espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-12 05:37:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[fuzz] migrate fuzz framework to nexus platform (#11538)

Browse Source
This commit is contained in:
Jonathan Hui
2025-05-28 18:32:04 -07:00
committed by GitHub
parent 1798f3b61c
commit 6d40977782
13 changed files with 179 additions and 1274 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/fuzz/CMakeLists.txt
+25 -75
View File
@@ -1,5 +1,5 @@
#
# Copyright (c) 2021, The OpenThread Authors.
# Copyright (c) 2025, The OpenThread Authors.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -28,105 +28,55 @@
set(COMMON_INCLUDES
${PROJECT_SOURCE_DIR}/include
${PROJECT_SOURCE_DIR}/src
${PROJECT_SOURCE_DIR}/src/core
${PROJECT_SOURCE_DIR}/tests/nexus
)
set(COMMON_COMPILE_OPTIONS
-DOPENTHREAD_FTD=1
-DOPENTHREAD_MTD=0
-DOPENTHREAD_RADIO=0
-DOPENTHREAD_SPINEL_CONFIG_OPENTHREAD_MESSAGE_ENABLE=1
)
set(COMMON_SOURCES
fuzzer_platform.cpp
)
set(COMMON_LIBS
openthread-ftd
ot-nexus-platform
${OT_MBEDTLS}
$ENV{LIB_FUZZING_ENGINE}
ot-config
)
add_executable(ot-cli-received-fuzzer
cli_received.cpp
${COMMON_SOURCES}
)
#----------------------------------------------------------------------------------------------------------------------
target_compile_options(ot-cli-received-fuzzer
PRIVATE
${COMMON_COMPILE_OPTIONS}
)
macro(ot_nexus_test name)
target_include_directories(ot-cli-received-fuzzer
# Macro to add an OpenThread nexus test.
#
# Nexus test name will be `nexus_{name}`. Test source file of
# `test_{name}.cpp` is used. Optional extra arguments can be
# passed to provide additional source files.
add_executable(${name}-fuzzer
${name}.cpp ${ARGN}
)
target_include_directories(${name}-fuzzer
PRIVATE
${COMMON_INCLUDES}
)
)
target_link_libraries(ot-cli-received-fuzzer
target_link_libraries(${name}-fuzzer
PRIVATE
openthread-cli-ftd
${COMMON_LIBS}
)
)
add_executable(ot-ip6-send-fuzzer
ip6_send.cpp
${COMMON_SOURCES}
)
target_compile_options(ot-ip6-send-fuzzer
target_compile_options(${name}-fuzzer
PRIVATE
${COMMON_COMPILE_OPTIONS}
)
)
endmacro()
target_include_directories(ot-ip6-send-fuzzer
PRIVATE
${COMMON_INCLUDES}
)
#----------------------------------------------------------------------------------------------------------------------
target_link_libraries(ot-ip6-send-fuzzer
PRIVATE
${COMMON_LIBS}
)
add_executable(ot-radio-receive-done-fuzzer
radio_receive_done.cpp
${COMMON_SOURCES}
)
target_compile_options(ot-radio-receive-done-fuzzer
PRIVATE
${COMMON_COMPILE_OPTIONS}
)
target_include_directories(ot-radio-receive-done-fuzzer
PRIVATE
${COMMON_INCLUDES}
)
target_link_libraries(ot-radio-receive-done-fuzzer
PRIVATE
${COMMON_LIBS}
)
add_executable(ot-ncp-hdlc-received-fuzzer
ncp_hdlc_received.cpp
${COMMON_SOURCES}
)
target_compile_options(ot-ncp-hdlc-received-fuzzer
PRIVATE
${COMMON_COMPILE_OPTIONS}
)
target_include_directories(ot-ncp-hdlc-received-fuzzer
PRIVATE
${COMMON_INCLUDES}
)
target_link_libraries(ot-ncp-hdlc-received-fuzzer
PRIVATE
openthread-ncp-ftd
${COMMON_LIBS}
)
ot_nexus_test(radio-one-node)
tests/fuzz/cli_received.cpp
-114
View File
@@ -1,114 +0,0 @@
/*
* Copyright (c) 2019, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openthread/cli.h>
#include <openthread/instance.h>
#include <openthread/ip6.h>
#include <openthread/link.h>
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
static int CliOutput(void *aContext, const char *aFormat, va_list aArguments)
{
OT_UNUSED_VARIABLE(aContext);
OT_UNUSED_VARIABLE(aFormat);
OT_UNUSED_VARIABLE(aArguments);
return vsnprintf(nullptr, 0, aFormat, aArguments);
}
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
const otPanId panId = 0xdead;
otInstance *instance = nullptr;
uint8_t *buf = nullptr;
VerifyOrExit(size <= 65536);
FuzzerPlatformInit();
instance = otInstanceInitSingle();
otCliInit(instance, CliOutput, nullptr);
IgnoreError(otLinkSetPanId(instance, panId));
IgnoreError(otIp6SetEnabled(instance, true));
IgnoreError(otThreadSetEnabled(instance, true));
IgnoreError(otThreadBecomeLeader(instance));
AdvanceTime(instance, 10000);
buf = static_cast<uint8_t *>(malloc(size + 1));
memcpy(buf, data, size);
buf[size] = '\0';
otCliInputLine(reinterpret_cast<char *>(buf));
VerifyOrExit(!FuzzerPlatformResetWasRequested());
AdvanceTime(instance, 10000);
exit:
if (buf != nullptr)
{
free(buf);
}
if (instance != nullptr)
{
otInstanceFinalize(instance);
}
return 0;
}
tests/fuzz/corpora/radio-receive-done/mle-parent-request
BIN
View File
Binary file not shown.
