runtime/fuzzer_corpus_test.cc - platform/art - Git at Google

 /*
  * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <cstdint>
 #include <filesystem>
 #include <unordered_set>

 #include "android-base/file.h"
 #include "android-base/macros.h"
 #include "common_runtime_test.h"
 #include "dex/class_accessor-inl.h"
 #include "dex/dex_file_verifier.h"
 #include "dex/standard_dex_file.h"
 #include "gtest/gtest.h"
 #include "handle_scope-inl.h"
 #include "jni/java_vm_ext.h"
 #include "verifier/class_verifier.h"
 #include "ziparchive/zip_archive.h"

 namespace art {
 // Global variable to count how many DEX files passed DEX file verification and they were
 // registered, since these are the cases for which we would be running the GC.
 int skipped_gc_iterations = 0;
 // Global variable to call the GC once every maximum number of iterations.
 // TODO: These values were obtained from local experimenting. They can be changed after
 // further investigation.
 static constexpr int kMaxSkipGCIterations = 100;

 // A class to be friends with ClassLinker and access the internal FindDexCacheDataLocked method.
 // TODO: Deduplicate this since it is the same with tools/fuzzer/libart_verify_classes_fuzzer.cc.
 class VerifyClassesFuzzerCorpusTestHelper {
  public:
   static const ClassLinker::DexCacheData* GetDexCacheData(Runtime* runtime, const DexFile* dex_file)
       REQUIRES_SHARED(Locks::mutator_lock_) {
     Thread* self = Thread::Current();
     ReaderMutexLock mu(self, *Locks::dex_lock_);
     ClassLinker* class_linker = runtime->GetClassLinker();
     const ClassLinker::DexCacheData* cached_data = class_linker->FindDexCacheDataLocked(*dex_file);
     return cached_data;
   }
 };

 // Manages the ZipArchiveHandle liveness.
 class ZipArchiveHandleScope {
  public:
   explicit ZipArchiveHandleScope(ZipArchiveHandle* handle) : handle_(handle) {}
   ~ZipArchiveHandleScope() { CloseArchive(*(handle_.release())); }

  private:
   std::unique_ptr<ZipArchiveHandle> handle_;
 };

 class FuzzerCorpusTest : public CommonRuntimeTest {
  public:
   static void DexFileVerification(const uint8_t* data,
                                   size_t size,
                                   const std::string& name,
                                   bool expected_success) {
     // Do not verify the checksum as we only care about the DEX file contents,
     // and know that the checksum would probably be erroneous (i.e. random).
     constexpr bool kVerify = false;

     auto container = std::make_shared<MemoryDexFileContainer>(data, size);
     StandardDexFile dex_file(data,
                              /*location=*/name,
                              /*location_checksum=*/0,
                              /*oat_dex_file=*/nullptr,
                              container);

     std::string error_msg;
     bool is_valid_dex_file =
         dex::Verify(&dex_file, dex_file.GetLocation().c_str(), kVerify, &error_msg);
     ASSERT_EQ(is_valid_dex_file, expected_success) << " Failed for " << name;
   }

   static void ClassVerification(const uint8_t* data,
                                 size_t size,
                                 const std::string& name,
                                 bool expected_success) {
     // Do not verify the checksum as we only care about the DEX file contents,
     // and know that the checksum would probably be erroneous (i.e. random)
     constexpr bool kVerify = false;
     bool passed_class_verification = true;

     auto container = std::make_shared<MemoryDexFileContainer>(data, size);
     StandardDexFile dex_file(data,
                              /*location=*/name,
                              /*location_checksum=*/0,
                              /*oat_dex_file=*/nullptr,
                              container);

     std::string error_msg;
     const bool success_dex =
         dex::Verify(&dex_file, dex_file.GetLocation().c_str(), kVerify, &error_msg);
     ASSERT_EQ(success_dex, true) << " Failed for " << name;

     Runtime* runtime = Runtime::Current();
     CHECK(runtime != nullptr);

     ScopedObjectAccess soa(Thread::Current());
     ClassLinker* class_linker = runtime->GetClassLinker();
     jobject class_loader = RegisterDexFileAndGetClassLoader(runtime, &dex_file);

     // Scope for the handles
     {
       art::StackHandleScope<4> scope(soa.Self());
       art::Handle<art::mirror::ClassLoader> h_loader =
           scope.NewHandle(soa.Decode<art::mirror::ClassLoader>(class_loader));
       art::MutableHandle<art::mirror::Class> h_klass(scope.NewHandle<art::mirror::Class>(nullptr));
       art::MutableHandle<art::mirror::DexCache> h_dex_cache(
           scope.NewHandle<art::mirror::DexCache>(nullptr));
       art::MutableHandle<art::mirror::ClassLoader> h_dex_cache_class_loader =
           scope.NewHandle(h_loader.Get());

       for (art::ClassAccessor accessor : dex_file.GetClasses()) {
         h_klass.Assign(
             class_linker->FindClass(soa.Self(), dex_file, accessor.GetClassIdx(), h_loader));
         // Ignore classes that couldn't be loaded since we are looking for crashes during
         // class/method verification.
         if (h_klass == nullptr || h_klass->IsErroneous()) {
           // Treat as failure to pass verification
           passed_class_verification = false;
           soa.Self()->ClearException();
           continue;
         }
         h_dex_cache.Assign(h_klass->GetDexCache());

         // The class loader from the class's dex cache is different from the dex file's class loader
         // for boot image classes e.g. java.util.AbstractCollection.
         h_dex_cache_class_loader.Assign(h_klass->GetDexCache()->GetClassLoader());
         verifier::FailureKind failure =
             verifier::ClassVerifier::VerifyClass(soa.Self(),
                                                  /* verifier_deps= */ nullptr,
                                                  h_dex_cache->GetDexFile(),
                                                  h_klass,
                                                  h_dex_cache,
                                                  h_dex_cache_class_loader,
                                                  *h_klass->GetClassDef(),
                                                  runtime->GetCompilerCallbacks(),
                                                  verifier::HardFailLogMode::kLogWarning,
                                                  /* api_level= */ 0,
                                                  &error_msg);
         if (failure != verifier::FailureKind::kNoFailure) {
           passed_class_verification = false;
         }
       }
     }
     skipped_gc_iterations++;

     // Delete weak root to the DexCache before removing a DEX file from the cache. This is usually
     // handled by the GC, but since we are not calling it every iteration, we need to delete them
     // manually.
     const ClassLinker::DexCacheData* dex_cache_data =
         VerifyClassesFuzzerCorpusTestHelper::GetDexCacheData(runtime, &dex_file);
     soa.Env()->GetVm()->DeleteWeakGlobalRef(soa.Self(), dex_cache_data->weak_root);

     class_linker->RemoveDexFromCaches(dex_file);

     // Delete global ref and unload class loader to free RAM.
     soa.Env()->GetVm()->DeleteGlobalRef(soa.Self(), class_loader);

     if (skipped_gc_iterations == kMaxSkipGCIterations) {
       runtime->GetHeap()->CollectGarbage(/* clear_soft_references */ true);
       skipped_gc_iterations = 0;
     }

     ASSERT_EQ(passed_class_verification, expected_success) << " Failed for " << name;
   }

   void TestFuzzerHelper(
       const std::string& archive_filename,
       const std::unordered_set<std::string>& valid_dex_files,
       std::function<void(const uint8_t*, size_t, const std::string&, bool)> verify_file) {
     // Consistency checks.
     const std::string folder = android::base::GetExecutableDirectory();
     ASSERT_TRUE(std::filesystem::is_directory(folder)) << folder << " is not a folder";
     ASSERT_FALSE(std::filesystem::is_empty(folder)) << " No files found for directory " << folder;
     const std::string filename = folder + "/" + archive_filename;

     // Iterate using ZipArchiveHandle. We have to be careful about managing the pointers with
     // CloseArchive, StartIteration, and EndIteration.
     std::string error_msg;
     ZipArchiveHandle handle;
     ZipArchiveHandleScope scope(&handle);
     int32_t error = OpenArchive(filename.c_str(), &handle);
     ASSERT_TRUE(error == 0) << "Error: " << error;

     void* cookie;
     error = StartIteration(handle, &cookie);
     ASSERT_TRUE(error == 0) << "couldn't iterate " << filename << " : " << ErrorCodeString(error);

     ZipEntry64 entry;
     std::string name;
     std::vector<char> data;
     while ((error = Next(cookie, &entry, &name)) >= 0) {
       if (!name.ends_with(".dex")) {
         // Skip non-DEX files.
         LOG(WARNING) << "Found a non-dex file: " << name;
         continue;
       }
       data.resize(entry.uncompressed_length);
       error = ExtractToMemory(handle, &entry, reinterpret_cast<uint8_t*>(data.data()), data.size());
       ASSERT_TRUE(error == 0) << "failed to extract entry: " << name << " from " << filename << ""
                               << ErrorCodeString(error);

       const uint8_t* file_data = reinterpret_cast<const uint8_t*>(data.data());
       // Special case for empty dex file. Set a fake data since the size is 0 anyway.
       if (file_data == nullptr) {
         ASSERT_EQ(data.size(), 0);
         file_data = reinterpret_cast<const uint8_t*>(&name);
       }

       const bool is_valid_dex_file = valid_dex_files.find(name) != valid_dex_files.end();
       verify_file(file_data, data.size(), name, is_valid_dex_file);
     }

