diff --git a/tests/fuzz/CMakeLists.txt b/tests/fuzz/CMakeLists.txt index c2d5da2b7..6d3d4c057 100644 --- a/tests/fuzz/CMakeLists.txt +++ b/tests/fuzz/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2021, The OpenThread Authors. +# Copyright (c) 2025, The OpenThread Authors. # All rights reserved. # # Redistribution and use in source and binary forms, with or without @@ -28,105 +28,55 @@ set(COMMON_INCLUDES ${PROJECT_SOURCE_DIR}/include + ${PROJECT_SOURCE_DIR}/src ${PROJECT_SOURCE_DIR}/src/core + ${PROJECT_SOURCE_DIR}/tests/nexus ) set(COMMON_COMPILE_OPTIONS -DOPENTHREAD_FTD=1 -DOPENTHREAD_MTD=0 -DOPENTHREAD_RADIO=0 - -DOPENTHREAD_SPINEL_CONFIG_OPENTHREAD_MESSAGE_ENABLE=1 -) - -set(COMMON_SOURCES - fuzzer_platform.cpp ) set(COMMON_LIBS openthread-ftd + ot-nexus-platform ${OT_MBEDTLS} $ENV{LIB_FUZZING_ENGINE} ot-config ) -add_executable(ot-cli-received-fuzzer - cli_received.cpp - ${COMMON_SOURCES} -) +#---------------------------------------------------------------------------------------------------------------------- -target_compile_options(ot-cli-received-fuzzer - PRIVATE - ${COMMON_COMPILE_OPTIONS} -) +macro(ot_nexus_test name) -target_include_directories(ot-cli-received-fuzzer + # Macro to add an OpenThread nexus test. + # + # Nexus test name will be `nexus_{name}`. Test source file of + # `test_{name}.cpp` is used. Optional extra arguments can be + # passed to provide additional source files. + + add_executable(${name}-fuzzer + ${name}.cpp ${ARGN} + ) + + target_include_directories(${name}-fuzzer PRIVATE ${COMMON_INCLUDES} -) + ) -target_link_libraries(ot-cli-received-fuzzer + target_link_libraries(${name}-fuzzer PRIVATE - openthread-cli-ftd ${COMMON_LIBS} -) + ) -add_executable(ot-ip6-send-fuzzer - ip6_send.cpp - ${COMMON_SOURCES} -) - -target_compile_options(ot-ip6-send-fuzzer + target_compile_options(${name}-fuzzer PRIVATE ${COMMON_COMPILE_OPTIONS} -) + ) +endmacro() -target_include_directories(ot-ip6-send-fuzzer - PRIVATE - ${COMMON_INCLUDES} -) +#---------------------------------------------------------------------------------------------------------------------- -target_link_libraries(ot-ip6-send-fuzzer - PRIVATE - ${COMMON_LIBS} -) - -add_executable(ot-radio-receive-done-fuzzer - radio_receive_done.cpp - ${COMMON_SOURCES} -) - -target_compile_options(ot-radio-receive-done-fuzzer - PRIVATE - ${COMMON_COMPILE_OPTIONS} -) - -target_include_directories(ot-radio-receive-done-fuzzer - PRIVATE - ${COMMON_INCLUDES} -) - -target_link_libraries(ot-radio-receive-done-fuzzer - PRIVATE - ${COMMON_LIBS} -) - -add_executable(ot-ncp-hdlc-received-fuzzer - ncp_hdlc_received.cpp - ${COMMON_SOURCES} -) - -target_compile_options(ot-ncp-hdlc-received-fuzzer - PRIVATE - ${COMMON_COMPILE_OPTIONS} -) - -target_include_directories(ot-ncp-hdlc-received-fuzzer - PRIVATE - ${COMMON_INCLUDES} -) - -target_link_libraries(ot-ncp-hdlc-received-fuzzer - PRIVATE - openthread-ncp-ftd - ${COMMON_LIBS} -) +ot_nexus_test(radio-one-node) diff --git a/tests/fuzz/cli_received.cpp b/tests/fuzz/cli_received.cpp deleted file mode 100644 index a8a2a10e3..000000000 --- a/tests/fuzz/cli_received.cpp +++ /dev/null @@ -1,114 +0,0 @@ -/* - * Copyright (c) 2019, The OpenThread Authors. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the copyright holder nor the - * names of its contributors may be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#include -#include -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include - -#include "fuzzer_platform.h" -#include "common/code_utils.hpp" -#include "common/time.hpp" - -static int CliOutput(void *aContext, const char *aFormat, va_list aArguments) -{ - OT_UNUSED_VARIABLE(aContext); - OT_UNUSED_VARIABLE(aFormat); - OT_UNUSED_VARIABLE(aArguments); - - return vsnprintf(nullptr, 0, aFormat, aArguments); -} - -void AdvanceTime(otInstance *aInstance, uint32_t aDuration) -{ - uint32_t time = otPlatAlarmMilliGetNow() + aDuration; - - while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) - { - while (otTaskletsArePending(aInstance)) - { - otTaskletsProcess(aInstance); - } - - FuzzerPlatformProcess(aInstance); - } -} - -extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) -{ - const otPanId panId = 0xdead; - - otInstance *instance = nullptr; - uint8_t *buf = nullptr; - - VerifyOrExit(size <= 65536); - - FuzzerPlatformInit(); - - instance = otInstanceInitSingle(); - otCliInit(instance, CliOutput, nullptr); - IgnoreError(otLinkSetPanId(instance, panId)); - IgnoreError(otIp6SetEnabled(instance, true)); - IgnoreError(otThreadSetEnabled(instance, true)); - IgnoreError(otThreadBecomeLeader(instance)); - - AdvanceTime(instance, 10000); - - buf = static_cast(malloc(size + 1)); - memcpy(buf, data, size); - buf[size] = '\0'; - - otCliInputLine(reinterpret_cast(buf)); - - VerifyOrExit(!FuzzerPlatformResetWasRequested()); - - AdvanceTime(instance, 10000); - -exit: - - if (buf != nullptr) - { - free(buf); - } - - if (instance != nullptr) - { - otInstanceFinalize(instance); - } - - return 0; -} diff --git a/tests/fuzz/corpora/radio-receive-done/mle-parent-request b/tests/fuzz/corpora/radio-receive-done/mle-parent-request deleted file mode 100644 index 9a4e8179d..000000000 Binary files a/tests/fuzz/corpora/radio-receive-done/mle-parent-request and /dev/null differ diff --git a/tests/fuzz/fuzzer_platform.cpp b/tests/fuzz/fuzzer_platform.cpp deleted file mode 100644 index a13d0b3c0..000000000 --- a/tests/fuzz/fuzzer_platform.cpp +++ /dev/null @@ -1,670 +0,0 @@ -/* - * Copyright (c) 2017, The OpenThread Authors. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the copyright holder nor the - * names of its contributors may be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#include "openthread-core-config.h" - -#include "fuzzer_platform.h" - -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "mac/mac_frame.hpp" -#include "openthread/error.h" - -using namespace ot; - -typedef struct AlarmState -{ - uint32_t fire; - bool isRunning; -} AlarmState; - -enum -{ - IEEE802154_ACK_LENGTH = 5, - - IEEE802154_FRAME_TYPE_ACK = 2 << 0, -}; - -static uint32_t sAlarmNow; -static AlarmState sAlarmMilli; -static AlarmState sAlarmMicro; -static uint32_t sRandomState = 1; -static uint8_t sRadioTransmitPsdu[OT_RADIO_FRAME_MAX_SIZE]; -static otRadioFrame sRadioTransmitFrame; -static uint8_t sRadioAckPsdu[OT_RADIO_FRAME_MAX_SIZE]; -static otRadioFrame sRadioAckFrame; -static bool sResetWasRequested = false; -static otRadioState sRadioState = OT_RADIO_STATE_DISABLED; - -bool otMacFrameIsAckRequested(const otRadioFrame *aFrame) -{ - return static_cast(aFrame)->GetAckRequest(); -} - -otError otMacFrameGetSequence(const otRadioFrame *aFrame, uint8_t *aSequence) -{ - otError error; - - if (static_cast(aFrame)->IsSequencePresent()) - { - *aSequence = static_cast(aFrame)->GetSequence(); - error = kErrorNone; - } - else - { - error = kErrorParse; - } - - return error; -} - -void FuzzerPlatformInit(void) -{ - sRandomState = 1; - sAlarmNow = 0; - memset(&sAlarmMilli, 0, sizeof(sAlarmMilli)); - memset(&sAlarmMicro, 0, sizeof(sAlarmMicro)); - - sRadioTransmitFrame.mPsdu = sRadioTransmitPsdu; - sRadioAckFrame.mPsdu = sRadioAckPsdu; -} - -void FuzzerPlatformProcess(otInstance *aInstance) -{ - if (sRadioState == OT_RADIO_STATE_TRANSMIT) - { - sRadioState = OT_RADIO_STATE_RECEIVE; - - if (otMacFrameIsAckRequested(&sRadioTransmitFrame)) - { - otError error; - - sRadioAckFrame.mLength = IEEE802154_ACK_LENGTH; - sRadioAckFrame.mPsdu[0] = IEEE802154_FRAME_TYPE_ACK; - sRadioAckFrame.mPsdu[1] = 0; - sRadioAckFrame.mChannel = sRadioTransmitFrame.mChannel; - error = otMacFrameGetSequence(&sRadioTransmitFrame, &sRadioAckFrame.mPsdu[2]); - - if (error == OT_ERROR_NONE) - { - otPlatRadioTxDone(aInstance, &sRadioTransmitFrame, &sRadioAckFrame, OT_ERROR_NONE); - } - else - { - otPlatRadioTxDone(aInstance, &sRadioTransmitFrame, nullptr, OT_ERROR_NO_ACK); - } - } - else - { - otPlatRadioTxDone(aInstance, &sRadioTransmitFrame, nullptr, OT_ERROR_NONE); - } - } - - if (sAlarmMilli.isRunning || sAlarmMicro.isRunning) - { - uint32_t fire = UINT32_MAX; - - if (sAlarmMilli.isRunning && fire > sAlarmMilli.fire) - { - fire = sAlarmMilli.fire; - } - - if (sAlarmMicro.isRunning && fire > sAlarmMicro.fire) - { - fire = sAlarmMicro.fire; - } - - sAlarmNow = fire; - - if (sAlarmMilli.isRunning && sAlarmNow >= sAlarmMilli.fire) - { - sAlarmMilli.isRunning = false; - otPlatAlarmMilliFired(aInstance); - } - -#if OPENTHREAD_CONFIG_PLATFORM_USEC_TIMER_ENABLE - if (sAlarmMicro.isRunning && sAlarmNow >= sAlarmMicro.fire) - { - sAlarmMicro.isRunning = false; - otPlatAlarmMicroFired(aInstance); - } -#endif - } -} - -bool FuzzerPlatformResetWasRequested(void) { return sResetWasRequested; } - -extern "C" { - -uint32_t otPlatAlarmMilliGetNow(void) { return sAlarmNow / 1000; } - -void otPlatAlarmMilliStartAt(otInstance *aInstance, uint32_t aT0, uint32_t aDt) -{ - OT_UNUSED_VARIABLE(aInstance); - - sAlarmMilli.fire = (aT0 + aDt) * 1000; - sAlarmMilli.isRunning = true; -} - -void otPlatAlarmMilliStop(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - sAlarmMilli.isRunning = false; -} - -uint32_t otPlatAlarmMicroGetNow(void) { return sAlarmNow; } - -void otPlatAlarmMicroStartAt(otInstance *aInstance, uint32_t aT0, uint32_t aDt) -{ - OT_UNUSED_VARIABLE(aInstance); - - sAlarmMicro.fire = aT0 + aDt; - sAlarmMicro.isRunning = true; -} - -void otPlatAlarmMicroStop(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - sAlarmMicro.isRunning = false; -} - -bool otDiagIsEnabled(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - return false; -} - -otError otDiagProcessCmd(otInstance *aInstance, uint8_t aArgsLength, char *aArgs[], char *aOutput, size_t aOutputMaxLen) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aArgsLength); - OT_UNUSED_VARIABLE(aArgs); - OT_UNUSED_VARIABLE(aOutput); - OT_UNUSED_VARIABLE(aOutputMaxLen); - - return OT_ERROR_NOT_IMPLEMENTED; -} - -otError otDiagProcessCmdLine(otInstance *aInstance, const char *aString, char *aOutput, size_t aOutputMaxLen) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aString); - OT_UNUSED_VARIABLE(aOutput); - OT_UNUSED_VARIABLE(aOutputMaxLen); - - return OT_ERROR_NOT_IMPLEMENTED; -} - -void otPlatReset(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - sResetWasRequested = true; -} - -otPlatResetReason otPlatGetResetReason(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return OT_PLAT_RESET_REASON_POWER_ON; -} - -OT_TOOL_WEAK void otPlatLog(otLogLevel aLogLevel, otLogRegion aLogRegion, const char *aFormat, ...) -{ - OT_UNUSED_VARIABLE(aLogLevel); - OT_UNUSED_VARIABLE(aLogRegion); - OT_UNUSED_VARIABLE(aFormat); -} - -void otPlatWakeHost(void) {} - -otError otPlatMultipanGetActiveInstance(otInstance **) { return OT_ERROR_NOT_IMPLEMENTED; } - -otError otPlatMultipanSetActiveInstance(otInstance *, bool) { return OT_ERROR_NOT_IMPLEMENTED; } - -void otPlatRadioGetIeeeEui64(otInstance *aInstance, uint8_t *aIeeeEui64) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aIeeeEui64); -} - -void otPlatRadioSetPanId(otInstance *aInstance, uint16_t aPanId) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aPanId); -} - -void otPlatRadioSetExtendedAddress(otInstance *aInstance, const otExtAddress *aExtAddr) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aExtAddr); -} - -void otPlatRadioSetShortAddress(otInstance *aInstance, uint16_t aShortAddress) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aShortAddress); -} - -void otPlatRadioSetPromiscuous(otInstance *aInstance, bool aEnabled) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aEnabled); -} - -void otPlatRadioSetRxOnWhenIdle(otInstance *aInstance, bool aEnabled) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aEnabled); -} - -bool otPlatRadioIsEnabled(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return true; -} - -otError otPlatRadioEnable(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - sRadioState = OT_RADIO_STATE_SLEEP; - - return OT_ERROR_NONE; -} - -otError otPlatRadioDisable(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - sRadioState = OT_RADIO_STATE_DISABLED; - - return OT_ERROR_NONE; -} - -otError otPlatRadioSleep(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - sRadioState = OT_RADIO_STATE_SLEEP; - - return OT_ERROR_NONE; -} - -otError