1 /* 2 * Copyright (C) 2019 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <fuzzer/FuzzedDataProvider.h> 18 #include <stddef.h> 19 #include <stdint.h> 20 21 #include "fuzz/helpers.h" 22 #include "hci/acl_manager.h" 23 #include "hci/fuzz/fuzz_hci_layer.h" 24 #include "hci/hci_layer.h" 25 #include "module.h" 26 #include "os/fake_timer/fake_timerfd.h" 27 28 using bluetooth::FuzzTestModuleRegistry; 29 using bluetooth::fuzz::GetArbitraryBytes; 30 using bluetooth::hci::AclManager; 31 using bluetooth::hci::HciLayer; 32 using bluetooth::hci::fuzz::FuzzHciLayer; 33 using bluetooth::os::fake_timer::fake_timerfd_advance; 34 using bluetooth::os::fake_timer::fake_timerfd_cap_at; 35 using bluetooth::os::fake_timer::fake_timerfd_reset; 36 37 constexpr int32_t kMinTimeAdvanced = 0; 38 /** 39 * kMaxTotalTimeAdvanced value is referenced from 40 * kDefaultConfigSaveDelay defined in storage_module.cc 41 */ 42 constexpr int32_t kMaxTotalTimeAdvanced = 3000; 43 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)44extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 45 FuzzedDataProvider dataProvider(data, size); 46 47 static FuzzTestModuleRegistry moduleRegistry = FuzzTestModuleRegistry(); 48 FuzzHciLayer* fuzzHci = moduleRegistry.Inject<FuzzHciLayer>(&HciLayer::Factory); 49 fuzzHci->TurnOnAutoReply(&dataProvider); 50 moduleRegistry.Start<AclManager>(); 51 fuzzHci->TurnOffAutoReply(); 52 uint64_t totalAdvanceTime = 0; 53 54 while (dataProvider.remaining_bytes() > 0) { 55 const uint8_t action = dataProvider.ConsumeIntegralInRange(0, 2); 56 57 switch (action) { 58 case 1: { 59 uint64_t advanceTime = dataProvider.ConsumeIntegralInRange<uint64_t>(kMinTimeAdvanced, 60 kMaxTotalTimeAdvanced); 61 totalAdvanceTime += advanceTime; 62 if (totalAdvanceTime < kMaxTotalTimeAdvanced) { 63 fake_timerfd_advance(advanceTime); 64 } 65 break; 66 } 67 case 2: { 68 fuzzHci->injectArbitrary(dataProvider); 69 break; 70 } 71 } 72 } 73 74 moduleRegistry.WaitForIdleAndStopAll(); 75 fake_timerfd_reset(); 76 return 0; 77 } 78