Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1ecb561b authored by Zach Johnson's avatar Zach Johnson Committed by Gerrit Code Review
Browse files

Merge changes Ifca979db,Iff63f090,I0c0aa26e,I747ad92b 

* changes:
  Add very basic AclManager fuzz test
  Move GetArbitraryBytes to common fuzz helpers
  Rename bluetooth_gd_hci_fuzz_test target to bluetooth_gd_hci_layer_fuzz_test
  Rename DevNullHci to HciLayerFuzzClient
parents ed126191 28c906b0

system/gd/Android.bp

+9 −1
Original line number Diff line number Diff line
@@ -357,7 +357,7 @@ cc_fuzz { 
}



cc_fuzz {

    name: "bluetooth_gd_hci_fuzz_test",

    name: "bluetooth_gd_hci_layer_fuzz_test",

    defaults: ["gd_fuzz_defaults"],

    srcs: [

        "hci/fuzz/hci_layer_fuzz_test.cc",
@@ -365,6 +365,14 @@ cc_fuzz { 
    ],

}



cc_fuzz {

    name: "bluetooth_gd_acl_manager_fuzz_test",

    defaults: ["gd_fuzz_defaults"],

    srcs: [

        "hci/fuzz/acl_manager_fuzz_test.cc",

    ],

}



cc_benchmark {

    name: "bluetooth_benchmark_gd",

    defaults: ["gd_defaults"],

system/gd/fuzz/helpers.cc

+4 −0
Original line number Diff line number Diff line
@@ -37,5 +37,9 @@ std::vector<std::vector<uint8_t>> SplitInput(const uint8_t* data, size_t size, c 
  return result;

}



std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp) {

  return fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegral<size_t>());

}



}  // namespace fuzz

}  // namespace bluetooth

system/gd/fuzz/helpers.h

+4 −0
Original line number Diff line number Diff line
@@ -20,11 +20,15 @@ 
#include <vector>

#include "os/handler.h"



#include <fuzzer/FuzzedDataProvider.h>



namespace bluetooth {

namespace fuzz {



std::vector<std::vector<uint8_t>> SplitInput(const uint8_t* data, size_t size, const uint8_t* separator,

                                             size_t separatorSize);



std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp);



}  // namespace fuzz

}  // namespace bluetooth

system/gd/hci/Android.bp

+2 −1
Original line number Diff line number Diff line
@@ -57,7 +57,8 @@ filegroup { 
    name: "BluetoothHciFuzzHelperSources",

    srcs: [

        "fuzz/status_vs_complete_commands.cc",

        "fuzz/dev_null_hci.cc",

        "fuzz/hci_layer_fuzz_client.cc",

        "fuzz/fuzz_hci_layer.cc",

    ],

}

system/gd/hci/fuzz/acl_manager_fuzz_test.cc

0 → 100644
+66 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2019 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <stddef.h>

#include <stdint.h>

#include "fuzz/helpers.h"

#include "hci/acl_manager.h"

#include "hci/fuzz/fuzz_hci_layer.h"

#include "hci/hci_layer.h"

#include "module.h"

#include "os/fuzz/fake_timerfd.h"

#include "os/log.h"



#include <fuzzer/FuzzedDataProvider.h>



using bluetooth::TestModuleRegistry;

using bluetooth::fuzz::GetArbitraryBytes;

using bluetooth::hci::AclManager;

using bluetooth::hci::HciLayer;

using bluetooth::hci::fuzz::FuzzHciLayer;

using bluetooth::os::fuzz::fake_timerfd_advance;

using bluetooth::os::fuzz::fake_timerfd_cap_at;

using bluetooth::os::fuzz::fake_timerfd_reset;



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

  FuzzedDataProvider dataProvider(data, size);



  static TestModuleRegistry moduleRegistry = TestModuleRegistry();

  FuzzHciLayer* fuzzHci = new FuzzHciLayer();



  moduleRegistry.InjectTestModule(&HciLayer::Factory, fuzzHci);

  fuzzHci->Start();

  moduleRegistry.Start<AclManager>(&moduleRegistry.GetTestThread());



  while (dataProvider.remaining_bytes() > 0) {

    const uint8_t action = dataProvider.ConsumeIntegralInRange(0, 12);

    switch (action) {

      case 1:

        fake_timerfd_advance(dataProvider.ConsumeIntegral<uint64_t>());

        break;

      case 2:

        fuzzHci->injectAclData(GetArbitraryBytes(&dataProvider));

        break;

    }

  }



  if (!moduleRegistry.GetTestThread().GetReactor()->WaitForIdle(std::chrono::milliseconds(100))) {

    LOG_ERROR("idle timed out");

  }

  moduleRegistry.StopAll();

  fake_timerfd_reset();

  return 0;

}