Merge "Added fuzzer for libbtdevice" am: cb0e9828 am: dc180acf am:...

/*

 * Copyright (C) 2021 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at:

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

cc_fuzz {

    name: "btdevice_esco_fuzzer",

    defaults: ["fluoride_defaults"],

    srcs: [

        "btdevice_esco_fuzzer.cpp",

    ],

    shared_libs: [

        "liblog",

        "libdl",

    ],

    static_libs: [

        "libbtdevice",

        "libbtcore",

        "libosi",

        "libbluetooth-types",

    ],

    include_dirs: [

        "packages/modules/Bluetooth/system",

        "packages/modules/Bluetooth/system/device/include",

    ],

    cflags: [

        "-DBUILDCFG",

    ],

    fuzz_config: {

        cc: [

            "android-media-fuzzing-reports@google.com",

        ],

        componentid: 155276,

    },

}

# Fuzzers for libbtdevice

## Plugin Design Considerations

The fuzzer plugin for `libbtdevice` is designed based on the understanding of the

source code and tries to achieve the following:

##### Maximize code coverage

The configuration parameters are not hard-coded, but instead selected based on

incoming data. This ensures more code paths are reached by the fuzzers.

Fuzzer assigns values to the following parameters to pass on to libbtdevice:

1. Bluetooth Interop Feature (parameter name: `interopFeature`)

2. Bluetooth Esco Codec (parameter name: `escoCodec`)

| Parameter| Valid Values| Configured Value|

|------------- |-------------| ----- |

| `interopFeature` | 0.`INTEROP_DISABLE_LE_SECURE_CONNECTIONS` 1.`INTEROP_AUTO_RETRY_PAIRING` 2.`INTEROP_DISABLE_ABSOLUTE_VOLUME` 3.`INTEROP_DISABLE_AUTO_PAIRING` 4.`INTEROP_KEYBOARD_REQUIRES_FIXED_PIN` 5.`INTEROP_2MBPS_LINK_ONLY` 6.`INTEROP_HID_PREF_CONN_SUP_TIMEOUT_3S` 7.`INTEROP_GATTC_NO_SERVICE_CHANGED_IND` 8.`INTEROP_DISABLE_AVDTP_RECONFIGURE` 9.`INTEROP_DYNAMIC_ROLE_SWITCH` 10.`INTEROP_DISABLE_ROLE_SWITCH` 11.`INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL` 12.`INTEROP_DISABLE_NAME_REQUEST` 13.`INTEROP_AVRCP_1_4_ONLY` 14.`INTEROP_DISABLE_SNIFF` 15.`INTEROP_DISABLE_AVDTP_SUSPEND`| Value obtained from FuzzedDataProvider |

| `escoCodec` | 0.`SCO_CODEC_CVSD_D1` 1.`ESCO_CODEC_CVSD_S3` 2.`ESCO_CODEC_CVSD_S4` 3.`ESCO_CODEC_MSBC_T1` 4.`ESCO_CODEC_MSBC_T2`| Value obtained from FuzzedDataProvider |

This also ensures that the plugins are always deterministic for any given input.

##### Maximize utilization of input data

The plugin feed the entire input data to the module.

This ensures that the plugin tolerates any kind of input (empty, huge,

malformed, etc) and doesn't `exit()` on any input and thereby increasing the

chance of identifying vulnerabilities.

## Build

This describes steps to build btdevice_esco_fuzzer binary.

### Android

#### Steps to build

Build the fuzzer

```

  $ mm -j$(nproc) btdevice_esco_fuzzer

```

### Steps to run

To run on device

```

  $ adb sync data

  $ adb shell /data/fuzz/arm64/btdevice_esco_fuzzer/btdevice_esco_fuzzer

```

## References:

 * http://llvm.org/docs/LibFuzzer.html

 * https://github.com/google/oss-fuzz

/*

 * Copyright (C) 2021 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include <fuzzer/FuzzedDataProvider.h>

#include <string>

#include "esco_parameters.h"

#include "interop.h"

using namespace std;

constexpr size_t kNumAddressOctets = 6;

constexpr size_t kMaxStringLength = 10;

constexpr interop_feature_t kInteropFeature[] = {

    interop_feature_t::INTEROP_DISABLE_LE_SECURE_CONNECTIONS,

    interop_feature_t::INTEROP_AUTO_RETRY_PAIRING,

    interop_feature_t::INTEROP_DISABLE_ABSOLUTE_VOLUME,

    interop_feature_t::INTEROP_DISABLE_AUTO_PAIRING,

    interop_feature_t::INTEROP_KEYBOARD_REQUIRES_FIXED_PIN,

    interop_feature_t::INTEROP_2MBPS_LINK_ONLY,

    interop_feature_t::INTEROP_HID_PREF_CONN_SUP_TIMEOUT_3S,

    interop_feature_t::INTEROP_GATTC_NO_SERVICE_CHANGED_IND,

    interop_feature_t::INTEROP_DISABLE_AVDTP_RECONFIGURE,

    interop_feature_t::INTEROP_DYNAMIC_ROLE_SWITCH,

    interop_feature_t::INTEROP_DISABLE_ROLE_SWITCH,

    interop_feature_t::INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL,

    interop_feature_t::INTEROP_DISABLE_NAME_REQUEST,

    interop_feature_t::INTEROP_AVRCP_1_4_ONLY,

    interop_feature_t::INTEROP_DISABLE_SNIFF,

    interop_feature_t::INTEROP_DISABLE_AVDTP_SUSPEND,

};

constexpr esco_codec_t kEscoCodec[] = {

    esco_codec_t::SCO_CODEC_CVSD_D1,  esco_codec_t::ESCO_CODEC_CVSD_S3,

    esco_codec_t::ESCO_CODEC_CVSD_S4, esco_codec_t::ESCO_CODEC_MSBC_T1,

    esco_codec_t::ESCO_CODEC_MSBC_T2,

};

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

  FuzzedDataProvider mFuzzedDataProvider = FuzzedDataProvider(data, size);

  RawAddress fuzzAddress;

  string addressString;

  for (size_t i = 0; i < kNumAddressOctets; ++i) {

    addressString.append(

        mFuzzedDataProvider.ConsumeBytesAsString(sizeof(uint8_t)));

    if (i != kNumAddressOctets - 1) {

      addressString.append(":");

    }

  }

  RawAddress::FromString(addressString, fuzzAddress);

  interop_feature_t interopFeature =

      mFuzzedDataProvider.PickValueInArray(kInteropFeature);

  interop_match_addr(interopFeature, &fuzzAddress);

  interop_database_add(interopFeature, &fuzzAddress,

                       mFuzzedDataProvider.ConsumeIntegralInRange<int32_t>(

                           1, RawAddress::kLength - 1));

  interop_database_clear();

  interop_match_name(

      interopFeature,

      mFuzzedDataProvider.ConsumeRandomLengthString(kMaxStringLength).c_str());

  esco_codec_t escoCodec = mFuzzedDataProvider.PickValueInArray(kEscoCodec);

  esco_parameters_for_codec(escoCodec);

  return 0;

}