Merge Android U (ab/10368041)tmp_amf_298295554

Bug: 291102124
Merged-In: I40f39f20268fa51c3f5c690e89f8853a5aff0566
Change-Id: Ic2996360fe99f05286bbe22c375053e2c249a762

11 files changed, 101 insertions, 2 deletions

diff --git a/fuzzing/Android.bp b/fuzzing/Android.bp
index 5c22cb4..857c611 100644
--- a/fuzzing/Android.bp
+++ b/fuzzing/Android.bp
@@ -19,3 +19,4 @@ cc_fuzz {
     },
     host_supported: true,
 }
+
diff --git a/fuzzing/corpus/crash-a5b94d95681291f3057eea7f0233c8f1529b2f59 b/fuzzing/corpus/crash-a5b94d95681291f3057eea7f0233c8f1529b2f59
new file mode 100644
index 0000000..dbab42e
--- /dev/null
+++ b/fuzzing/corpus/crash-a5b94d95681291f3057eea7f0233c8f1529b2f59
diff --git a/fuzzing/corpus/hardy-octopus b/fuzzing/corpus/hardy-octopus
new file mode 100644
index 0000000..81615e9
--- /dev/null
+++ b/fuzzing/corpus/hardy-octopus
diff --git a/fuzzing/corpus/header-truncated b/fuzzing/corpus/header-truncated
new file mode 100644
index 0000000..1db29d8
--- /dev/null
+++ b/fuzzing/corpus/header-truncated
diff --git a/fuzzing/corpus/header-v-1 b/fuzzing/corpus/header-v-1
new file mode 100644
index 0000000..a773d07
--- /dev/null
+++ b/fuzzing/corpus/header-v-1
diff --git a/fuzzing/corpus/header-v0 b/fuzzing/corpus/header-v0
new file mode 100644
index 0000000..f22ec6a
--- /dev/null
+++ b/fuzzing/corpus/header-v0
diff --git a/fuzzing/corpus/meson-g12a-sei510-android.dtb b/fuzzing/corpus/meson-g12a-sei510-android.dtb
new file mode 100644
index 0000000..317175d
--- /dev/null
+++ b/fuzzing/corpus/meson-g12a-sei510-android.dtb
diff --git a/fuzzing/corpus/oob_by_one b/fuzzing/corpus/oob_by_one
new file mode 100644
index 0000000..216523c
--- /dev/null
+++ b/fuzzing/corpus/oob_by_one
diff --git a/fuzzing/corpus/quirks.dtb b/fuzzing/corpus/quirks.dtb
new file mode 100644
index 0000000..676024a
--- /dev/null
+++ b/fuzzing/corpus/quirks.dtb
diff --git a/fuzzing/libfdt_fuzzer.c b/fuzzing/libfdt_fuzzer.c
index 89fe3c2..b271714 100644
--- a/fuzzing/libfdt_fuzzer.c
+++ b/fuzzing/libfdt_fuzzer.c
@@ -59,6 +59,24 @@ static bool phandle_is_valid(uint32_t phandle) {
   return phandle != 0 && phandle != UINT32_MAX;
 }
 
+static void walk_node_properties(const void *device_tree, int node) {
+  int property, len = 0;
+
+  fdt_for_each_property_offset(property, device_tree, node) {
+    const struct fdt_property *prop = fdt_get_property_by_offset(device_tree,
+                                                                 property, &len);
+    if (!prop)
+      continue;
+    check_mem(prop->data, fdt32_to_cpu(prop->len));
+
+    const char *prop_name = fdt_string(device_tree, prop->nameoff);
+    if (prop_name != NULL) {
+      check_mem(prop_name, strlen(prop_name));
+    }
+  }
+}
+
+
 static void walk_device_tree(const void *device_tree, int parent_node) {
   int len = 0;
   const char *node_name = fdt_get_name(device_tree, parent_node, &len);
@@ -72,6 +90,30 @@ static void walk_device_tree(const void *device_tree, int parent_node) {
     assert(node >= 0); // it should at least find parent_node
   }
 
+  char path_buf[64];
+  if(fdt_get_path(device_tree, parent_node, path_buf, sizeof(path_buf)) == 0) {
+    fdt_path_offset(device_tree, path_buf);
+  }
+
+  fdt_parent_offset(device_tree, parent_node);
+
+  // Exercise sub-node search string functions
+  fdt_subnode_offset(device_tree, parent_node, "a");
+  fdt_get_property(device_tree, parent_node, "reg", &len);
+
+  // Check for a stringlist node called 'stringlist' (added to corpus)
+  const int sl_count = fdt_stringlist_count(device_tree,
+                                            parent_node, "stringlist");
+  if (sl_count > 0) {
+    for (int i = 0; i < sl_count; i++) {
+      fdt_stringlist_get(device_tree, parent_node, "stringlist", i, &len);
+    }
+
+    fdt_stringlist_search(device_tree, parent_node, "stringlist", "a");
+  }
+
+  walk_node_properties(device_tree, parent_node);
+
   // recursively walk the node's children
   for (int node = fdt_first_subnode(device_tree, parent_node); node >= 0;
        node = fdt_next_subnode(device_tree, node)) {
@@ -80,15 +122,49 @@ static void walk_device_tree(const void *device_tree, int parent_node) {
 }
 
 
+static void walk_mem_rsv(const void *device_tree) {
+  const int n = fdt_num_mem_rsv(device_tree);
+  uint64_t address, size;
+
+  for (int i = 0; i < n; i++) {
+    fdt_get_mem_rsv(device_tree, i, &address, &size);
+  }
+}
+
+
 // Information on device tree is available in external/dtc/Documentation/
 // folder.
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  int rc;
+
   // Non-zero return values are reserved for future use.
   if (size < FDT_V17_SIZE) return 0;
 
-  if (fdt_check_full(data, size) != 0) return 0;
+  // Produce coverage of checking function
+  rc = fdt_check_full(data, size);
+  fdt_strerror(rc);
 
+  // Don't continue if the library rejected the input
+  if (rc != 0) return 0;
+
+  // Cover reading functions
   walk_device_tree(data, /* parent_node */ 0);
+  walk_mem_rsv(data);
+
+  // Cover phandle functions
+  uint32_t phandle;
+  fdt_generate_phandle(data, &phandle);
+
+  // Try and get a path by alias
+  fdt_path_offset(data, "a");
+
+  // Try to get an alias
+  fdt_get_alias(data, "a");
+
+  // Exercise common search functions
+  fdt_node_offset_by_compatible(data, 0, "a");
+  fdt_node_offset_by_prop_value(data, 0, "x", "42", 3);
 
   return 0;
 }
+
diff --git a/libfdt/fdt_ro.c b/libfdt/fdt_ro.c
index 87d736b..a62ec78 100644
--- a/libfdt/fdt_ro.c
+++ b/libfdt/fdt_ro.c
@@ -10,6 +10,14 @@
 
 #include "libfdt_internal.h"
 
+/* Check if a buffer contains a nul-terminated string.
+ * Used for checking property values which should be strings.
+ */
+static bool is_nul_string(const char *buf, const size_t buf_len) {
+	return buf_len > 0 && buf[buf_len - 1] == '\0' &&
+		strnlen(buf, buf_len) == buf_len - 1;
+}
+
 static int fdt_nodename_eq_(const void *fdt, int offset,
 			    const char *s, int len)
 {
@@ -531,13 +539,27 @@ uint32_t fdt_get_phandle(const void *fdt, int nodeoffset)
 const char *fdt_get_alias_namelen(const void *fdt,
 				  const char *name, int namelen)
 {
+	const char *prop;
 	int aliasoffset;
+	int prop_len;
 
 	aliasoffset = fdt_path_offset(fdt, "/aliases");
 	if (aliasoffset < 0)
 		return NULL;
 
-	return fdt_getprop_namelen(fdt, aliasoffset, name, namelen, NULL);
+	prop = fdt_getprop_namelen(fdt, aliasoffset, name, namelen, &prop_len);
+	if (prop && !can_assume(VALID_INPUT)) {
+		/* Validate the alias value.  From the devicetree spec v0.3:
+		 * "An alias value is a device path and is encoded as a string.
+		 *  The value representes the full path to a node, ..."
+		 * A full path must start at the root to prevent recursion.
+		 */
+		if (prop_len == 0 || *prop != '/' || !is_nul_string(prop, prop_len)) {
+			prop = NULL;
+		}
+	}
+
+	return prop;
 }
 
 const char *fdt_get_alias(const void *fdt, const char *name)