path: root/system/stack/test/fuzzers/sdp/sdpFuzzFunctions.h

/*
 * Copyright 2020 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#ifndef FUZZER_SDP_FUNCTIONS_H_
#define FUZZER_SDP_FUNCTIONS_H_

#include <fuzzer/FuzzedDataProvider.h>

#include <vector>

#include "fuzzers/common/commonFuzzHelpers.h"
#include "fuzzers/sdp/sdpFuzzHelpers.h"
#include "stack/include/sdp_api.h"
#include "types/bluetooth/uuid.h"
#include "types/raw_address.h"

#define SDP_MAX_DB_LEN 1024 * 1024  // 1 MB
#define MAX_NUM_DBS 64

/* This is a vector of lambda functions the fuzzer will pull from.
 *  This is done so new functions can be added to the fuzzer easily
 *  without requiring modifications to the main fuzzer file. This also
 *  allows multiple fuzzers to include this file, if functionality is needed.
 */
static const std::vector<std::function<void(FuzzedDataProvider*)>>
    sdp_operations = {
        // SDP_InitDiscoveryDb
        [](FuzzedDataProvider* fdp) -> void {
          if (sdp_db_vect.size() >= MAX_NUM_DBS) {
            return;
          }

          // build out uuid_list
          std::vector<bluetooth::Uuid> uuid_list;
          uint8_t num_uuids = fdp->ConsumeIntegral<uint8_t>();
          for (uint8_t i = 0; i < num_uuids; i++) {
            uuid_list.push_back(generateArbitraryUuid(fdp));
          }

          // build out attr_list
          std::vector<uint16_t> attr_list = generateArbitraryAttrList(fdp);

          uint32_t db_size =
              fdp->ConsumeIntegralInRange<uint32_t>(0, SDP_MAX_DB_LEN);
          std::shared_ptr<tSDP_DISCOVERY_DB> p_db(
              reinterpret_cast<tSDP_DISCOVERY_DB*>(malloc(db_size)), free);
          if (p_db) {
            bool success = SDP_InitDiscoveryDb(
                p_db.get(), db_size, uuid_list.size(), uuid_list.data(),
                attr_list.size(),
                reinterpret_cast<uint16_t*>(attr_list.data()));
            if (success) {
              sdp_db_vect.push_back(p_db);
            }
          }
        },

        // SDP_CancelServiceSearch
        [](FuzzedDataProvider* fdp) -> void {
          SDP_CancelServiceSearch(
              getArbitraryVectorElement(fdp, sdp_db_vect, true).get());
        },

        // SDP_ServiceSearchRequest
        [](FuzzedDataProvider* fdp) -> void {
          const RawAddress bd_addr = generateRawAddress(fdp);
          tSDP_DISCOVERY_DB* db =
              getArbitraryVectorElement(fdp, sdp_db_vect, false).get();
          if (db) {
            SDP_ServiceSearchRequest(bd_addr, db, &sdp_disc_cmpl_cb);
          }
        },

        // SDP_ServiceSearchAttributeRequest
        [](FuzzedDataProvider* fdp) -> void {
          const RawAddress bd_addr = generateRawAddress(fdp);
          tSDP_DISCOVERY_DB* db =
              getArbitraryVectorElement(fdp, sdp_db_vect, false).get();
          if (db) {
            SDP_ServiceSearchAttributeRequest(bd_addr, db, &sdp_disc_cmpl_cb);
          }
        },

        // SDP_ServiceSearchAttributeRequest2
        [](FuzzedDataProvider* fdp) -> void {
          const RawAddress bd_addr = generateRawAddress(fdp);
          std::vector<uint8_t> user_data = fdp->ConsumeBytes<uint8_t>(
              fdp->ConsumeIntegralInRange<size_t>(0, 1024));
          tSDP_DISCOVERY_DB* db =
              getArbitraryVectorElement(fdp, sdp_db_vect, false).get();

          if (db) {
            SDP_ServiceSearchAttributeRequest2(bd_addr, db, &sdp_disc_cmpl_cb2,
                                               user_data.data());
          }
        },

        // SDP_FindAttributeInRec
        [](FuzzedDataProvider* fdp) -> void {
          tSDP_DISC_REC* p_rec =
              generateArbitrarySdpDiscRecord(fdp, false).get();
          SDP_FindAttributeInRec(p_rec, fdp->ConsumeIntegral<uint16_t>());
        },

        // SDP_FindServiceInDb
        [](FuzzedDataProvider* fdp) -> void {
          SDP_FindServiceInDb(
              getArbitraryVectorElement(fdp, sdp_db_vect, true).get(),
              fdp->ConsumeIntegral<uint16_t>(),
              generateArbitrarySdpDiscRecord(fdp, true).get());
        },

