diff --git a/tests/fuzz/cli_received.cpp b/tests/fuzz/cli_received.cpp index 2dcbbd8ee..aa532925c 100644 --- a/tests/fuzz/cli_received.cpp +++ b/tests/fuzz/cli_received.cpp @@ -26,8 +26,6 @@ * POSSIBILITY OF SUCH DAMAGE. */ -#define MAX_ITERATIONS 100 - #include #include #include @@ -40,9 +38,11 @@ #include #include #include +#include #include "fuzzer_platform.h" #include "common/code_utils.hpp" +#include "common/time.hpp" static int CliOutput(void *aContext, const char *aFormat, va_list aArguments) { @@ -53,6 +53,21 @@ static int CliOutput(void *aContext, const char *aFormat, va_list aArguments) return vsnprintf(nullptr, 0, aFormat, aArguments); } +void AdvanceTime(otInstance *aInstance, uint32_t aDuration) +{ + uint32_t time = otPlatAlarmMilliGetNow() + aDuration; + + while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) + { + while (otTaskletsArePending(aInstance)) + { + otTaskletsProcess(aInstance); + } + + FuzzerPlatformProcess(aInstance); + } +} + extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; @@ -71,8 +86,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) IgnoreError(otThreadSetEnabled(instance, true)); IgnoreError(otThreadBecomeLeader(instance)); - buf = static_cast(malloc(size + 1)); + AdvanceTime(instance, 10000); + buf = static_cast(malloc(size + 1)); memcpy(buf, data, size); buf[size] = '\0'; @@ -80,15 +96,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) VerifyOrExit(!FuzzerPlatformResetWasRequested()); - for (int i = 0; i < MAX_ITERATIONS; i++) - { - while (otTaskletsArePending(instance)) - { - otTaskletsProcess(instance); - } - - FuzzerPlatformProcess(instance); - } + AdvanceTime(instance, 10000); exit: diff --git a/tests/fuzz/ip6_send.cpp b/tests/fuzz/ip6_send.cpp index df267fa22..9dfcc9d8f 100644 --- a/tests/fuzz/ip6_send.cpp +++ b/tests/fuzz/ip6_send.cpp @@ -26,8 +26,6 @@ * POSSIBILITY OF SUCH DAMAGE. */ -#define MAX_ITERATIONS 100 - #include #include @@ -38,9 +36,26 @@ #include #include #include +#include #include "fuzzer_platform.h" #include "common/code_utils.hpp" +#include "common/time.hpp" + +void AdvanceTime(otInstance *aInstance, uint32_t aDuration) +{ + uint32_t time = otPlatAlarmMilliGetNow() + aDuration; + + while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) + { + while (otTaskletsArePending(aInstance)) + { + otTaskletsProcess(aInstance); + } + + FuzzerPlatformProcess(aInstance); + } +} extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { @@ -62,6 +77,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) otSrpServerSetEnabled(instance, true); IgnoreError(otThreadBecomeLeader(instance)); + AdvanceTime(instance, 10000); + settings.mLinkSecurityEnabled = (data[0] & 0x1) != 0; settings.mPriority = OT_MESSAGE_PRIORITY_NORMAL; @@ -77,15 +94,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) VerifyOrExit(!FuzzerPlatformResetWasRequested()); - for (int i = 0; i < MAX_ITERATIONS; i++) - { - while (otTaskletsArePending(instance)) - { - otTaskletsProcess(instance); - } - - FuzzerPlatformProcess(instance); - } + AdvanceTime(instance, 10000); exit: diff --git a/tests/fuzz/ncp_hdlc_received.cpp b/tests/fuzz/ncp_hdlc_received.cpp index d60155e4b..129623abf 100644 --- a/tests/fuzz/ncp_hdlc_received.cpp +++ b/tests/fuzz/ncp_hdlc_received.cpp @@ -26,8 +26,6 @@ * POSSIBILITY OF SUCH DAMAGE. */ -#define MAX_ITERATIONS 100 - #include #include @@ -39,9 +37,11 @@ #include #include #include +#include #include "fuzzer_platform.h" #include "common/code_utils.hpp" +#include "common/time.hpp" static int HdlcSend(const uint8_t *aBuf, uint16_t aBufLength) { @@ -51,6 +51,21 @@ static int HdlcSend(const uint8_t *aBuf, uint16_t aBufLength) return aBufLength; } +void AdvanceTime(otInstance *aInstance, uint32_t aDuration) +{ + uint32_t time = otPlatAlarmMilliGetNow() + aDuration; + + while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) + { + while (otTaskletsArePending(aInstance)) + { + otTaskletsProcess(aInstance); + } + + FuzzerPlatformProcess(aInstance); + } +} + extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; @@ -70,23 +85,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) otSrpServerSetEnabled(instance, true); IgnoreError(otThreadBecomeLeader(instance)); + AdvanceTime(instance, 10000); + buf = static_cast(malloc(size)); - memcpy(buf, data, size); - otNcpHdlcReceive(buf, static_cast(size)); VerifyOrExit(!FuzzerPlatformResetWasRequested()); - for (int i = 0; i < MAX_ITERATIONS; i++) - { - while (otTaskletsArePending(instance)) - { - otTaskletsProcess(instance); - } - - FuzzerPlatformProcess(instance); - } + AdvanceTime(instance, 10000); exit: diff --git a/tests/fuzz/radio_receive_done.cpp b/tests/fuzz/radio_receive_done.cpp index d30b4aef7..6878ff370 100644 --- a/tests/fuzz/radio_receive_done.cpp +++ b/tests/fuzz/radio_receive_done.cpp @@ -26,8 +26,6 @@ * POSSIBILITY OF SUCH DAMAGE. */ -#define MAX_ITERATIONS 100 - #include #include @@ -37,10 +35,27 @@ #include #include #include +#include #include #include "fuzzer_platform.h" #include "common/code_utils.hpp" +#include "common/time.hpp" + +void AdvanceTime(otInstance *aInstance, uint32_t aDuration) +{ + uint32_t time = otPlatAlarmMilliGetNow() + aDuration; + + while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) + { + while (otTaskletsArePending(aInstance)) + { + otTaskletsProcess(aInstance); + } + + FuzzerPlatformProcess(aInstance); + } +} extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { @@ -60,28 +75,20 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) IgnoreError(otThreadSetEnabled(instance, true)); IgnoreError(otThreadBecomeLeader(instance)); - buf = static_cast(malloc(size)); + AdvanceTime(instance, 10000); + buf = static_cast(malloc(size)); memset(&frame, 0, sizeof(frame)); frame.mPsdu = buf; frame.mChannel = 11; frame.mLength = static_cast(size); - memcpy(buf, data, frame.mLength); otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE); VerifyOrExit(!FuzzerPlatformResetWasRequested()); - for (int i = 0; i < MAX_ITERATIONS; i++) - { - while (otTaskletsArePending(instance)) - { - otTaskletsProcess(instance); - } - - FuzzerPlatformProcess(instance); - } + AdvanceTime(instance, 10000); exit: