1 /*
2 * wpa_supplicant - P2P fuzzer
3 * Copyright (c) 2015, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "p2p/p2p.h"
15 #include "../fuzzer-common.h"
16
17
debug_print(void * ctx,int level,const char * msg)18 static void debug_print(void *ctx, int level, const char *msg)
19 {
20 wpa_printf(level, "P2P: %s", msg);
21 }
22
23
find_stopped(void * ctx)24 static void find_stopped(void *ctx)
25 {
26 }
27
28
start_listen(void * ctx,unsigned int freq,unsigned int duration,const struct wpabuf * probe_resp_ie)29 static int start_listen(void *ctx, unsigned int freq,
30 unsigned int duration,
31 const struct wpabuf *probe_resp_ie)
32 {
33 return 0;
34 }
35
36
stop_listen(void * ctx)37 static void stop_listen(void *ctx)
38 {
39 }
40
41
dev_found(void * ctx,const u8 * addr,const struct p2p_peer_info * info,int new_device)42 static void dev_found(void *ctx, const u8 *addr,
43 const struct p2p_peer_info *info,
44 int new_device)
45 {
46 }
47
48
dev_lost(void * ctx,const u8 * dev_addr)49 static void dev_lost(void *ctx, const u8 *dev_addr)
50 {
51 }
52
53
send_action(void * ctx,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * buf,size_t len,unsigned int wait_time,int * scheduled)54 static int send_action(void *ctx, unsigned int freq, const u8 *dst,
55 const u8 *src, const u8 *bssid, const u8 *buf,
56 size_t len, unsigned int wait_time, int *scheduled)
57 {
58 *scheduled = 0;
59 return 0;
60 }
61
62
send_action_done(void * ctx)63 static void send_action_done(void *ctx)
64 {
65 }
66
67
go_neg_req_rx(void * ctx,const u8 * src,u16 dev_passwd_id,u8 go_intent)68 static void go_neg_req_rx(void *ctx, const u8 *src, u16 dev_passwd_id,
69 u8 go_intent)
70 {
71 }
72
73
init_p2p(void)74 static struct p2p_data * init_p2p(void)
75 {
76 struct p2p_config p2p;
77
78 os_memset(&p2p, 0, sizeof(p2p));
79 p2p.max_peers = 100;
80 p2p.passphrase_len = 8;
81 p2p.channels.reg_classes = 1;
82 p2p.channels.reg_class[0].reg_class = 81;
83 p2p.channels.reg_class[0].channel[0] = 1;
84 p2p.channels.reg_class[0].channel[1] = 2;
85 p2p.channels.reg_class[0].channels = 2;
86 p2p.debug_print = debug_print;
87 p2p.find_stopped = find_stopped;
88 p2p.start_listen = start_listen;
89 p2p.stop_listen = stop_listen;
90 p2p.dev_found = dev_found;
91 p2p.dev_lost = dev_lost;
92 p2p.send_action = send_action;
93 p2p.send_action_done = send_action_done;
94 p2p.go_neg_req_rx = go_neg_req_rx;
95
96 return p2p_init(&p2p);
97 }
98
99
100 struct arg_ctx {
101 const u8 *data;
102 size_t data_len;
103 struct p2p_data *p2p;
104 int count;
105 };
106
107
test_send(void * eloop_data,void * user_ctx)108 static void test_send(void *eloop_data, void *user_ctx)
109 {
110 struct arg_ctx *ctx = eloop_data;
111 struct os_reltime rx_time;
112
113 wpa_hexdump(MSG_MSGDUMP, "fuzzer - IEs", ctx->data, ctx->data_len);
114
115 os_memset(&rx_time, 0, sizeof(rx_time));
116 p2p_scan_res_handler(ctx->p2p, (u8 *) "\x02\x00\x00\x00\x01\x00", 2412,
117 &rx_time, 0, ctx->data, ctx->data_len);
118 p2p_scan_res_handled(ctx->p2p, 0);
119
120 p2p_probe_req_rx(ctx->p2p, (u8 *) "\x02\x00\x00\x00\x01\x00",
121 (u8 *) "\x02\x00\x00\x00\x00\x00",
122 (u8 *) "\x02\x00\x00\x00\x00\x00",
123 ctx->data, ctx->data_len, 2412, 0);
124
125 if (ctx->data_len >= IEEE80211_HDRLEN + 1) {
126 struct os_reltime rx_time;
127 const struct ieee80211_mgmt *mgmt;
128
129 mgmt = (const struct ieee80211_mgmt *) ctx->data;
130 os_memset(&rx_time, 0, sizeof(rx_time));
131 p2p_rx_action(ctx->p2p, mgmt->da, mgmt->sa, mgmt->bssid,
132 mgmt->u.action.category,
133 (const u8 *) ctx->data + IEEE80211_HDRLEN + 1,
134 ctx->data_len - IEEE80211_HDRLEN - 1, 2412);
135 }
136
137 eloop_terminate();
138 }
139
140
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)141 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
142 {
143 struct p2p_data *p2p;
144 struct arg_ctx ctx;
145
146 wpa_fuzzer_set_debug_level();
147
148 if (os_program_init())
149 return -1;
150
151 if (eloop_init()) {
152 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
153 return 0;
154 }
155
156 p2p = init_p2p();
157 if (!p2p) {
158 wpa_printf(MSG_ERROR, "P2P init failed");
159 return 0;
160 }
161
162 os_memset(&ctx, 0, sizeof(ctx));
163 ctx.p2p = p2p;
164 ctx.data = data;
165 ctx.data_len = size;
166
167 eloop_register_timeout(0, 0, test_send, &ctx, NULL);
168
169 wpa_printf(MSG_DEBUG, "Starting eloop");
170 eloop_run();
171 wpa_printf(MSG_DEBUG, "eloop done");
172
173 p2p_deinit(p2p);
174 eloop_destroy();
175 os_program_deinit();
176
177 return 0;
178 }
179
