1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fuzzer/FuzzedDataProvider.h>
17 #include "containersfastbufferwritereadvalue_fuzzer.h"
18
19 #include "ecmascript/containers/containers_buffer.h"
20 #include "ecmascript/containers/containers_private.h"
21 #include "ecmascript/ecma_string-inl.h"
22 #include "ecmascript/ecma_vm.h"
23 #include "ecmascript/global_env.h"
24 #include "ecmascript/js_api/js_api_buffer.h"
25 #include "ecmascript/js_handle.h"
26 #include "ecmascript/object_factory.h"
27
28 using namespace panda;
29 using namespace panda::ecmascript;
30 using namespace panda::ecmascript::containers;
31
32 #define MAXBYTELEN sizeof(uint32_t)
33
34 namespace OHOS {
35
JSObjectCreate(JSThread * thread)36 JSFunction *JSObjectCreate(JSThread *thread)
37 {
38 EcmaVM *ecmaVM = thread->GetEcmaVM();
39 JSHandle<GlobalEnv> globalEnv = ecmaVM->GetGlobalEnv();
40 return globalEnv->GetObjectFunction().GetObject<JSFunction>();
41 }
42
CreateEcmaRuntimeCallInfo(JSThread * thread,uint32_t numArgs)43 EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)
44 {
45 auto factory = thread->GetEcmaVM()->GetFactory();
46 JSHandle<JSTaggedValue> hclass(thread, JSObjectCreate(thread));
47 JSHandle<JSTaggedValue> callee(factory->NewJSObjectByConstructor(JSHandle<JSFunction>::Cast(hclass), hclass));
48 JSHandle<JSTaggedValue> undefined = thread->GlobalConstants()->GetHandledUndefined();
49 EcmaRuntimeCallInfo *objCallInfo =
50 EcmaInterpreter::NewRuntimeCallInfo(thread, undefined, callee, undefined, numArgs);
51 return objCallInfo;
52 }
InitializeFastBufferConstructor(JSThread * thread)53 JSTaggedValue InitializeFastBufferConstructor(JSThread *thread)
54 {
55 ObjectFactory *factory = thread->GetEcmaVM()->GetFactory();
56 JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
57
58 JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject();
59 JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate"));
60 JSHandle<JSTaggedValue> value =
61 JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue();
62
63 auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6);
64 objCallInfo->SetFunction(JSTaggedValue::Undefined());
65 objCallInfo->SetThis(value.GetTaggedValue());
66 objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(ContainerTag::FastBuffer)));
67 JSTaggedValue result = ContainersPrivate::Load(objCallInfo);
68 return result;
69 }
70
CreateJSAPIFastBuffer(JSThread * thread,uint32_t length)71 JSHandle<JSAPIFastBuffer> CreateJSAPIFastBuffer(JSThread *thread, uint32_t length)
72 {
73 JSHandle<JSFunction> newTarget(thread, InitializeFastBufferConstructor(thread));
74 auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6);
75 objCallInfo->SetFunction(newTarget.GetTaggedValue());
76 objCallInfo->SetNewTarget(newTarget.GetTaggedValue());
77 objCallInfo->SetThis(JSTaggedValue::Undefined());
78 objCallInfo->SetCallArg(0, JSTaggedValue(length));
79
80 JSTaggedValue result = ContainersBuffer::BufferConstructor(objCallInfo);
81 JSHandle<JSAPIFastBuffer> buffer(thread, result);
82 return buffer;
83 }
84
ContainersFastBufferWriteReadValueOfFuzzTest(const uint8_t * data,size_t size)85 void ContainersFastBufferWriteReadValueOfFuzzTest(const uint8_t* data, size_t size)
86 {
87 constexpr size_t STRING_MAX_LENGTH = 100;
88 RuntimeOption option;
89 option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