tests/fuzz/fuzzer_platform.cpp
-670
View File
@@ -1,670 +0,0 @@
/*
* Copyright (c) 2017, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include "openthread-core-config.h"
#include "fuzzer_platform.h"
#include <string.h>
#include <openthread/platform/alarm-micro.h>
#include <openthread/platform/alarm-milli.h>
#include <openthread/platform/diag.h>
#include <openthread/platform/dnssd.h>
#include <openthread/platform/entropy.h>
#include <openthread/platform/logging.h>
#include <openthread/platform/mdns_socket.h>
#include <openthread/platform/misc.h>
#include <openthread/platform/multipan.h>
#include <openthread/platform/radio.h>
#include <openthread/platform/settings.h>
#include "mac/mac_frame.hpp"
#include "openthread/error.h"
using namespace ot;
typedef struct AlarmState
{
uint32_t fire;
bool isRunning;
} AlarmState;
enum
{
IEEE802154_ACK_LENGTH = 5,
IEEE802154_FRAME_TYPE_ACK = 2 << 0,
};
static uint32_t sAlarmNow;
static AlarmState sAlarmMilli;
static AlarmState sAlarmMicro;
static uint32_t sRandomState = 1;
static uint8_t sRadioTransmitPsdu[OT_RADIO_FRAME_MAX_SIZE];
static otRadioFrame sRadioTransmitFrame;
static uint8_t sRadioAckPsdu[OT_RADIO_FRAME_MAX_SIZE];
static otRadioFrame sRadioAckFrame;
static bool sResetWasRequested = false;
static otRadioState sRadioState = OT_RADIO_STATE_DISABLED;
bool otMacFrameIsAckRequested(const otRadioFrame *aFrame)
{
return static_cast<const Mac::Frame *>(aFrame)->GetAckRequest();
}
otError otMacFrameGetSequence(const otRadioFrame *aFrame, uint8_t *aSequence)
{
otError error;
if (static_cast<const Mac::Frame *>(aFrame)->IsSequencePresent())
{
*aSequence = static_cast<const Mac::Frame *>(aFrame)->GetSequence();
error = kErrorNone;
}
else
{
error = kErrorParse;
}
return error;
}
void FuzzerPlatformInit(void)
{
sRandomState = 1;
sAlarmNow = 0;
memset(&sAlarmMilli, 0, sizeof(sAlarmMilli));
memset(&sAlarmMicro, 0, sizeof(sAlarmMicro));
sRadioTransmitFrame.mPsdu = sRadioTransmitPsdu;
sRadioAckFrame.mPsdu = sRadioAckPsdu;
}
void FuzzerPlatformProcess(otInstance *aInstance)
{
if (sRadioState == OT_RADIO_STATE_TRANSMIT)
{
sRadioState = OT_RADIO_STATE_RECEIVE;
if (otMacFrameIsAckRequested(&sRadioTransmitFrame))
{
otError error;
sRadioAckFrame.mLength = IEEE802154_ACK_LENGTH;
sRadioAckFrame.mPsdu[0] = IEEE802154_FRAME_TYPE_ACK;
sRadioAckFrame.mPsdu[1] = 0;
sRadioAckFrame.mChannel = sRadioTransmitFrame.mChannel;
error = otMacFrameGetSequence(&sRadioTransmitFrame, &sRadioAckFrame.mPsdu[2]);
if (error == OT_ERROR_NONE)
{
otPlatRadioTxDone(aInstance, &sRadioTransmitFrame, &sRadioAckFrame, OT_ERROR_NONE);
