/system/bt/stack/test/fuzzers/sdp/ |
D | sdpFuzzFunctions.h | 37 [](FuzzedDataProvider* fdp) -> void { 44 uint8_t num_uuids = fdp->ConsumeIntegral<uint8_t>(); 46 uuid_list.push_back(generateArbitraryUuid(fdp)); 50 std::vector<uint16_t> attr_list = generateArbitraryAttrList(fdp); 53 fdp->ConsumeIntegralInRange<uint32_t>(0, SDP_MAX_DB_LEN); 68 [](FuzzedDataProvider* fdp) -> void { 70 getArbitraryVectorElement(fdp, sdp_db_vect, true).get()); 74 [](FuzzedDataProvider* fdp) -> void { 75 const RawAddress bd_addr = generateRawAddress(fdp); 77 getArbitraryVectorElement(fdp, sdp_db_vect, false).get(); [all …]
|
D | sdpFuzzHelpers.h | 84 std::vector<uint16_t> generateArbitraryAttrList(FuzzedDataProvider* fdp) { in generateArbitraryAttrList() argument 86 uint16_t num_attrs = fdp->ConsumeIntegralInRange<uint16_t>(0, SDP_MAX_ATTRS); in generateArbitraryAttrList() 90 attr_list.push_back(fdp->ConsumeIntegral<uint16_t>()); in generateArbitraryAttrList() 96 tSDP_DISC_ATVAL generateArbitrarySdpDiscAttrVal(FuzzedDataProvider* fdp) { in generateArbitrarySdpDiscAttrVal() argument 99 new_attrval.v.u8 = fdp->ConsumeIntegral<uint8_t>(); in generateArbitrarySdpDiscAttrVal() 100 new_attrval.v.u16 = fdp->ConsumeIntegral<uint16_t>(); in generateArbitrarySdpDiscAttrVal() 101 new_attrval.v.u32 = fdp->ConsumeIntegral<uint32_t>(); in generateArbitrarySdpDiscAttrVal() 103 new_attrval.v.array[i] = fdp->ConsumeIntegral<uint8_t>(); in generateArbitrarySdpDiscAttrVal() 105 new_attrval.v.p_sub_attr = generateArbitrarySdpDiscAttr(fdp, true).get(); in generateArbitrarySdpDiscAttrVal() 111 FuzzedDataProvider* fdp, bool allow_null) { in generateArbitrarySdpDiscAttr() argument [all …]
|
/system/bt/stack/test/fuzzers/a2dp/codec/ |
D | a2dpCodecConfigFuzzFunctions.h | 37 [](FuzzedDataProvider* fdp) -> void { 39 btav_a2dp_codec_index_t codec_index = getArbitraryBtavCodecIndex(fdp); 41 getArbitraryBtavCodecPriority(fdp); 52 [](FuzzedDataProvider* fdp) -> void { 57 size_t index = fdp->ConsumeIntegralInRange<size_t>( 64 [](FuzzedDataProvider* fdp) -> void { 66 getArbitraryVectorElement(fdp, a2dp_codec_config_vect, false)); 75 [](FuzzedDataProvider* fdp) -> void { 77 getArbitraryVectorElement(fdp, a2dp_codec_config_vect, false)); 86 [](FuzzedDataProvider* fdp) -> void { [all …]
|
D | a2dpCodecInfoFuzzFunctions.h | 39 [](FuzzedDataProvider* fdp, uint8_t*) -> void { 48 [](FuzzedDataProvider* fdp, uint8_t*) -> void { 53 size_t index = fdp->ConsumeIntegralInRange<size_t>( 62 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { 67 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { 72 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { 77 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { 82 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { 87 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { 92 [](FuzzedDataProvider* fdp, uint8_t* codec_info) -> void { [all …]
|
D | a2dpCodecFuzzFunctions.h | 41 [](FuzzedDataProvider* fdp) -> void { 45 fdp->ConsumeIntegralInRange<size_t>(0, MAX_NUM_PROPERTIES); 47 codec_priorities.push_back(getArbitraryBtavCodecConfig(fdp)); 60 [](FuzzedDataProvider* fdp) -> void { 66 fdp->ConsumeIntegralInRange<size_t>(0, a2dp_codecs_vect.size() - 1); 72 [](FuzzedDataProvider* fdp) -> void { 77 getArbitraryVectorElement(fdp, a2dp_codecs_vect, false); 86 [](FuzzedDataProvider* fdp) -> void { 88 getArbitraryVectorElement(fdp, a2dp_codecs_vect, false); 90 getArbitraryVectorElement(fdp, a2dp_codec_info_vect, false); [all …]
|
D | a2dpCodecHelperFunctions.h | 65 btav_a2dp_codec_index_t getArbitraryBtavCodecIndex(FuzzedDataProvider* fdp) { in getArbitraryBtavCodecIndex() argument 67 fdp->ConsumeIntegralInRange<size_t>(0, CODEC_INDEX_ENUM_VALS.size() - 1)); in getArbitraryBtavCodecIndex() 72 FuzzedDataProvider* fdp) { in getArbitraryBtavCodecPriority() argument 73 return CODEC_PRIORITY_ENUM_VALS.at(fdp->ConsumeIntegralInRange<size_t>( in getArbitraryBtavCodecPriority() 78 FuzzedDataProvider* fdp) { in getArbitraryBtavCodecSampleRate() argument 79 return CODEC_SAMPLERATE_ENUM_VALS.at(fdp->ConsumeIntegralInRange<size_t>( in getArbitraryBtavCodecSampleRate() 84 FuzzedDataProvider* fdp) { in getArbitraryBtavCodecBitsPerSample() argument 86 fdp->ConsumeIntegralInRange<size_t>(0, CODEC_BPS_ENUM_VALS.size() - 1)); in getArbitraryBtavCodecBitsPerSample() 90 FuzzedDataProvider* fdp) { in getArbitraryBtavCodecChannelMode() argument 91 return CODEC_CHANNELMODE_ENUM_VALS.at(fdp->ConsumeIntegralInRange<size_t>( in getArbitraryBtavCodecChannelMode() [all …]
|
D | a2dpCodecInfoFuzzHelpers.h | 34 FuzzedDataProvider* fdp, in callArbitraryCodecInfoFunction() argument 39 fdp->ConsumeIntegralInRange<uint8_t>(0, ops_vector.size() - 1); in callArbitraryCodecInfoFunction() 43 getArbitraryVectorElement(fdp, a2dp_codec_info_vect, false); in callArbitraryCodecInfoFunction() 49 ops_vector[function_id](fdp, codec_info); in callArbitraryCodecInfoFunction()
|
/system/bt/stack/test/fuzzers/a2dp/ |
D | a2dpFuzzFunctions.h | 52 [](FuzzedDataProvider* fdp) -> void { 54 fdp->ConsumeBytesWithTerminator<char>(MAX_STR_LEN); 56 fdp->ConsumeBytesWithTerminator<char>(MAX_STR_LEN); 57 A2DP_AddRecord(fdp->ConsumeIntegral<uint16_t>(), p_service_name.data(), 58 p_provider_name.data(), fdp->ConsumeIntegral<uint16_t>(), 60 getArbitraryVectorElement(fdp, sdp_record_handles, true)); 64 [](FuzzedDataProvider* fdp) -> void { 65 tA2DP_SDP_DB_PARAMS p_db = generateDBParams(fdp); 66 const RawAddress bd_addr = generateRawAddress(fdp); 67 A2DP_FindService(fdp->ConsumeIntegral<uint16_t>(), bd_addr, &p_db, [all …]
|
