/proc/self/cwd/test/fuzz_server.cc
Line | Count | Source |
1 | | #include <stddef.h> |
2 | | #include <stdint.h> |
3 | | #include <stdio.h> |
4 | | #include <string.h> |
5 | | #include <sys/types.h> |
6 | | #include <unistd.h> |
7 | | #include "src/iso14229.h" |
8 | | #include <fuzzer/FuzzedDataProvider.h> |
9 | | |
10 | | #ifdef __cplusplus |
11 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *, size_t); |
12 | | #else |
13 | | int LLVMFuzzerTestOneInput(const uint8_t *, size_t); |
14 | | #endif |
15 | | |
16 | | static uint64_t g_time_now_us = 0; |
17 | | static uint8_t client_recv_buf[UDS_TP_MTU]; |
18 | | |
19 | 1.82M | static UDSErr_t fn(UDSServer_t *srv, UDSEvent_t ev, void *arg) { |
20 | 1.82M | FuzzedDataProvider *fuzzed_data = (FuzzedDataProvider *)srv->fn_data; |
21 | 1.82M | UDSErr_t retval = static_cast<UDSErr_t>(fuzzed_data->ConsumeIntegral<int>()); |
22 | 1.82M | switch (ev) { |
23 | 330 | case UDS_EVT_DiagSessCtrl: { |
24 | 330 | UDSDiagSessCtrlArgs_t *r = (UDSDiagSessCtrlArgs_t *)arg; |
25 | 330 | r->p2_ms = fuzzed_data->ConsumeIntegral<uint16_t>(); |
26 | 330 | r->p2_star_ms = fuzzed_data->ConsumeIntegral<uint32_t>(); |
27 | 330 | break; |
28 | 0 | } |
29 | 2.44k | case UDS_EVT_EcuReset: { |
30 | 2.44k | UDSECUResetArgs_t *r = (UDSECUResetArgs_t *)arg; |
31 | 2.44k | r->powerDownTimeMillis = fuzzed_data->ConsumeIntegral<uint32_t>(); |
32 | 2.44k | break; |
33 | 0 | } |
34 | 1.58k | case UDS_EVT_ReadDataByIdent: { |
35 | 1.58k | UDSRDBIArgs_t *r = (UDSRDBIArgs_t *)arg; |
36 | 1.58k | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
37 | 1.58k | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
38 | 1.58k | r->copy(srv, data.data(), data.size()); |
39 | 1.58k | break; |
40 | 0 | } |
41 | 383 | case UDS_EVT_ReadMemByAddr: { |
42 | 383 | UDSReadMemByAddrArgs_t *r = (UDSReadMemByAddrArgs_t *)arg; |
43 | 383 | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
44 | 383 | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
45 | 383 | r->copy(srv, data.data(), data.size()); |
46 | 383 | break; |
47 | 0 | } |
48 | 813 | case UDS_EVT_CommCtrl: { |
49 | 813 | UDSCommCtrlArgs_t *r = (UDSCommCtrlArgs_t *)arg; |
50 | 813 | r->ctrlType = fuzzed_data->ConsumeIntegral<uint8_t>(); |
51 | 813 | r->commType = fuzzed_data->ConsumeIntegral<uint8_t>(); |
52 | 813 | break; |
53 | 0 | } |
54 | 105 | case UDS_EVT_SecAccessRequestSeed: { |
55 | 105 | UDSSecAccessRequestSeedArgs_t *r = (UDSSecAccessRequestSeedArgs_t *)arg; |
56 | 105 | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
57 | 105 | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
58 | 105 | r->copySeed(srv, data.data(), data.size()); |
59 | 105 | break; |
60 | 0 | } |
61 | 59 | case UDS_EVT_SecAccessValidateKey: { |
62 | 59 | break; |
63 | 0 | } |