}
else
{
otPlatRadioTxDone(aInstance, &sRadioTransmitFrame, nullptr, OT_ERROR_NO_ACK);
}
}
else
{
otPlatRadioTxDone(aInstance, &sRadioTransmitFrame, nullptr, OT_ERROR_NONE);
}
}
if (sAlarmMilli.isRunning || sAlarmMicro.isRunning)
{
uint32_t fire = UINT32_MAX;
if (sAlarmMilli.isRunning && fire > sAlarmMilli.fire)
{
fire = sAlarmMilli.fire;
}
if (sAlarmMicro.isRunning && fire > sAlarmMicro.fire)
{
fire = sAlarmMicro.fire;
}
sAlarmNow = fire;
if (sAlarmMilli.isRunning && sAlarmNow >= sAlarmMilli.fire)
{
sAlarmMilli.isRunning = false;
otPlatAlarmMilliFired(aInstance);
}
#if OPENTHREAD_CONFIG_PLATFORM_USEC_TIMER_ENABLE
if (sAlarmMicro.isRunning && sAlarmNow >= sAlarmMicro.fire)
{
sAlarmMicro.isRunning = false;
otPlatAlarmMicroFired(aInstance);
}
#endif
}
}
bool FuzzerPlatformResetWasRequested(void) { return sResetWasRequested; }
extern "C" {
uint32_t otPlatAlarmMilliGetNow(void) { return sAlarmNow / 1000; }
void otPlatAlarmMilliStartAt(otInstance *aInstance, uint32_t aT0, uint32_t aDt)
{
OT_UNUSED_VARIABLE(aInstance);
sAlarmMilli.fire = (aT0 + aDt) * 1000;
sAlarmMilli.isRunning = true;
}
void otPlatAlarmMilliStop(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
sAlarmMilli.isRunning = false;
}
uint32_t otPlatAlarmMicroGetNow(void) { return sAlarmNow; }
void otPlatAlarmMicroStartAt(otInstance *aInstance, uint32_t aT0, uint32_t aDt)
{
OT_UNUSED_VARIABLE(aInstance);
sAlarmMicro.fire = aT0 + aDt;
sAlarmMicro.isRunning = true;
}
void otPlatAlarmMicroStop(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
sAlarmMicro.isRunning = false;
}
bool otDiagIsEnabled(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return false;
}
otError otDiagProcessCmd(otInstance *aInstance, uint8_t aArgsLength, char *aArgs[], char *aOutput, size_t aOutputMaxLen)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aArgsLength);
OT_UNUSED_VARIABLE(aArgs);
OT_UNUSED_VARIABLE(aOutput);
OT_UNUSED_VARIABLE(aOutputMaxLen);
return OT_ERROR_NOT_IMPLEMENTED;
}
otError otDiagProcessCmdLine(otInstance *aInstance, const char *aString, char *aOutput, size_t aOutputMaxLen)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aString);
OT_UNUSED_VARIABLE(aOutput);
OT_UNUSED_VARIABLE(aOutputMaxLen);
return OT_ERROR_NOT_IMPLEMENTED;
}
void otPlatReset(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
sResetWasRequested = true;
}
otPlatResetReason otPlatGetResetReason(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return OT_PLAT_RESET_REASON_POWER_ON;
}
OT_TOOL_WEAK void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, ...)