D | a2dpFuzzHelpers.h | 33 tA2DP_SDP_DB_PARAMS generateDBParams(FuzzedDataProvider* fdp) { in generateDBParams() argument 34 std::vector<uint16_t> attr_list = generateArbitraryAttrList(fdp); in generateDBParams() 37 db_params.db_len = fdp->ConsumeIntegralInRange<uint32_t>(0, MAX_DB_SIZE); in generateDBParams()
|
/system/keymaster/tests/fuzzers/ |
D | buffer_fuzz.cpp | 36 [](keymaster::Buffer* buf, FuzzedDataProvider* fdp) -> void { in __anon10ed34010302() 37 buf->reserve(fdp->ConsumeIntegralInRange<int>(kMinBufferSize, kMaxBufferSize)); in __anon10ed34010302() 39 [](keymaster::Buffer* buf, FuzzedDataProvider* fdp) -> void { in __anon10ed34010402() 40 buf->advance_read(fdp->ConsumeIntegral<int>()); in __anon10ed34010402() 42 [](keymaster::Buffer* buf, FuzzedDataProvider* fdp) -> void { in __anon10ed34010502() 43 buf->advance_write(fdp->ConsumeIntegral<int>()); in __anon10ed34010502() 45 [](keymaster::Buffer* buf, FuzzedDataProvider* fdp) -> void { in __anon10ed34010602() 46 buf->Reinitialize(fdp->ConsumeIntegralInRange<size_t>(kMinBufferSize, kMaxBufferSize)); in __anon10ed34010602() 48 [](keymaster::Buffer* buf, FuzzedDataProvider* fdp) -> void { in __anon10ed34010702() 49 size_t buf_size = fdp->ConsumeIntegralInRange<size_t>(kMinBufferSize, kMaxBufferSize); in __anon10ed34010702() [all …]
|
D | message_serializable_fuzz.cpp | 28 void RunDeserialize(keymaster::Serializable* ser, FuzzedDataProvider* fdp) { in RunDeserialize() argument 29 uint16_t buf_size = fdp->ConsumeIntegralInRange<uint16_t>(kMinBufferSize, kMaxBufferSize); in RunDeserialize() 33 int32_t end = fdp->ConsumeIntegralInRange<int32_t>(0, buf_size); in RunDeserialize() 37 void RunSerialize(keymaster::Serializable* ser, FuzzedDataProvider* fdp) { in RunSerialize() argument 41 int32_t end = fdp->ConsumeIntegralInRange<int32_t>(0, buf_size); in RunSerialize() 46 FuzzedDataProvider fdp(data, size); in LLVMFuzzerTestOneInput() local 48 keymaster::getSerializable(fdp.ConsumeEnum<keymaster::SerializableType>()); in LLVMFuzzerTestOneInput() 52 for (size_t i = 0; fdp.remaining_bytes() > 0; i++) { in LLVMFuzzerTestOneInput() 53 if (fdp.ConsumeBool()) { in LLVMFuzzerTestOneInput() 54 RunSerialize(serializable.get(), &fdp); in LLVMFuzzerTestOneInput() [all …]
|
/system/bt/gd/hci/fuzz/ |
D | fuzz_hci_layer.cc | 81 void FuzzHciLayer::injectArbitrary(FuzzedDataProvider& fdp) { in injectArbitrary() argument 82 const uint8_t action = fdp.ConsumeIntegralInRange(0, 13); in injectArbitrary() 85 injectAclData(GetArbitraryBytes(&fdp)); in injectArbitrary() 88 injectCommandComplete(GetArbitraryBytes(&fdp)); in injectArbitrary() 91 injectCommandStatus(GetArbitraryBytes(&fdp)); in injectArbitrary() 94 injectEvent(fdp); in injectArbitrary() 97 injectLeEvent(fdp); in injectArbitrary() 100 injectSecurityEvent(GetArbitraryBytes(&fdp)); in injectArbitrary() 103 injectLeSecurityEvent(GetArbitraryBytes(&fdp)); in injectArbitrary() 106 injectAclEvent(GetArbitraryBytes(&fdp)); in injectArbitrary() [all …]
|
D | hci_layer_fuzz_client.cc | 55 void HciLayerFuzzClient::injectArbitrary(FuzzedDataProvider& fdp) { in injectArbitrary() argument 56 const uint8_t action = fdp.ConsumeIntegralInRange(0, 8); in injectArbitrary() 59 injectAclData(GetArbitraryBytes(&fdp)); in injectArbitrary() 62 injectHciCommand(GetArbitraryBytes(&fdp)); in injectArbitrary() 68 injectLeSecurityCommand(GetArbitraryBytes(&fdp)); in injectArbitrary() 71 injectAclConnectionCommand(GetArbitraryBytes(&fdp)); in injectArbitrary() 74 injectLeAclConnectionCommand(GetArbitraryBytes(&fdp)); in injectArbitrary() 77 injectLeAdvertisingCommand(GetArbitraryBytes(&fdp)); in injectArbitrary() 80 injectLeScanningCommand(GetArbitraryBytes(&fdp)); in injectArbitrary()
|
D | fuzz_hci_layer.h | 44 void TurnOnAutoReply(FuzzedDataProvider* fdp) { in TurnOnAutoReply() argument 45 auto_reply_fdp = fdp; in TurnOnAutoReply() 126 void injectArbitrary(FuzzedDataProvider& fdp); 145 void injectEvent(FuzzedDataProvider& fdp); 146 void injectLeEvent(FuzzedDataProvider& fdp); 152 void injectAclDisconnect(FuzzedDataProvider& fdp); 154 void injectLeAclDisconnect(FuzzedDataProvider& fdp);
|
D | hci_layer_fuzz_client.h | 41 void injectArbitrary(FuzzedDataProvider& fdp);
|
/system/bt/stack/test/fuzzers/common/ |
D | commonFuzzHelpers.h | 28 FuzzedDataProvider* fdp, in callArbitraryFunction() argument 32 fdp->ConsumeIntegralInRange<uint8_t>(0, ops_vector.size() - 1); in callArbitraryFunction() 35 ops_vector[function_id](fdp); in callArbitraryFunction() 39 T getArbitraryVectorElement(FuzzedDataProvider* fdp, std::vector<T> vect, in getArbitraryVectorElement() argument 43 if (vect.empty() || (allow_null && fdp->ConsumeBool())) { in getArbitraryVectorElement() 48 return vect.at(fdp->ConsumeIntegralInRange<size_t>(0, vect.size() - 1)); in getArbitraryVectorElement() 51 RawAddress generateRawAddress(FuzzedDataProvider* fdp) { in generateRawAddress() argument 60 std::vector<uint8_t> bytes = fdp->ConsumeBytes<uint8_t>(retval.kLength); in generateRawAddress() 66 bluetooth::Uuid generateArbitraryUuid(FuzzedDataProvider* fdp) { in generateArbitraryUuid() argument 68 fdp->ConsumeBytes<uint8_t>(bluetooth::Uuid::kNumBytes128); in generateArbitraryUuid()
|
/system/libfmq/fuzzer/ |
D | fmq_fuzzer.cpp | 77 FuzzedDataProvider fdp(&readerData[0], readerData.size()); in reader() local 78 while (fdp.remaining_bytes()) { in reader() 80 size_t numElements = fdp.ConsumeIntegralInRange<size_t>(0, kMaxNumElements); in reader() 90 *writeCounter = fdp.ConsumeIntegral<uint64_t>(); in reader() 99 void writer(Queue& writeMq, FuzzedDataProvider& fdp) { in writer() argument 100 while (fdp.remaining_bytes()) { in writer() 105 fdp.ConsumeIntegral<uint8_t>(); in writer() 115 *readCounter = fdp.ConsumeIntegral<uint64_t>(); in writer() 117 *firstStart = fdp.ConsumeIntegral<payload_t>(); in writer() 126 FuzzedDataProvider fdp(&writerData[0], writerData.size()); in fuzzAidlWithReaders() local [all …]