     ASSERT_TRUE(error >= -1) << "failed iterating " << filename << " : " << ErrorCodeString(error);
     EndIteration(cookie);
   }

  private:
   static jobject RegisterDexFileAndGetClassLoader(Runtime* runtime, StandardDexFile* dex_file)
       REQUIRES_SHARED(Locks::mutator_lock_) {
     Thread* self = Thread::Current();
     ClassLinker* class_linker = runtime->GetClassLinker();
     const std::vector<const DexFile*> dex_files = {dex_file};
     jobject class_loader = class_linker->CreatePathClassLoader(self, dex_files);
     ObjPtr<mirror::ClassLoader> cl = self->DecodeJObject(class_loader)->AsClassLoader();
     class_linker->RegisterDexFile(*dex_file, cl);
     return class_loader;
   }
 };

 // Tests that we can verify dex files without crashing.
 TEST_F(FuzzerCorpusTest, VerifyCorpusDexFiles) {
   // These dex files are expected to pass verification. The others are regressions tests.
   const std::unordered_set<std::string> valid_dex_files = {"Main.dex", "hello_world.dex"};
   const std::string archive_filename = "dex_verification_fuzzer_corpus.zip";

   TestFuzzerHelper(archive_filename, valid_dex_files, DexFileVerification);
 }

 // Tests that we can verify classes from dex files without crashing.
 TEST_F(FuzzerCorpusTest, VerifyCorpusClassDexFiles) {
   // These dex files are expected to pass verification. The others are regressions tests.
   const std::unordered_set<std::string> valid_dex_files = {"Main.dex", "hello_world.dex"};
   const std::string archive_filename = "class_verification_fuzzer_corpus.zip";

   TestFuzzerHelper(archive_filename, valid_dex_files, ClassVerification);
 }

 }  // namespace art
	/*
	* Copyright (C) 2023 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <cstdint>
	#include <filesystem>
	#include <unordered_set>

	#include "android-base/file.h"
	#include "android-base/macros.h"
	#include "common_runtime_test.h"
	#include "dex/class_accessor-inl.h"
	#include "dex/dex_file_verifier.h"
	#include "dex/standard_dex_file.h"
	#include "gtest/gtest.h"
	#include "handle_scope-inl.h"
	#include "jni/java_vm_ext.h"
	#include "verifier/class_verifier.h"
	#include "ziparchive/zip_archive.h"

	namespace art {
	// Global variable to count how many DEX files passed DEX file verification and they were
	// registered, since these are the cases for which we would be running the GC.
	int skipped_gc_iterations = 0;
	// Global variable to call the GC once every maximum number of iterations.
	// TODO: These values were obtained from local experimenting. They can be changed after
	// further investigation.
	static constexpr int kMaxSkipGCIterations = 100;

	// A class to be friends with ClassLinker and access the internal FindDexCacheDataLocked method.
	// TODO: Deduplicate this since it is the same with tools/fuzzer/libart_verify_classes_fuzzer.cc.
	class VerifyClassesFuzzerCorpusTestHelper {
	public:
	static const ClassLinker::DexCacheData* GetDexCacheData(Runtime* runtime, const DexFile* dex_file)
	REQUIRES_SHARED(Locks::mutator_lock_) {
	Thread* self = Thread::Current();
	ReaderMutexLock mu(self, *Locks::dex_lock_);
	ClassLinker* class_linker = runtime->GetClassLinker();
	const ClassLinker::DexCacheData* cached_data = class_linker->FindDexCacheDataLocked(*dex_file);
	return cached_data;
	}
	};