        // SDP_FindServiceUUIDInDb
        [](FuzzedDataProvider* fdp) -> void {
          const bluetooth::Uuid uuid = generateArbitraryUuid(fdp);
          SDP_FindServiceUUIDInDb(
              getArbitraryVectorElement(fdp, sdp_db_vect, true).get(), uuid,
              generateArbitrarySdpDiscRecord(fdp, true).get());
        },

        // SDP_FindServiceUUIDInRec_128bit
        [](FuzzedDataProvider* fdp) -> void {
          bluetooth::Uuid uuid = generateArbitraryUuid(fdp);
          tSDP_DISC_REC* p_rec =
              generateArbitrarySdpDiscRecord(fdp, false).get();
          SDP_FindServiceUUIDInRec_128bit(p_rec, &uuid);
        },

        // SDP_FindServiceInDb_128bit
        [](FuzzedDataProvider* fdp) -> void {
          SDP_FindServiceInDb_128bit(
              getArbitraryVectorElement(fdp, sdp_db_vect, true).get(),
              generateArbitrarySdpDiscRecord(fdp, true).get());
        },

        // SDP_FindProtocolListElemInRec
        [](FuzzedDataProvider* fdp) -> void {
          tSDP_PROTOCOL_ELEM elem = generateArbitrarySdpProtocolElements(fdp);
          tSDP_DISC_REC* p_rec =
              generateArbitrarySdpDiscRecord(fdp, false).get();
          SDP_FindProtocolListElemInRec(p_rec, fdp->ConsumeIntegral<uint16_t>(),
                                        &elem);
        },

        // SDP_FindProfileVersionInRec
        [](FuzzedDataProvider* fdp) -> void {
          uint16_t p_version;
          tSDP_DISC_REC* p_rec =
              generateArbitrarySdpDiscRecord(fdp, false).get();

          SDP_FindProfileVersionInRec(p_rec, fdp->ConsumeIntegral<uint16_t>(),
                                      &p_version);
        },

        // SDP_CreateRecord
        [](FuzzedDataProvider* fdp) -> void {
          uint32_t handle = SDP_CreateRecord();
          if (handle) {
            sdp_record_handles.push_back(handle);
          }
        },

        // SDP_DeleteRecord
        [](FuzzedDataProvider* fdp) -> void {
          SDP_DeleteRecord(
              getArbitraryVectorElement(fdp, sdp_record_handles, true));
        },

        // SDP_AddAttribute
        [](FuzzedDataProvider* fdp) -> void {
          std::vector<uint8_t> val = fdp->ConsumeBytes<uint8_t>(
              fdp->ConsumeIntegralInRange<size_t>(1, 1024));
          if (val.size() > 0) {
            SDP_AddAttribute(
                getArbitraryVectorElement(fdp, sdp_record_handles, true),
                fdp->ConsumeIntegral<uint16_t>(),
                fdp->ConsumeIntegral<uint8_t>(), val.size(), val.data());
          }
        },

        // SDP_AddSequence
        [](FuzzedDataProvider* fdp) -> void {
          SDP_Sequence_Helper seq = generateArbitrarySdpElemSequence(fdp);

          SDP_AddSequence(
              getArbitraryVectorElement(fdp, sdp_record_handles, true),
              fdp->ConsumeIntegral<uint16_t>(), seq.num_elem, seq.type.get(),
              seq.len.get(), seq.p_val.get());
        },

        // SDP_AddUuidSequence
        [](FuzzedDataProvider* fdp) -> void {
          uint16_t num_uuids = fdp->ConsumeIntegralInRange<uint16_t>(1, 64);
          uint16_t* uuids = new uint16_t[num_uuids];
          for (uint16_t i = 0; i < num_uuids; i++) {
            uuids[i] = fdp->ConsumeIntegral<uint16_t>();
          }

          SDP_AddUuidSequence(
              getArbitraryVectorElement(fdp, sdp_record_handles, true),
              fdp->ConsumeIntegral<uint16_t>(), num_uuids, uuids);
          delete[] uuids;
        },

        // SDP_AddProtocolList
        [](FuzzedDataProvider* fdp) -> void {
          std::shared_ptr<tSDP_PROTO_LIST_ELEM> p_proto_list =
              generateArbitrarySdpProtocolElementList(fdp);
          if (p_proto_list) {
            SDP_AddProtocolList(
                getArbitraryVectorElement(fdp, sdp_record_handles, true),
                p_proto_list.get()->num_elems, p_proto_list.get()->list_elem);
          }
        },

