1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <ctime>
17 #include <thread>
18 #include <vector>
19
20 #include <securec.h>
21
22 #include "data_flow_statistics.h"
23 #include "i_net_stats_service.h"
24 #include "net_mgr_log_wrapper.h"
25 #include "net_stats_client.h"
26 #include "net_stats_constants.h"
27 #define private public
28 #include "net_stats_service.h"
29 #include "net_stats_service_stub.h"
30
31 namespace OHOS {
32 namespace NetManagerStandard {
33 namespace {
34 const uint8_t *g_baseFuzzData = nullptr;
35 size_t g_baseFuzzSize = 0;
36 size_t g_baseFuzzPos;
37 constexpr size_t STR_LEN = 10;
38 } // namespace
39
GetData()40 template <class T> T GetData()
41 {
42 T object{};
43 size_t objectSize = sizeof(object);
44 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
45 return object;
46 }
47 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
48 if (ret != EOK) {
49 return {};
50 }
51 g_baseFuzzPos += objectSize;
52 return object;
53 }
54
GetStringFromData(int strlen)55 std::string GetStringFromData(int strlen)
56 {
57 char cstr[strlen];
58 cstr[strlen - 1] = '\0';
59 for (int i = 0; i < strlen - 1; i++) {
60 cstr[i] = GetData<char>();
61 }
62 std::string str(cstr);
63 return str;
64 }
65
66 class INetStatsCallbackTest : public IRemoteStub<INetStatsCallback> {
67 public:
NetIfaceStatsChanged(const std::string & iface)68 int32_t NetIfaceStatsChanged(const std::string &iface)
69 {
70 return 0;
71 }
72
NetUidStatsChanged(const std::string & iface,uint32_t uid)73 int32_t NetUidStatsChanged(const std::string &iface, uint32_t uid)
74 {
75 return 0;
76 }
77 };
78
79 static bool g_isInited = false;
80
Init()81 void Init()
82 {
83 if (!g_isInited) {
84 DelayedSingleton<NetStatsService>::GetInstance()->Init();
85 g_isInited = false;
86 } else {
87 g_isInited = true;
88 }
89 }
90
OnRemoteRequest(uint32_t code,MessageParcel & data)91 int32_t OnRemoteRequest(uint32_t code, MessageParcel &data)
92 {
93 if (!g_isInited) {
94 Init();
95 }
96
97 MessageParcel reply;
98 MessageOption option;
99
100 int32_t ret = DelayedSingleton<NetStatsService>::GetInstance()->OnRemoteRequest(code, data, reply, option);
101 return ret;
102 }
103
WriteInterfaceToken(MessageParcel & data)104 bool WriteInterfaceToken(MessageParcel &data)
105 {
106 if (!data.WriteInterfaceToken(NetStatsServiceStub::GetDescriptor())) {
107 return false;
108 }
109 return true;
110 }
111
RegisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)112 void RegisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
113 {
114 if ((data == nullptr) || (size == 0)) {
115 return;
116 }
117
118 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
119 if (callback == nullptr) {
120 return;
121 }
122
123 MessageParcel dataParcel;
124 if (!WriteInterfaceToken(dataParcel)) {
125 return;
126 }
127 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
128
129 OnRemoteRequest(INetStatsService::CMD_NSM_REGISTER_NET_STATS_CALLBACK, dataParcel);
130 }
131
UnregisterNetStatsCallbackFuzzTest(const uint8_t * data,size_t size)132 void UnregisterNetStatsCallbackFuzzTest(const uint8_t *data, size_t size)
133 {
134 if ((data == nullptr) || (size == 0)) {
135 return;
136 }
137
138 sptr<INetStatsCallbackTest> callback = new (std::nothrow) INetStatsCallbackTest();
139 if (callback == nullptr) {
140 return;
141 }
142
143 MessageParcel dataParcel;
144 if (!WriteInterfaceToken(dataParcel)) {
145 return;
146 }
147 dataParcel.WriteRemoteObject(callback->AsObject().GetRefPtr());
148
149 OnRemoteRequest(INetStatsService::CMD_NSM_UNREGISTER_NET_STATS_CALLBACK, dataParcel);
150 }
151
GetIfaceRxBytesFuzzTest(const uint8_t * data,size_t size)152 void GetIfaceRxBytesFuzzTest(const uint8_t *data, size_t size)
153 {
154 if ((data == nullptr) || (size == 0)) {
155 return;
156 }
157 g_baseFuzzData = data;
158 g_baseFuzzSize = size;
159 g_baseFuzzPos = 0;
160
161 std::string interfaceName = GetStringFromData(STR_LEN);
162 MessageParcel dataParcel;
163 if (!WriteInterfaceToken(dataParcel)) {
164 return;
165 }
166 dataParcel.WriteString(interfaceName);
167
168 OnRemoteRequest(INetStatsService::CMD_NSM_UNREGISTER_NET_STATS_CALLBACK, dataParcel);
169 }
170
GetIfaceTxBytesFuzzTest(const uint8_t * data,size_t size)171 void GetIfaceTxBytesFuzzTest(const uint8_t *data, size_t size)
