1 /*
2 * Copyright (c) 2023-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "capabilityinfomanager_fuzzer.h"
17
18 #include <fuzzer/FuzzedDataProvider.h>
19
20 #include "constants.h"
21 #include "capability_info.h"
22 #include "capability_utils.h"
23 #include "capability_info_manager.h"
24 #include "distributed_hardware_log.h"
25 #include "dh_context.h"
26 #include "dh_utils_tool.h"
27
28 namespace OHOS {
29 namespace DistributedHardware {
30 namespace {
31 constexpr uint16_t TEST_DEV_TYPE_PAD = 0x11;
32 constexpr int32_t EVEN_CHECK = 2;
33 }
34
OnSuccess(const std::string & networkId,const std::vector<DHDescriptor> & descriptors,EnableStep enableStep)35 void TestGetDistributedHardwareCallback::OnSuccess(const std::string &networkId,
36 const std::vector<DHDescriptor> &descriptors, EnableStep enableStep)
37 {
38 (void)networkId;
39 (void)descriptors;
40 (void)enableStep;
41 }
42
OnError(const std::string & networkId,int32_t error)43 void TestGetDistributedHardwareCallback::OnError(const std::string &networkId, int32_t error)
44 {
45 (void)networkId;
46 (void)error;
47 }
48
CapabilityInfoManagerFuzzTest(const uint8_t * data,size_t size)49 void CapabilityInfoManagerFuzzTest(const uint8_t* data, size_t size)
50 {
51 if ((data == nullptr) || (size <= sizeof(DistributedKv::ChangeNotification))) {
52 return;
53 }
54
55 DistributedKv::Entry insert;
56 DistributedKv::Entry update;
57 DistributedKv::Entry del;
58 insert.key = std::string(reinterpret_cast<const char*>(data), size);
59 update.key = std::string(reinterpret_cast<const char*>(data), size);
60 del.key = std::string(reinterpret_cast<const char*>(data), size);
61 insert.value = std::string(reinterpret_cast<const char*>(data), size);
62 update.value = std::string(reinterpret_cast<const char*>(data), size);
63 del.value = std::string(reinterpret_cast<const char*>(data), size);
64 std::vector<DistributedKv::Entry> inserts;
65 std::vector<DistributedKv::Entry> updates;
66 std::vector<DistributedKv::Entry> deleteds;
67 inserts.push_back(insert);
68 updates.push_back(update);
69 deleteds.push_back(del);
70 std::string deviceId(reinterpret_cast<const char*>(data), size);
71
72 DistributedKv::ChangeNotification changeIn(std::move(inserts), std::move(updates), std::move(deleteds),
73 deviceId, true);
74 CapabilityInfoManager::GetInstance()->OnChange(changeIn);
75 }
76
RemoveCapabilityInfoInMemFuzzTest(const uint8_t * data,size_t size)77 void RemoveCapabilityInfoInMemFuzzTest(const uint8_t* data, size_t size)
78 {
79 if ((data == nullptr) || (size == 0)) {
80 return;
81 }
82 std::string deviceId(reinterpret_cast<const char*>(data), size);
83 CapabilityInfoManager::GetInstance()->RemoveCapabilityInfoInMem(deviceId);
84 }
85
RemoveCapabilityInfoByKeyFuzzTest(const uint8_t * data,size_t size)86 void RemoveCapabilityInfoByKeyFuzzTest(const uint8_t* data, size_t size)
87 {
88 if ((data == nullptr) || (size == 0)) {
89 return;
90 }
91 std::string key(reinterpret_cast<const char*>(data), size);
92 CapabilityInfoManager::GetInstance()->Init();
93 CapabilityInfoManager::GetInstance()->RemoveCapabilityInfoByKey(key);
94 CapabilityInfoManager::GetInstance()->UnInit();
95 }
96
RemoveCapabilityInfoInDBFuzzTest(const uint8_t * data,size_t size)97 void RemoveCapabilityInfoInDBFuzzTest(const uint8_t* data, size_t size)
98 {
99 if ((data == nullptr) || (size == 0)) {
100 return;
101 }
102 std::string deviceId(reinterpret_cast<const char*>(data), size);
103 CapabilityInfoManager::GetInstance()->Init();
104 CapabilityInfoManager::GetInstance()->RemoveCapabilityInfoInDB(deviceId);
105 CapabilityInfoManager::GetInstance()->UnInit();
106 }
107
SyncDeviceInfoFromDBFuzzTest(const uint8_t * data,size_t size)108 void SyncDeviceInfoFromDBFuzzTest(const uint8_t* data, size_t size)
109 {
110 if ((data == nullptr) || (size == 0)) {
111 return;
112 }
113 std::string deviceId(reinterpret_cast<const char*>(data), size);
114 CapabilityInfoManager::GetInstance()->Init();
115 CapabilityInfoManager::GetInstance()->SyncDeviceInfoFromDB(deviceId);
116 CapabilityInfoManager::GetInstance()->SyncRemoteCapabilityInfos();
117 CapabilityInfoManager::GetInstance()->UnInit();
118 }
119
AddCapabilityInMemFuzzTest(const uint8_t * data,size_t size)120 void AddCapabilityInMemFuzzTest(const uint8_t* data, size_t size)
121 {
122 if ((data == nullptr) || (size == 0)) {
123 return;
124 }
125 std::vector<std::shared_ptr<CapabilityInfo>> resInfos;
126 CapabilityInfoManager::GetInstance()->AddCapabilityInMem(resInfos);
127
128 std::string dhId1(reinterpret_cast<const char*>(data), size);
129 std::string deviceId1(reinterpret_cast<const char*>(data), size);
130 std::string deviceName1(reinterpret_cast<const char*>(data), size);
131 std::string dhAttrs1(reinterpret_cast<const char*>(data), size);
132 std::string dhSubtype1(reinterpret_cast<const char*>(data), size);
133 std::shared_ptr<CapabilityInfo> capInfo1 = std::make_shared<CapabilityInfo>(
134 dhId1, deviceId1, deviceName1, TEST_DEV_TYPE_PAD, DHType::AUDIO, dhAttrs1, dhSubtype1);
135
136 std::string dhId2(reinterpret_cast<const char*>(data), size);
137 std::string deviceId2(reinterpret_cast<const char*>(data), size);
138 std::string deviceName2(reinterpret_cast<const char*>(data), size);
139 std::string dhAttrs2(reinterpret_cast<const char*>(data), size);
140 std::string dhSubtype2(reinterpret_cast<const char*>(data), size);
141 std::shared_ptr<CapabilityInfo> capInfo2 = std::make_shared<CapabilityInfo>(
142 dhId2, deviceId2, deviceName2, TEST_DEV_TYPE_PAD, DHType::CAMERA, dhAttrs2, dhSubtype2);
143 std::vector<std::shared_ptr<CapabilityInfo>> resInfos1 { capInfo1, capInfo2 };
144 CapabilityInfoManager::GetInstance()->AddCapabilityInMem(resInfos1);
145 }
146
GetDataByKeyFuzzTest(const uint8_t * data,size_t size)147 void GetDataByKeyFuzzTest(const uint8_t* data, size_t size)
148 {
149 if ((data == nullptr) || (size == 0)) {
150 return;
151 }
152 std::string key(reinterpret_cast<const char*>(data), size);
153 std::shared_ptr<CapabilityInfo> capInfoPtr;
154 CapabilityInfoManager::GetInstance()->GetDataByKey(key, capInfoPtr);
155
156 CapabilityInfoManager::GetInstance()->Init();
157 CapabilityInfoManager::GetInstance()->GetDataByKey(key, capInfoPtr);
158 CapabilityInfoManager::GetInstance()->UnInit();
159 }
160
CapabilityInfoManagerOnChangeInsertFuzzTest(const uint8_t * data,size_t size)161 void CapabilityInfoManagerOnChangeInsertFuzzTest(const uint8_t* data, size_t size)
162 {
163 if ((data == nullptr) || (size == 0)) {
164 return;
165 }
166 cJSON *insertJson = cJSON_CreateObject();
167 if (insertJson == nullptr) {
168 return;
169 }
170 std::string networkId(reinterpret_cast<const char*>(data), size);
171 std::string udId(reinterpret_cast<const char*>(data), size);
172 std::string uuId(reinterpret_cast<const char*>(data), size);
173 DHContext::GetInstance().AddOnlineDevice(udId, uuId, networkId);
174 std::string deviceId = Sha256(uuId);
175 cJSON_AddStringToObject(insertJson, DH_ID, "111111");
