1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <fuzzer/FuzzedDataProvider.h>
17 #include "osi/include/compat.h"
18
19 #define MAX_BUFFER_SIZE 4096
20
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)21 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
22 // Our functions are only defined with __GLIBC__
23 #if __GLIBC__
24 // Init our wrapper
25 FuzzedDataProvider dataProvider(Data, Size);
26
27 size_t buf_size =
28 dataProvider.ConsumeIntegralInRange<size_t>(0, MAX_BUFFER_SIZE);
29 if (buf_size == 0) {
30 return 0;
31 }
32
33 // Set up our buffers
34 // NOTE: If the src buffer is not NULL-terminated, the strlcpy will
35 // overread regardless of the len arg. Force null-term for now.
36 std::vector<char> bytes =
37 dataProvider.ConsumeBytesWithTerminator<char>(buf_size, '\0');
38 if (bytes.empty()) {
39 return 0;
40 }
41 buf_size = bytes.size();
42 void* dst_buf = malloc(buf_size);
43 if (dst_buf == nullptr) {
44 return 0;
45 }
46
47 // Call the getId fn just to ensure things don't crash
48 gettid();
49
50 // Copy, then concat
51 size_t len_to_cpy = dataProvider.ConsumeIntegralInRange<size_t>(0, buf_size);
52 strlcpy(reinterpret_cast<char*>(dst_buf),
53 reinterpret_cast<char*>(bytes.data()), len_to_cpy);
54 strlcat(reinterpret_cast<char*>(dst_buf),
55 reinterpret_cast<char*>(bytes.data()), len_to_cpy);
56
57 // Clear out our dest buffer
58 free(dst_buf);
59 #endif
60
61 return 0;
62 }
63