espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-01 23:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

[fuzz] advance time before fuzz input enable to more services (#8243)

Browse Source
This commit is contained in:
Jonathan Hui
2022-10-06 08:54:00 -07:00
committed by GitHub
parent 4f57b8d461
commit 10de4c4f13
4 changed files with 80 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/fuzz/cli_received.cpp
+20 -12
View File
@@ -26,8 +26,6 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#define MAX_ITERATIONS 100
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@@ -40,9 +38,11 @@
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
static int CliOutput(void *aContext, const char *aFormat, va_list aArguments)
{
@@ -53,6 +53,21 @@ static int CliOutput(void *aContext, const char *aFormat, va_list aArguments)
return vsnprintf(nullptr, 0, aFormat, aArguments);
}
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
const otPanId panId = 0xdead;
@@ -71,8 +86,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
IgnoreError(otThreadSetEnabled(instance, true));
IgnoreError(otThreadBecomeLeader(instance));
buf = static_cast<uint8_t *>(malloc(size + 1));
AdvanceTime(instance, 10000);
buf = static_cast<uint8_t *>(malloc(size + 1));
memcpy(buf, data, size);
buf[size] = '\0';
@@ -80,15 +96,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
VerifyOrExit(!FuzzerPlatformResetWasRequested());
for (int i = 0; i < MAX_ITERATIONS; i++)
{
while (otTaskletsArePending(instance))
{
otTaskletsProcess(instance);
}
FuzzerPlatformProcess(instance);
}
AdvanceTime(instance, 10000);
exit:
tests/fuzz/ip6_send.cpp
+20 -11
View File
@@ -26,8 +26,6 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#define MAX_ITERATIONS 100
#include <stddef.h>
#include <openthread/instance.h>
@@ -38,9 +36,26 @@
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
@@ -62,6 +77,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
otSrpServerSetEnabled(instance, true);
IgnoreError(otThreadBecomeLeader(instance));
AdvanceTime(instance, 10000);
settings.mLinkSecurityEnabled = (data[0] & 0x1) != 0;
settings.mPriority = OT_MESSAGE_PRIORITY_NORMAL;
@@ -77,15 +94,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
VerifyOrExit(!FuzzerPlatformResetWasRequested());
for (int i = 0; i < MAX_ITERATIONS; i++)
{
while (otTaskletsArePending(instance))
{
otTaskletsProcess(instance);
}
FuzzerPlatformProcess(instance);
}
AdvanceTime(instance, 10000);
exit:
tests/fuzz/ncp_hdlc_received.cpp
+20 -13
View File
@@ -26,8 +26,6 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#define MAX_ITERATIONS 100
#include <stdlib.h>
#include <string.h>
@@ -39,9 +37,11 @@
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
static int HdlcSend(const uint8_t *aBuf, uint16_t aBufLength)
{
@@ -51,6 +51,21 @@ static int HdlcSend(const uint8_t *aBuf, uint16_t aBufLength)
return aBufLength;
}
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
const otPanId panId = 0xdead;
@@ -70,23 +85,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
otSrpServerSetEnabled(instance, true);
IgnoreError(otThreadBecomeLeader(instance));
AdvanceTime(instance, 10000);
buf = static_cast<uint8_t *>(malloc(size));
memcpy(buf, data, size);
otNcpHdlcReceive(buf, static_cast<uint16_t>(size));
VerifyOrExit(!FuzzerPlatformResetWasRequested());
for (int i = 0; i < MAX_ITERATIONS; i++)
{
while (otTaskletsArePending(instance))
{
otTaskletsProcess(instance);
}
FuzzerPlatformProcess(instance);
}
AdvanceTime(instance, 10000);
exit:
tests/fuzz/radio_receive_done.cpp
+20 -13
View File
@@ -26,8 +26,6 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#define MAX_ITERATIONS 100
#include <stdlib.h>
#include <string.h>
@@ -37,10 +35,27 @@
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include <openthread/platform/radio.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
@@ -60,28 +75,20 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
IgnoreError(otThreadSetEnabled(instance, true));
IgnoreError(otThreadBecomeLeader(instance));
buf = static_cast<uint8_t *>(malloc(size));
AdvanceTime(instance, 10000);
buf = static_cast<uint8_t *>(malloc(size));
memset(&frame, 0, sizeof(frame));
frame.mPsdu = buf;
frame.mChannel = 11;
frame.mLength = static_cast<uint8_t>(size);
memcpy(buf, data, frame.mLength);
otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE);
VerifyOrExit(!FuzzerPlatformResetWasRequested());
for (int i = 0; i < MAX_ITERATIONS; i++)
{
while (otTaskletsArePending(instance))
{
otTaskletsProcess(instance);
}
FuzzerPlatformProcess(instance);
}
AdvanceTime(instance, 10000);
exit: