1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include <string>
16 #include "avsession_log.h"
17 #include "softbussessionmanager_fuzzer.h"
18 #include "softbus_session_manager.h"
19 #include "securec.h"
20
21 using namespace std;
22 namespace OHOS::AVSession {
23 static const int32_t MIN_SIZE_NUM = 4;
24 static const uint8_t *RAW_DATA = nullptr;
25 static size_t g_dataSize = 0;
26 static size_t g_pos;
27
28 template<class T>
GetData()29 T GetData()
30 {
31 T object {};
32 size_t objectSize = sizeof(object);
33 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
34 return object;
35 }
36 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
37 if (ret != EOK) {
38 return {};
39 }
40 g_pos += objectSize;
41 return object;
42 }
43
44 class SoftbusSessionListenerDemo : public SoftbusSessionListener {
45 public:
OnBind(int32_t socket,PeerSocketInfo info)46 void OnBind(int32_t socket, PeerSocketInfo info) override {};
OnShutdown(int32_t socket,ShutdownReason reason)47 void OnShutdown(int32_t socket, ShutdownReason reason) override {};
OnBytes(int32_t socket,const void * data,int32_t dataLen)48 void OnBytes(int32_t socket, const void *data, int32_t dataLen) override {};
OnMessage(int32_t socket,const void * data,int32_t dataLen)49 void OnMessage(int32_t socket, const void *data, int32_t dataLen) override {};
50 };
51
SoftbusSessionManagerFuzzTest(uint8_t * data,size_t size)52 void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size)
53 {
54 std::shared_ptr<SoftbusSessionManager> manager_ = std::make_shared<SoftbusSessionManager>();
55 std::shared_ptr<SoftbusSessionListenerDemo> softbusSessionListenerDemo =
56 std::make_shared<SoftbusSessionListenerDemo>();
57 manager_->AddSessionListener(softbusSessionListenerDemo);
58 int32_t socket = GetData<uint8_t>();
59 std::string infoName = std::to_string(GetData<uint8_t>());
60 std::string infoNetworkId = std::to_string(GetData<uint8_t>());
61 std::string infoPkgName = std::to_string(GetData<uint8_t>());
62 PeerSocketInfo info = {
63 .name = const_cast<char *>(infoName.c_str()),
64 .networkId = const_cast<char *>(infoNetworkId.c_str()),
65 .pkgName = const_cast<char *>(infoPkgName.c_str()),
66 .dataType = DATA_TYPE_BYTES,
67 };
68 manager_->OnBind(socket, info);
69 manager_->OnShutdown(socket, ShutdownReason::SHUTDOWN_REASON_LOCAL);
70
71 MessageParcel data_;
72 data_.WriteRawData(data, size);
73
74 std::string deviceId = std::to_string(GetData<uint8_t>());
75 manager_->ObtainPeerDeviceId(socket, deviceId);
76
77 data_.RewindRead(GetData<uint8_t>());
78 auto obj = std::make_unique<int32_t>(data_.ReadInt32());
79 const void *objectId = obj.get();
80 unsigned int dataLen = GetData<unsigned int>();
81 manager_->OnBytes(socket, objectId, dataLen);
82 manager_->OnBytes(socket, nullptr, dataLen);
83 manager_->OnMessage(socket, objectId, dataLen);
84 manager_->OnMessage(socket, nullptr, dataLen);
85
86 std::string pkg = to_string(GetData<uint8_t>());
87 manager_->Socket(pkg);
88 manager_->Shutdown(socket);
89
90 std::string inforOne = std::to_string(GetData<uint8_t>());
91 std::string inforTwo = std::to_string(GetData<uint8_t>());
92 manager_->SendMessage(socket, inforOne);
93 manager_->SendMessage(socket, inforTwo);
94 manager_->SendBytes(socket, inforOne);
95 manager_->SendBytes(socket, inforTwo);
96
97 info.networkId = nullptr;
98 manager_->OnBind(socket, info);
99
100 manager_->AddSessionListener(nullptr);
101 }
102
SoftbusSessionManagerOnRemoteRequest(uint8_t * data,size_t size)103 void SoftbusSessionManagerOnRemoteRequest(uint8_t* data, size_t size)
104 {
105 auto softbusSessionManager = std::make_unique<SoftbusSessionManagerFuzzer>();
106 if (softbusSessionManager == nullptr) {
107 SLOGI("softbusSessionManager is null");
108 return;
109 }
110 softbusSessionManager->SoftbusSessionManagerFuzzTest(data, size);
111 }
112 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)113 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
114 {
115 SLOGI("the maximum length of size should not be verified");
116 if ((data == nullptr) || (size < MIN_SIZE_NUM)) {
117 return 0;
118 }
119 RAW_DATA = data;
120 g_dataSize = size;
121 g_pos = 0;
122 /* Run your code on data */
123 SoftbusSessionManagerOnRemoteRequest(data, size);
124 return 0;
125 }
126 }