1 /*
2 * Copyright (C) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "mdns_client_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #include "message_parcel.h"
22 #include "refbase.h"
23 #include <securec.h>
24
25 #include "i_mdns_event.h"
26 #include "net_manager_ext_constants.h"
27 #define private public
28 #include "mdns_service.h"
29 #undef private
30
31 namespace OHOS {
32 namespace NetManagerStandard {
33
34 class IRegistrationCallbackTest : public IRemoteStub<IRegistrationCallback> {
35 public:
HandleRegister(const MDnsServiceInfo & serviceInfo,int32_t retCode)36 void HandleRegister(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
HandleUnRegister(const MDnsServiceInfo & serviceInfo,int32_t retCode)37 void HandleUnRegister(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
HandleRegisterResult(const MDnsServiceInfo & serviceInfo,int32_t retCode)38 void HandleRegisterResult(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
39 };
40
41 class IDiscoveryCallbackTest : public IRemoteStub<IDiscoveryCallback> {
42 public:
HandleStartDiscover(const MDnsServiceInfo & serviceInfo,int32_t retCode)43 void HandleStartDiscover(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
HandleStopDiscover(const MDnsServiceInfo & serviceInfo,int32_t retCode)44 void HandleStopDiscover(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
HandleServiceFound(const MDnsServiceInfo & serviceInfo,int32_t retCode)45 void HandleServiceFound(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
HandleServiceLost(const MDnsServiceInfo & serviceInfo,int32_t retCode)46 void HandleServiceLost(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
47 };
48
49 class IResolveCallbackTest : public IRemoteStub<IResolveCallback> {
50 public:
HandleResolveResult(const MDnsServiceInfo & serviceInfo,int32_t retCode)51 void HandleResolveResult(const MDnsServiceInfo &serviceInfo, int32_t retCode) override {}
52 };
53
54 static const uint8_t *g_baseFuzzData = nullptr;
55 static size_t g_baseFuzzSize = 0;
56 static size_t g_baseFuzzPos;
57 static bool g_isInited = false;
58 static constexpr size_t STR_LEN = 10;
59
InitGlobalData(const uint8_t * data,size_t size)60 bool InitGlobalData(const uint8_t *data, size_t size)
61 {
62 if (data == nullptr || size == 0) {
63 return false;
64 }
65 g_baseFuzzData = data;
66 g_baseFuzzSize = size;
67 g_baseFuzzPos = 0;
68 return true;
69 }
70
GetData()71 template <class T> T GetData()
72 {
73 T object{};
74 size_t objectSize = sizeof(object);
75 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
76 return object;
77 }
78 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
79 if (ret != EOK) {
80 return {};
81 }
82 g_baseFuzzPos += objectSize;
83 return object;
84 }
85
GetStringFromData(int strlen)86 std::string GetStringFromData(int strlen)
87 {
88 char cstr[strlen];
89 cstr[strlen - 1] = '\0';
90 for (int i = 0; i < strlen - 1; i++) {
91 cstr[i] = GetData<char>();
92 }
93 std::string str(cstr);
94 return str;
95 }
96
WriteInterfaceToken(MessageParcel & data)97 bool WriteInterfaceToken(MessageParcel &data)
98 {
99 return data.WriteInterfaceToken(IMDnsService::GetDescriptor());
100 }
101
Init()102 void Init()
103 {
104 if (!g_isInited) {
105 DelayedSingleton<MDnsService>::GetInstance()->Init();
106 g_isInited = true;
107 }
108 }
109
OnRemoteRequest(uint32_t code,MessageParcel & data)110 int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
111 {
112 if (!g_isInited) {
113 Init();
114 }
115
116 MessageParcel reply;
117 MessageOption option;
118 return DelayedSingleton<MDnsService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
119 }
120
RegisterServiceFuzzTest(const uint8_t * data,size_t size)121 void RegisterServiceFuzzTest(const uint8_t *data, size_t size)
122 {
123 NETMGR_EXT_LOG_D("RegisterServiceFuzzTest enter");
124 if (!InitGlobalData(data, size)) {
125 return;
126 }
127
128 MessageParcel dataParcel;
129 if (!WriteInterfaceToken(dataParcel)) {
130 return;
131 }
132
133 sptr<MDnsServiceInfo> info = new (std::nothrow) MDnsServiceInfo();
134 info->name = GetStringFromData(STR_LEN);
135 info->type = GetStringFromData(STR_LEN);
136 info->family = GetData<int32_t>();
137 info->addr = GetStringFromData(STR_LEN);
138 info->port = GetData<int32_t>();
139 std::string str = GetStringFromData(STR_LEN);
140 info->txtRecord = std::vector<uint8_t>(str.begin(), str.end());
141 if (!MDnsServiceInfo::Marshalling(dataParcel, info)) {
142 return;
143 }
144
145 sptr<IRegistrationCallbackTest> callback = new (std::nothrow) IRegistrationCallbackTest();
146 if (callback == nullptr) {
147 return;
148 }
149 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
150
151 OnRemoteRequest(IMDnsService::CMD_REGISTER, dataParcel);
152 }
153
UnRegisterServiceFuzzTest(const uint8_t * data,size_t size)154 void UnRegisterServiceFuzzTest(const uint8_t *data, size_t size)
155 {