172 {
173 if ((data == nullptr) || (size == 0)) {
174 return;
175 }
176 g_baseFuzzData = data;
177 g_baseFuzzSize = size;
178 g_baseFuzzPos = 0;
179
180 std::string interfaceName = GetStringFromData(STR_LEN);
181 MessageParcel dataParcel;
182 if (!WriteInterfaceToken(dataParcel)) {
183 return;
184 }
185 dataParcel.WriteString(interfaceName);
186
187 OnRemoteRequest(INetStatsService::CMD_GET_IFACE_TXBYTES, dataParcel);
188 }
189
GetUidRxBytesFuzzTest(const uint8_t * data,size_t size)190 void GetUidRxBytesFuzzTest(const uint8_t *data, size_t size)
191 {
192 if ((data == nullptr) || (size == 0)) {
193 return;
194 }
195 g_baseFuzzData = data;
196 g_baseFuzzSize = size;
197 g_baseFuzzPos = 0;
198
199 uint32_t uid = GetData<uint32_t>();
200 MessageParcel dataParcel;
201 if (!WriteInterfaceToken(dataParcel)) {
202 return;
203 }
204 dataParcel.WriteUint32(uid);
205
206 OnRemoteRequest(INetStatsService::CMD_GET_UID_RXBYTES, dataParcel);
207 }
208
GetUidTxBytesFuzzTest(const uint8_t * data,size_t size)209 void GetUidTxBytesFuzzTest(const uint8_t *data, size_t size)
210 {
211 if ((data == nullptr) || (size == 0)) {
212 return;
213 }
214 g_baseFuzzData = data;
215 g_baseFuzzSize = size;
216 g_baseFuzzPos = 0;
217
218 uint32_t uid = GetData<uint32_t>();
219 MessageParcel dataParcel;
220 if (!WriteInterfaceToken(dataParcel)) {
221 return;
222 }
223 dataParcel.WriteUint32(uid);
224
225 OnRemoteRequest(INetStatsService::CMD_GET_UID_TXBYTES, dataParcel);
226 }
227
GetCellularRxBytesFuzzTest(const uint8_t * data,size_t size)228 void GetCellularRxBytesFuzzTest(const uint8_t *data, size_t size)
229 {
230 if ((data == nullptr) || (size == 0)) {
231 return;
232 }
233 g_baseFuzzData = data;
234 g_baseFuzzSize = size;
235 g_baseFuzzPos = 0;
236
237 MessageParcel dataParcel;
238 if (!WriteInterfaceToken(dataParcel)) {
239 return;
240 }
241
242 OnRemoteRequest(INetStatsService::CMD_GET_CELLULAR_RXBYTES, dataParcel);
243 }
244
GetCellularTxBytesFuzzTest(const uint8_t * data,size_t size)245 void GetCellularTxBytesFuzzTest(const uint8_t *data, size_t size)
246 {
247 if ((data == nullptr) || (size == 0)) {
248 return;
249 }
250 g_baseFuzzData = data;
251 g_baseFuzzSize = size;
252 g_baseFuzzPos = 0;
253
254 MessageParcel dataParcel;
255 if (!WriteInterfaceToken(dataParcel)) {
256 return;
257 }
258
259 OnRemoteRequest(INetStatsService::CMD_GET_CELLULAR_TXBYTES, dataParcel);
260 }
261
GetAllRxBytesFuzzTest(const uint8_t * data,size_t size)262 void GetAllRxBytesFuzzTest(const uint8_t *data, size_t size)
263 {
264 if ((data == nullptr) || (size == 0)) {
265 return;
266 }
267 g_baseFuzzData = data;
268 g_baseFuzzSize = size;
269 g_baseFuzzPos = 0;
270
271 MessageParcel dataParcel;
272 if (!WriteInterfaceToken(dataParcel)) {
273 return;
274 }
275
276 OnRemoteRequest(INetStatsService::CMD_GET_ALL_RXBYTES, dataParcel);
277 }
278
GetAllTxBytesFuzzTest(const uint8_t * data,size_t size)279 void GetAllTxBytesFuzzTest(const uint8_t *data, size_t size)
280 {
281 if ((data == nullptr) || (size == 0)) {
282 return;
283 }
284 g_baseFuzzData = data;
285 g_baseFuzzSize = size;
286 g_baseFuzzPos = 0;
287
288 MessageParcel dataParcel;
289 if (!WriteInterfaceToken(dataParcel)) {
290 return;
291 }
292
293 OnRemoteRequest(INetStatsService::CMD_GET_ALL_TXBYTES, dataParcel);
294 }
295 } // namespace NetManagerStandard
296 } // namespace OHOS
297
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)298 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
299 {
300 /* Run your code on data */
301 OHOS::NetManagerStandard::RegisterNetStatsCallbackFuzzTest(data, size);
302 OHOS::NetManagerStandard::UnregisterNetStatsCallbackFuzzTest(data, size);
303 OHOS::NetManagerStandard::GetIfaceRxBytesFuzzTest(data, size);
304 OHOS::NetManagerStandard::GetIfaceTxBytesFuzzTest(data, size);
305 OHOS::NetManagerStandard::GetUidRxBytesFuzzTest(data, size);
306 OHOS::NetManagerStandard::GetUidTxBytesFuzzTest(data, size);
307 OHOS::NetManagerStandard::GetCellularRxBytesFuzzTest(data, size);
308 OHOS::NetManagerStandard::GetCellularTxBytesFuzzTest(data, size);
309 OHOS::NetManagerStandard::GetAllRxBytesFuzzTest(data, size);
310 OHOS::NetManagerStandard::GetAllTxBytesFuzzTest(data, size);
311 return 0;
312 }