Coverage Report

Created: 2026-10-17 06:35

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/proc/self/cwd/test/fuzz_server.cc
Line
Count
Source
1
#include <stddef.h>
2
#include <stdint.h>
3
#include <stdio.h>
4
#include <string.h>
5
#include <sys/types.h>
6
#include <unistd.h>
7
#include "src/iso14229.h"
8
#include <fuzzer/FuzzedDataProvider.h>
9
10
#ifdef __cplusplus
11
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
12
#else
13
int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
14
#endif
15
16
static uint64_t g_time_now_us = 0;
17
static uint8_t client_recv_buf[UDS_TP_MTU];
18
19
1.82M
static UDSErr_t fn(UDSServer_t *srv, UDSEvent_t ev, void *arg) {
20
1.82M
    FuzzedDataProvider *fuzzed_data = (FuzzedDataProvider *)srv->fn_data;
21
1.82M
    UDSErr_t retval = static_cast<UDSErr_t>(fuzzed_data->ConsumeIntegral<int>());
22
1.82M
    switch (ev) {
23
330
        case UDS_EVT_DiagSessCtrl: {
24
330
            UDSDiagSessCtrlArgs_t *r = (UDSDiagSessCtrlArgs_t *)arg;
25
330
            r->p2_ms = fuzzed_data->ConsumeIntegral<uint16_t>();
26
330
            r->p2_star_ms = fuzzed_data->ConsumeIntegral<uint32_t>();
27
330
            break;
28
0
        }
29
2.44k
        case UDS_EVT_EcuReset: {
30
2.44k
            UDSECUResetArgs_t *r = (UDSECUResetArgs_t *)arg;
31
2.44k
            r->powerDownTimeMillis = fuzzed_data->ConsumeIntegral<uint32_t>();
32
2.44k
            break;
33
0
        }
34
1.58k
        case UDS_EVT_ReadDataByIdent: {
35
1.58k
            UDSRDBIArgs_t *r = (UDSRDBIArgs_t *)arg;
36
1.58k
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
37
1.58k
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
38
1.58k
            r->copy(srv, data.data(), data.size());
39
1.58k
            break;
40
0
        }
41
383
        case UDS_EVT_ReadMemByAddr: {
42
383
            UDSReadMemByAddrArgs_t *r = (UDSReadMemByAddrArgs_t *)arg;
43
383
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
44
383
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
45
383
            r->copy(srv, data.data(), data.size());
46
383
            break;
47
0
        }
48
813
        case UDS_EVT_CommCtrl: {
49
813
            UDSCommCtrlArgs_t *r = (UDSCommCtrlArgs_t *)arg;
50
813
            r->ctrlType = fuzzed_data->ConsumeIntegral<uint8_t>();
51
813
            r->commType = fuzzed_data->ConsumeIntegral<uint8_t>();
52
813
            break;
53
0
        }
54
105
        case UDS_EVT_SecAccessRequestSeed: {
55
105
            UDSSecAccessRequestSeedArgs_t *r = (UDSSecAccessRequestSeedArgs_t *)arg;
56
105
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
57
105
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
58
105
            r->copySeed(srv, data.data(), data.size());
59
105
            break;
60
0
        }
61
59
        case UDS_EVT_SecAccessValidateKey: {
62
59
            break;
63
0
        }
64
277
        case UDS_EVT_WriteDataByIdent: {
65
277
            break;
66
0
        }
67
656
        case UDS_EVT_RoutineCtrl: {
68
656
            UDSRoutineCtrlArgs_t *r = (UDSRoutineCtrlArgs_t *)arg;
69
656
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
70
656
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
71
656
            r->copyStatusRecord(srv, data.data(), data.size());
72
656
            break;
73
0
        }
74
417
        case UDS_EVT_RequestDownload: {
75
417
            UDSRequestDownloadArgs_t *r = (UDSRequestDownloadArgs_t *)arg;
76
417
            r->maxNumberOfBlockLength = fuzzed_data->ConsumeIntegral<uint16_t>();
77
417
            break;
78
0
        }
79
353
        case UDS_EVT_RequestUpload: {
80
353
            UDSRequestUploadArgs_t *r = (UDSRequestUploadArgs_t *)arg;
81
353
            r->maxNumberOfBlockLength = fuzzed_data->ConsumeIntegral<uint16_t>();
82
353
            break;
83
0
        }
84
195
        case UDS_EVT_TransferData: {
85
195
            UDSTransferDataArgs_t *r = (UDSTransferDataArgs_t *)arg;
86
195
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
87
195
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
88
195
            r->copyResponse(srv, data.data(), data.size());
89
195
            break;
90
0
        }
91
101
        case UDS_EVT_RequestTransferExit: {
92
101
            UDSRequestTransferExitArgs_t *r = (UDSRequestTransferExitArgs_t *)arg;
93
101
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