otPlatRadioReceive(otInstance *aInstance, uint8_t aChannel) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aChannel); - - sRadioState = OT_RADIO_STATE_RECEIVE; - - return OT_ERROR_NONE; -} - -otError otPlatRadioTransmit(otInstance *aInstance, otRadioFrame *aFrame) -{ - sRadioState = OT_RADIO_STATE_TRANSMIT; - - otPlatRadioTxStarted(aInstance, aFrame); - - return OT_ERROR_NONE; -} - -otError otPlatRadioGetTransmitPower(otInstance *aInstance, int8_t *aPower) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aPower); - return OT_ERROR_NONE; -} - -otRadioFrame *otPlatRadioGetTransmitBuffer(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return &sRadioTransmitFrame; -} - -int8_t otPlatRadioGetRssi(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return 0; -} - -otRadioCaps otPlatRadioGetCaps(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return OT_RADIO_CAPS_NONE; -} - -bool otPlatRadioGetPromiscuous(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return false; -} - -void otPlatRadioEnableSrcMatch(otInstance *aInstance, bool aEnable) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aEnable); -} - -otError otPlatRadioAddSrcMatchShortEntry(otInstance *aInstance, uint16_t aShortAddress) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aShortAddress); - return OT_ERROR_NONE; -} - -otError otPlatRadioAddSrcMatchExtEntry(otInstance *aInstance, const otExtAddress *aExtAddress) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aExtAddress); - return OT_ERROR_NONE; -} - -otError otPlatRadioClearSrcMatchShortEntry(otInstance *aInstance, uint16_t aShortAddress) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aShortAddress); - return OT_ERROR_NONE; -} - -otError otPlatRadioClearSrcMatchExtEntry(otInstance *aInstance, const otExtAddress *aExtAddress) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aExtAddress); - return OT_ERROR_NONE; -} - -void otPlatRadioClearSrcMatchShortEntries(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); } - -void otPlatRadioClearSrcMatchExtEntries(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); } - -otError otPlatRadioEnergyScan(otInstance *aInstance, uint8_t aScanChannel, uint16_t aScanDuration) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aScanChannel); - OT_UNUSED_VARIABLE(aScanDuration); - return OT_ERROR_NOT_IMPLEMENTED; -} - -otError otPlatRadioSetTransmitPower(otInstance *aInstance, int8_t aPower) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aPower); - return OT_ERROR_NOT_IMPLEMENTED; -} - -otError otPlatRadioGetCcaEnergyDetectThreshold(otInstance *aInstance, int8_t *aThreshold) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aThreshold); - return OT_ERROR_NOT_IMPLEMENTED; -} - -otError otPlatRadioSetCcaEnergyDetectThreshold(otInstance *aInstance, int8_t aThreshold) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aThreshold); - return OT_ERROR_NOT_IMPLEMENTED; -} - -int8_t otPlatRadioGetReceiveSensitivity(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - return 0; -} - -otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength) -{ - for (uint16_t length = 0; length < aOutputLength; length++) - { - aOutput[length] = (uint8_t)rand(); - } - - return OT_ERROR_NONE; -} - -void otPlatSettingsInit(otInstance *aInstance, const uint16_t *aSensitiveKeys, uint16_t aSensitiveKeysLength) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aSensitiveKeys); - OT_UNUSED_VARIABLE(aSensitiveKeysLength); -} - -void otPlatSettingsDeinit(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); } - -otError otPlatSettingsGet(otInstance *aInstance, uint16_t aKey, int aIndex, uint8_t *aValue, uint16_t *aValueLength) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aKey); - OT_UNUSED_VARIABLE(aIndex); - OT_UNUSED_VARIABLE(aValue); - OT_UNUSED_VARIABLE(aValueLength); - return OT_ERROR_NOT_FOUND; -} - -otError otPlatSettingsSet(otInstance *aInstance, uint16_t aKey, const uint8_t *aValue, uint16_t aValueLength) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aKey); - OT_UNUSED_VARIABLE(aValue); - OT_UNUSED_VARIABLE(aValueLength); - return