176 cJSON_AddStringToObject(insertJson, DEV_ID, deviceId.c_str());
177 cJSON_AddStringToObject(insertJson, DEV_NAME, "dev_name");
178 char* cjson = cJSON_PrintUnformatted(insertJson);
179 if (cjson == nullptr) {
180 cJSON_Delete(insertJson);
181 return;
182 }
183 std::string jsonStr(cjson);
184 DistributedKv::Entry insert;
185 insert.key = std::string(reinterpret_cast<const char*>(data), size);
186 insert.value = jsonStr;
187
188 DistributedKv::Entry update;
189 DistributedKv::Entry del;
190 std::vector<DistributedKv::Entry> inserts;
191 std::vector<DistributedKv::Entry> updates;
192 std::vector<DistributedKv::Entry> deleteds;
193 inserts.push_back(insert);
194 updates.push_back(update);
195 deleteds.push_back(del);
196
197 DistributedKv::ChangeNotification changeIn(std::move(inserts), std::move(updates), std::move(deleteds),
198 deviceId, true);
199 CapabilityInfoManager::GetInstance()->OnChange(changeIn);
200 DHContext::GetInstance().RemoveOnlineDeviceIdEntryByNetworkId(networkId);
201 cJSON_free(cjson);
202 cJSON_Delete(insertJson);
203 }
204
CapabilityInfoManagerOnChangeUpdateFuzzTest(const uint8_t * data,size_t size)205 void CapabilityInfoManagerOnChangeUpdateFuzzTest(const uint8_t* data, size_t size)
206 {
207 if ((data == nullptr) || (size == 0)) {
208 return;
209 }
210 cJSON *updateJson = cJSON_CreateObject();
211 if (updateJson == nullptr) {
212 return;
213 }
214 std::string networkId(reinterpret_cast<const char*>(data), size);
215 std::string udId(reinterpret_cast<const char*>(data), size);
216 std::string uuId(reinterpret_cast<const char*>(data), size);
217 DHContext::GetInstance().AddOnlineDevice(udId, uuId, networkId);
218 std::string deviceId = Sha256(uuId);
219 cJSON_AddStringToObject(updateJson, DH_ID, "222222");
220 cJSON_AddStringToObject(updateJson, DEV_ID, deviceId.c_str());
221 cJSON_AddStringToObject(updateJson, DEV_NAME, "dev_name");
222 char* cjson = cJSON_PrintUnformatted(updateJson);
223 if (cjson == nullptr) {
224 cJSON_Delete(updateJson);
225 return;
226 }
227 std::string jsonStr(cjson);
228 DistributedKv::Entry update;
229 update.key = std::string(reinterpret_cast<const char*>(data), size);
230 update.value = jsonStr;
231
232 DistributedKv::Entry insert;
233 DistributedKv::Entry del;
234 std::vector<DistributedKv::Entry> inserts;
235 std::vector<DistributedKv::Entry> updates;
236 std::vector<DistributedKv::Entry> deleteds;
237 inserts.push_back(insert);
238 updates.push_back(update);
239 deleteds.push_back(del);
240
241 DistributedKv::ChangeNotification changeIn(std::move(inserts), std::move(updates), std::move(deleteds),
242 deviceId, true);
243 CapabilityInfoManager::GetInstance()->OnChange(changeIn);
244 DHContext::GetInstance().RemoveOnlineDeviceIdEntryByNetworkId(networkId);
245 cJSON_free(cjson);
246 cJSON_Delete(updateJson);
247 }
248
CapabilityInfoManagerOnChangeDeleteFuzzTest(const uint8_t * data,size_t size)249 void CapabilityInfoManagerOnChangeDeleteFuzzTest(const uint8_t* data, size_t size)
250 {
251 if ((data == nullptr) || (size == 0)) {
252 return;
253 }
254 cJSON *deleteJson = cJSON_CreateObject();
255 if (deleteJson == nullptr) {
256 return;
257 }
258 std::string networkId(reinterpret_cast<const char*>(data), size);
259 std::string udId(reinterpret_cast<const char*>(data), size);
260 std::string uuId(reinterpret_cast<const char*>(data), size);
261 DHContext::GetInstance().AddOnlineDevice(udId, uuId, networkId);
262 std::string deviceId = Sha256(uuId);