64 | 277 | case UDS_EVT_WriteDataByIdent: { |
65 | 277 | break; |
66 | 0 | } |
67 | 656 | case UDS_EVT_RoutineCtrl: { |
68 | 656 | UDSRoutineCtrlArgs_t *r = (UDSRoutineCtrlArgs_t *)arg; |
69 | 656 | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
70 | 656 | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
71 | 656 | r->copyStatusRecord(srv, data.data(), data.size()); |
72 | 656 | break; |
73 | 0 | } |
74 | 417 | case UDS_EVT_RequestDownload: { |
75 | 417 | UDSRequestDownloadArgs_t *r = (UDSRequestDownloadArgs_t *)arg; |
76 | 417 | r->maxNumberOfBlockLength = fuzzed_data->ConsumeIntegral<uint16_t>(); |
77 | 417 | break; |
78 | 0 | } |
79 | 353 | case UDS_EVT_RequestUpload: { |
80 | 353 | UDSRequestUploadArgs_t *r = (UDSRequestUploadArgs_t *)arg; |
81 | 353 | r->maxNumberOfBlockLength = fuzzed_data->ConsumeIntegral<uint16_t>(); |
82 | 353 | break; |
83 | 0 | } |
84 | 195 | case UDS_EVT_TransferData: { |
85 | 195 | UDSTransferDataArgs_t *r = (UDSTransferDataArgs_t *)arg; |
86 | 195 | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
87 | 195 | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
88 | 195 | r->copyResponse(srv, data.data(), data.size()); |
89 | 195 | break; |
90 | 0 | } |
91 | 101 | case UDS_EVT_RequestTransferExit: { |
92 | 101 | UDSRequestTransferExitArgs_t *r = (UDSRequestTransferExitArgs_t *)arg; |
93 | 101 | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
94 | 101 | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
95 | 101 | r->copyResponse(srv, data.data(), data.size()); |
96 | 101 | break; |
97 | 0 | } |
98 | 1.55k | case UDS_EVT_RequestFileTransfer: { |
99 | 1.55k | UDSRequestFileTransferArgs_t *r = (UDSRequestFileTransferArgs_t *)arg; |
100 | 1.55k | r->maxNumberOfBlockLength = fuzzed_data->ConsumeIntegral<uint16_t>(); |
101 | 1.55k | break; |
102 | 0 | } |
103 | 6.53k | case UDS_EVT_Custom: { |
104 | 6.53k | UDSCustomArgs_t *r = (UDSCustomArgs_t *)arg; |
105 | 6.53k | const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
106 | 6.53k | std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count); |
107 | 6.53k | r->copyResponse(srv, data.data(), data.size()); |
108 | 6.53k | break; |
109 | 0 | } |
110 | 1.81M | default: |
111 | 1.81M | break; |
112 | 1.82M | } |
113 | 1.82M | return retval; |
114 | 1.82M | } |
115 | | |
116 | 39.1M | uint32_t UDSMillis() { return g_time_now_us / 1000; } |
117 | | |
118 | 4.35k | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
119 | 4.35k | FuzzedDataProvider fuzzed_data(data, size); |
120 | 4.35k | UDSServer_t srv; |
121 | 4.35k | UDSTp_t *mock_client = NULL; |
122 | 4.35k | ISOTPMockArgs_t server_args = { |
123 | 4.35k | .sa_phys = 0x7E0, |
124 | 4.35k | .ta_phys = 0x7E8, |
125 | 4.35k | .sa_func = 0x7DF, |
126 | 4.35k | .ta_func = UDS_TP_NOOP_ADDR |
