Add FuzzingHciHal, to inject fuzzed input up the stack (1b495c27) · Commits · e / os / android_packages_modules_Bluetooth

system/gd/hal/Android.bp

+7 −0

Original line number	Diff line number	Diff line
		@@ -39,3 +39,10 @@ filegroup {
		"facade.cc",
		],
		}

		filegroup {
		name: "BluetoothHalFuzzingSources",
		srcs: [
		"fuzzing/fuzzing_hci_hal.cc",
		],
		}

system/gd/hal/fuzzing/fuzzing_hci_hal.cc

0 → 100644

+51 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include "hal/fuzzing/fuzzing_hci_hal.h"
		#include "fuzzing/helpers.h"
		#include "hci/hci_packets.h"

		namespace bluetooth {
		namespace hal {
		namespace fuzzing {

		void FuzzingHciHal::registerIncomingPacketCallback(HciHalCallbacks* callbacks) {
		callbacks_ = callbacks;
		}

		void FuzzingHciHal::unregisterIncomingPacketCallback() {
		callbacks_ = nullptr;
		}

		int FuzzingHciHal::injectFuzzInput(const uint8_t* data, size_t size) {
		const uint8_t separator[] = {0xDE, 0xAD, 0xBE, 0xEF};
		auto inputs = ::bluetooth::fuzzing::SplitInput(data, size, separator, sizeof(separator));
		for (auto const& sdata : inputs) {
		auto packet = packet::PacketView<packet::kLittleEndian>(std::make_shared<std::vector<uint8_t>>(sdata));
		hci::AclPacketView aclPacket = hci::AclPacketView::Create(packet);
		if (!aclPacket.IsValid()) {
		continue;
		}

		callbacks_->aclDataReceived(sdata);
		sentinel_work_item_.WaitUntilFinishedOn(GetHandler());
		}
		return 0;
		}

		} // namespace fuzzing
		} // namespace hal
		} // namespace bluetooth

system/gd/hal/fuzzing/fuzzing_hci_hal.h

0 → 100644

+53 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2020 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#pragma once

		#include "fuzzing/helpers.h"
		#include "hal/hci_hal.h"

		namespace bluetooth {
		namespace hal {
		namespace fuzzing {

		class FuzzingHciHal : public HciHal {
		public:
		void registerIncomingPacketCallback(HciHalCallbacks* callbacks) override;
		void unregisterIncomingPacketCallback() override;

		void sendHciCommand(HciPacket command) override {}
		void sendAclData(HciPacket packet) override {}
		void sendScoData(HciPacket packet) override {}

		int injectFuzzInput(const uint8_t* data, size_t size);

		std::string ToString() const override {
		return "HciHalFuzz";
		}

		protected:
		void ListDependencies(ModuleList* list) override {}
		void Start() override {}
		void Stop() override {}

		private:
		HciHalCallbacks* callbacks_;
		::bluetooth::fuzzing::SentinelWorkItem sentinel_work_item_;
		};

		} // namespace fuzzing
		} // namespace hal
		} // namespace bluetooth