OT_ERROR_NONE; -} - -otError otPlatSettingsAdd(otInstance *aInstance, uint16_t aKey, const uint8_t *aValue, uint16_t aValueLength) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aKey); - OT_UNUSED_VARIABLE(aValue); - OT_UNUSED_VARIABLE(aValueLength); - return OT_ERROR_NONE; -} - -otError otPlatSettingsDelete(otInstance *aInstance, uint16_t aKey, int aIndex) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aKey); - OT_UNUSED_VARIABLE(aIndex); - return OT_ERROR_NONE; -} - -void otPlatSettingsWipe(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); } - -void otPlatDiagSetOutputCallback(otInstance *aInstance, otPlatDiagOutputCallback aCallback, void *aContext) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aCallback); - OT_UNUSED_VARIABLE(aContext); -} - -otError otPlatDiagProcess(otInstance *aInstance, uint8_t aArgsLength, char *aArgs[]) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aArgsLength); - OT_UNUSED_VARIABLE(aArgs); - - return OT_ERROR_INVALID_COMMAND; -} - -void otPlatDiagModeSet(bool aMode) { OT_UNUSED_VARIABLE(aMode); } - -bool otPlatDiagModeGet(void) { return false; } - -void otPlatDiagChannelSet(uint8_t aChannel) { OT_UNUSED_VARIABLE(aChannel); } - -void otPlatDiagTxPowerSet(int8_t aTxPower) { OT_UNUSED_VARIABLE(aTxPower); } - -void otPlatDiagRadioReceived(otInstance *aInstance, otRadioFrame *aFrame, otError aError) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aFrame); - OT_UNUSED_VARIABLE(aError); -} - -void otPlatDiagAlarmCallback(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); } - -otPlatDnssdState otPlatDnssdGetState(otInstance *aInstance) -{ - OT_UNUSED_VARIABLE(aInstance); - - return OT_PLAT_DNSSD_STOPPED; -} - -void otPlatDnssdRegisterService(otInstance *aInstance, - const otPlatDnssdService *aService, - otPlatDnssdRequestId aRequestId, - otPlatDnssdRegisterCallback aCallback) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aService); - OT_UNUSED_VARIABLE(aRequestId); - OT_UNUSED_VARIABLE(aCallback); -} - -void otPlatDnssdUnregisterService(otInstance *aInstance, - const otPlatDnssdService *aService, - otPlatDnssdRequestId aRequestId, - otPlatDnssdRegisterCallback aCallback) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aService); - OT_UNUSED_VARIABLE(aRequestId); - OT_UNUSED_VARIABLE(aCallback); -} - -void otPlatDnssdRegisterHost(otInstance *aInstance, - const otPlatDnssdHost *aHost, - otPlatDnssdRequestId aRequestId, - otPlatDnssdRegisterCallback aCallback) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aHost); - OT_UNUSED_VARIABLE(aRequestId); - OT_UNUSED_VARIABLE(aCallback); -} - -void otPlatDnssdUnregisterHost(otInstance *aInstance, - const otPlatDnssdHost *aHost, - otPlatDnssdRequestId aRequestId, - otPlatDnssdRegisterCallback aCallback) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aHost); - OT_UNUSED_VARIABLE(aRequestId); - OT_UNUSED_VARIABLE(aCallback); -} - -void otPlatDnssdRegisterKey(otInstance *aInstance, - const otPlatDnssdKey *aKey, - otPlatDnssdRequestId aRequestId, - otPlatDnssdRegisterCallback aCallback) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aKey); - OT_UNUSED_VARIABLE(aRequestId); - OT_UNUSED_VARIABLE(aCallback); -} - -void otPlatDnssdUnregisterKey(otInstance *aInstance, - const otPlatDnssdKey *aKey, - otPlatDnssdRequestId aRequestId, - otPlatDnssdRegisterCallback aCallback) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aKey); - OT_UNUSED_VARIABLE(aRequestId); - OT_UNUSED_VARIABLE(aCallback); -} - -otError otPlatMdnsSetListeningEnabled(otInstance *aInstance, bool aEnable, uint32_t aInfraIfIndex) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aEnable); - OT_UNUSED_VARIABLE(aInfraIfIndex); - - return OT_ERROR_NOT_IMPLEMENTED; -} - -void otPlatMdnsSendMulticast(otInstance *aInstance, otMessage *aMessage, uint32_t aInfraIfIndex) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aMessage); - OT_UNUSED_VARIABLE(aInfraIfIndex); -} - -void otPlatMdnsSendUnicast(otInstance *aInstance, otMessage *aMessage, const otPlatMdnsAddressInfo *aAddress) -{ - OT_UNUSED_VARIABLE(aInstance); - OT_UNUSED_VARIABLE(aMessage); - OT_UNUSED_VARIABLE(aAddress); -} - -bool otPlatInfraIfHasAddress(uint32_t aInfraIfIndex, const otIp6Address *aAddress) -{ - OT_UNUSED_VARIABLE(aInfraIfIndex); - OT_UNUSED_VARIABLE(aAddress); - - return false; -} - -otError otPlatInfraIfSendIcmp6Nd(uint32_t aInfraIfIndex, - const otIp6Address *aDestAddress, - const uint8_t *aBuffer, - uint16_t aBufferLength) -{ - OT_UNUSED_VARIABLE(aInfraIfIndex); - OT_UNUSED_VARIABLE(aDestAddress); - OT_UNUSED_VARIABLE(aBuffer); - OT_UNUSED_VARIABLE(aBufferLength); - - return OT_ERROR_FAILED; -} - -otError otPlatInfraIfDiscoverNat64Prefix(uint32_t aInfraIfIndex) -{ - OT_UNUSED_VARIABLE(aInfraIfIndex); - - return OT_ERROR_FAILED; -} - -} // extern "C" diff --git a/tests/fuzz/fuzzer_platform.h b/tests/fuzz/fuzzer_platform.h deleted file mode 100644 index 343039c38..000000000 --- a/tests/fuzz/fuzzer_platform.h +++ /dev/null @@ -1,46 +0,0 @@ -/* - * Copyright (c) 2019, The OpenThread Authors. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the copyright holder nor the - * names of its contributors may be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#ifndef FUZZER_PLATFORM_H_ -#define FUZZER_PLATFORM_H_ - -#include - -#ifdef __cplusplus -extern "C" { -#endif - -void FuzzerPlatformInit(void); -void FuzzerPlatformProcess(otInstance *aInstance); -bool FuzzerPlatformResetWasRequested(void); - -#ifdef __cplusplus -} // extern "C" -#endif - -#endif // FUZZER_PLATFORM_H_ diff --git a/tests/fuzz/ip6_send.cpp b/tests/fuzz/ip6_send.cpp deleted file mode 100644 index ef366a0a5..000000000 --- a/tests/fuzz/ip6_send.cpp +++ /dev/null @@ -1,112 +0,0 @@ -/* - * Copyright (c) 2017, The OpenThread Authors. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the copyright holder nor the - * names of its contributors may be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "fuzzer_platform.h" -#include "common/code_utils.hpp" -#include "common/time.hpp" - -void AdvanceTime(otInstance *aInstance, uint32_t aDuration) -{ - uint32_t time = otPlatAlarmMilliGetNow() + aDuration; - - while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) - { - while (otTaskletsArePending(aInstance)) - { - otTaskletsProcess(aInstance); - } - - FuzzerPlatformProcess(aInstance); - } -} - -extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) -{ - const otPanId panId = 0xdead; - - otInstance *instance = nullptr; - otMessage *message = nullptr; - otError error = OT_ERROR_NONE; - otMessageSettings settings; - - VerifyOrExit(size > 0); - - FuzzerPlatformInit(); - - instance = otInstanceInitSingle(); - IgnoreError(otLinkSetPanId(instance, panId)); - IgnoreError(otIp6SetEnabled(instance, true)); - IgnoreError(otThreadSetEnabled(instance, true)); - otSrpServerSetEnabled(instance, true); - IgnoreError(otThreadBecomeLeader(instance)); - - AdvanceTime(instance, 10000); - - settings.mLinkSecurityEnabled = (data[0] & 0x1) != 0; - settings.mPriority = OT_MESSAGE_PRIORITY_NORMAL; - - message = otIp6NewMessage(instance, &settings); - VerifyOrExit(message != nullptr, error = OT_ERROR_NO_BUFS); - - error = otMessageAppend(message, data + 1, static_cast(size - 1)); - SuccessOrExit(error); - - error = otIp6Send(instance, message); - - message = nullptr; - - VerifyOrExit(!FuzzerPlatformResetWasRequested()); - - AdvanceTime(instance, 10000); - -exit: - - if (message != nullptr) - { - otMessageFree(message); - } - - if (instance != nullptr) - { - otInstanceFinalize(instance); - } - - return 0; -} diff --git a/tests/fuzz/ncp_hdlc_received.cpp b/tests/fuzz/ncp_hdlc_received.cpp deleted file mode 100644 index 8afb417ea..000000000 --- a/tests/fuzz/ncp_hdlc_received.cpp +++ /dev/null @@ -1,111 +0,0 @@ -/* - * Copyright (c) 2018, The OpenThread Authors. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the copyright holder nor the - * names of its contributors may be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "fuzzer_platform.h" -#include "common/code_utils.hpp" -#include "common/time.hpp" - -static int HdlcSend(const uint8_t *aBuf, uint16_t aBufLength) -{ - OT_UNUSED_VARIABLE(aBuf); - OT_UNUSED_VARIABLE(aBufLength); - - return aBufLength; -} - -void AdvanceTime(otInstance *aInstance, uint32_t aDuration) -{ - uint32_t time = otPlatAlarmMilliGetNow() + aDuration; - - while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) - { - while (otTaskletsArePending(aInstance)) - { - otTaskletsProcess(aInstance); - } - - FuzzerPlatformProcess(aInstance); - } -} - -extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) -{ - const otPanId panId = 0xdead; - - otInstance *instance = nullptr; - uint8_t *buf = nullptr; - - VerifyOrExit(size <= 65536); - - FuzzerPlatformInit(); - - instance = otInstanceInitSingle(); - otNcpHdlcInit(instance, HdlcSend); - IgnoreError(otLinkSetPanId(instance, panId)); - IgnoreError(otIp6SetEnabled(instance, true)); - IgnoreError(otThreadSetEnabled(instance, true)); - otSrpServerSetEnabled(instance, true); - IgnoreError(otThreadBecomeLeader(instance)); - - AdvanceTime(instance, 10000); - - buf = static_cast(malloc(size)); - memcpy(buf, data, size); - otNcpHdlcReceive(buf, static_cast(size)); - - VerifyOrExit(!FuzzerPlatformResetWasRequested()); - - AdvanceTime(instance, 10000); - -exit: - - if (buf != nullptr) - { - free(buf); - } - - if (instance != nullptr) - { - otInstanceFinalize(instance); - } - - return 0; -} diff --git a/tests/fuzz/oss-fuzz-build b/tests/fuzz/oss-fuzz-build index 3f03af8f5..7928b8c2d 100755 --- a/tests/fuzz/oss-fuzz-build +++ b/tests/fuzz/oss-fuzz-build @@ -36,47 +36,15 @@ set -euxo pipefail cmake -GNinja \ -DCMAKE_C_FLAGS="${CFLAGS}" \ -DCMAKE_CXX_FLAGS="${CXXFLAGS}" \ - -DBUILD_TESTING=OFF \ - -DOT_BUILD_EXECUTABLES=OFF \ + -DOT_COMPILE_WARNING_AS_ERROR=ON \ -DOT_FUZZ_TARGETS=ON \ - -DOT_MTD=OFF \ - -DOT_PLATFORM=external \ - -DOT_RCP=OFF \ - -DOT_BORDER_AGENT=ON \ - -DOT_BORDER_ROUTER=ON \ - -DOT_BORDER_ROUTING=ON \ - -DOT_CHANNEL_MANAGER=ON \ - -DOT_CHANNEL_MONITOR=ON \ - -DOT_COAP=ON \ - -DOT_COAPS=ON \ - -DOT_COAP_BLOCK=ON \ - -DOT_COAP_OBSERVE=ON \ - -DOT_COMMISSIONER=ON \ - -DOT_DATASET_UPDATER=ON \ - -DOT_DHCP6_CLIENT=ON \ - -DOT_DHCP6_SERVER=ON \ - -DOT_DNS_CLIENT=ON \ - -DOT_DNSSD_SERVER=ON \ - -DOT_ECDSA=ON \ - -DOT_HISTORY_TRACKER=ON \ - -DOT_IP6_FRAGM=ON \ - -DOT_JAM_DETECTION=ON \ - -DOT_JOINER=ON \ - -DOT_LINK_RAW=ON \ - -DOT_LOG_OUTPUT=APP \ - -DOT_MAC_FILTER=ON \ - -DOT_MDNS=ON \ - -DOT_NETDATA_PUBLISHER=ON \ - -DOT_NETDIAG_CLIENT=ON \ - -DOT_PING_SENDER=ON \ - -DOT_SERVICE=ON \ - -DOT_SLAAC=ON \ - -DOT_SNTP_CLIENT=ON \ - -DOT_SRP_ADV_PROXY=ON \ - -DOT_SRP_CLIENT=ON \ - -DOT_SRP_SERVER=ON \ - -DOT_THREAD_VERSION=1.3 \ - -DOT_UPTIME=ON \ + -DOT_MULTIPLE_INSTANCE=ON \ + -DOT_PLATFORM=nexus \ + -DOT_THREAD_VERSION=1.4 \ + -DOT_APP_CLI=OFF \ + -DOT_APP_NCP=OFF \ + -DOT_APP_RCP=OFF \ + -DOT_PROJECT_CONFIG=../tests/nexus/openthread-core-nexus-config.h \ .. ninja ) diff --git a/tests/fuzz/ot_fuzz_framework.cpp b/tests/fuzz/ot_fuzz_framework.cpp deleted file mode 100644 index e69de29bb..000000000 diff --git a/tests/fuzz/ot_fuzz_framework.h b/tests/fuzz/ot_fuzz_framework.h deleted file mode 100644 index e69de29bb..000000000 diff --git a/tests/fuzz/radio-one-node.cpp b/tests/fuzz/radio-one-node.cpp new file mode 100644 index 000000000..72d2dd343 --- /dev/null +++ b/tests/fuzz/radio-one-node.cpp @@ -0,0 +1,137 @@ +/* + * Copyright (c) 2025, The OpenThread Authors. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include +#include +#include + +#include "platform/nexus_core.hpp" +#include "platform/nexus_node.hpp" + +namespace ot { +namespace Nexus { + +class FuzzDataProvider +{ +public: + FuzzDataProvider(const uint8_t *aData, size_t aSize) + : mData(aData) + , mSize(aSize) + { + } + + void ConsumeData(void *aBuf, size_t aLength) + { + assert(aLength <= mSize); + memcpy(aBuf, mData, aLength); + mData += aLength; + mSize -= aLength; + } + + uint8_t *ConsumeRemainingBytes(void) + { + uint8_t *buf = static_cast(malloc(mSize)); + memcpy(buf, mData, mSize); + mSize = 0; + return buf; + } + + size_t RemainingBytes(void) { return mSize; } + +private: + const uint8_t *mData; + size_t mSize; +}; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + FuzzDataProvider fdp(data, size); + + unsigned