1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "datavalue_fuzzer.h"
17
18 #include <fuzzer/FuzzedDataProvider.h>
19
20 #include "grd_api_manager.h"
21 #include "oh_data_value.h"
22 #include "oh_value_object.h"
23 #include "oh_values_bucket.h"
24 #include "rdb_errno.h"
25 #include "relational_store.h"
26 #include "relational_store_error_code.h"
27 #include "relational_store_impl.h"
28
29 using namespace OHOS::NativeRdb;
30 using namespace OHOS::RdbNdk;
31
OHValuePutAssetsFuzzTest(FuzzedDataProvider & provider,OH_Data_Value * value)32 void OHValuePutAssetsFuzzTest(FuzzedDataProvider &provider, OH_Data_Value *value)
33 {
34 const int minCount = 1;
35 const int maxCount = 50;
36 size_t count = provider.ConsumeIntegralInRange<size_t>(minCount, maxCount);
37 Data_Asset **assets = OH_Data_Asset_CreateMultiple(count);
38 if (assets == nullptr) {
39 return;
40 }
41 for (size_t i = 0; i < count; i++) {
42 int64_t value = provider.ConsumeIntegral<int64_t>();
43 OH_Data_Asset_SetCreateTime(assets[i], value);
44 }
45 OH_Value_PutAssets(value, assets, count);
46 OH_Data_Asset_DestroyMultiple(assets, count);
47 }
48
OHValuePutFloatVectorFuzzTest(FuzzedDataProvider & provider,OH_Data_Value * value)49 void OHValuePutFloatVectorFuzzTest(FuzzedDataProvider &provider, OH_Data_Value *value)
50 {
51 const int minFloatVectorSize = 1;
52 const int maxFloatVectorSize = 100;
53 size_t floatVectorSize = provider.ConsumeIntegralInRange<size_t>(minFloatVectorSize, maxFloatVectorSize);
54 std::vector<float> floatVector(floatVectorSize);
55 for (size_t i = 0; i < floatVectorSize; i++) {
56 floatVector[i] = provider.ConsumeFloatingPoint<float>();
57 }
58 OH_Value_PutFloatVector(value, floatVector.data(), floatVectorSize);
59 }
60
OHValuePutUnlimitedIntFuzzTest(FuzzedDataProvider & provider,OH_Data_Value * value)61 void OHValuePutUnlimitedIntFuzzTest(FuzzedDataProvider &provider, OH_Data_Value *value)
62 {
63 const int minSign = 0;
64 const int maxSign = 1;
65 int sign = provider.ConsumeIntegralInRange<int>(minSign, maxSign);
66 const int minUnlimitedIntSize = 1;
67 const int maxUnlimitedIntSize = 10;
68 size_t unlimitedIntSize = provider.ConsumeIntegralInRange<size_t>(minUnlimitedIntSize, maxUnlimitedIntSize);
69 std::vector<uint64_t> trueForm(unlimitedIntSize);
70 for (size_t i = 0; i < unlimitedIntSize; i++) {
71 trueForm[i] = provider.ConsumeIntegral<uint64_t>();
72 }
73 OH_Value_PutUnlimitedInt(value, sign, trueForm.data(), unlimitedIntSize);
74 }
75
DataValuePutFuzzTest(FuzzedDataProvider & provider,OH_Data_Value * value)76 void DataValuePutFuzzTest(FuzzedDataProvider &provider, OH_Data_Value *value)
77 {
78 if (value == nullptr) {
79 return;
80 }
81 // Test OH_Value_PutNull
82 {
83 OH_Value_PutNull(value);
84 }
85
86 // Test OH_Value_PutInt
87 {
88 int64_t intValue = provider.ConsumeIntegral<int64_t>();
89 OH_Value_PutInt(value, intValue);
90 }
91
92 // Test OH_Value_PutReal
93 {
94 double realValue = provider.ConsumeFloatingPoint<double>();
95 OH_Value_PutReal(value, realValue);
96 }
97
98 // Test OH_Value_PutText
99 {
100 std::string textValue = provider.ConsumeRandomLengthString();
101 OH_Value_PutText(value, textValue.c_str());
102 }
103
104 // Test OH_Value_PutBlob
105 {
106 const int minBlobSize = 1;
107 const int maxBlobSize = 50;
108 size_t blobSize = provider.ConsumeIntegralInRange<size_t>(minBlobSize, maxBlobSize);
109 std::vector<uint8_t> blobData = provider.ConsumeBytes<uint8_t>(blobSize);
110 OH_Value_PutBlob(value, blobData.data(), blobData.size());
111 }
112
113 // Test OH_Value_PutAsset
114 {
115 Data_Asset *asset = OH_Data_Asset_CreateOne();
116 if (asset == nullptr) {
117 return;
118 }
119 OH_Value_PutAsset(value, asset);
120 OH_Data_Asset_DestroyOne(asset);
121 }
122
123 // Test OH_Value_PutAssets
124 OHValuePutAssetsFuzzTest(provider, value);
125
126 // Test OH_Value_PutFloatVector
127 OHValuePutFloatVectorFuzzTest(provider, value);
128
129 // Test OH_Value_PutUnlimitedInt