	// Manages the ZipArchiveHandle liveness.
	class ZipArchiveHandleScope {
	public:
	explicit ZipArchiveHandleScope(ZipArchiveHandle* handle) : handle_(handle) {}
	~ZipArchiveHandleScope() { CloseArchive(*(handle_.release())); }

	private:
	std::unique_ptr<ZipArchiveHandle> handle_;
	};

	class FuzzerCorpusTest : public CommonRuntimeTest {
	public:
	static void DexFileVerification(const uint8_t* data,
	size_t size,
	const std::string& name,
	bool expected_success) {
	// Do not verify the checksum as we only care about the DEX file contents,
	// and know that the checksum would probably be erroneous (i.e. random).
	constexpr bool kVerify = false;

	auto container = std::make_shared<MemoryDexFileContainer>(data, size);
	StandardDexFile dex_file(data,
	/location=/name,
	/location_checksum=/0,
	/oat_dex_file=/nullptr,
	container);

	std::string error_msg;
	bool is_valid_dex_file =
	dex::Verify(&dex_file, dex_file.GetLocation().c_str(), kVerify, &error_msg);
	ASSERT_EQ(is_valid_dex_file, expected_success) << " Failed for " << name;
	}

	static void ClassVerification(const uint8_t* data,
	size_t size,
	const std::string& name,
	bool expected_success) {
	// Do not verify the checksum as we only care about the DEX file contents,
	// and know that the checksum would probably be erroneous (i.e. random)
	constexpr bool kVerify = false;
	bool passed_class_verification = true;

	auto container = std::make_shared<MemoryDexFileContainer>(data, size);
	StandardDexFile dex_file(data,
	/location=/name,
	/location_checksum=/0,
	/oat_dex_file=/nullptr,
	container);

	std::string error_msg;
	const bool success_dex =
	dex::Verify(&dex_file, dex_file.GetLocation().c_str(), kVerify, &error_msg);
	ASSERT_EQ(success_dex, true) << " Failed for " << name;

	Runtime* runtime = Runtime::Current();
	CHECK(runtime != nullptr);

	ScopedObjectAccess soa(Thread::Current());
	ClassLinker* class_linker = runtime->GetClassLinker();
	jobject class_loader = RegisterDexFileAndGetClassLoader(runtime, &dex_file);

	// Scope for the handles
	{
	art::StackHandleScope<4> scope(soa.Self());
	art::Handle<art::mirror::ClassLoader> h_loader =
	scope.NewHandle(soa.Decode<art::mirror::ClassLoader>(class_loader));
	art::MutableHandle<art::mirror::Class> h_klass(scope.NewHandle<art::mirror::Class>(nullptr));
	art::MutableHandle<art::mirror::DexCache> h_dex_cache(
	scope.NewHandle<art::mirror::DexCache>(nullptr));
	art::MutableHandle<art::mirror::ClassLoader> h_dex_cache_class_loader =
	scope.NewHandle(h_loader.Get());

	for (art::ClassAccessor accessor : dex_file.GetClasses()) {
	h_klass.Assign(
	class_linker->FindClass(soa.Self(), dex_file, accessor.GetClassIdx(), h_loader));
	// Ignore classes that couldn't be loaded since we are looking for crashes during
	// class/method verification.
	if (h_klass == nullptr \|\| h_klass->IsErroneous()) {
	// Treat as failure to pass verification
	passed_class_verification = false;
	soa.Self()->ClearException();
	continue;
	}
	h_dex_cache.Assign(h_klass->GetDexCache());

	// The class loader from the class's dex cache is different from the dex file's class loader
	// for boot image classes e.g. java.util.AbstractCollection.
	h_dex_cache_class_loader.Assign(h_klass->GetDexCache()->GetClassLoader());
	verifier::FailureKind failure =
	verifier::ClassVerifier::VerifyClass(soa.Self(),
	/* verifier_deps= */ nullptr,
	h_dex_cache->GetDexFile(),
	h_klass,
	h_dex_cache,
	h_dex_cache_class_loader,
	*h_klass->GetClassDef(),
	runtime->GetCompilerCallbacks(),
	verifier::HardFailLogMode::kLogWarning,
	/* api_level= */ 0,
	&error_msg);
	if (failure != verifier::FailureKind::kNoFailure) {
	passed_class_verification = false;
	}
	}
	}
	skipped_gc_iterations++;

	// Delete weak root to the DexCache before removing a DEX file from the cache. This is usually
	// handled by the GC, but since we are not calling it every iteration, we need to delete them
	// manually.
	const ClassLinker::DexCacheData* dex_cache_data =
	VerifyClassesFuzzerCorpusTestHelper::GetDexCacheData(runtime, &dex_file);
	soa.Env()->GetVm()->DeleteWeakGlobalRef(soa.Self(), dex_cache_data->weak_root);

	class_linker->RemoveDexFromCaches(dex_file);