        // SDP_AddAdditionProtoLists
        [](FuzzedDataProvider* fdp) -> void {
          uint16_t arr_size;
          tSDP_PROTO_LIST_ELEM** p_proto_list =
              generateArbitrarySdpProtocolElementListArray(fdp, &arr_size);
          if (p_proto_list) {
            if (p_proto_list[0]) {
              SDP_AddAdditionProtoLists(
                  getArbitraryVectorElement(fdp, sdp_record_handles, true),
                  arr_size, p_proto_list[0]);
              for (uint16_t i = 0; i < arr_size; i++) {
                delete p_proto_list[i];
              }
            }
            free(p_proto_list);
          }
        },

        // SDP_AddProfileDescriptorList
        [](FuzzedDataProvider* fdp) -> void {
          SDP_AddProfileDescriptorList(
              getArbitraryVectorElement(fdp, sdp_record_handles, true),
              fdp->ConsumeIntegral<uint16_t>(),
              fdp->ConsumeIntegral<uint16_t>());
        },

        // SDP_AddLanguageBaseAttrIDList
        [](FuzzedDataProvider* fdp) -> void {
          SDP_AddLanguageBaseAttrIDList(
              getArbitraryVectorElement(fdp, sdp_record_handles, true),
              fdp->ConsumeIntegral<uint16_t>(),
              fdp->ConsumeIntegral<uint16_t>(),
              fdp->ConsumeIntegral<uint16_t>());
        },

        // SDP_AddServiceClassIdList
        [](FuzzedDataProvider* fdp) -> void {
          uint16_t num_services = fdp->ConsumeIntegralInRange<uint16_t>(0, 64);
          uint16_t* service_uuids = new uint16_t[num_services];
          for (uint16_t i = 0; i < num_services; i++) {
            service_uuids[i] = fdp->ConsumeIntegral<uint16_t>();
          }

          SDP_AddServiceClassIdList(
              getArbitraryVectorElement(fdp, sdp_record_handles, true),
              num_services, service_uuids);

          delete[] service_uuids;
        },

        // SDP_DeleteAttribute
        [](FuzzedDataProvider* fdp) -> void {
          SDP_DeleteAttribute(
              getArbitraryVectorElement(fdp, sdp_record_handles, true),
              fdp->ConsumeIntegral<uint16_t>());
        },

        // SDP_SetLocalDiRecord
        [](FuzzedDataProvider* fdp) -> void {
          uint32_t handle;  // Output var
          tSDP_DI_RECORD device_info = generateArbitrarySdpDiRecord(fdp);
          SDP_SetLocalDiRecord(&device_info, &handle);
        },

        // SDP_DiDiscover
        [](FuzzedDataProvider* fdp) -> void {
          const RawAddress remote_device = generateRawAddress(fdp);

          // Create a new buffer for the discoveryDB init call
          uint32_t db_size =
              fdp->ConsumeIntegralInRange<uint32_t>(0, SDP_MAX_DB_LEN);
          std::shared_ptr<tSDP_DISCOVERY_DB> p_db(
              reinterpret_cast<tSDP_DISCOVERY_DB*>(malloc(db_size)), free);
          if (p_db) {
            SDP_DiDiscover(remote_device, p_db.get(), db_size,
                           &sdp_disc_cmpl_cb);
          }
        },

        // SDP_GetNumDiRecords
        [](FuzzedDataProvider* fdp) -> void {
          SDP_GetNumDiRecords(
              getArbitraryVectorElement(fdp, sdp_db_vect, true).get());
        },

        // SDP_GetDiRecord
        [](FuzzedDataProvider* fdp) -> void {
          tSDP_DI_GET_RECORD device_info;  // Output var
          SDP_GetDiRecord(
              fdp->ConsumeIntegral<uint8_t>(), &device_info,
              getArbitraryVectorElement(fdp, sdp_db_vect, true).get());
        },

        // SDP_SetTraceLevel
        [](FuzzedDataProvider* fdp) -> void {
          SDP_SetTraceLevel(fdp->ConsumeIntegral<uint8_t>());
        },

        // SDP_FindServiceUUIDInRec
        [](FuzzedDataProvider* fdp) -> void {
          tSDP_DISC_REC* p_rec =
              generateArbitrarySdpDiscRecord(fdp, false).get();
          bluetooth::Uuid uuid;  // Output var
          SDP_FindServiceUUIDInRec(p_rec, &uuid);
        }};

#endif  // FUZZER_SDP_FUNCTIONS_H_