{
OT_UNUSED_VARIABLE(aLogLevel);
OT_UNUSED_VARIABLE(aLogRegion);
OT_UNUSED_VARIABLE(aFormat);
}
void otPlatWakeHost(void) {}
otError otPlatMultipanGetActiveInstance(otInstance **) { return OT_ERROR_NOT_IMPLEMENTED; }
otError otPlatMultipanSetActiveInstance(otInstance *, bool) { return OT_ERROR_NOT_IMPLEMENTED; }
void otPlatRadioGetIeeeEui64(otInstance *aInstance, uint8_t *aIeeeEui64)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aIeeeEui64);
}
void otPlatRadioSetPanId(otInstance *aInstance, uint16_t aPanId)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aPanId);
}
void otPlatRadioSetExtendedAddress(otInstance *aInstance, const otExtAddress *aExtAddr)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aExtAddr);
}
void otPlatRadioSetShortAddress(otInstance *aInstance, uint16_t aShortAddress)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aShortAddress);
}
void otPlatRadioSetPromiscuous(otInstance *aInstance, bool aEnabled)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aEnabled);
}
void otPlatRadioSetRxOnWhenIdle(otInstance *aInstance, bool aEnabled)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aEnabled);
}
bool otPlatRadioIsEnabled(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return true;
}
otError otPlatRadioEnable(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
sRadioState = OT_RADIO_STATE_SLEEP;
return OT_ERROR_NONE;
}
otError otPlatRadioDisable(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
sRadioState = OT_RADIO_STATE_DISABLED;
return OT_ERROR_NONE;
}
otError otPlatRadioSleep(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
sRadioState = OT_RADIO_STATE_SLEEP;
return OT_ERROR_NONE;
}
otError otPlatRadioReceive(otInstance *aInstance, uint8_t aChannel)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aChannel);
sRadioState = OT_RADIO_STATE_RECEIVE;
return OT_ERROR_NONE;
}
otError otPlatRadioTransmit(otInstance *aInstance, otRadioFrame *aFrame)
{
sRadioState = OT_RADIO_STATE_TRANSMIT;
otPlatRadioTxStarted(aInstance, aFrame);
return OT_ERROR_NONE;
}
otError otPlatRadioGetTransmitPower(otInstance *aInstance, int8_t *aPower)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aPower);
return OT_ERROR_NONE;
}
otRadioFrame *otPlatRadioGetTransmitBuffer(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return &sRadioTransmitFrame;
}
int8_t otPlatRadioGetRssi(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return 0;
}
otRadioCaps otPlatRadioGetCaps(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return OT_RADIO_CAPS_NONE;
}
bool otPlatRadioGetPromiscuous(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return false;
}
void otPlatRadioEnableSrcMatch(otInstance *aInstance, bool aEnable)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aEnable);
}
otError otPlatRadioAddSrcMatchShortEntry(otInstance *aInstance, uint16_t aShortAddress)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aShortAddress);
return OT_ERROR_NONE;
}
otError otPlatRadioAddSrcMatchExtEntry(otInstance *aInstance, const otExtAddress *aExtAddress)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aExtAddress);
return OT_ERROR_NONE;
}
otError otPlatRadioClearSrcMatchShortEntry(otInstance *aInstance, uint16_t aShortAddress)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aShortAddress);
return OT_ERROR_NONE;
}
otError otPlatRadioClearSrcMatchExtEntry(otInstance *aInstance, const otExtAddress *aExtAddress)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aExtAddress);
return OT_ERROR_NONE;
}
void otPlatRadioClearSrcMatchShortEntries(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); }
void otPlatRadioClearSrcMatchExtEntries(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); }
