1 /* 2 * Copyright 2019 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <stddef.h> 18 #include <stdint.h> 19 #include "fuzz/helpers.h" 20 #include "hci/acl_manager.h" 21 #include "hci/fuzz/fuzz_hci_layer.h" 22 #include "hci/hci_layer.h" 23 #include "module.h" 24 #include "os/fuzz/fake_timerfd.h" 25 #include "os/log.h" 26 27 #include <fuzzer/FuzzedDataProvider.h> 28 29 using bluetooth::FuzzTestModuleRegistry; 30 using bluetooth::fuzz::GetArbitraryBytes; 31 using bluetooth::hci::AclManager; 32 using bluetooth::hci::HciLayer; 33 using bluetooth::hci::fuzz::FuzzHciLayer; 34 using bluetooth::os::fuzz::fake_timerfd_advance; 35 using bluetooth::os::fuzz::fake_timerfd_cap_at; 36 using bluetooth::os::fuzz::fake_timerfd_reset; 37 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)38extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 39 FuzzedDataProvider dataProvider(data, size); 40 41 static FuzzTestModuleRegistry moduleRegistry = FuzzTestModuleRegistry(); 42 FuzzHciLayer* fuzzHci = moduleRegistry.Inject<FuzzHciLayer>(&HciLayer::Factory); 43 fuzzHci->TurnOnAutoReply(&dataProvider); 44 moduleRegistry.Start<AclManager>(); 45 fuzzHci->TurnOffAutoReply(); 46 47 while (dataProvider.remaining_bytes() > 0) { 48 const uint8_t action = dataProvider.ConsumeIntegralInRange(0, 2); 49 switch (action) { 50 case 1: 51 fake_timerfd_advance(dataProvider.ConsumeIntegral<uint64_t>()); 52 break; 53 case 2: 54 fuzzHci->injectArbitrary(dataProvider); 55 break; 56 } 57 } 58 59 moduleRegistry.WaitForIdleAndStopAll(); 60 fake_timerfd_reset(); 61 return 0; 62 } 63