int seed; + otRadioFrame frame; + otError error; + + if (size < sizeof(seed) + sizeof(error) + sizeof(frame)) + { + return 0; + } + + if (size > sizeof(seed) + sizeof(error) + sizeof(frame) + OT_RADIO_FRAME_MAX_SIZE) + { + return 0; + } + + fdp.ConsumeData(&seed, sizeof(seed)); + srand(seed); + + Core nexus; + + Node &node = nexus.CreateNode(); + + node.GetInstance().SetLogLevel(kLogLevelInfo); + + Log("---------------------------------------------------------------------------------------"); + Log("Form network"); + + node.Form(); + nexus.AdvanceTime(13 * 1000); + VerifyOrQuit(node.Get().IsLeader()); + + Log("---------------------------------------------------------------------------------------"); + Log("Fuzz"); + + fdp.ConsumeData(&error, sizeof(error)); + fdp.ConsumeData(&frame, sizeof(frame)); + + frame.mLength = fdp.RemainingBytes(); + + if (frame.mLength == 0) + { + frame.mPsdu = NULL; + } + else + { + frame.mPsdu = fdp.ConsumeRemainingBytes(); + } + + otPlatRadioReceiveDone(&node.GetInstance(), &frame, error); + + nexus.AdvanceTime(10 * 1000); + + if (frame.mPsdu) + { + free(frame.mPsdu); + } + +exit: + return 0; +} + +} // namespace Nexus +} // namespace ot diff --git a/tests/fuzz/radio_receive_done.cpp b/tests/fuzz/radio_receive_done.cpp deleted file mode 100644 index 04399cd6f..000000000 --- a/tests/fuzz/radio_receive_done.cpp +++ /dev/null @@ -1,106 +0,0 @@ -/* - * Copyright (c) 2017, The OpenThread Authors. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. Neither the name of the copyright holder nor the - * names of its contributors may be used to endorse or promote products - * derived from this software without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - */ - -#include -#include - -#include -#include -#include -#include -#include -#include -#include -#include - -#include "fuzzer_platform.h" -#include "common/code_utils.hpp" -#include "common/time.hpp" - -void AdvanceTime(otInstance *aInstance, uint32_t aDuration) -{ - uint32_t time = otPlatAlarmMilliGetNow() + aDuration; - - while (ot::TimeMilli(otPlatAlarmMilliGetNow()) <= ot::TimeMilli(time)) - { - while (otTaskletsArePending(aInstance)) - { - otTaskletsProcess(aInstance); - } - - FuzzerPlatformProcess(aInstance); - } -} - -extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) -{ - const otPanId panId = 0xdead; - - otInstance *instance = nullptr; - otRadioFrame frame; - uint8_t *buf = nullptr; - - VerifyOrExit(size <= OT_RADIO_FRAME_MAX_SIZE); - - FuzzerPlatformInit(); - - instance = otInstanceInitSingle(); - IgnoreError(otLinkSetPanId(instance, panId)); - IgnoreError(otIp6SetEnabled(instance, true)); - IgnoreError(otThreadSetEnabled(instance, true)); - IgnoreError(otThreadBecomeLeader(instance)); - - AdvanceTime(instance, 10000); - - buf = static_cast(malloc(size)); - memset(&frame, 0, sizeof(frame)); - frame.mPsdu = buf; - frame.mChannel = 11; - frame.mLength = static_cast(size); - memcpy(buf, data, frame.mLength); - - otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE); - - VerifyOrExit(!FuzzerPlatformResetWasRequested()); - - AdvanceTime(instance, 10000); - -exit: - - if (buf != nullptr) - { - free(buf); - } - - if (instance != nullptr) - { - otInstanceFinalize(instance); - } - - return 0; -} diff --git a/tests/nexus/platform/nexus_misc.cpp b/tests/nexus/platform/nexus_misc.cpp index 09919940f..a56ed29fa 100644 --- a/tests/nexus/platform/nexus_misc.cpp +++ b/tests/nexus/platform/nexus_misc.cpp @@ -84,6 +84,7 @@ void otPlatFree(void *aPtr) { free(aPtr); } otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength) { +#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Error error = OT_ERROR_NONE; FILE *file = nullptr; size_t readLength; @@ -102,6 +103,14 @@ otError otPlatEntropyGet(uint8_t *aOutput, uint16_t aOutputLength) exit: return error; +#else + for (uint16_t length = 0; length < aOutputLength; length++) + { + aOutput[length] = (uint8_t)rand(); + } + + return OT_ERROR_NONE; +#endif } //---------------------------------------------------------------------------------------------------------------------