156 NETMGR_EXT_LOG_D("UnRegisterServiceFuzzTest enter");
157 if (!InitGlobalData(data, size)) {
158 return;
159 }
160
161 MessageParcel dataParcel;
162 if (!WriteInterfaceToken(dataParcel)) {
163 return;
164 }
165
166 sptr<MDnsServiceInfo> info = new (std::nothrow) MDnsServiceInfo();
167 info->name = GetStringFromData(STR_LEN);
168 info->type = GetStringFromData(STR_LEN);
169 info->family = GetData<int32_t>();
170 info->addr = GetStringFromData(STR_LEN);
171 info->port = GetData<int32_t>();
172 std::string str = GetStringFromData(STR_LEN);
173 info->txtRecord = std::vector<uint8_t>(str.begin(), str.end());
174 if (!MDnsServiceInfo::Marshalling(dataParcel, info)) {
175 return;
176 }
177
178 sptr<IRegistrationCallbackTest> callback = new (std::nothrow) IRegistrationCallbackTest();
179 if (callback == nullptr) {
180 return;
181 }
182 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
183
184 OnRemoteRequest(IMDnsService::CMD_STOP_REGISTER, dataParcel);
185 }
186
StartDiscoverServiceFuzzTest(const uint8_t * data,size_t size)187 void StartDiscoverServiceFuzzTest(const uint8_t *data, size_t size)
188 {
189 NETMGR_EXT_LOG_D("StartDiscoverServiceFuzzTest enter");
190 if (!InitGlobalData(data, size)) {
191 return;
192 }
193
194 MessageParcel dataParcel;
195 if (!WriteInterfaceToken(dataParcel)) {
196 return;
197 }
198
199 sptr<MDnsServiceInfo> info = new (std::nothrow) MDnsServiceInfo();
200 info->name = GetStringFromData(STR_LEN);
201 info->type = GetStringFromData(STR_LEN);
202 info->family = GetData<int32_t>();
203 info->addr = GetStringFromData(STR_LEN);
204 info->port = GetData<int32_t>();
205 std::string str = GetStringFromData(STR_LEN);
206 info->txtRecord = std::vector<uint8_t>(str.begin(), str.end());
207 if (!MDnsServiceInfo::Marshalling(dataParcel, info)) {
208 return;
209 }
210
211 sptr<IDiscoveryCallbackTest> callback = new (std::nothrow) IDiscoveryCallbackTest();
212 if (callback == nullptr) {
213 return;
214 }
215 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
216
217 OnRemoteRequest(IMDnsService::CMD_DISCOVER, dataParcel);
218 }
219
StopDiscoverServiceFuzzTest(const uint8_t * data,size_t size)220 void StopDiscoverServiceFuzzTest(const uint8_t *data, size_t size)
221 {
222 NETMGR_EXT_LOG_D("StopDiscoverServiceFuzzTest enter");
223 if (!InitGlobalData(data, size)) {
224 return;
225 }
226
227 MessageParcel dataParcel;
228 if (!WriteInterfaceToken(dataParcel)) {
229 return;
230 }
231
232 sptr<MDnsServiceInfo> info = new (std::nothrow) MDnsServiceInfo();
233 info->name = GetStringFromData(STR_LEN);
234 info->type = GetStringFromData(STR_LEN);
235 info->family = GetData<int32_t>();
236 info->addr = GetStringFromData(STR_LEN);
237 info->port = GetData<int32_t>();
238 std::string str = GetStringFromData(STR_LEN);
239 info->txtRecord = std::vector<uint8_t>(str.begin(), str.end());
240 if (!MDnsServiceInfo::Marshalling(dataParcel, info)) {
241 return;
242 }
243
244 sptr<IDiscoveryCallbackTest> callback = new (std::nothrow) IDiscoveryCallbackTest();
245 if (callback == nullptr) {
246 return;
247 }
248 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
249
250 OnRemoteRequest(IMDnsService::CMD_STOP_DISCOVER, dataParcel);
251 }
252
ResolveServiceFuzzTest(const uint8_t * data,size_t size)253 void ResolveServiceFuzzTest(const uint8_t *data, size_t size)
254 {
255 NETMGR_EXT_LOG_D("ResolveServiceFuzzTest enter");
256 if (!InitGlobalData(data, size)) {
257 return;
258 }
259
260 MessageParcel dataParcel;
261 if (!WriteInterfaceToken(dataParcel)) {
262 return;
263 }
264
265 sptr<MDnsServiceInfo> info = new (std::nothrow) MDnsServiceInfo();
266 info->name = GetStringFromData(STR_LEN);
267 info->type = GetStringFromData(STR_LEN);
268 info->family = GetData<int32_t>();
269 info->addr = GetStringFromData(STR_LEN);
270 info->port = GetData<int32_t>();
271 std::string str = GetStringFromData(STR_LEN);
272 info->txtRecord = std::vector<uint8_t>(str.begin(), str.end());
273 if (!MDnsServiceInfo::Marshalling(dataParcel, info)) {
274 return;
275 }
276
277 sptr<IResolveCallbackTest> callback = new (std::nothrow) IResolveCallbackTest();
278 if (callback == nullptr) {
279 return;
280 }
281 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
282
283 OnRemoteRequest(IMDnsService::CMD_RESOLVE, dataParcel);
284 }
285 } // namespace NetManagerStandard
286 } // namespace OHOS
287
288 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)289 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
290 {
291 /* Run your code on data */
292 OHOS::NetManagerStandard::RegisterServiceFuzzTest(data, size);
293 OHOS::NetManagerStandard::UnRegisterServiceFuzzTest(data, size);
294 OHOS::NetManagerStandard::StartDiscoverServiceFuzzTest(data, size);
295 OHOS::NetManagerStandard::StopDiscoverServiceFuzzTest(data, size);
296 OHOS::NetManagerStandard::ResolveServiceFuzzTest(data, size);
297 return 0;
298 }
299