Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3ba6b45 authored by Myles Watson's avatar Myles Watson
Browse files

Add waiting_for_complete_ to HCI fuzzer 

Only send command status and command complete when HCI
is expecting them to avoid aborts.

Bug: 295314777
Test: mma -j32
Flag: EXEMPT, fuzz-only change
Change-Id: Ida7ce4f42b8e322cadc1581f57f189a1b421f8dd
parent 56965b19

system/gd/hal/fuzz/fuzz_hci_hal.cc

+4 −5
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ void FuzzHciHal::sendHciCommand(HciPacket packet) { 


  waiting_opcode_ = command.GetOpCode();

  waiting_for_status_ = hci::fuzz::uses_command_status(waiting_opcode_);

  waiting_for_complete_ = !waiting_for_status_;

}



void FuzzHciHal::injectHciEvent(std::vector<uint8_t> data) {
@@ -68,11 +69,10 @@ void FuzzHciHal::injectHciEvent(std::vector<uint8_t> data) { 


  hci::CommandCompleteView complete = hci::CommandCompleteView::Create(event);

  if (complete.IsValid()) {

    if (waiting_for_status_ || complete.GetCommandOpCode() != waiting_opcode_) {

    if (!waiting_for_complete_ || complete.GetCommandOpCode() != waiting_opcode_) {

      return;

    }

  } else if (!waiting_for_status_) {

    return;

    waiting_for_complete_ = false;

  }



  hci::CommandStatusView status = hci::CommandStatusView::Create(event);
@@ -80,8 +80,7 @@ void FuzzHciHal::injectHciEvent(std::vector<uint8_t> data) { 
    if (!waiting_for_status_ || status.GetCommandOpCode() != waiting_opcode_) {

      return;

    }

  } else if (waiting_for_status_) {

    return;

    waiting_for_status_ = false;

  }



  callbacks_->hciEventReceived(data);

system/gd/hal/fuzz/fuzz_hci_hal.h

+3 −2
Original line number Diff line number Diff line
@@ -54,8 +54,9 @@ class FuzzHciHal : public HciHal { 
  void injectIsoData(std::vector<uint8_t> data);



  HciHalCallbacks* callbacks_;

  hci::OpCode waiting_opcode_;

  bool waiting_for_status_;

  hci::OpCode waiting_opcode_{};

  bool waiting_for_complete_{};

  bool waiting_for_status_{};

};



}  // namespace fuzz