|
/system/bt/gd/l2cap/fuzz/ |
D | fuzz_l2cap.cc | 50 FuzzedDataProvider fdp = FuzzedDataProvider(data, size); in LLVMFuzzerTestOneInput() local 51 ShimL2capFuzz l2shim(&fdp); in LLVMFuzzerTestOneInput() 53 std::vector<uint8_t> addressVals = fdp.ConsumeBytes<uint8_t>(Address::kLength); in LLVMFuzzerTestOneInput() 70 uint16_t psm = fdp.ConsumeIntegralInRange<uint16_t>(0x0001, 0x007F); in LLVMFuzzerTestOneInput() 72 uint16_t dynamicPsm = fdp.ConsumeIntegralInRange<uint16_t>(0x0080, 0x00FF); in LLVMFuzzerTestOneInput() 84 …Cid dynamicCid = fdp.ConsumeIntegralInRange<uint16_t>(l2cap::kFirstDynamicChannel, l2cap::kLastDyn… in LLVMFuzzerTestOneInput() 88 while (fdp.remaining_bytes() > 0) { in LLVMFuzzerTestOneInput() 90 bool dynamic = fdp.ConsumeBool(); in LLVMFuzzerTestOneInput() 94 …static_cast<uint16_t>(std::min(static_cast<size_t>(fdp.ConsumeIntegral<uint16_t>()), fdp.remaining… in LLVMFuzzerTestOneInput() 95 std::vector<uint8_t> data = fdp.ConsumeBytes<uint8_t>(packetSize); in LLVMFuzzerTestOneInput()
|
D | shim_l2cap.h | 59 ShimL2capFuzz(FuzzedDataProvider* fdp) { in ShimL2capFuzz() argument 66 fuzzHci->TurnOnAutoReply(fdp); in ShimL2capFuzz()
|
/system/bt/gd/hal/fuzz/ |
D | fuzz_hci_hal.cc | 35 void FuzzHciHal::injectArbitrary(FuzzedDataProvider& fdp) { in injectArbitrary() argument 36 const uint8_t action = fdp.ConsumeIntegralInRange(0, 4); in injectArbitrary() 39 injectAclData(GetArbitraryBytes(&fdp)); in injectArbitrary() 42 injectHciEvent(GetArbitraryBytes(&fdp)); in injectArbitrary() 45 injectScoData(GetArbitraryBytes(&fdp)); in injectArbitrary() 48 injectIsoData(GetArbitraryBytes(&fdp)); in injectArbitrary()
|
D | fuzz_hci_hal.h | 37 void injectArbitrary(FuzzedDataProvider& fdp);
|
/system/bt/embdrv/g722/fuzzer/ |
D | g722_enc_fuzzer.cc | 20 uint32_t get_rate_from_fdp(FuzzedDataProvider* fdp) { in get_rate_from_fdp() argument 21 uint32_t rate = fdp->ConsumeIntegralInRange<uint32_t>( in get_rate_from_fdp() 34 FuzzedDataProvider fdp(data, size); in LLVMFuzzerTestOneInput() local 63 uint32_t rate = get_rate_from_fdp(&fdp); in LLVMFuzzerTestOneInput()
|
/system/bt/gd/fuzz/ |
D | helpers.cc | 41 std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp) { in GetArbitraryBytes() argument 42 return fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegral<size_t>()); in GetArbitraryBytes()
|
D | helpers.h | 32 std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp);
|
/system/bt/vendor_libs/test_vendor_lib/model/setup/ |
D | async_manager.cc | 192 for (auto& fdp : watched_shared_fds_) { in setUpFileDescriptorSet() local 193 FD_SET(fdp.first, &read_fds); in setUpFileDescriptorSet() 194 nfds = std::max(fdp.first, nfds); in setUpFileDescriptorSet()
|