otError otPlatRadioEnergyScan(otInstance *aInstance, uint8_t aScanChannel, uint16_t aScanDuration)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aScanChannel);
OT_UNUSED_VARIABLE(aScanDuration);
return OT_ERROR_NOT_IMPLEMENTED;
}
otError otPlatRadioSetTransmitPower(otInstance *aInstance, int8_t aPower)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aPower);
return OT_ERROR_NOT_IMPLEMENTED;
}
otError otPlatRadioGetCcaEnergyDetectThreshold(otInstance *aInstance, int8_t *aThreshold)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aThreshold);
return OT_ERROR_NOT_IMPLEMENTED;
}
otError otPlatRadioSetCcaEnergyDetectThreshold(otInstance *aInstance, int8_t aThreshold)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aThreshold);
return OT_ERROR_NOT_IMPLEMENTED;
}
int8_t otPlatRadioGetReceiveSensitivity(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return 0;
}
otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength)
{
for (uint16_t length = 0; length < aOutputLength; length++)
{
aOutput[length] = (uint8_t)rand();
}
return OT_ERROR_NONE;
}
void otPlatSettingsInit(otInstance *aInstance, const uint16_t *aSensitiveKeys, uint16_t aSensitiveKeysLength)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aSensitiveKeys);
OT_UNUSED_VARIABLE(aSensitiveKeysLength);
}
void otPlatSettingsDeinit(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); }
otError otPlatSettingsGet(otInstance *aInstance, uint16_t aKey, int aIndex, uint8_t *aValue, uint16_t *aValueLength)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aKey);
OT_UNUSED_VARIABLE(aIndex);
OT_UNUSED_VARIABLE(aValue);
OT_UNUSED_VARIABLE(aValueLength);
return OT_ERROR_NOT_FOUND;
}
otError otPlatSettingsSet(otInstance *aInstance, uint16_t aKey, const uint8_t *aValue, uint16_t aValueLength)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aKey);
OT_UNUSED_VARIABLE(aValue);
OT_UNUSED_VARIABLE(aValueLength);
return OT_ERROR_NONE;
}
otError otPlatSettingsAdd(otInstance *aInstance, uint16_t aKey, const uint8_t *aValue, uint16_t aValueLength)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aKey);
OT_UNUSED_VARIABLE(aValue);
OT_UNUSED_VARIABLE(aValueLength);
return OT_ERROR_NONE;
}
otError otPlatSettingsDelete(otInstance *aInstance, uint16_t aKey, int aIndex)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aKey);
OT_UNUSED_VARIABLE(aIndex);
return OT_ERROR_NONE;
}
void otPlatSettingsWipe(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); }
void otPlatDiagSetOutputCallback(otInstance *aInstance, otPlatDiagOutputCallback aCallback, void *aContext)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aCallback);
OT_UNUSED_VARIABLE(aContext);
}
otError otPlatDiagProcess(otInstance *aInstance, uint8_t aArgsLength, char *aArgs[])
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aArgsLength);
OT_UNUSED_VARIABLE(aArgs);
return OT_ERROR_INVALID_COMMAND;
}
void otPlatDiagModeSet(bool aMode) { OT_UNUSED_VARIABLE(aMode); }
bool otPlatDiagModeGet(void) { return false; }
void otPlatDiagChannelSet(uint8_t aChannel) { OT_UNUSED_VARIABLE(aChannel); }
void otPlatDiagTxPowerSet(int8_t aTxPower) { OT_UNUSED_VARIABLE(aTxPower); }
void otPlatDiagRadioReceived(otInstance *aInstance, otRadioFrame *aFrame, otError aError)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aFrame);
OT_UNUSED_VARIABLE(aError);
}
void otPlatDiagAlarmCallback(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); }
otPlatDnssdState otPlatDnssdGetState(otInstance *aInstance)
{
OT_UNUSED_VARIABLE(aInstance);
return OT_PLAT_DNSSD_STOPPED;
}
void otPlatDnssdRegisterService(otInstance *aInstance,
const otPlatDnssdService *aService,
