1 /*
2 * Copyright (C) 2022 Huawei Technologies Co., Ltd.
3 * Licensed under the Mulan PSL v2.
4 * You can use this software according to the terms and conditions of the Mulan PSL v2.
5 * You may obtain a copy of Mulan PSL v2 at:
6 * http://license.coscl.org.cn/MulanPSL2
7 * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
8 * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
9 * PURPOSE.
10 * See the Mulan PSL v2 for more details.
11 */
12
13 #include "libteecvendorregistersharedmemory_fuzzer.h"
14
15 #include <cstddef>
16 #include <cstdint>
17 #include "tee_client_api.h"
18 #include "tee_client_constants.h"
19 #include "tee_client_type.h"
20 #include "tee_client_inner.h"
21 #include "tee_client_inner_api.h"
22
23 namespace OHOS {
LibteecVendorRegisterSharedMemoryFuzzTest(const uint8_t * data,size_t size)24 bool LibteecVendorRegisterSharedMemoryFuzzTest(const uint8_t *data, size_t size)
25 {
26 bool result = false;
27 if (size > sizeof(TEEC_Context) + sizeof(TEEC_SharedMemory)) {
28 uint8_t *temp = const_cast<uint8_t *>(data);
29 TEEC_Context context = *reinterpret_cast<TEEC_Context *>(temp);
30 temp += sizeof(TEEC_Context);
31 TEEC_SharedMemory memory = *reinterpret_cast<TEEC_SharedMemory *>(temp);
32 (void)TEEC_RegisterSharedMemory(&context, &memory);
33 }
34 return result;
35 }
36
TEEC_RegisterSharedMemoryInnerTest_001(const uint8_t * data,size_t size)37 void TEEC_RegisterSharedMemoryInnerTest_001(const uint8_t *data, size_t size)
38 {
39 TEEC_ContextInner context = { 0 };
40 TEEC_SharedMemoryInner sharedMem = { 0 };
41
42 TEEC_Result ret = TEEC_RegisterSharedMemoryInner(NULL, &sharedMem);
43
44 ret = TEEC_RegisterSharedMemoryInner(&context, NULL);
45
46 sharedMem.buffer = NULL;
47 ret = TEEC_RegisterSharedMemoryInner(&context, &sharedMem);
48
49 char buffer[4] = { 0 };
50 sharedMem.buffer = buffer;
51 sharedMem.flags = 0xffffffff;
52 ret = TEEC_RegisterSharedMemoryInner(&context, &sharedMem);
53 (void)data;
54 (void)size;
55 (void)ret;
56 }
57
TEEC_RegisterSharedMemoryTest_001(const uint8_t * data,size_t size)58 void TEEC_RegisterSharedMemoryTest_001(const uint8_t *data, size_t size)
59 {
60 TEEC_Context context = { 0 };
61 TEEC_SharedMemory sharedMem = { 0 };
62
63 TEEC_Result ret = TEEC_RegisterSharedMemory(NULL, &sharedMem);
64
65 ret = TEEC_RegisterSharedMemory(&context, NULL);
66
67 ret = TEEC_InitializeContext(NULL, &context);
68
69 char buf[4] = { 0 };
70 sharedMem.buffer = buf;
71 sharedMem.size = 4; // 4 size of memory
72 sharedMem.flags = TEEC_MEM_INPUT;
73 ret = TEEC_RegisterSharedMemory(&context, &sharedMem);
74 (void)data;
75 (void)size;
76 (void)ret;
77 }
78 }
79
80 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)81 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
82 {
83 /* Run your code on data */
84 OHOS::LibteecVendorRegisterSharedMemoryFuzzTest(data, size);
85 OHOS::TEEC_RegisterSharedMemoryInnerTest_001(data, size);
86 OHOS::TEEC_RegisterSharedMemoryTest_001(data, size);
87 return 0;
88 }