127 | 4.35k | }; |
128 | 4.35k | ISOTPMockArgs_t client_args = { |
129 | 4.35k | .sa_phys = 0x7E8, |
130 | 4.35k | .ta_phys = 0x7E0, |
131 | 4.35k | .sa_func = UDS_TP_NOOP_ADDR, |
132 | 4.35k | .ta_func = 0x7DF |
133 | 4.35k | }; |
134 | 4.35k | UDSServerInit(&srv); |
135 | 4.35k | srv.fn = fn; |
136 | 4.35k | srv.fn_data = (void*)&fuzzed_data; |
137 | 4.35k | srv.tp = ISOTPMockNew("server", &server_args); |
138 | 4.35k | mock_client = ISOTPMockNew("client", &client_args); |
139 | | |
140 | 4.35k | g_time_now_us = fuzzed_data.ConsumeIntegral<uint32_t>(); |
141 | 4.35k | static constexpr int MAX_STEPS = 10; |
142 | 47.9k | for (int step = 0; step < MAX_STEPS; step++) { |
143 | 43.5k | UDSSDU_t sdu_info; |
144 | 43.5k | sdu_info.A_Mtype = static_cast<UDS_A_Mtype_t>(fuzzed_data.ConsumeIntegralInRange<int>(UDS_A_MTYPE_DIAG, UDS_A_MTYPE_SECURE_REMOTE_DIAG)); |
145 | 43.5k | sdu_info.A_SA = fuzzed_data.ConsumeIntegral<uint32_t>(); |
146 | 43.5k | sdu_info.A_TA = fuzzed_data.ConsumeIntegral<uint32_t>(); |
147 | 43.5k | sdu_info.A_TA_Type = static_cast<UDS_A_TA_Type_t>(fuzzed_data.ConsumeIntegralInRange<int>(UDS_A_TA_TYPE_PHYSICAL, UDS_A_TA_TYPE_FUNCTIONAL)); |
148 | 43.5k | sdu_info.A_AE = fuzzed_data.ConsumeIntegral<uint32_t>(); |
149 | 43.5k | const size_t msg_len = fuzzed_data.ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU); |
150 | 43.5k | std::vector<uint8_t> msg = fuzzed_data.ConsumeBytes<uint8_t>(msg_len); |
151 | | |
152 | 43.5k | { |
153 | 43.5k | const size_t wait_ms = fuzzed_data.ConsumeIntegralInRange<size_t>(0, 6000); |
154 | 43.5k | const size_t poll_rate_us = fuzzed_data.ConsumeIntegralInRange<size_t>(100, 1000000); |
155 | 10.9M | for (size_t time_us = 0; time_us < wait_ms * 1000; time_us += poll_rate_us) { |
156 | 10.9M | g_time_now_us += poll_rate_us; |
157 | 10.9M | UDSServerPoll(&srv); |
158 | 10.9M | } |
159 | | |
160 | 43.5k | if (!msg.empty()) { |
161 | 5.96k | UDSTpSend(mock_client, msg.data(), msg.size(), &sdu_info); |
162 | 5.96k | } |
163 | 43.5k | } |
164 | | |
165 | 43.5k | { |
166 | 43.5k | const size_t wait_ms = fuzzed_data.ConsumeIntegralInRange<size_t>(0, 6000); |
167 | 43.5k | const size_t poll_rate_us = fuzzed_data.ConsumeIntegralInRange<size_t>(100, 1000000); |
168 | 27.8M | for (size_t time_us = 0; time_us < wait_ms * 1000; time_us += poll_rate_us) { |
169 | 27.8M | g_time_now_us += poll_rate_us; |
170 | 27.8M | UDSServerPoll(&srv); |
171 | 27.8M | size_t recvlen = 0; |
172 | 27.8M | UDSErr_t err = UDSTpRecv(mock_client, client_recv_buf, sizeof(client_recv_buf), &recvlen, NULL); |
173 | 27.8M | (void)err; |
174 | 27.8M | } |
175 | 43.5k | } |
176 | | |
177 | 43.5k | } |
178 | 4.35k | ISOTPMockFree(mock_client); |
179 | 4.35k | ISOTPMockFree(srv.tp); |
180 | 4.35k | return 0; |
181 | 4.35k | } |