otPlatDnssdRequestId aRequestId,
otPlatDnssdRegisterCallback aCallback)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aService);
OT_UNUSED_VARIABLE(aRequestId);
OT_UNUSED_VARIABLE(aCallback);
}
void otPlatDnssdUnregisterService(otInstance *aInstance,
const otPlatDnssdService *aService,
otPlatDnssdRequestId aRequestId,
otPlatDnssdRegisterCallback aCallback)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aService);
OT_UNUSED_VARIABLE(aRequestId);
OT_UNUSED_VARIABLE(aCallback);
}
void otPlatDnssdRegisterHost(otInstance *aInstance,
const otPlatDnssdHost *aHost,
otPlatDnssdRequestId aRequestId,
otPlatDnssdRegisterCallback aCallback)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aHost);
OT_UNUSED_VARIABLE(aRequestId);
OT_UNUSED_VARIABLE(aCallback);
}
void otPlatDnssdUnregisterHost(otInstance *aInstance,
const otPlatDnssdHost *aHost,
otPlatDnssdRequestId aRequestId,
otPlatDnssdRegisterCallback aCallback)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aHost);
OT_UNUSED_VARIABLE(aRequestId);
OT_UNUSED_VARIABLE(aCallback);
}
void otPlatDnssdRegisterKey(otInstance *aInstance,
const otPlatDnssdKey *aKey,
otPlatDnssdRequestId aRequestId,
otPlatDnssdRegisterCallback aCallback)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aKey);
OT_UNUSED_VARIABLE(aRequestId);
OT_UNUSED_VARIABLE(aCallback);
}
void otPlatDnssdUnregisterKey(otInstance *aInstance,
const otPlatDnssdKey *aKey,
otPlatDnssdRequestId aRequestId,
otPlatDnssdRegisterCallback aCallback)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aKey);
OT_UNUSED_VARIABLE(aRequestId);
OT_UNUSED_VARIABLE(aCallback);
}
otError otPlatMdnsSetListeningEnabled(otInstance *aInstance, bool aEnable, uint32_t aInfraIfIndex)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aEnable);
OT_UNUSED_VARIABLE(aInfraIfIndex);
return OT_ERROR_NOT_IMPLEMENTED;
}
void otPlatMdnsSendMulticast(otInstance *aInstance, otMessage *aMessage, uint32_t aInfraIfIndex)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aMessage);
OT_UNUSED_VARIABLE(aInfraIfIndex);
}
void otPlatMdnsSendUnicast(otInstance *aInstance, otMessage *aMessage, const otPlatMdnsAddressInfo *aAddress)
{
OT_UNUSED_VARIABLE(aInstance);
OT_UNUSED_VARIABLE(aMessage);
OT_UNUSED_VARIABLE(aAddress);
}
bool otPlatInfraIfHasAddress(uint32_t aInfraIfIndex, const otIp6Address *aAddress)
{
OT_UNUSED_VARIABLE(aInfraIfIndex);
OT_UNUSED_VARIABLE(aAddress);
return false;
}
otError otPlatInfraIfSendIcmp6Nd(uint32_t aInfraIfIndex,
const otIp6Address *aDestAddress,
const uint8_t *aBuffer,
uint16_t aBufferLength)
{
OT_UNUSED_VARIABLE(aInfraIfIndex);
OT_UNUSED_VARIABLE(aDestAddress);
OT_UNUSED_VARIABLE(aBuffer);
OT_UNUSED_VARIABLE(aBufferLength);
return OT_ERROR_FAILED;
}
otError otPlatInfraIfDiscoverNat64Prefix(uint32_t aInfraIfIndex)
{
OT_UNUSED_VARIABLE(aInfraIfIndex);
return OT_ERROR_FAILED;
}
} // extern "C"
tests/fuzz/fuzzer_platform.h
-46
View File
@@ -1,46 +0,0 @@
/*
* Copyright (c) 2019, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef FUZZER_PLATFORM_H_
#define FUZZER_PLATFORM_H_
#include <openthread/instance.h>
#ifdef __cplusplus
extern "C" {
#endif
void FuzzerPlatformInit(void);
void FuzzerPlatformProcess(otInstance *aInstance);
bool FuzzerPlatformResetWasRequested(void);
#ifdef __cplusplus
} // extern "C"
#endif
#endif // FUZZER_PLATFORM_H_
tests/fuzz/ip6_send.cpp
-112
View File
@@ -1,112 +0,0 @@
/*
* Copyright (c) 2017, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <stddef.h>
#include <openthread/instance.h>
#include <openthread/ip6.h>
#include <openthread/link.h>
#include <openthread/message.h>
#include <openthread/srp_server.h>
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
const otPanId panId = 0xdead;
