1 /* 2 * Copyright 2019 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <stddef.h> 18 #include <stdint.h> 19 #include "fuzz/helpers.h" 20 #include "hal/fuzz/fuzz_hci_hal.h" 21 #include "hci/fuzz/hci_layer_fuzz_client.h" 22 #include "hci/hci_layer.h" 23 #include "module.h" 24 #include "os/fake_timer/fake_timerfd.h" 25 #include "os/log.h" 26 27 #include <fuzzer/FuzzedDataProvider.h> 28 29 using bluetooth::FuzzTestModuleRegistry; 30 using bluetooth::fuzz::GetArbitraryBytes; 31 using bluetooth::hal::HciHal; 32 using bluetooth::hal::fuzz::FuzzHciHal; 33 using bluetooth::hci::fuzz::HciLayerFuzzClient; 34 using bluetooth::os::fake_timer::fake_timerfd_reset; 35 LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)36extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 37 FuzzedDataProvider dataProvider(data, size); 38 39 static FuzzTestModuleRegistry moduleRegistry = FuzzTestModuleRegistry(); 40 FuzzHciHal* fuzzHal = moduleRegistry.Inject<FuzzHciHal>(&HciHal::Factory); 41 HciLayerFuzzClient* fuzzClient = moduleRegistry.Start<HciLayerFuzzClient>(); 42 43 while (dataProvider.remaining_bytes() > 0) { 44 const uint8_t action = dataProvider.ConsumeIntegralInRange(1, 2); 45 switch (action) { 46 case 1: 47 fuzzHal->injectArbitrary(dataProvider); 48 break; 49 case 2: 50 fuzzClient->injectArbitrary(dataProvider); 51 break; 52 } 53 } 54 55 moduleRegistry.WaitForIdleAndStopAll(); 56 fake_timerfd_reset(); 57 return 0; 58 } 59