HCI: Add fuzz test for HCI packets

* Add fuzz test for a subset of HCI packets
* Modify the fuzz test generator to generate and register fuzz test at
  the same time

Bug: 142684649
Test: bluetooth_gd_fuzz_test
Change-Id: I1962fd497467bbf469d773823e3e6cf81f62772b

diff --git a/gd/Android.bp b/gd/Android.bp
index fb187f6..61bb5a7 100644 (file)
--- a/gd/Android.bp
+++ b/gd/Android.bp
@@ -293,6 +293,7 @@ cc_fuzz {
   defaults: ["gd_defaults"],
   srcs: [
     "fuzz_test.cc",
+    ":BluetoothHciFuzzTestSources",
     ":BluetoothL2capFuzzTestSources",
   ],
   static_libs: [

diff --git a/gd/fuzz_test.cc b/gd/fuzz_test.cc
index 3adfbac..ef358b5 100644 (file)
--- a/gd/fuzz_test.cc
+++ b/gd/fuzz_test.cc
@@ -19,9 +19,11 @@
 
 extern void RunL2capClassicDynamicChannelAllocatorFuzzTest(const uint8_t* data, size_t size);
 extern void RunL2capPacketFuzzTest(const uint8_t* data, size_t size);
+extern void RunHciPacketFuzzTest(const uint8_t* data, size_t size);
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   RunL2capClassicDynamicChannelAllocatorFuzzTest(data, size);
   RunL2capPacketFuzzTest(data, size);
+  RunHciPacketFuzzTest(data, size);
   return 0;
 }
\ No newline at end of file

diff --git a/gd/hci/Android.bp b/gd/hci/Android.bp
index 57ad49c..40913ae 100644 (file)
--- a/gd/hci/Android.bp
+++ b/gd/hci/Android.bp
@@ -43,3 +43,10 @@ filegroup {
         "cert/cert.cc",
     ],
 }
+
+filegroup {
+    name: "BluetoothHciFuzzTestSources",
+    srcs: [
+        "hci_packets_fuzz_test.cc",
+    ],
+}

diff --git a/gd/hci/hci_packets_fuzz_test.cc b/gd/hci/hci_packets_fuzz_test.cc
new file mode 100644 (file)
index 0000000..5ef3ef6
--- /dev/null
+++ b/gd/hci/hci_packets_fuzz_test.cc
@@ -0,0 +1,135 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define PACKET_FUZZ_TESTING
+#include "hci/hci_packets.h"
+
+#include <memory>
+
+#include "os/log.h"
+#include "packet/bit_inserter.h"
+#include "packet/raw_builder.h"
+
+using bluetooth::packet::BitInserter;
+using bluetooth::packet::RawBuilder;
+using std::vector;
+
+namespace bluetooth {
+namespace hci {
+
+std::vector<void (*)(const uint8_t*, size_t)> hci_packet_fuzz_tests;
+
+DEFINE_AND_REGISTER_ResetReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ResetCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBufferSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBufferSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_HostBufferSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_HostBufferSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalVersionInformationReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalVersionInformationCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBdAddrReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBdAddrCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalSupportedCommandsReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalSupportedCommandsCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSimplePairingModeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSimplePairingModeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteLeHostSupportReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteLeHostSupportCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalExtendedFeaturesReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalExtendedFeaturesCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSecureConnectionsHostSupportReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSecureConnectionsHostSupportCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadWhiteListSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadWhiteListSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadBufferSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadBufferSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteCurrentIacLapReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteCurrentIacLapCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteInquiryScanActivityReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteInquiryScanActivityCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadInquiryScanActivityReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadInquiryScanActivityCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadCurrentIacLapReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadCurrentIacLapCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadNumberOfSupportedIacReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadNumberOfSupportedIacCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadPageTimeoutReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadPageTimeoutCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WritePageTimeoutReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WritePageTimeoutCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryStatusReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryCancelReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryCancelCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_PeriodicInquiryModeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_PeriodicInquiryModeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ExitPeriodicInquiryModeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ExitPeriodicInquiryModeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+}  // namespace hci
+}  // namespace bluetooth
+
+void RunHciPacketFuzzTest(const uint8_t* data, size_t size) {
+  if (data == nullptr) return;
+  for (auto test_function : bluetooth::hci::hci_packet_fuzz_tests) {
+    test_function(data, size);
+  }
+}
\ No newline at end of file

diff --git a/gd/l2cap/l2cap_packet_fuzz_test.cc b/gd/l2cap/l2cap_packet_fuzz_test.cc
index 2551f9d..6fecafc 100644 (file)
--- a/gd/l2cap/l2cap_packet_fuzz_test.cc
+++ b/gd/l2cap/l2cap_packet_fuzz_test.cc
@@ -17,8 +17,6 @@
 #define PACKET_FUZZ_TESTING
 #include "l2cap/l2cap_packets.h"
 
