| commit | 2fabebd8349ab0692f5b0669c5835d7de0acf539 | [log] [tgz] |
|---|---|---|
| author | Michael Ensing <michael.ensing@leviathansecurity.com> | Fri May 29 18:12:29 2020 -0700 |
| committer | Michael Ensing <michael.ensing@leviathansecurity.com> | Mon Jun 01 16:13:29 2020 -0700 |
| tree | 90a7ae3953f44e13fcb3df09797d39ea7c913c1e | |
| parent | 987c8df33f90da95aedc5249e3e7b18f76eeca4e [diff] |
Fix CHECK failure in libosi-allocation-tracker fuzzer
If the allocatior had not been initialized prior to a call to
allocation_tracker_notify_alloc, the function would immediately
return the provided pointer, but not track it (as the tracker is not
initialized). On fuzzer loop teardown, allocation_tracker_notify_free
is called, cannot find the pointer/id pair in its map, and asserts.
Test: Ran compiled fuzzer with crashfile before and after change to
verify crash had been fixed
(`./libosi_fuzz_allocation_tracker ./corpus/ -runs=0`)
Signed-off-by: Michael Ensing <michael.ensing@leviathansecurity.com>
Change-Id: I42e2759aa6efb9b6733509e298a552600e874f82
Just build AOSP - Fluoride is there by default.
Instructions for Ubuntu, tested on 14.04 with Clang 3.5.0 and 16.10 with Clang 3.8.0
mkdir ~/fluoride cd ~/fluoride git clone https://android.googlesource.com/platform/packages/modules/Bluetooth/system
Install dependencies (require sudo access):
cd ~/fluoride/bt build/install_deps.sh
Then fetch third party dependencies:
cd ~/fluoride/bt mkdir third_party cd third_party git clone https://github.com/google/googletest.git git clone https://android.googlesource.com/platform/external/aac git clone https://android.googlesource.com/platform/external/libchrome git clone https://android.googlesource.com/platform/external/libldac git clone https://android.googlesource.com/platform/external/modp_b64 git clone https://android.googlesource.com/platform/external/tinyxml2
And third party dependencies of third party dependencies:
cd fluoride/bt/third_party/libchrome/base/third_party mkdir valgrind cd valgrind curl https://chromium.googlesource.com/chromium/src/base/+/master/third_party/valgrind/valgrind.h?format=TEXT | base64 -d > valgrind.h curl https://chromium.googlesource.com/chromium/src/base/+/master/third_party/valgrind/memcheck.h?format=TEXT | base64 -d > memcheck.h
NOTE: If packages/modules/Bluetooth/system is checked out under AOSP, then create symbolic links instead of downloading sources
cd packages/modules/Bluetooth/system mkdir third_party cd third_party ln -s ../../../external/aac aac ln -s ../../../external/libchrome libchrome ln -s ../../../external/libldac libldac ln -s ../../../external/modp_b64 modp_b64 ln -s ../../../external/tinyxml2 tinyxml2 ln -s ../../../external/googletest googletest
cd ~/fluoride/bt gn gen out/Default
cd ~/fluoride/bt ninja -C out/Default all
This will build all targets (the shared library, executables, tests, etc) and put them in out/Default. To build an individual target, replace "all" with the target of your choice, e.g. ninja -C out/Default net_test_osi.
cd ~/fluoride/bt/out/Default LD_LIBRARY_PATH=./ ./bluetoothtbd -create-ipc-socket=fluoride
Follows the Chromium project Eclipse Setup Instructions until "Optional: Building inside Eclipse" section (don't do that section, we will set it up differently)
Generate Eclipse settings:
cd packages/modules/Bluetooth/system gn gen --ide=eclipse out/Default
In Eclipse, do File->Import->C/C++->C/C++ Project Settings, choose the XML location under packages/modules/Bluetooth/system/out/Default
Right click on the project. Go to Preferences->C/C++ Build->Builder Settings. Uncheck "Use default build command", but instead using "ninja -C out/Default"
Goto Behaviour tab, change clean command to "-t clean"