1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hidreadtimeout_fuzzer.h"
17 #include <cstddef>
18 #include <cstdint>
19
20 #include "hdf_log.h"
21 #include "v1_1/hid_ddk_stub.h"
22 #include "v1_1/ihid_ddk.h"
23
24 using namespace OHOS::HDI::Input::Ddk::V1_1;
25
26 namespace OHOS {
27 namespace HID {
28 constexpr size_t THRESHOLD = 10;
29 constexpr int32_t OFFSET = 4;
30 const std::u16string HID_INTERFACE_TOKEN = u"ohos.hdi.input.ddk.v1_1.IHidDdk";
31
HidReadTimeoutFuzzerTest(const uint8_t * rawData,size_t size)32 bool HidReadTimeoutFuzzerTest(const uint8_t *rawData, size_t size)
33 {
34 if (rawData == nullptr) {
35 HDF_LOGE("%{public}s: rawData is null", __func__);
36 return false;
37 }
38 rawData = rawData + OFFSET;
39 size = size - OFFSET;
40
41 MessageParcel data;
42 data.WriteInterfaceToken(HID_INTERFACE_TOKEN);
43 data.WriteBuffer(rawData, size);
44 data.RewindRead(0);
45 MessageParcel reply;
46 MessageOption option;
47 sptr<OHOS::HDI::Input::Ddk::V1_1::IHidDdk> hidDdkInterface = OHOS::HDI::Input::Ddk::V1_1::IHidDdk::Get(false);
48 if (hidDdkInterface == nullptr) {
49 HDF_LOGE("%{public}s: get hidDdkInterface failed", __func__);
50 return false;
51 }
52 sptr<OHOS::HDI::Input::Ddk::V1_1::HidDdkStub> hidDdk = new OHOS::HDI::Input::Ddk::V1_1::HidDdkStub(hidDdkInterface);
53 if (hidDdk == nullptr) {
54 HDF_LOGE("%{public}s: new hidDdk failed", __func__);
55 return false;
56 }
57 hidDdk->OnRemoteRequest(CMD_HID_DDK_READ_TIMEOUT, data, reply, option);
58
59 return true;
60 }
61 } // namespace HID
62 } // namespace OHOS
63
64 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)65 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
66 {
67 if (size < OHOS::HID::THRESHOLD) {
68 return 0;
69 }
70
71 OHOS::HID::HidReadTimeoutFuzzerTest(data, size);
72 return 0;
73 }
74