1 /*
2 * Copyright 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <base/functional/bind.h>
18 #include <bluetooth/log.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20
21 #include <cstdint>
22 #include <functional>
23 #include <optional>
24 #include <vector>
25
26 #include "osi/include/allocator.h"
27 #include "stack/include/avct_api.h"
28 #include "stack/include/avrc_api.h"
29 #include "test/fake/fake_osi.h"
30 #include "test/mock/mock_btif_config.h"
31 #include "test/mock/mock_stack_acl.h"
32 #include "test/mock/mock_stack_btm_dev.h"
33 #include "test/mock/mock_stack_l2cap_api.h"
34 #include "test/mock/mock_stack_l2cap_ble.h"
35 #include "types/bluetooth/uuid.h"
36
37 using bluetooth::Uuid;
38 using namespace bluetooth;
39
40 // Verify the passed data is readable
ConsumeData(const uint8_t * data,size_t size)41 static void ConsumeData(const uint8_t* data, size_t size) {
42 volatile uint8_t checksum = 0;
43 for (size_t i = 0; i < size; i++) {
44 checksum ^= data[i];
45 }
46 }
47
48 namespace {
49
50 constexpr uint16_t kDummyCid = 0x1234;
51 constexpr uint8_t kDummyId = 0x77;
52 constexpr uint8_t kDummyRemoteAddr[] = {0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC};
53
54 // Set up default callback structure
55 static tL2CAP_APPL_INFO avct_appl, avct_br_appl;
56
57 class FakeBtStack {
58 public:
FakeBtStack()59 FakeBtStack() {
60 test::mock::stack_l2cap_api::L2CA_DataWrite.body = [](uint16_t cid,
61 BT_HDR* hdr) {
62 log::assert_that(cid == kDummyCid, "assert failed: cid == kDummyCid");
63 ConsumeData((const uint8_t*)hdr, hdr->offset + hdr->len);
64 osi_free(hdr);
65 return L2CAP_DW_SUCCESS;
66 };
67 test::mock::stack_l2cap_api::L2CA_DisconnectReq.body = [](uint16_t cid) {
68 log::assert_that(cid == kDummyCid, "assert failed: cid == kDummyCid");
69 return true;
70 };
71 test::mock::stack_l2cap_api::L2CA_ConnectReqWithSecurity.body =
72 [](uint16_t psm, const RawAddress& p_bd_addr, uint16_t sec_level) {
73 log::assert_that(p_bd_addr == kDummyRemoteAddr,
74 "assert failed: p_bd_addr == kDummyRemoteAddr");
75 return kDummyCid;
76 };
77 test::mock::stack_l2cap_api::L2CA_RegisterWithSecurity.body =
78 [](uint16_t psm, const tL2CAP_APPL_INFO& p_cb_info, bool enable_snoop,
79 tL2CAP_ERTM_INFO* p_ertm_info, uint16_t my_mtu,
80 uint16_t required_remote_mtu, uint16_t sec_level) {
81 log::assert_that(
82 psm == AVCT_PSM || psm == AVCT_BR_PSM,
83 "assert failed: psm == AVCT_PSM || psm == AVCT_BR_PSM");
84 if (psm == AVCT_PSM) {
85 avct_appl = p_cb_info;
86 } else if (psm == AVCT_BR_PSM) {
87 avct_br_appl = p_cb_info;
88 }
89 return psm;
90 };
91 test::mock::stack_l2cap_api::L2CA_Deregister.body = [](uint16_t psm) {};
92 }
93
~FakeBtStack()94 ~FakeBtStack() {
95 test::mock::stack_l2cap_api::L2CA_DataWrite = {};
96 test::mock::stack_l2cap_api::L2CA_ConnectReqWithSecurity = {};
97 test::mock::stack_l2cap_api::L2CA_DisconnectReq = {};
98 test::mock::stack_l2cap_api::L2CA_RegisterWithSecurity = {};
99 test::mock::stack_l2cap_api::L2CA_Deregister = {};
100 }
101 };
102
103 class Fakes {
104 public:
105 test::fake::FakeOsi fake_osi;
106 FakeBtStack fake_stack;
107 };
108
109 } // namespace
110
111 #ifdef __ANDROID__
112 namespace android {
113 namespace sysprop {
114 namespace bluetooth {
115 namespace Avrcp {
absolute_volume()116 std::optional<bool> absolute_volume() { return true; }
117 } // namespace Avrcp
118
119 namespace Bta {
disable_delay()120 std::optional<std::int32_t> disable_delay() { return 200; }
121 } // namespace Bta
122
123 namespace Pan {