130 OHValuePutUnlimitedIntFuzzTest(provider, value);
131 }
132
OHValueGetAssetsFuzzTest(OH_Data_Value * value)133 void OHValueGetAssetsFuzzTest(OH_Data_Value *value)
134 {
135 size_t assetsSize;
136 OH_Value_GetAssetsCount(value, &assetsSize);
137
138 Data_Asset **assets = OH_Data_Asset_CreateMultiple(assetsSize);
139 if (assets == nullptr) {
140 return;
141 }
142 size_t assetsOutLen;
143 OH_Value_GetAssets(value, assets, assetsSize, &assetsOutLen);
144 OH_Data_Asset_DestroyMultiple(assets, assetsSize);
145 }
146
DataValueGetFuzzTestPartOne(OH_Data_Value * value)147 void DataValueGetFuzzTestPartOne(OH_Data_Value *value)
148 {
149 if (value == nullptr) {
150 return;
151 }
152 // Test OH_Value_GetType
153 {
154 OH_ColumnType type;
155 OH_Value_GetType(value, &type);
156 }
157
158 // Test OH_Value_IsNull
159 {
160 bool isNull;
161 OH_Value_IsNull(value, &isNull);
162 }
163
164 // Test OH_Value_GetInt
165 {
166 int64_t intValue;
167 OH_Value_GetInt(value, &intValue);
168 }
169
170 // Test OH_Value_GetReal
171 {
172 double realValue;
173 OH_Value_GetReal(value, &realValue);
174 }
175
176 // Test OH_Value_GetText
177 {
178 const char *textValue;
179 OH_Value_GetText(value, &textValue);
180 }
181
182 // Test OH_Value_GetBlob
183 {
184 const uint8_t *blobValue;
185 size_t blobLength;
186 OH_Value_GetBlob(value, &blobValue, &blobLength);
187 }
188
189 // Test OH_Value_GetAsset
190 {
191 Data_Asset *asset = OH_Data_Asset_CreateOne();
192 if (asset == nullptr) {
193 return;
194 }
195 OH_Value_GetAsset(value, asset);
196 OH_Data_Asset_DestroyOne(asset);
197 }
198
199 // Test OH_Value_GetAssetsCount
200 {
201 size_t assetsCount;
202 OH_Value_GetAssetsCount(value, &assetsCount);
203 }
204
205 // Test OH_Value_GetAssets
206 OHValueGetAssetsFuzzTest(value);
207
208 // Test OH_Value_GetFloatVectorCount
209 {
210 size_t floatVectorCount;
211 OH_Value_GetFloatVectorCount(value, &floatVectorCount);
212 }
213 }
214
DataValueGetFuzzTestPartTwo(OH_Data_Value * value)215 void DataValueGetFuzzTestPartTwo(OH_Data_Value *value)
216 {
217 if (value == nullptr) {
218 return;
219 }
220 // Test OH_Value_GetFloatVector
221 {
222 size_t floatVectorSize;
223 OH_Value_GetFloatVectorCount(value, &floatVectorSize);
224 const size_t maxMallocSize = 100;
225 if (floatVectorSize > maxMallocSize) {
226 floatVectorSize = maxMallocSize;
227 }
228 float *floatVector = (float *)malloc(floatVectorSize * sizeof(float));
229 if (floatVector == nullptr) {
230 return;
231 }
232 size_t floatVectorOutLen;
233 OH_Value_GetFloatVector(value, floatVector, floatVectorSize, &floatVectorOutLen);
234 free(floatVector);
235 }
236
237 // Test OH_Value_GetUnlimitedIntBand
238 {
239 size_t unlimitedIntBand;
240 OH_Value_GetUnlimitedIntBand(value, &unlimitedIntBand);
241 }
242
243 // Test OH_Value_GetUnlimitedInt
244 {
245 size_t unlimitedIntSize;
246 OH_Value_GetUnlimitedIntBand(value, &unlimitedIntSize);
247 const size_t maxMallocSize = 100;
248 if (unlimitedIntSize > maxMallocSize) {
249 unlimitedIntSize = maxMallocSize;
250 }
251 uint64_t *trueForm = (uint64_t *)malloc(unlimitedIntSize * sizeof(uint64_t));
252 if (trueForm == nullptr) {
253 return;
254 }
255 size_t unlimitedIntOutLen;
256 int sign;
257 OH_Value_GetUnlimitedInt(value, &sign, trueForm, unlimitedIntSize, &unlimitedIntOutLen);
258 free(trueForm);
259 }
260 }
261
DataValueFuzzTest(FuzzedDataProvider & provider)262 void DataValueFuzzTest(FuzzedDataProvider &provider)
263 {
264 OH_Data_Value *value = OH_Value_Create();
265 if (value == nullptr) {
266 return;
267 }
268 DataValuePutFuzzTest(provider, value);
269 DataValueGetFuzzTestPartOne(value);
270 DataValueGetFuzzTestPartTwo(value);
271 // Destroy the OH_Data_Value instance
272 OH_Value_Destroy(value);
273 }
274
275 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)276 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
277 {
278 // Run your code on data
279 FuzzedDataProvider provider(data, size);
280 DataValueFuzzTest(provider);
281 return 0;
282 }
283