| /* |
| * Copyright 2022 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <fuzzer/FuzzedDataProvider.h> |
| |
| #include <cstdint> |
| #include <functional> |
| #include <string> |
| #include <vector> |
| |
| #include "osi/include/allocator.h" |
| #include "stack/include/bnep_api.h" |
| #include "test/fake/fake_osi.h" |
| #include "test/mock/mock_btif_config.h" |
| #include "test/mock/mock_stack_acl.h" |
| #include "test/mock/mock_stack_btm_dev.h" |
| #include "test/mock/mock_stack_l2cap_api.h" |
| #include "test/mock/mock_stack_l2cap_ble.h" |
| #include "types/bluetooth/uuid.h" |
| |
| using bluetooth::Uuid; |
| |
| namespace { |
| |
| constexpr uint16_t kDummyCid = 0x1234; |
| constexpr uint8_t kDummyId = 0x77; |
| constexpr uint8_t kDummyRemoteAddr[] = {0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC}; |
| constexpr uint8_t kDummySrcUuid[] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, |
| 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, |
| 0xcc, 0xdd, 0xee, 0xff}; |
| constexpr uint8_t kDummyDstUuid[] = {0x00, 0x00, 0x00, 0x00, 0x22, 0x22, |
| 0x22, 0x22, 0x33, 0x33, 0x55, 0x55, |
| 0x55, 0x55, 0x55, 0x59}; |
| |
| // Set up default callback structure |
| static tL2CAP_APPL_INFO appl_info; |
| |
| class FakeBtStack { |
| public: |
| FakeBtStack() { |
| test::mock::stack_l2cap_api::L2CA_DataWrite.body = [](uint16_t cid, |
| BT_HDR* p_data) { |
| CHECK(cid == kDummyCid); |
| osi_free(p_data); |
| return L2CAP_DW_SUCCESS; |
| }; |
| test::mock::stack_l2cap_api::L2CA_DisconnectReq.body = [](uint16_t cid) { |
| CHECK(cid == kDummyCid); |
| return true; |
| }; |
| test::mock::stack_l2cap_api::L2CA_ConnectReq2.body = |
| [](uint16_t psm, const RawAddress& p_bd_addr, uint16_t sec_level) { |
| CHECK(p_bd_addr == kDummyRemoteAddr); |
| return kDummyCid; |
| }; |
| test::mock::stack_l2cap_api::L2CA_Register2.body = |
| [](uint16_t psm, const tL2CAP_APPL_INFO& p_cb_info, bool enable_snoop, |
| tL2CAP_ERTM_INFO* p_ertm_info, uint16_t my_mtu, |
| uint16_t required_remote_mtu, uint16_t sec_level) { |
| appl_info = p_cb_info; |
| return psm; |
| }; |
| test::mock::stack_l2cap_api::L2CA_Deregister.body = [](uint16_t psm) {}; |
| } |
| |
| ~FakeBtStack() { |
| test::mock::stack_l2cap_api::L2CA_DataWrite = {}; |
| test::mock::stack_l2cap_api::L2CA_ConnectReq2 = {}; |
| test::mock::stack_l2cap_api::L2CA_DisconnectReq = {}; |
| test::mock::stack_l2cap_api::L2CA_Register2 = {}; |
| test::mock::stack_l2cap_api::L2CA_Deregister = {}; |
| } |
| }; |
| |
| class Fakes { |
| public: |
| test::fake::FakeOsi fake_osi; |
| FakeBtStack fake_stack; |
| }; |
| |
| } // namespace |
| |
| // Verify the passed data is readable |
| static void ConsumeData(const uint8_t* data, size_t size) { |
| volatile uint8_t checksum = 0; |
| for (size_t i = 0; i < size; i++) { |
| checksum ^= data[i]; |
| } |
| } |
| |
| static void Fuzz(const uint8_t* data, size_t size) { |
| tBNEP_REGISTER reg = { |
| .p_conn_ind_cb = |
| [](uint16_t handle, const RawAddress& bd_addr, |
| const bluetooth::Uuid& remote_uuid, |
| const bluetooth::Uuid& local_uuid, |
| bool is_role_change) { BNEP_ConnectResp(handle, BNEP_SUCCESS); }, |
| .p_conn_state_cb = [](uint16_t handle, const RawAddress& rem_bda, |
| tBNEP_RESULT result, bool is_role_change) {}, |
| .p_data_ind_cb = [](uint16_t handle, const RawAddress& src, |
| const RawAddress& dst, uint16_t protocol, |
| uint8_t* p_data, uint16_t len, |
| bool fw_ext_present) { ConsumeData(p_data, len); }, |
| .p_tx_data_flow_cb = [](uint16_t handle, tBNEP_RESULT event) {}, |
| .p_filter_ind_cb = |
| [](uint16_t handle, bool indication, tBNEP_RESULT result, |
| uint16_t num_filters, |
| uint8_t* p_filters) { ConsumeData(p_filters, num_filters); }, |
| .p_mfilter_ind_cb = |
| [](uint16_t handle, bool indication, tBNEP_RESULT result, |
| uint16_t num_mfilters, |
| uint8_t* p_mfilters) { ConsumeData(p_mfilters, num_mfilters); }, |
| }; |
| |
| BNEP_Init(); |
| if (BNEP_SUCCESS != BNEP_Register(®)) { |
| return; |
| } |
| |
| FuzzedDataProvider fdp(data, size); |
| bool is_server = fdp.ConsumeBool(); |
| if (is_server) { |
| // Simulating an inbound connection event |
| appl_info.pL2CA_ConnectInd_Cb(kDummyRemoteAddr, kDummyCid, 0, kDummyId); |
| } else { |
| // Initiating an outbound connection |
| uint16_t handle; |
| BNEP_Connect(kDummyRemoteAddr, Uuid::From128BitBE(kDummySrcUuid), |
| Uuid::From128BitBE(kDummyDstUuid), &handle, 0); |
| |
| // Simulating outbound connection confirm event |
| appl_info.pL2CA_ConnectCfm_Cb(kDummyCid, L2CAP_CONN_OK); |
| } |
| |
| // Simulating configuration confirmation event |
| tL2CAP_CFG_INFO cfg = {}; |
| appl_info.pL2CA_ConfigCfm_Cb(kDummyCid, 0, &cfg); |
| |
| // Feeding input packets |
| constexpr uint16_t kMaxPacketSize = 1024; |
| while (fdp.remaining_bytes() > 0) { |
| auto size = fdp.ConsumeIntegralInRange<uint16_t>(0, kMaxPacketSize); |
| auto bytes = fdp.ConsumeBytes<uint8_t>(size); |
| BT_HDR* hdr = (BT_HDR*)osi_calloc(sizeof(BT_HDR) + bytes.size()); |
| hdr->len = bytes.size(); |
| std::copy(bytes.cbegin(), bytes.cend(), hdr->data); |
| appl_info.pL2CA_DataInd_Cb(kDummyCid, hdr); |
| } |
| |
| // Simulating disconnecting event |
| appl_info.pL2CA_DisconnectInd_Cb(kDummyCid, false); |
| |
| BNEP_Deregister(); |
| } |
| |
| extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) { |
| auto fakes = std::make_unique<Fakes>(); |
| Fuzz(Data, Size); |
| return 0; |
| } |