263 cJSON_AddStringToObject(deleteJson, DH_ID, "333333");
264 cJSON_AddStringToObject(deleteJson, DEV_ID, deviceId.c_str());
265 cJSON_AddStringToObject(deleteJson, DEV_NAME, "dev_name");
266 char* cjson = cJSON_PrintUnformatted(deleteJson);
267 if (cjson == nullptr) {
268 cJSON_Delete(deleteJson);
269 return;
270 }
271 std::string jsonStr(cjson);
272 DistributedKv::Entry del;
273 del.key = std::string(reinterpret_cast<const char*>(data), size);
274 del.value = jsonStr;
275
276 DistributedKv::Entry insert;
277 DistributedKv::Entry update;
278 std::vector<DistributedKv::Entry> inserts;
279 std::vector<DistributedKv::Entry> updates;
280 std::vector<DistributedKv::Entry> deleteds;
281 inserts.push_back(insert);
282 updates.push_back(update);
283 deleteds.push_back(del);
284
285 DistributedKv::ChangeNotification changeIn(std::move(inserts), std::move(updates), std::move(deleteds),
286 deviceId, true);
287 CapabilityInfoManager::GetInstance()->OnChange(changeIn);
288 DHContext::GetInstance().RemoveOnlineDeviceIdEntryByNetworkId(networkId);
289 cJSON_free(cjson);
290 cJSON_Delete(deleteJson);
291 }
292
HasCapabilityFuzzTest(const uint8_t * data,size_t size)293 void HasCapabilityFuzzTest(const uint8_t* data, size_t size)
294 {
295 if ((data == nullptr) || (size == 0)) {
296 return;
297 }
298
299 std::string dhId(reinterpret_cast<const char*>(data), size);
300 std::string deviceId(reinterpret_cast<const char*>(data), size);
301
302 CapabilityInfoManager::GetInstance()->HasCapability(deviceId, dhId);
303 }
304
DumpCapabilityInfosFuzzTest(const uint8_t * data,size_t size)305 void DumpCapabilityInfosFuzzTest(const uint8_t* data, size_t size)
306 {
307 if ((data == nullptr) || (size == 0)) {
308 return;
309 }
310 FuzzedDataProvider fdp(data, size);
311 std::vector<CapabilityInfo> capInfos;
312 std::string dhId = fdp.ConsumeRandomLengthString();
313 std::string deviceId = fdp.ConsumeRandomLengthString();
314 std::string deviceName = fdp.ConsumeRandomLengthString();
315 std::string dhAttrs = fdp.ConsumeRandomLengthString();
316 std::string dhSubtype = fdp.ConsumeRandomLengthString();
317 CapabilityInfo capInfo(dhId, deviceId, deviceName, TEST_DEV_TYPE_PAD, DHType::CAMERA, dhAttrs, dhSubtype);
318 capInfos.push_back(capInfo);
319 CapabilityInfoManager::GetInstance()->DumpCapabilityInfos(capInfos);
320 }
321
CapabilityInfoManagerEventHandlerCtorFuzzTest(const uint8_t * data,size_t size)322 void CapabilityInfoManagerEventHandlerCtorFuzzTest(const uint8_t* data, size_t size)
323 {
324 if ((data == nullptr) || (size == 0)) {
325 return;
326 }
327
328 auto runner = AppExecFwk::EventRunner::Create(true);
329 std::shared_ptr<CapabilityInfoManager> mgrPtr;
330 if (data[0] % EVEN_CHECK == 0) {
331 mgrPtr = nullptr;
332 } else {
333 mgrPtr = std::make_shared<CapabilityInfoManager>();
334 }
335
336 CapabilityInfoManager::CapabilityInfoManagerEventHandler handler(runner, mgrPtr);
337 CapabilityInfoManager::GetInstance()->Init();
338 CapabilityInfoManager::CapabilityInfoManagerEventHandler handler2(runner, mgrPtr);
339 CapabilityInfoManager::GetInstance()->UnInit();
340 }
341
GetEventHandlerFuzzTest(const uint8_t * data,size_t size)342 void GetEventHandlerFuzzTest(const uint8_t* data, size_t size)
343 {
344 (void)data;
345 (void)size;
346 CapabilityInfoManager::GetInstance()->GetEventHandler();
347 }
348
OnChangeFuzzTest(const uint8_t * data,size_t size)349 void OnChangeFuzzTest(const uint8_t* data, size_t size)
350 {
351 if ((data == nullptr) || (size == 0)) {
352 return;
