1 /* 2 * Copyright 2019 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <stddef.h> 18 #include <stdint.h> 19 #include "fuzz/helpers.h" 20 #include "hci/acl_manager.h" 21 #include "hci/fuzz/fuzz_hci_layer.h" 22 #include "hci/hci_layer.h" 23 #include "module.h" 24 #include "os/fake_timer/fake_timerfd.h" 25 #include "os/log.h" 26 27 #include <fuzzer/FuzzedDataProvider.h> 28 29 using bluetooth::FuzzTestModuleRegistry; 30 using bluetooth::fuzz::GetArbitraryBytes; 31 using bluetooth::hci::AclManager; 32 using bluetooth::hci::HciLayer; 33 using bluetooth::hci::fuzz::FuzzHciLayer; 34 using bluetooth::os::fake_timer::fake_timerfd_advance; 35 using bluetooth::os::fake_timer::fake_timerfd_cap_at; 36 using bluetooth::os::fake_timer::fake_timerfd_reset; 37 38 constexpr int32_t kMinTimeAdvanced = 0; 39 /** 40 * kMaxTotalTimeAdvanced value is referenced from 41 * kDefaultConfigSaveDelay defined in storage_module.cc 42 */ 43 constexpr int32_t kMaxTotalTimeAdvanced = 3000; 44 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)45extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 46 FuzzedDataProvider dataProvider(data, size); 47 48 static FuzzTestModuleRegistry moduleRegistry = FuzzTestModuleRegistry(); 49 FuzzHciLayer* fuzzHci = moduleRegistry.Inject<FuzzHciLayer>(&HciLayer::Factory); 50 fuzzHci->TurnOnAutoReply(&dataProvider); 51 moduleRegistry.Start<AclManager>(); 52 fuzzHci->TurnOffAutoReply(); 53 uint64_t totalAdvanceTime = 0; 54 55 while (dataProvider.remaining_bytes() > 0) { 56 const uint8_t action = dataProvider.ConsumeIntegralInRange(0, 2); 57 58 switch (action) { 59 case 1: { 60 uint64_t advanceTime = dataProvider.ConsumeIntegralInRange<uint64_t>(kMinTimeAdvanced, kMaxTotalTimeAdvanced); 61 totalAdvanceTime += advanceTime; 62 if (totalAdvanceTime < kMaxTotalTimeAdvanced) { 63 fake_timerfd_advance(advanceTime); 64 } 65 break; 66 } 67 case 2: { 68 fuzzHci->injectArbitrary(dataProvider); 69 break; 70 } 71 } 72 } 73 74 moduleRegistry.WaitForIdleAndStopAll(); 75 fake_timerfd_reset(); 76 return 0; 77 } 78