Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae1f6c41 authored by Zach Johnson's avatar Zach Johnson
Browse files

Move GetArbitraryBytes to common fuzz helpers 

Will be used in other tests.

Test: fuzz/run --host bluetooth_gd_hci_layer_fuzz_test
Change-Id: Iff63f0902c31802ac5412c678443b8ede66b5da9
parent 60838783

system/gd/fuzz/helpers.cc

+4 −0
Original line number Diff line number Diff line
@@ -37,5 +37,9 @@ std::vector<std::vector<uint8_t>> SplitInput(const uint8_t* data, size_t size, c 
  return result;

}



std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp) {

  return fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegral<size_t>());

}



}  // namespace fuzz

}  // namespace bluetooth

system/gd/fuzz/helpers.h

+4 −0
Original line number Diff line number Diff line
@@ -20,11 +20,15 @@ 
#include <vector>

#include "os/handler.h"



#include <fuzzer/FuzzedDataProvider.h>



namespace bluetooth {

namespace fuzz {



std::vector<std::vector<uint8_t>> SplitInput(const uint8_t* data, size_t size, const uint8_t* separator,

                                             size_t separatorSize);



std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp);



}  // namespace fuzz

}  // namespace bluetooth

system/gd/hci/fuzz/hci_layer_fuzz_test.cc

+2 −4
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#include <stddef.h>

#include <stdint.h>

#include "fuzz/helpers.h"

#include "hal/fuzz/fuzz_hci_hal.h"

#include "hci/fuzz/hci_layer_fuzz_client.h"

#include "hci/hci_layer.h"
@@ -26,6 +27,7 @@ 
#include <fuzzer/FuzzedDataProvider.h>



using bluetooth::TestModuleRegistry;

using bluetooth::fuzz::GetArbitraryBytes;

using bluetooth::hal::HciHal;

using bluetooth::hal::fuzz::FuzzHciHal;

using bluetooth::hci::fuzz::HciLayerFuzzClient;
@@ -33,10 +35,6 @@ using bluetooth::os::fuzz::fake_timerfd_advance; 
using bluetooth::os::fuzz::fake_timerfd_cap_at;

using bluetooth::os::fuzz::fake_timerfd_reset;



static std::vector<uint8_t> GetArbitraryBytes(FuzzedDataProvider* fdp) {

  return fdp->ConsumeBytes<uint8_t>(fdp->ConsumeIntegral<size_t>());

}



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

  FuzzedDataProvider dataProvider(data, size);

  fake_timerfd_cap_at(1999);  // prevent command timeouts