xref: /btstack/test/fuzz/fuzz_gatt_client.c (revision 93fdb564bf5c29ebce6a8bcd7598ffecc113ee8d)

#include <stdint.h>
#include <stddef.h>

#include "ble/gatt_client.h"
#include "btstack_run_loop_posix.h"
#include "btstack_memory.h"

static  void (*packet_handler)(uint8_t packet_type, uint8_t *packet, uint16_t size);

static int hci_transport_fuzz_set_baudrate(uint32_t baudrate){
    return 0;
}

static int hci_transport_fuzz_can_send_now(uint8_t packet_type){
    return 1;
}

static int hci_transport_fuzz_send_packet(uint8_t packet_type, uint8_t * packet, int size){
    return 0;
}

static void hci_transport_fuzz_init(const void * transport_config){
}

static int hci_transport_fuzz_open(void){
    return 0;
}

static int hci_transport_fuzz_close(void){
    return 0;
}

static void hci_transport_fuzz_register_packet_handler(void (*handler)(uint8_t packet_type, uint8_t *packet, uint16_t size)){
    packet_handler = handler;
}

static const hci_transport_t hci_transport_fuzz = {
        /* const char * name; */                                        "FUZZ",
        /* void   (*init) (const void *transport_config); */            &hci_transport_fuzz_init,
        /* int    (*open)(void); */                                     &hci_transport_fuzz_open,
        /* int    (*close)(void); */                                    &hci_transport_fuzz_close,
        /* void   (*register_packet_handler)(void (*handler)(...); */   &hci_transport_fuzz_register_packet_handler,
        /* int    (*can_send_packet_now)(uint8_t packet_type); */       &hci_transport_fuzz_can_send_now,
        /* int    (*send_packet)(...); */                               &hci_transport_fuzz_send_packet,
        /* int    (*set_baudrate)(uint32_t baudrate); */                &hci_transport_fuzz_set_baudrate,
        /* void   (*reset_link)(void); */                               NULL,
        /* void   (*set_sco_config)(uint16_t voice_setting, int num_connections); */ NULL,
};

static void gatt_client_packet_handler(uint8_t packet_type, uint16_t handle, uint8_t *packet, uint16_t size){
}

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    const hci_con_handle_t ble_handle = 0x0005;

    static bool gatt_client_initiated = false;
    if (!gatt_client_initiated){
        btstack_memory_init();
        btstack_run_loop_init(btstack_run_loop_posix_get_instance());
        // init hci, simulate connection
        hci_init(&hci_transport_fuzz, NULL);
        hci_setup_test_connections_fuzz();

        gatt_client_init();
        gatt_client_initiated = true;
    }

    // TODO: use first byte of random data to pick gatt_client request / set gatt client state
    // then, only use dat from second byte as response
    gatt_client_discover_primary_services(gatt_client_packet_handler, ble_handle);

    // send test response
    gatt_client_att_packet_handler_fuzz(ATT_DATA_PACKET, ble_handle, (uint8_t *) data, size);
    return 0;
}