otInstance *instance = nullptr;
otMessage *message = nullptr;
otError error = OT_ERROR_NONE;
otMessageSettings settings;
VerifyOrExit(size > 0);
FuzzerPlatformInit();
instance = otInstanceInitSingle();
IgnoreError(otLinkSetPanId(instance, panId));
IgnoreError(otIp6SetEnabled(instance, true));
IgnoreError(otThreadSetEnabled(instance, true));
otSrpServerSetEnabled(instance, true);
IgnoreError(otThreadBecomeLeader(instance));
AdvanceTime(instance, 10000);
settings.mLinkSecurityEnabled = (data[0] & 0x1) != 0;
settings.mPriority = OT_MESSAGE_PRIORITY_NORMAL;
message = otIp6NewMessage(instance, &settings);
VerifyOrExit(message != nullptr, error = OT_ERROR_NO_BUFS);
error = otMessageAppend(message, data + 1, static_cast<uint16_t>(size - 1));
SuccessOrExit(error);
error = otIp6Send(instance, message);
message = nullptr;
VerifyOrExit(!FuzzerPlatformResetWasRequested());
AdvanceTime(instance, 10000);
exit:
if (message != nullptr)
{
otMessageFree(message);
}
if (instance != nullptr)
{
otInstanceFinalize(instance);
}
return 0;
}
tests/fuzz/ncp_hdlc_received.cpp
-111
View File
@@ -1,111 +0,0 @@
/*
* Copyright (c) 2018, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdlib.h>
#include <string.h>
#include <openthread/instance.h>
#include <openthread/ip6.h>
#include <openthread/link.h>
#include <openthread/ncp.h>
#include <openthread/srp_server.h>
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
static int HdlcSend(const uint8_t *aBuf, uint16_t aBufLength)
{
OT_UNUSED_VARIABLE(aBuf);
OT_UNUSED_VARIABLE(aBufLength);
return aBufLength;
}
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
const otPanId panId = 0xdead;
otInstance *instance = nullptr;
uint8_t *buf = nullptr;
VerifyOrExit(size <= 65536);
FuzzerPlatformInit();
instance = otInstanceInitSingle();
otNcpHdlcInit(instance, HdlcSend);
IgnoreError(otLinkSetPanId(instance, panId));
IgnoreError(otIp6SetEnabled(instance, true));
IgnoreError(otThreadSetEnabled(instance, true));
otSrpServerSetEnabled(instance, true);
IgnoreError(otThreadBecomeLeader(instance));
AdvanceTime(instance, 10000);
buf = static_cast<uint8_t *>(malloc(size));
memcpy(buf, data, size);
otNcpHdlcReceive(buf, static_cast<uint16_t>(size));
VerifyOrExit(!FuzzerPlatformResetWasRequested());
AdvanceTime(instance, 10000);
exit:
if (buf != nullptr)
{
free(buf);
}
if (instance != nullptr)
{
otInstanceFinalize(instance);
}
return 0;
}
tests/fuzz/oss-fuzz-build
+8 -40
View File
@@ -36,47 +36,15 @@ set -euxo pipefail
cmake -GNinja \
-DCMAKE_C_FLAGS="${CFLAGS}" \
-DCMAKE_CXX_FLAGS="${CXXFLAGS}" \
-DBUILD_TESTING=OFF \
-DOT_BUILD_EXECUTABLES=OFF \
-DOT_COMPILE_WARNING_AS_ERROR=ON \
-DOT_FUZZ_TARGETS=ON \
-DOT_MTD=OFF \
-DOT_PLATFORM=external \
-DOT_RCP=OFF \
-DOT_BORDER_AGENT=ON \
-DOT_BORDER_ROUTER=ON \
-DOT_BORDER_ROUTING=ON \
-DOT_CHANNEL_MANAGER=ON \
-DOT_CHANNEL_MONITOR=ON \
-DOT_COAP=ON \
-DOT_COAPS=ON \
-DOT_COAP_BLOCK=ON \
-DOT_COAP_OBSERVE=ON \
-DOT_COMMISSIONER=ON \
-DOT_DATASET_UPDATER=ON \
-DOT_DHCP6_CLIENT=ON \
-DOT_DHCP6_SERVER=ON \
-DOT_DNS_CLIENT=ON \
-DOT_DNSSD_SERVER=ON \
-DOT_ECDSA=ON \
-DOT_HISTORY_TRACKER=ON \
-DOT_IP6_FRAGM=ON \
-DOT_JAM_DETECTION=ON \
-DOT_JOINER=ON \
-DOT_LINK_RAW=ON \
-DOT_LOG_OUTPUT=APP \
-DOT_MAC_FILTER=ON \
-DOT_MDNS=ON \
-DOT_NETDATA_PUBLISHER=ON \
-DOT_NETDIAG_CLIENT=ON \
-DOT_PING_SENDER=ON \
-DOT_SERVICE=ON \
-DOT_SLAAC=ON \
-DOT_SNTP_CLIENT=ON \
-DOT_SRP_ADV_PROXY=ON \
-DOT_SRP_CLIENT=ON \
-DOT_SRP_SERVER=ON \
-DOT_THREAD_VERSION=1.3 \
-DOT_UPTIME=ON \
-DOT_MULTIPLE_INSTANCE=ON \
-DOT_PLATFORM=nexus \
-DOT_THREAD_VERSION=1.4 \
-DOT_APP_CLI=OFF \
-DOT_APP_NCP=OFF \
-DOT_APP_RCP=OFF \
-DOT_PROJECT_CONFIG=../tests/nexus/openthread-core-nexus-config.h \
..
