From b7b085c9f97ee2d9f16415249ccdcc9f28663fb8 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Thu, 11 Apr 2019 11:59:20 -0700
Subject: [PATCH] [fuzz] advance alarm time to cover timer handlers (#3753)

---
 tests/fuzz/ip6_send.cpp           | 12 ++++++++++--
 tests/fuzz/ncp_uart_received.cpp  | 12 ++++++++++--
 tests/fuzz/radio_receive_done.cpp | 12 ++++++++++--
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/tests/fuzz/ip6_send.cpp b/tests/fuzz/ip6_send.cpp
index 4431c20f3..d9f3318a1 100644
--- a/tests/fuzz/ip6_send.cpp
+++ b/tests/fuzz/ip6_send.cpp
@@ -26,6 +26,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+#define MAX_ITERATIONS 100
+
 #include <stddef.h>
 
 #include <openthread/instance.h>
@@ -39,6 +41,7 @@
 #include "common/code_utils.hpp"
 
 extern "C" void FuzzerPlatformInit(void);
+extern "C" void FuzzerPlatformProcess(otInstance *aInstance);
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
@@ -72,9 +75,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 
     message = NULL;
 
-    while (otTaskletsArePending(instance))
+    for (int i = 0; i < MAX_ITERATIONS; i++)
     {
-        otTaskletsProcess(instance);
+        while (otTaskletsArePending(instance))
+        {
+            otTaskletsProcess(instance);
+        }
+
+        FuzzerPlatformProcess(instance);
     }
 
 exit:
diff --git a/tests/fuzz/ncp_uart_received.cpp b/tests/fuzz/ncp_uart_received.cpp
index edf3f6ceb..2b634c54b 100644
--- a/tests/fuzz/ncp_uart_received.cpp
+++ b/tests/fuzz/ncp_uart_received.cpp
@@ -26,6 +26,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+#define MAX_ITERATIONS 100
+
 #include <stdlib.h>
 #include <string.h>
 
@@ -41,6 +43,7 @@
 #include "common/code_utils.hpp"
 
 extern "C" void FuzzerPlatformInit(void);
+extern "C" void FuzzerPlatformProcess(otInstance *aInstance);
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
@@ -66,9 +69,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 
     otPlatUartReceived(buf, (uint16_t)size);
 
-    while (otTaskletsArePending(instance))
+    for (int i = 0; i < MAX_ITERATIONS; i++)
     {
-        otTaskletsProcess(instance);
+        while (otTaskletsArePending(instance))
+        {
+            otTaskletsProcess(instance);
+        }
+
+        FuzzerPlatformProcess(instance);
     }
 
 exit:
diff --git a/tests/fuzz/radio_receive_done.cpp b/tests/fuzz/radio_receive_done.cpp
index b41158f38..cacbaae5c 100644
--- a/tests/fuzz/radio_receive_done.cpp
+++ b/tests/fuzz/radio_receive_done.cpp
@@ -26,6 +26,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+#define MAX_ITERATIONS 100
+
 #include <stdlib.h>
 #include <string.h>
 
@@ -40,6 +42,7 @@
 #include "common/code_utils.hpp"
 
 extern "C" void FuzzerPlatformInit(void);
+extern "C" void FuzzerPlatformProcess(otInstance *aInstance);
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
@@ -70,9 +73,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 
     otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE);
 
-    while (otTaskletsArePending(instance))
+    for (int i = 0; i < MAX_ITERATIONS; i++)
     {
-        otTaskletsProcess(instance);
+        while (otTaskletsArePending(instance))
+        {
+            otTaskletsProcess(instance);
+        }
+
+        FuzzerPlatformProcess(instance);
     }
 
 exit: