1 /*
2  * Copyright 2019 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <fuzzer/FuzzedDataProvider.h>
18 #include <stddef.h>
19 #include <stdint.h>
20 
21 #include "fuzz/helpers.h"
22 #include "hal/fuzz/fuzz_hci_hal.h"
23 #include "hci/fuzz/hci_layer_fuzz_client.h"
24 #include "hci/hci_layer.h"
25 #include "module.h"
26 #include "os/fake_timer/fake_timerfd.h"
27 
28 // TODO(b/369381361) Enfore -Wmissing-prototypes
29 #pragma GCC diagnostic ignored "-Wmissing-prototypes"
30 
31 using bluetooth::FuzzTestModuleRegistry;
32 using bluetooth::fuzz::GetArbitraryBytes;
33 using bluetooth::hal::HciHal;
34 using bluetooth::hal::fuzz::FuzzHciHal;
35 using bluetooth::hci::fuzz::HciLayerFuzzClient;
36 using bluetooth::os::fake_timer::fake_timerfd_reset;
37 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)38 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
39   FuzzedDataProvider dataProvider(data, size);
40 
41   static FuzzTestModuleRegistry moduleRegistry = FuzzTestModuleRegistry();
42   FuzzHciHal* fuzzHal = moduleRegistry.Inject<FuzzHciHal>(&HciHal::Factory);
43   HciLayerFuzzClient* fuzzClient = moduleRegistry.Start<HciLayerFuzzClient>();
44 
45   while (dataProvider.remaining_bytes() > 0) {
46     const uint8_t action = dataProvider.ConsumeIntegralInRange(1, 2);
47     switch (action) {
48       case 1:
49         fuzzHal->injectArbitrary(dataProvider);
50         break;
51       case 2:
52         fuzzClient->injectArbitrary(dataProvider);
53         break;
54     }
55   }
56 
57   moduleRegistry.WaitForIdleAndStopAll();
58   fake_timerfd_reset();
59   return 0;
60 }
61