| /system/bt/gd/hci/fuzz/ |
| D | hci_layer_fuzz_test.cc | 30 using bluetooth::fuzz::GetArbitraryBytes;
32 using bluetooth::hal::fuzz::FuzzHciHal;
33 using bluetooth::hci::fuzz::HciLayerFuzzClient;
34 using bluetooth::os::fuzz::fake_timerfd_advance;
35 using bluetooth::os::fuzz::fake_timerfd_cap_at;
36 using bluetooth::os::fuzz::fake_timerfd_reset;
|
| D | acl_manager_fuzz_test.cc | 30 using bluetooth::fuzz::GetArbitraryBytes;
33 using bluetooth::hci::fuzz::FuzzHciLayer;
34 using bluetooth::os::fuzz::fake_timerfd_advance;
35 using bluetooth::os::fuzz::fake_timerfd_cap_at;
36 using bluetooth::os::fuzz::fake_timerfd_reset;
|
| D | hci_layer_fuzz_client.cc | 22 namespace fuzz { namespace
23 using bluetooth::fuzz::GetArbitraryBytes;
30 aclDevNull_ = new os::fuzz::DevNullQueue<AclView>(hci_->GetAclQueueEnd(), GetHandler()); in Start()
32 aclInject_ = new os::fuzz::FuzzInjectQueue<AclBuilder>(hci_->GetAclQueueEnd(), GetHandler()); in Start()
|
| D | hci_layer_fuzz_client.h | 32 namespace fuzz {
80 os::fuzz::DevNullQueue<AclView>* aclDevNull_;
81 os::fuzz::FuzzInjectQueue<AclBuilder>* aclInject_;
|
| D | fuzz_hci_layer.cc | 22 namespace fuzz { namespace
25 using bluetooth::fuzz::GetArbitraryBytes;
26 using bluetooth::fuzz::InvokeIfValid;
70 acl_dev_null_ = new os::fuzz::DevNullQueue<AclBuilder>(acl_queue_.GetDownEnd(), GetHandler()); in Start()
72 acl_inject_ = new os::fuzz::FuzzInjectQueue<AclView>(acl_queue_.GetDownEnd(), GetHandler()); in Start()
|
| D | fuzz_hci_layer.h | 30 namespace fuzz {
57 injectCommandComplete(bluetooth::fuzz::GetArbitraryBytes(auto_reply_fdp)); in EnqueueCommand()
66 injectCommandStatus(bluetooth::fuzz::GetArbitraryBytes(auto_reply_fdp)); in EnqueueCommand()
165 os::fuzz::DevNullQueue<AclBuilder>* acl_dev_null_;
166 os::fuzz::FuzzInjectQueue<AclView>* acl_inject_;
|
| D | status_vs_complete_commands.h | 23 namespace fuzz {
|
| D | status_vs_complete_commands.cc | 22 namespace fuzz { namespace
|
| /system/update_engine/update_manager/ |
| D | next_update_check_policy_impl.cc | 113 int fuzz = 0; in NextUpdateCheckTime() local
139 fuzz = constants.timeout_regular_fuzz; in NextUpdateCheckTime()
143 if (fuzz == 0) in NextUpdateCheckTime()
144 fuzz = interval; in NextUpdateCheckTime()
147 *last_checked_time + FuzzedInterval(&prng, interval, fuzz); in NextUpdateCheckTime()
153 int fuzz) { in FuzzedInterval() argument
155 DCHECK_GE(fuzz, 0); in FuzzedInterval()
156 int half_fuzz = fuzz / 2; in FuzzedInterval()
|
| /system/core/trusty/apploader/fuzz/ |
| D | app_fuzzer.cpp | 31 using android::trusty::fuzz::ExtraCounters;
32 using android::trusty::fuzz::TrustyApp;
103 android::trusty::fuzz::TrustyApp ta(TIPC_DEV, APPLOADER_PORT); in LLVMFuzzerTestOneInput()
107 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
115 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
121 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
129 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
|
| /system/bt/gd/os/linux_generic/ |
| D | linux.h | 25 #define TIMERFD_CREATE ::bluetooth::os::fuzz::fake_timerfd_create
26 #define TIMERFD_SETTIME ::bluetooth::os::fuzz::fake_timerfd_settime
27 #define TIMERFD_CLOSE ::bluetooth::os::fuzz::fake_timerfd_close
|
| /system/nfc/src/fuzzers/ |
| D | fuzz.sh | 17 FUZZ_DIR=data/fuzz/$(get_build_var TARGET_ARCH)/$FUZZER_NAME
63 run_once >./logs/fuzz.log 2>&1
66 CRASH=$(grep -aoP "Test unit written to \K\S+" ./logs/fuzz.log)
70 mv ./logs/fuzz.log ./logs/ERROR/run_$TS.log
80 cat ./logs/verify.log>>./logs/fuzz.log
82 cp ./logs/verify.log ./logs/fuzz.log
94 mv ./logs/fuzz.log ./logs/$SIG_DIR/run_$TS.log
147 function fuzz() { function
173 fuzz $@
|
| D | README.md | 49 4. `fuzz.sh` helper script:
52 it easier, a `fuzz.sh` helper script is included. It needs to be run with
54 it and then use the "fuzz" function defined in it.
