1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "fuzzer/FuzzedDataProvider.h"
18
19 #include "chpp/common/wifi_types.h"
20 #include "chpp/memory.h"
21
22 // Fuzzer for validating the conversion methods between CHPP/CHRE types for
23 // chreWifiScanParams.
24
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)25 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
26 FuzzedDataProvider fdp(data, size);
27
28 struct chreWifiScanParams params = {};
29 params.scanType = fdp.ConsumeIntegral<uint8_t>();
30 params.maxScanAgeMs = fdp.ConsumeIntegral<uint32_t>();
31 // ConsumeBytes only supports uint8_t currently.
32 std::vector<uint8_t> frequencyList = fdp.ConsumeBytes<uint8_t>(
33 CHRE_WIFI_FREQUENCY_LIST_MAX_LEN * sizeof(uint32_t));
34 params.frequencyList = reinterpret_cast<uint32_t *>(frequencyList.data());
35 params.frequencyListLen = frequencyList.size() / sizeof(uint32_t);
36 params.ssidListLen = fdp.ConsumeIntegral<uint8_t>();
37 std::vector<chreWifiSsidListItem> ssidList(params.ssidListLen);
38 for (uint8_t i = 0; i < params.ssidListLen; ++i) {
39 struct chreWifiSsidListItem item = {};
40 item.ssidLen = fdp.ConsumeIntegral<uint8_t>();
41 fdp.ConsumeData(item.ssid, item.ssidLen);
42 }
43 params.ssidList = ssidList.data();
44 params.radioChainPref = fdp.ConsumeIntegral<uint8_t>();
45 params.channelSet = fdp.ConsumeIntegral<uint8_t>();
46
47 ChppWifiScanParamsWithHeader *chppWithHeader = nullptr;
48 size_t outputSize = 999;
49 chppWifiScanParamsFromChre(¶ms, &chppWithHeader, &outputSize);
50 ChppWifiScanParams *chppParams = &chppWithHeader->payload;
51 outputSize -= sizeof(struct ChppAppHeader);
52 chreWifiScanParams *backParams =
53 chppWifiScanParamsToChre(chppParams, outputSize);
54
55 chppFree(chppWithHeader);
56 if (backParams != NULL) {
57 chppFree(const_cast<uint32_t *>(backParams->frequencyList));
58 chppFree(const_cast<chreWifiSsidListItem *>(backParams->ssidList));
59 }
60 chppFree(backParams);
61 return 0;
62 }