90 EcmaVM *vm = JSNApi::CreateJSVM(option);
91 {
92 JsiFastNativeScope scope(vm);
93 auto thread = vm->GetAssociatedJSThread();
94
95 const int32_t MaxMenory = 1024;
96 if (size > MaxMenory) {
97 size = MaxMenory;
98 }
99 FuzzedDataProvider fdp(data, size);
100 JSHandle<JSAPIFastBuffer> buf1 = CreateJSAPIFastBuffer(thread, STRING_MAX_LENGTH);
101 int32_t offset = fdp.ConsumeIntegral<int32_t>();
102 int32_t value = fdp.ConsumeIntegral<int32_t>();
103 double doubleValue = fdp.ConsumeFloatingPoint<double>();
104
105 EcmaRuntimeCallInfo *callInfo1 = CreateEcmaRuntimeCallInfo(thread, 8);
106 callInfo1->SetFunction(JSTaggedValue::Undefined());
107 callInfo1->SetThis(buf1.GetTaggedValue());
108 // 0 : means the first parameter
109 callInfo1->SetCallArg(0, JSTaggedValue(value));
110 // 1 : means the second parameter
111 callInfo1->SetCallArg(1, JSTaggedValue(offset));
112 [[maybe_unused]] JSTaggedValue ret = ContainersBuffer::WriteUInt8(callInfo1);
113 ret = ContainersBuffer::WriteUInt8(callInfo1);
114 ret = ContainersBuffer::WriteUInt16BE(callInfo1);
115 ret = ContainersBuffer::WriteUInt16LE(callInfo1);
116 ret = ContainersBuffer::WriteUInt32BE(callInfo1);
117 ret = ContainersBuffer::WriteUInt32LE(callInfo1);
118 ret = ContainersBuffer::WriteInt8(callInfo1);
119 ret = ContainersBuffer::WriteInt16BE(callInfo1);
120 ret = ContainersBuffer::WriteInt16LE(callInfo1);
121 ret = ContainersBuffer::WriteInt32BE(callInfo1);
122 ret = ContainersBuffer::WriteInt32LE(callInfo1);
123 EcmaRuntimeCallInfo *callInfo2 = CreateEcmaRuntimeCallInfo(thread, 8);
124 callInfo2->SetFunction(JSTaggedValue::Undefined());
125 callInfo2->SetThis(buf1.GetTaggedValue());
126 // 0 : means the first parameter
127 callInfo2->SetCallArg(0, JSTaggedValue(doubleValue));
128 // 1 : means the second parameter
129 callInfo2->SetCallArg(1, JSTaggedValue(offset));
130 ret = ContainersBuffer::WriteFloat32BE(callInfo2);
131 ret = ContainersBuffer::WriteFloat32LE(callInfo2);
132 ret = ContainersBuffer::WriteFloat64BE(callInfo2);
133 ret = ContainersBuffer::WriteFloat64LE(callInfo2);
134
135 EcmaRuntimeCallInfo *callInfo3 = CreateEcmaRuntimeCallInfo(thread, 8);
136 callInfo3->SetFunction(JSTaggedValue::Undefined());
137 callInfo3->SetThis(buf1.GetTaggedValue());
138 // 0 : means the first parameter
139 callInfo3->SetCallArg(0, JSTaggedValue(offset));
140 ret = ContainersBuffer::ReadUInt8(callInfo3);
141 ret = ContainersBuffer::ReadUInt16BE(callInfo3);
142 ret = ContainersBuffer::ReadUInt16LE(callInfo3);
143 ret = ContainersBuffer::ReadUInt32BE(callInfo3);
144 ret = ContainersBuffer::ReadUInt32LE(callInfo3);
145 ret = ContainersBuffer::ReadInt8(callInfo3);
146 ret = ContainersBuffer::ReadInt16BE(callInfo3);
147 ret = ContainersBuffer::ReadInt16LE(callInfo3);
148 ret = ContainersBuffer::ReadInt32BE(callInfo3);
149 ret = ContainersBuffer::ReadInt32LE(callInfo3);
150 ret = ContainersBuffer::ReadFloat32BE(callInfo3);
151 ret = ContainersBuffer::ReadFloat32LE(callInfo3);
152 ret = ContainersBuffer::ReadFloat64BE(callInfo3);
153 ret = ContainersBuffer::ReadFloat64LE(callInfo3);
154 }
155 JSNApi::DestroyJSVM(vm);
156 }
157 }
158
159 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)160 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
161 {
162 // Run your code on data.
163 OHOS::ContainersFastBufferWriteReadValueOfFuzzTest(data, size);
164 return 0;
165 }