64 ../fuzz.sh build
74 ../fuzz.sh run --once
89 By default "fuzz run" will continue with whatever left last time. However,
92 7. Other tools provided by `fuzz.sh`:
94 Here are some extra options provided by `fuzz.sh` script:
95 * "fuzz gcov" pulls the coverage data from device, and generate a
97 * "fuzz gdb" setup gdb instance with the fuzz input so you can debug a
|
| /system/core/trusty/confirmationui/fuzz/ |
| D | msg_fuzzer.cpp | 30 using android::trusty::fuzz::ExtraCounters;
31 using android::trusty::fuzz::TrustyApp;
154 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
162 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
169 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
|
| /system/core/trusty/fuzz/ |
| D | tipc_fuzzer.cpp | 27 using android::trusty::fuzz::ExtraCounters;
28 using android::trusty::fuzz::TrustyApp;
92 android::trusty::fuzz::Abort(); in LLVMFuzzerTestOneInput()
|
| /system/bt/gd/hci/ |
| D | Android.bp | 81 "fuzz/status_vs_complete_commands.cc",
82 "fuzz/hci_layer_fuzz_client.cc",
83 "fuzz/fuzz_hci_layer.cc",
|
| /system/bt/gd/hal/fuzz/ |
| D | fuzz_hci_hal.cc | 24 namespace fuzz { namespace
25 using bluetooth::fuzz::GetArbitraryBytes;
60 waiting_for_status_ = hci::fuzz::uses_command_status(waiting_opcode_); in sendHciCommand()
|
| /system/tools/aidl/tests/ |
| D | aidl_parser_fuzzer.cpp | 32 void fuzz(const FakeIoDelegate& io, const std::vector<std::string>& args) { in fuzz() function
69 fuzz(io, args); in fuzzLang()
84 fuzz(io, args); in fuzzCheckApi()
|
| /system/core/fs_mgr/libsnapshot/ |
| D | fuzz.sh | 5 FUZZ_BINARY=/data/fuzz/${TARGET_ARCH}/${FUZZ_TARGET}/${FUZZ_TARGET}
6 DEVICE_INIT_CORPUS_DIR=/data/fuzz/${TARGET_ARCH}/${FUZZ_TARGET}/corpus
72 …unzip -o -j -d ${HOST_SCRATCH_DIR} ${ANDROID_PRODUCT_OUT}/coverage/data/fuzz/${TARGET_ARCH}/${FUZZ…
|
| D | fuzz_utils.h | 33 namespace android::fuzz {
217 using FunctionMap = android::fuzz::FunctionMap<Class>; \
224 [[maybe_unused]] static int consistent = android::fuzz::CheckConsistency<Action>(); \
225 android::fuzz::ExecuteAllActionProtos<Action>(module, action_protos); \
261 auto func = &::android::fuzz::ActionPerformer<FUZZ_FUNCTION_CLASS_NAME( \
|
| D | fuzz_utils.cpp | 19 namespace android::fuzz { namespace
|
| /system/core/trusty/fuzz/include/trusty/fuzz/ |
| D | counters.h | 26 namespace fuzz {
|
| /system/bt/gd/os/fuzz/ |
| D | fake_timerfd.h | 25 namespace fuzz {
|
| D | fuzz_inject_queue.h | 23 namespace fuzz {
|
| /system/bt/gd/fuzz/ |
| D | run | 33 …ild-mode --"all-modules" --dir="$(pwd)" $TEST_NAME && ${ANDROID_HOST_OUT}/fuzz/$HOST_ARCH/$TEST_NA…
|