94
101
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
95
101
            r->copyResponse(srv, data.data(), data.size());
96
101
            break;
97
0
        }
98
1.55k
        case UDS_EVT_RequestFileTransfer: {
99
1.55k
            UDSRequestFileTransferArgs_t *r = (UDSRequestFileTransferArgs_t *)arg;
100
1.55k
            r->maxNumberOfBlockLength  = fuzzed_data->ConsumeIntegral<uint16_t>();
101
1.55k
            break;
102
0
        }
103
6.53k
        case UDS_EVT_Custom: {
104
6.53k
            UDSCustomArgs_t *r = (UDSCustomArgs_t *)arg;
105
6.53k
            const size_t count = fuzzed_data->ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
106
6.53k
            std::vector<uint8_t> data = fuzzed_data->ConsumeBytes<uint8_t>(count);
107
6.53k
            r->copyResponse(srv, data.data(), data.size());
108
6.53k
            break;
109
0
        }
110
1.81M
        default: 
111
1.81M
            break;
112
1.82M
    }
113
1.82M
    return retval;
114
1.82M
}
115
116
39.1M
uint32_t UDSMillis() { return g_time_now_us / 1000; }
117
118
4.35k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
119
4.35k
    FuzzedDataProvider fuzzed_data(data, size);
120
4.35k
    UDSServer_t srv;
121
4.35k
    UDSTp_t *mock_client = NULL;
122
4.35k
    ISOTPMockArgs_t server_args = {
123
4.35k
        .sa_phys = 0x7E0,
124
4.35k
        .ta_phys = 0x7E8,
125
4.35k
        .sa_func = 0x7DF,
126
4.35k
        .ta_func = UDS_TP_NOOP_ADDR
127
4.35k
    };
128
4.35k
    ISOTPMockArgs_t client_args = {
129
4.35k
        .sa_phys = 0x7E8,
130
4.35k
        .ta_phys = 0x7E0,
131
4.35k
        .sa_func = UDS_TP_NOOP_ADDR,
132
4.35k
        .ta_func = 0x7DF
133
4.35k
    };
134
4.35k
    UDSServerInit(&srv);
135
4.35k
    srv.fn = fn;
136
4.35k
    srv.fn_data = (void*)&fuzzed_data;
137
4.35k
    srv.tp = ISOTPMockNew("server", &server_args);
138
4.35k
    mock_client = ISOTPMockNew("client", &client_args);
139
140
4.35k
    g_time_now_us = fuzzed_data.ConsumeIntegral<uint32_t>();
141
4.35k
    static constexpr int MAX_STEPS = 10;
142
47.9k
    for (int step = 0; step < MAX_STEPS; step++) {
143
43.5k
        UDSSDU_t sdu_info;
144
43.5k
        sdu_info.A_Mtype = static_cast<UDS_A_Mtype_t>(fuzzed_data.ConsumeIntegralInRange<int>(UDS_A_MTYPE_DIAG, UDS_A_MTYPE_SECURE_REMOTE_DIAG));
145
43.5k
        sdu_info.A_SA = fuzzed_data.ConsumeIntegral<uint32_t>();
146
43.5k
        sdu_info.A_TA = fuzzed_data.ConsumeIntegral<uint32_t>();
147
43.5k
        sdu_info.A_TA_Type = static_cast<UDS_A_TA_Type_t>(fuzzed_data.ConsumeIntegralInRange<int>(UDS_A_TA_TYPE_PHYSICAL, UDS_A_TA_TYPE_FUNCTIONAL));
148
43.5k
        sdu_info.A_AE = fuzzed_data.ConsumeIntegral<uint32_t>();
149
43.5k
        const size_t msg_len = fuzzed_data.ConsumeIntegralInRange<size_t>(0, UDS_TP_MTU);
150
43.5k
        std::vector<uint8_t> msg = fuzzed_data.ConsumeBytes<uint8_t>(msg_len);
151
152
43.5k
        {
153
43.5k
            const size_t wait_ms = fuzzed_data.ConsumeIntegralInRange<size_t>(0, 6000);
154
43.5k
            const size_t poll_rate_us = fuzzed_data.ConsumeIntegralInRange<size_t>(100, 1000000);
155
10.9M
            for (size_t time_us = 0; time_us < wait_ms * 1000; time_us += poll_rate_us) {
156
10.9M
                g_time_now_us += poll_rate_us;
157
10.9M
                UDSServerPoll(&srv);
158
10.9M
            }
159
160
43.5k
            if (!msg.empty()) {
161
5.96k
                UDSTpSend(mock_client, msg.data(), msg.size(), &sdu_info);
162
5.96k
            }
163
43.5k
        }
164
165
43.5k
        {
166
43.5k
            const size_t wait_ms = fuzzed_data.ConsumeIntegralInRange<size_t>(0, 6000);
167
43.5k
            const size_t poll_rate_us = fuzzed_data.ConsumeIntegralInRange<size_t>(100, 1000000);
168
27.8M
            for (size_t time_us = 0; time_us < wait_ms * 1000; time_us += poll_rate_us) {
169
27.8M
                g_time_now_us += poll_rate_us;
170
27.8M
                UDSServerPoll(&srv);
171
27.8M
                size_t recvlen = 0;
172
27.8M
                UDSErr_t err = UDSTpRecv(mock_client, client_recv_buf, sizeof(client_recv_buf), &recvlen, NULL);
173
27.8M
                (void)err;
174
27.8M
            }
175
43.5k
        }
176
177
43.5k
    }
178
4.35k
    ISOTPMockFree(mock_client);
179
4.35k
    ISOTPMockFree(srv.tp);
180
4.35k
    return 0;
181
4.35k
}