353 }
354
355 std::string uuId(reinterpret_cast<const char*>(data), size);
356 std::string deviceId = Sha256(uuId);
357 DistributedKv::Entry insert;
358 DistributedKv::Entry update;
359 DistributedKv::Entry del;
360 std::vector<DistributedKv::Entry> inserts;
361 std::vector<DistributedKv::Entry> updates;
362 std::vector<DistributedKv::Entry> deleteds;
363 inserts.push_back(insert);
364 updates.push_back(update);
365 deleteds.push_back(del);
366
367 DistributedKv::ChangeNotification changeIn(std::move(inserts), std::move(updates), std::move(deleteds),
368 deviceId, true);
369 CapabilityInfoManager::GetInstance()->OnChange(changeIn);
370 }
371
GetDataByDHTypeFuzzTest(const uint8_t * data,size_t size)372 void GetDataByDHTypeFuzzTest(const uint8_t* data, size_t size)
373 {
374 (void)data;
375 (void)size;
376 DHType dhType = DHType::AUDIO;
377 std::map<std::string, std::shared_ptr<CapabilityInfo>> capabilityMap;
378 CapabilityInfoManager::GetInstance()->GetDataByDHType(dhType, capabilityMap);
379 }
380
AsyncGetDistributedHardwareFuzzTest(const uint8_t * data,size_t size)381 void AsyncGetDistributedHardwareFuzzTest(const uint8_t* data, size_t size)
382 {
383 if ((data == nullptr) || (size == 0)) {
384 return;
385 }
386
387 std::string networkId(reinterpret_cast<const char*>(data), size);
388 EnableStep enableStep = static_cast<EnableStep>(data[0] % 4);
389 sptr<IGetDhDescriptorsCallback> callback(new TestGetDistributedHardwareCallback());
390 CapabilityInfoManager::GetInstance()->AsyncGetDistributedHardware(networkId, enableStep, callback);
391 }
392
GetEntriesByKeysFuzzTest(const uint8_t * data,size_t size)393 void GetEntriesByKeysFuzzTest(const uint8_t* data, size_t size)
394 {
395 if ((data == nullptr) || (size == 0)) {
396 return;
397 }
398
399 std::vector<std::string> keys = {std::string(reinterpret_cast<const char*>(data), size)};
400 CapabilityInfoManager::GetInstance()->GetEntriesByKeys(keys);
401 }
402 }
403 }
404
405 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)406 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
407 {
408 /* Run your code on data */
409 OHOS::DistributedHardware::CapabilityInfoManagerFuzzTest(data, size);
410 OHOS::DistributedHardware::RemoveCapabilityInfoInMemFuzzTest(data, size);
411 OHOS::DistributedHardware::RemoveCapabilityInfoByKeyFuzzTest(data, size);
412 OHOS::DistributedHardware::RemoveCapabilityInfoInDBFuzzTest(data, size);
413 OHOS::DistributedHardware::SyncDeviceInfoFromDBFuzzTest(data, size);
414 OHOS::DistributedHardware::AddCapabilityInMemFuzzTest(data, size);
415 OHOS::DistributedHardware::GetDataByKeyFuzzTest(data, size);
416 OHOS::DistributedHardware::CapabilityInfoManagerOnChangeInsertFuzzTest(data, size);
417 OHOS::DistributedHardware::CapabilityInfoManagerOnChangeUpdateFuzzTest(data, size);
418 OHOS::DistributedHardware::CapabilityInfoManagerOnChangeDeleteFuzzTest(data, size);
419 OHOS::DistributedHardware::HasCapabilityFuzzTest(data, size);
420 OHOS::DistributedHardware::DumpCapabilityInfosFuzzTest(data, size);
421 OHOS::DistributedHardware::CapabilityInfoManagerEventHandlerCtorFuzzTest(data, size);
422 OHOS::DistributedHardware::GetEventHandlerFuzzTest(data, size);
423 OHOS::DistributedHardware::OnChangeFuzzTest(data, size);
424 OHOS::DistributedHardware::GetDataByDHTypeFuzzTest(data, size);
425 OHOS::DistributedHardware::AsyncGetDistributedHardwareFuzzTest(data, size);
426 OHOS::DistributedHardware::GetEntriesByKeysFuzzTest(data, size);
427 return 0;
428 }
429
430