	// Delete global ref and unload class loader to free RAM.
	soa.Env()->GetVm()->DeleteGlobalRef(soa.Self(), class_loader);

	if (skipped_gc_iterations == kMaxSkipGCIterations) {
	runtime->GetHeap()->CollectGarbage(/* clear_soft_references */ true);
	skipped_gc_iterations = 0;
	}

	ASSERT_EQ(passed_class_verification, expected_success) << " Failed for " << name;
	}

	void TestFuzzerHelper(
	const std::string& archive_filename,
	const std::unordered_set<std::string>& valid_dex_files,
	std::function<void(const uint8_t*, size_t, const std::string&, bool)> verify_file) {
	// Consistency checks.
	const std::string folder = android::base::GetExecutableDirectory();
	ASSERT_TRUE(std::filesystem::is_directory(folder)) << folder << " is not a folder";
	ASSERT_FALSE(std::filesystem::is_empty(folder)) << " No files found for directory " << folder;
	const std::string filename = folder + "/" + archive_filename;

	// Iterate using ZipArchiveHandle. We have to be careful about managing the pointers with
	// CloseArchive, StartIteration, and EndIteration.
	std::string error_msg;
	ZipArchiveHandle handle;
	ZipArchiveHandleScope scope(&handle);
	int32_t error = OpenArchive(filename.c_str(), &handle);
	ASSERT_TRUE(error == 0) << "Error: " << error;

	void* cookie;
	error = StartIteration(handle, &cookie);
	ASSERT_TRUE(error == 0) << "couldn't iterate " << filename << " : " << ErrorCodeString(error);

	ZipEntry64 entry;
	std::string name;
	std::vector<char> data;
	while ((error = Next(cookie, &entry, &name)) >= 0) {
	if (!name.ends_with(".dex")) {
	// Skip non-DEX files.
	LOG(WARNING) << "Found a non-dex file: " << name;
	continue;
	}
	data.resize(entry.uncompressed_length);
	error = ExtractToMemory(handle, &entry, reinterpret_cast<uint8_t*>(data.data()), data.size());
	ASSERT_TRUE(error == 0) << "failed to extract entry: " << name << " from " << filename << ""
	<< ErrorCodeString(error);

	const uint8_t* file_data = reinterpret_cast<const uint8_t*>(data.data());
	// Special case for empty dex file. Set a fake data since the size is 0 anyway.
	if (file_data == nullptr) {
	ASSERT_EQ(data.size(), 0);
	file_data = reinterpret_cast<const uint8_t*>(&name);
	}

	const bool is_valid_dex_file = valid_dex_files.find(name) != valid_dex_files.end();
	verify_file(file_data, data.size(), name, is_valid_dex_file);
	}

	ASSERT_TRUE(error >= -1) << "failed iterating " << filename << " : " << ErrorCodeString(error);
	EndIteration(cookie);
	}

	private:
	static jobject RegisterDexFileAndGetClassLoader(Runtime* runtime, StandardDexFile* dex_file)
	REQUIRES_SHARED(Locks::mutator_lock_) {
	Thread* self = Thread::Current();
	ClassLinker* class_linker = runtime->GetClassLinker();
	const std::vector<const DexFile*> dex_files = {dex_file};
	jobject class_loader = class_linker->CreatePathClassLoader(self, dex_files);
	ObjPtr<mirror::ClassLoader> cl = self->DecodeJObject(class_loader)->AsClassLoader();
	class_linker->RegisterDexFile(*dex_file, cl);
	return class_loader;
	}
	};

	// Tests that we can verify dex files without crashing.
	TEST_F(FuzzerCorpusTest, VerifyCorpusDexFiles) {
	// These dex files are expected to pass verification. The others are regressions tests.
	const std::unordered_set<std::string> valid_dex_files = {"Main.dex", "hello_world.dex"};
	const std::string archive_filename = "dex_verification_fuzzer_corpus.zip";

	TestFuzzerHelper(archive_filename, valid_dex_files, DexFileVerification);
	}

	// Tests that we can verify classes from dex files without crashing.
	TEST_F(FuzzerCorpusTest, VerifyCorpusClassDexFiles) {
	// These dex files are expected to pass verification. The others are regressions tests.
	const std::unordered_set<std::string> valid_dex_files = {"Main.dex", "hello_world.dex"};
	const std::string archive_filename = "class_verification_fuzzer_corpus.zip";

	TestFuzzerHelper(archive_filename, valid_dex_files, ClassVerification);
	}

	} // namespace art