Coverage Report

Created: 2025-10-28 06:13

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/openthread/tests/fuzz/icmp6.cpp
Line
Count
Source
1
/*
2
 *  Copyright (c) 2025, The OpenThread Authors.
3
 *  All rights reserved.
4
 *
5
 *  Redistribution and use in source and binary forms, with or without
6
 *  modification, are permitted provided that the following conditions are met:
7
 *  1. Redistributions of source code must retain the above copyright
8
 *     notice, this list of conditions and the following disclaimer.
9
 *  2. Redistributions in binary form must reproduce the above copyright
10
 *     notice, this list of conditions and the following disclaimer in the
11
 *     documentation and/or other materials provided with the distribution.
12
 *  3. Neither the name of the copyright holder nor the
13
 *     names of its contributors may be used to endorse or promote products
14
 *     derived from this software without specific prior written permission.
15
 *
16
 *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17
 *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18
 *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19
 *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20
 *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21
 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22
 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23
 *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24
 *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25
 *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26
 *  POSSIBILITY OF SUCH DAMAGE.
27
 */
28
29
#include <stdarg.h>
30
#include <stdio.h>
31
#include <stdlib.h>
32
#include <string.h>
33
34
#include "platform/nexus_core.hpp"
35
#include "platform/nexus_node.hpp"
36
37
namespace ot {
38
namespace Nexus {
39
40
class FuzzDataProvider
41
{
42
public:
43
    FuzzDataProvider(const uint8_t *aData, size_t aSize)
44
24.7k
        : mData(aData)
45
24.7k
        , mSize(aSize)
46
24.7k
    {
47
24.7k
    }
48
49
    void ConsumeData(void *aBuf, size_t aLength)
50
56.0k
    {
51
56.0k
        assert(aLength <= mSize);
52
56.0k
        memcpy(aBuf, mData, aLength);
53
56.0k
        mData += aLength;
54
56.0k
        mSize -= aLength;
55
56.0k
    }
56
57
    uint8_t *ConsumeRemainingBytes(void)
58
19.4k
    {
59
19.4k
        uint8_t *buf = static_cast<uint8_t *>(malloc(mSize));
60
19.4k
        memcpy(buf, mData, mSize);
61
19.4k
        mSize = 0;
62
19.4k
        return buf;
63
19.4k
    }
64
65
13.9k
    size_t RemainingBytes(void) { return mSize; }
66
67
private:
68
    const uint8_t *mData;
69
    size_t         mSize;
70
};
71
72
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
73
1.77k
{
74
1.77k
    const uint16_t kMaxMessageSize = 2048;
75
76
1.77k
    FuzzDataProvider fdp(data, size);
77
78
1.77k
    unsigned int seed;
79
1.77k
    uint32_t     ifIndex;
80
1.77k
    otIp6Address srcAddress;
81
1.77k
    uint8_t     *buffer;
82
1.77k
    uint16_t     bufferLength;
83
84
1.77k
    if (size < sizeof(seed) + sizeof(ifIndex) + sizeof(srcAddress))
85
8
    {
86
8
        return 0;
87
8
    }
88
89
1.76k
    if (size > sizeof(seed) + sizeof(ifIndex) + sizeof(srcAddress) + kMaxMessageSize)
90
14
    {
91
14
        return 0;
92
14
    }
93
94
1.75k
    fdp.ConsumeData(&seed, sizeof(seed));
95
1.75k
    srand(seed);
96
97
1.75k
    Core nexus;
98
99
1.75k
    Node &node = nexus.CreateNode();
100
101
1.75k
    node.GetInstance().SetLogLevel(kLogLevelInfo);
102
103
1.75k
    node.GetInstance().Get<BorderRouter::InfraIf>().Init(/* aInfraIfIndex */ 1, /* aInfraIfIsRunning */ true);
104
1.75k
    node.GetInstance().Get<BorderRouter::RoutingManager>().SetEnabled(true);
105
1.75k
    node.GetInstance().Get<Srp::Server>().SetAutoEnableMode(true);
106
1.75k
    node.GetInstance().Get<BorderRouter::RoutingManager>().SetDhcp6PdEnabled(true);
107
1.75k
    node.GetInstance().Get<BorderRouter::RoutingManager>().SetNat64PrefixManagerEnabled(true);
108
1.75k
    node.GetInstance().Get<Nat64::Translator>().SetEnabled(true);
109
110
1.75k
    Log("---------------------------------------------------------------------------------------");
111
1.75k
    Log("Form network");
112
113
1.75k
    node.Form();
114
1.75k
    nexus.AdvanceTime(60 * 1000);
115
1.75k
    VerifyOrQuit(node.Get<Mle::Mle>().IsLeader());
116
1.75k
    VerifyOrQuit(node.Get<Srp::Server>().GetState() == Srp::Server::kStateRunning);
117
118
1.75k
    Log("---------------------------------------------------------------------------------------");
119
1.75k
    Log("Fuzz");
120
121
1.75k
    fdp.ConsumeData(&ifIndex, sizeof(ifIndex));
122
1.75k
    fdp.ConsumeData(&srcAddress, sizeof(srcAddress));
123
1.75k
    bufferLength = fdp.RemainingBytes();
124
1.75k
    buffer       = fdp.ConsumeRemainingBytes();
125
126
1.75k
    otPlatInfraIfRecvIcmp6Nd(&node.GetInstance(), ifIndex, &srcAddress, buffer, bufferLength);
127
128
1.75k
    nexus.AdvanceTime(10 * 1000);
129
130
1.75k
    if (buffer)
131
1.75k
    {
132
1.75k
        free(buffer);
133
1.75k
    }
134
135
1.75k
    return 0;
136
1.75k
}
137
138
} // namespace Nexus
139
} // namespace ot