1 /*
2 * Copyright (C) 2022 Huawei Technologies Co., Ltd.
3 * Licensed under the Mulan PSL v2.
4 * You can use this software according to the terms and conditions of the Mulan PSL v2.
5 * You may obtain a copy of Mulan PSL v2 at:
6 * http://license.coscl.org.cn/MulanPSL2
7 * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
8 * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
9 * PURPOSE.
10 * See the Mulan PSL v2 for more details.
11 */
12
13 #include "teeclientopensession_fuzzer.h"
14
15 #include <cstddef>
16 #include <cstdint>
17 #include "tee_client_api.h"
18 #include "tee_client_constants.h"
19 #include "tee_client_type.h"
20
21 namespace OHOS {
TeeClientOpenSessionFuzzTest(const uint8_t * data,size_t size)22 bool TeeClientOpenSessionFuzzTest(const uint8_t *data, size_t size)
23 {
24 bool result = false;
25 if (size > sizeof(TEEC_Context) + sizeof(TEEC_Session) + sizeof(TEEC_UUID) + sizeof(uint32_t) +
26 sizeof(TEEC_Operation) + sizeof(uint32_t) + sizeof(TEEC_Parameter) + sizeof(TEEC_SharedMemory)) {
27 uint8_t *temp = const_cast<uint8_t *>(data);
28 TEEC_Context context = *reinterpret_cast<TEEC_Context *>(temp);
29 temp += sizeof(TEEC_Context);
30 TEEC_Session session = *reinterpret_cast<TEEC_Session *>(temp);
31 temp += sizeof(TEEC_Session);
32 TEEC_UUID uuid = *reinterpret_cast<TEEC_UUID *>(temp);
33 temp += sizeof(TEEC_UUID);
34 uint32_t connectionMethod = *reinterpret_cast<uint32_t *>(temp);
35 temp += sizeof(uint32_t);
36 TEEC_Operation operation = *reinterpret_cast<TEEC_Operation *>(temp);
37 temp += sizeof(TEEC_Operation);
38 uint32_t returnOrigin = *reinterpret_cast<uint32_t *>(temp);
39 temp += sizeof(uint32_t);
40
41 TEEC_Parameter param = *reinterpret_cast<TEEC_Parameter *>(temp);
42 temp += sizeof(TEEC_Parameter);
43 TEEC_SharedMemory memory = *reinterpret_cast<TEEC_SharedMemory *>(temp);
44 temp += sizeof(TEEC_SharedMemory);
45 memory.context = &context;
46 param.memref.parent = &memory;
47 operation.params[0] = param;
48 operation.params[1] = param;
49 operation.params[2] = param;
50 operation.params[3] = param;
51 operation.session = &session;
52
53 TEEC_Result ret = TEEC_OpenSession(&context, &session, &uuid, connectionMethod,
54 reinterpret_cast<const char *>(temp), &operation, &returnOrigin);
55 if (ret == TEEC_SUCCESS) {
56 TEEC_CloseSession(&session);
57 }
58 }
59 return result;
60 }
61 }
62
63 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)64 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
65 {
66 /* Run your code on data */
67 OHOS::TeeClientOpenSessionFuzzTest(data, size);
68 return 0;
69 }