuf definition of FooActionProto, and
	// also the name of the function of Foo.
	#define FUZZ_SIMPLE_FUNCTION(Action, FunctionName) \
	FUZZ_FUNCTION(Action, FunctionName, \
	decltype(std::declval<Action::ClassType>().FunctionName()), \
	Action::ClassType* module) { \
	return module->FunctionName(); \
	}