ninja
)
tests/fuzz/ot_fuzz_framework.cpp
View File
tests/fuzz/ot_fuzz_framework.h
View File
tests/fuzz/radio-one-node.cpp
+137
View File
@@ -0,0 +1,137 @@
/*
* Copyright (c) 2025, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "platform/nexus_core.hpp"
#include "platform/nexus_node.hpp"
namespace ot {
namespace Nexus {
class FuzzDataProvider
{
public:
FuzzDataProvider(const uint8_t *aData, size_t aSize)
: mData(aData)
, mSize(aSize)
{
}
void ConsumeData(void *aBuf, size_t aLength)
{
assert(aLength <= mSize);
memcpy(aBuf, mData, aLength);
mData += aLength;
mSize -= aLength;
}
uint8_t *ConsumeRemainingBytes(void)
{
uint8_t *buf = static_cast<uint8_t *>(malloc(mSize));
memcpy(buf, mData, mSize);
mSize = 0;
return buf;
}
size_t RemainingBytes(void) { return mSize; }
private:
const uint8_t *mData;
size_t mSize;
};
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
FuzzDataProvider fdp(data, size);
unsigned int seed;
otRadioFrame frame;
otError error;
if (size < sizeof(seed) + sizeof(error) + sizeof(frame))
{
return 0;
}
if (size > sizeof(seed) + sizeof(error) + sizeof(frame) + OT_RADIO_FRAME_MAX_SIZE)
{
return 0;
}
fdp.ConsumeData(&seed, sizeof(seed));
srand(seed);
Core nexus;
Node &node = nexus.CreateNode();
node.GetInstance().SetLogLevel(kLogLevelInfo);
Log("---------------------------------------------------------------------------------------");
Log("Form network");
node.Form();
nexus.AdvanceTime(13 * 1000);
VerifyOrQuit(node.Get<Mle::Mle>().IsLeader());
Log("---------------------------------------------------------------------------------------");
Log("Fuzz");
fdp.ConsumeData(&error, sizeof(error));
fdp.ConsumeData(&frame, sizeof(frame));
frame.mLength = fdp.RemainingBytes();
if (frame.mLength == 0)
{
frame.mPsdu = NULL;
}
else
{
frame.mPsdu = fdp.ConsumeRemainingBytes();
}
otPlatRadioReceiveDone(&node.GetInstance(), &frame, error);
nexus.AdvanceTime(10 * 1000);
if (frame.mPsdu)
{
free(frame.mPsdu);
}
exit:
return 0;
}
} // namespace Nexus
} // namespace ot
tests/fuzz/radio_receive_done.cpp
-106
View File
@@ -1,106 +0,0 @@
/*
* Copyright (c) 2017, The OpenThread Authors.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdlib.h>
#include <string.h>
#include <openthread/instance.h>
#include <openthread/ip6.h>
#include <openthread/link.h>
#include <openthread/tasklet.h>
#include <openthread/thread.h>
#include <openthread/thread_ftd.h>
#include <openthread/platform/alarm-milli.h>
#include <openthread/platform/radio.h>
#include "fuzzer_platform.h"
#include "common/code_utils.hpp"
#include "common/time.hpp"
void AdvanceTime(otInstance *aInstance, uint32_t aDuration)
{
uint32_t time = otPlatAlarmMilliGetNow() + aDuration;
while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time))
{
while (otTaskletsArePending(aInstance))
{
otTaskletsProcess(aInstance);
}
FuzzerPlatformProcess(aInstance);
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
const otPanId panId = 0xdead;
otInstance *instance = nullptr;
otRadioFrame frame;
uint8_t *buf = nullptr;
VerifyOrExit(size <= OT_RADIO_FRAME_MAX_SIZE);
FuzzerPlatformInit();
instance = otInstanceInitSingle();
IgnoreError(otLinkSetPanId(instance, panId));
IgnoreError(otIp6SetEnabled(instance, true));
IgnoreError(otThreadSetEnabled(instance, true));
IgnoreError(otThreadBecomeLeader(instance));
AdvanceTime(instance, 10000);
buf = static_cast<uint8_t *>(malloc(size));
memset(&frame, 0, sizeof(frame));
frame.mPsdu = buf;
frame.mChannel = 11;
frame.mLength = static_cast<uint8_t>(size);
memcpy(buf, data, frame.mLength);
otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE);
VerifyOrExit(!FuzzerPlatformResetWasRequested());
AdvanceTime(instance, 10000);
exit:
if (buf != nullptr)
{
free(buf);
}
if (instance != nullptr)
{
otInstanceFinalize(instance);
}
return 0;
}
tests/nexus/platform/nexus_misc.cpp
+9
View File
@@ -84,6 +84,7 @@ void otPlatFree(void *aPtr) { free(aPtr); }
otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength)
{
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
Error error = OT_ERROR_NONE;
FILE *file = nullptr;
size_t readLength;
@@ -102,6 +103,14 @@ otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength)
exit:
return error;
#else
for (uint16_t length = 0; length < aOutputLength; length++)
{
aOutput[length] = (uint8_t)rand();
}
return OT_ERROR_NONE;
#endif
}
//---------------------------------------------------------------------------------------------------------------------