-#include <gtest/gtest.h>
-#include <forward_list>
 #include <memory>
 
 #include "os/log.h"
@@ -32,24 +30,24 @@ using std::vector;
 namespace bluetooth {
 namespace l2cap {
 
-DEFINE_ExtendedInformationStartFrameReflectionFuzzTest;
+std::vector<void (*)(const uint8_t*, size_t)> l2cap_packet_fuzz_tests;
 
-DEFINE_StandardInformationFrameWithFcsReflectionFuzzTest;
+DEFINE_AND_REGISTER_ExtendedInformationStartFrameReflectionFuzzTest(l2cap_packet_fuzz_tests);
 
-DEFINE_StandardSupervisoryFrameWithFcsReflectionFuzzTest;
+DEFINE_AND_REGISTER_StandardInformationFrameWithFcsReflectionFuzzTest(l2cap_packet_fuzz_tests);
 
-DEFINE_GroupFrameReflectionFuzzTest;
+DEFINE_AND_REGISTER_StandardSupervisoryFrameWithFcsReflectionFuzzTest(l2cap_packet_fuzz_tests);
 
-DEFINE_ConfigurationRequestReflectionFuzzTest;
+DEFINE_AND_REGISTER_GroupFrameReflectionFuzzTest(l2cap_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ConfigurationRequestReflectionFuzzTest(l2cap_packet_fuzz_tests);
 
 }  // namespace l2cap
 }  // namespace bluetooth
 
 void RunL2capPacketFuzzTest(const uint8_t* data, size_t size) {
   if (data == nullptr) return;
-  bluetooth::l2cap::RunExtendedInformationStartFrameReflectionFuzzTest(data, size);
-  bluetooth::l2cap::RunStandardInformationFrameWithFcsReflectionFuzzTest(data, size);
-  bluetooth::l2cap::RunStandardSupervisoryFrameWithFcsReflectionFuzzTest(data, size);
-  bluetooth::l2cap::RunGroupFrameReflectionFuzzTest(data, size);
-  bluetooth::l2cap::RunConfigurationRequestReflectionFuzzTest(data, size);
+  for (auto test_function : bluetooth::l2cap::l2cap_packet_fuzz_tests) {
+    test_function(data, size);
+  }
 }
\ No newline at end of file

diff --git a/gd/packet/parser/packet_def.cc b/gd/packet/parser/packet_def.cc
index 1235768..1252a1b 100644 (file)
--- a/gd/packet/parser/packet_def.cc
+++ b/gd/packet/parser/packet_def.cc
@@ -341,7 +341,7 @@ void PacketDef::GenTestDefine(std::ostream& s) const {
 
 void PacketDef::GenFuzzTestDefine(std::ostream& s) const {
   s << "#ifdef PACKET_FUZZ_TESTING\n";
-  s << "#define DEFINE_" << name_ << "ReflectionFuzzTest ";
+  s << "#define DEFINE_AND_REGISTER_" << name_ << "ReflectionFuzzTest(REGISTRY) ";
   s << "void Run" << name_ << "ReflectionFuzzTest(const uint8_t* data, size_t size) {";
   s << "auto vec = std::make_shared<std::vector<uint8_t>>(data, data + size);";
   s << name_ << "View view = " << name_ << "View::Create(";
@@ -374,6 +374,13 @@ void PacketDef::GenFuzzTestDefine(std::ostream& s) const {
   s << "BitInserter it(*packet_bytes);";
   s << "packet->Serialize(it);";
   s << "}";
+  s << " class " << name_ << "ReflectionFuzzTestRegistrant {";
+  s << "public: ";
+  s << "explicit " << name_
+    << "ReflectionFuzzTestRegistrant(std::vector<void(*)(const uint8_t*, size_t)>& fuzz_test_registry) {";
+  s << "fuzz_test_registry.push_back(Run" << name_ << "ReflectionFuzzTest);";
+  s << "}}; ";
+  s << name_ << "ReflectionFuzzTestRegistrant " << name_ << "_reflection_fuzz_test_registrant(REGISTRY);";
   s << "\n#endif";
 }