fast_pair_data_parser_fuzzer.cc 2.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "ash/services/quick_pair/fast_pair_data_parser.h"
  5. #include <fuzzer/FuzzedDataProvider.h>
  6. #include <stddef.h>
  7. #include <stdint.h>
  8. #include "ash/quick_pair/common/logging.h"
  9. #include "ash/services/quick_pair/public/mojom/fast_pair_data_parser.mojom.h"
  10. #include "base/callback_helpers.h"
  11. #include "base/command_line.h"
  12. #include "base/no_destructor.h"
  13. #include "base/test/task_environment.h"
  14. #include "base/test/test_timeouts.h"
  15. #include "mojo/core/embedder/embedder.h"
  16. #include "mojo/public/cpp/bindings/remote.h"
  17. namespace {
  18. struct Environment {
  19. Environment()
  20. : task_environment(
  21. (base::CommandLine::Init(0, nullptr),
  22. TestTimeouts::Initialize(),
  23. base::test::TaskEnvironment::MainThreadType::DEFAULT)) {
  24. mojo::core::Init();
  25. // Disable noisy logging for fuzzing.
  26. logging::SetMinLogLevel(logging::LOGGING_FATAL);
  27. // Create instance once to be reused between fuzzing rounds.
  28. parser = std::make_unique<ash::quick_pair::FastPairDataParser>(
  29. remote.BindNewPipeAndPassReceiver());
  30. }
  31. base::test::TaskEnvironment task_environment;
  32. mojo::Remote<ash::quick_pair::mojom::FastPairDataParser> remote;
  33. std::unique_ptr<ash::quick_pair::FastPairDataParser> parser;
  34. ash::quick_pair::ScopedDisableLoggingForTesting disable_logging;
  35. };
  36. } // namespace
  37. extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  38. static base::NoDestructor<Environment> env;
  39. FuzzedDataProvider fuzzed_data(data, size);
  40. // Does not structure the fuzzed data so that we test all possible inputs,
  41. // with the tradeoff that deeper code paths may not be reached.
  42. size_t first_vec_size = fuzzed_data.ConsumeIntegral<uint16_t>();
  43. std::vector<uint8_t> first_vec =
  44. fuzzed_data.ConsumeBytes<uint8_t>(first_vec_size);
  45. std::vector<uint8_t> second_vec =
  46. fuzzed_data.ConsumeRemainingBytes<uint8_t>();
  47. env->parser->GetHexModelIdFromServiceData(first_vec, base::DoNothing());
  48. env->parser->ParseDecryptedResponse(first_vec, second_vec, base::DoNothing());
  49. env->parser->ParseDecryptedPasskey(first_vec, second_vec, base::DoNothing());
  50. std::string second_vec_str =
  51. std::string(second_vec.begin(), second_vec.end());
  52. env->parser->ParseNotDiscoverableAdvertisement(first_vec, second_vec_str,
  53. base::DoNothing());
  54. env->parser->ParseMessageStreamMessages(first_vec, base::DoNothing());
  55. return 0;
  56. }