/* * Copyright (c) 2019, The OpenThread Authors. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the copyright holder nor the * names of its contributors may be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #define MAX_ITERATIONS 100 #include #include #include #include #include #include #include #include #include #include #include "common/code_utils.hpp" extern "C" void FuzzerPlatformInit(void); extern "C" void FuzzerPlatformProcess(otInstance *aInstance); extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; otInstance *instance = NULL; uint8_t * buf = NULL; VerifyOrExit(size <= 65536); FuzzerPlatformInit(); instance = otInstanceInitSingle(); otCliUartInit(instance); otLinkSetPanId(instance, panId); otIp6SetEnabled(instance, true); otThreadSetEnabled(instance, true); otThreadBecomeLeader(instance); buf = static_cast(malloc(size)); memcpy(buf, data, size); otPlatUartReceived(buf, (uint16_t)size); for (int i = 0; i < MAX_ITERATIONS; i++) { while (otTaskletsArePending(instance)) { otTaskletsProcess(instance); } FuzzerPlatformProcess(instance); } exit: if (buf != NULL) { free(buf); } if (instance != NULL) { otInstanceFinalize(instance); } return 0; }