commit 6065c0576fdc22d7cbb264fbdda06a05595225f5
author Steven Moreland <smoreland@google.com> Mon Sep 30 18:22:44 2019 -0700
committer Steven Moreland <smoreland@google.com> Mon Sep 30 18:29:12 2019 -0700
tree 9795c2db090fede8ae79e64284523e5361bc0a9f
parent 6d81393c13ba5bf816fe0ed7c39b51c9af3cb6be

libbinder fuzzer: print data from inplace reads

To make sure there are no OOB reads for these two cases.

Bug: 131861045
Test: binder_parcel_fuzzer
Change-Id: Id58fc8e8e72c6fc1c88734794382c1138ffd36f6

libs/binder/fuzzer/binder.cpp

diff --git a/libs/binder/fuzzer/binder.cpp b/libs/binder/fuzzer/binder.cpp
index f678f4c..86264db 100644
--- a/libs/binder/fuzzer/binder.cpp
+++ b/libs/binder/fuzzer/binder.cpp
@@ -125,7 +125,7 @@
     [] (const ::android::Parcel& p, uint8_t len) {
         FUZZ_LOG() << "about to readInplace";
         const void* r = p.readInplace(len);
-        FUZZ_LOG() << "readInplace done. pointer: " << r;
+        FUZZ_LOG() << "readInplace done. pointer: " << r << " bytes: " << hexString(r, len);
     },
     PARCEL_READ_OPT_STATUS(int32_t, readInt32),
     PARCEL_READ_OPT_STATUS(uint32_t, readUint32),
@@ -152,7 +152,8 @@
         FUZZ_LOG() << "about to readString16Inplace";
         size_t outLen = 0;
         const char16_t* str = p.readString16Inplace(&outLen);
-        FUZZ_LOG() << "readString16Inplace: " << (str ? "non-null" : "null") << " size: " << outLen;
+        FUZZ_LOG() << "readString16Inplace: " << hexString(str, sizeof(char16_t) * outLen)
+                   << " size: " << outLen;
     },
     PARCEL_READ_WITH_STATUS(android::sp<android::IBinder>, readStrongBinder),
     PARCEL_READ_WITH_STATUS(android::sp<android::IBinder>, readNullableStrongBinder),