nap()124 std::optional<bool> nap() { return false; }
125 } // namespace Pan
126 } // namespace bluetooth
127 } // namespace sysprop
128 } // namespace android
129 #endif
130
ctrl_cb(uint8_t handle,uint8_t event,uint16_t result,const RawAddress * peer_addr)131 static void ctrl_cb(uint8_t handle, uint8_t event, uint16_t result,
132 const RawAddress* peer_addr) {}
133
msg_cb(uint8_t handle,uint8_t label,uint8_t opcode,tAVRC_MSG * p_msg)134 static void msg_cb(uint8_t handle, uint8_t label, uint8_t opcode,
135 tAVRC_MSG* p_msg) {
136 uint8_t scratch_buf[512];
137 tAVRC_STS status;
138
139 if (p_msg->hdr.ctype == AVCT_CMD) {
140 tAVRC_COMMAND cmd = {0};
141 memset(scratch_buf, 0, sizeof(scratch_buf));
142 status = AVRC_ParsCommand(p_msg, &cmd, scratch_buf, sizeof(scratch_buf));
143 if (status == AVRC_STS_NO_ERROR) {
144 BT_HDR* p_pkt = (BT_HDR*)nullptr;
145 status = AVRC_BldCommand(&cmd, &p_pkt);
146 if (status == AVRC_STS_NO_ERROR && p_pkt) {
147 osi_free(p_pkt);
148 }
149 }
150 } else if (p_msg->hdr.ctype == AVCT_RSP) {
151 tAVRC_RESPONSE rsp = {0};
152 memset(scratch_buf, 0, sizeof(scratch_buf));
153 status = AVRC_ParsResponse(p_msg, &rsp, scratch_buf, sizeof(scratch_buf));
154 if (status == AVRC_STS_NO_ERROR) {
155 BT_HDR* p_pkt = (BT_HDR*)nullptr;
156 status = AVRC_BldResponse(handle, &rsp, &p_pkt);
157 if (status == AVRC_STS_NO_ERROR && p_pkt) {
158 osi_free(p_pkt);
159 }
160 }
161
162 uint16_t buf_len = sizeof(scratch_buf);
163 memset(scratch_buf, 0, sizeof(scratch_buf));
164 status = AVRC_Ctrl_ParsResponse(p_msg, &rsp, scratch_buf, &buf_len);
165 if (status == AVRC_STS_NO_ERROR) {
166 BT_HDR* p_pkt = (BT_HDR*)nullptr;
167 status = AVRC_BldResponse(handle, &rsp, &p_pkt);
168 if (status == AVRC_STS_NO_ERROR && p_pkt) {
169 osi_free(p_pkt);
170 }
171 }
172 }
173 }
174
Fuzz(const uint8_t * data,size_t size)175 static void Fuzz(const uint8_t* data, size_t size) {
176 FuzzedDataProvider fdp(data, size);
177 bool is_initiator = fdp.ConsumeBool();
178 bool is_controller = fdp.ConsumeBool();
179 bool is_br = fdp.ConsumeBool();
180
181 AVCT_Register();
182 AVRC_Init();
183
184 tL2CAP_APPL_INFO* appl_info = is_br ? &avct_br_appl : &avct_appl;
185
186 tAVRC_CONN_CB ccb = {
187 .ctrl_cback = base::Bind(ctrl_cb),
188 .msg_cback = base::Bind(msg_cb),
189 .conn = (uint8_t)(is_initiator ? AVCT_INT : AVCT_ACP),
190 .control = (uint8_t)(is_controller ? AVCT_CONTROL : AVCT_TARGET),
191 };
192
193 appl_info->pL2CA_ConnectInd_Cb(kDummyRemoteAddr, kDummyCid, 0, kDummyId);
194
195 uint8_t handle;
196 if (AVCT_SUCCESS != AVRC_Open(&handle, &ccb, kDummyRemoteAddr)) {
197 return;
198 }
199
200 tL2CAP_CFG_INFO cfg;
201 appl_info->pL2CA_ConfigCfm_Cb(kDummyCid, is_initiator, &cfg);
202
203 // Feeding input packets
204 constexpr uint16_t kMaxPacketSize = 1024;
205 while (fdp.remaining_bytes() > 0) {
206 auto size = fdp.ConsumeIntegralInRange<uint16_t>(0, kMaxPacketSize);
207 auto bytes = fdp.ConsumeBytes<uint8_t>(size);
208 BT_HDR* hdr = (BT_HDR*)osi_calloc(sizeof(BT_HDR) + bytes.size());
209 hdr->len = bytes.size();
210 std::copy(bytes.cbegin(), bytes.cend(), hdr->data);
211 appl_info->pL2CA_DataInd_Cb(kDummyCid, hdr);
212 }
213
214 AVRC_Close(handle);
215
216 // Simulating disconnecting event
217 appl_info->pL2CA_DisconnectInd_Cb(kDummyCid, false);
218
219 AVCT_Deregister();
220 }
221
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)222 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
223 auto fakes = std::make_unique<Fakes>();
224 Fuzz(Data, Size);
225 return 0;
226 }
227