1 /*
2 * Copyright (c) 2022-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "distributed_input_transport_base_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <functional>
21 #include <fuzzer/FuzzedDataProvider.h>
22 #include <iostream>
23 #include <thread>
24 #include <unistd.h>
25
26 #include <refbase.h>
27
28 #include "constants_dinput.h"
29 #include "distributed_input_transport_base.h"
30
31 namespace OHOS {
32 namespace DistributedHardware {
StartSessionFuzzTest(const uint8_t * data,size_t size)33 void StartSessionFuzzTest(const uint8_t *data, size_t size)
34 {
35 if ((data == nullptr) || (size == 0)) {
36 return;
37 }
38
39 std::string remoteDevId(reinterpret_cast<const char*>(data), size);
40
41 const uint32_t sleepTimeUs = 100 * 1000;
42 usleep(sleepTimeUs);
43 DistributedInput::DistributedInputTransportBase::GetInstance().StartSession(remoteDevId);
44 DistributedInput::DistributedInputTransportBase::GetInstance().StopSession(remoteDevId);
45 }
46
OnBytesReceivedFuzzTest(const uint8_t * data,size_t size)47 void OnBytesReceivedFuzzTest(const uint8_t *data, size_t size)
48 {
49 if ((data == nullptr) || (size < sizeof(int32_t))) {
50 return;
51 }
52
53 int32_t sessionId = *(reinterpret_cast<const int32_t*>(data));
54 const char *msg = reinterpret_cast<const char *>(data);
55 uint32_t dataLen = static_cast<const uint32_t>(size);
56 DistributedInput::DistributedInputTransportBase::GetInstance().OnBytesReceived(sessionId, msg, dataLen);
57 }
58
GetSessionIdByDevIdFuzzTest(const uint8_t * data,size_t size)59 void GetSessionIdByDevIdFuzzTest(const uint8_t *data, size_t size)
60 {
61 if ((data == nullptr) || (size == 0)) {
62 return;
63 }
64 std::string srcId(reinterpret_cast<const char*>(data), size);
65 DistributedInput::DistributedInputTransportBase::GetInstance().GetSessionIdByDevId(srcId);
66 }
67
HandleSessionFuzzTest(const uint8_t * data,size_t size)68 void HandleSessionFuzzTest(const uint8_t *data, size_t size)
69 {
70 if ((data == nullptr) || (size < sizeof(int32_t))) {
71 return;
72 }
73 int32_t sessionId = *(reinterpret_cast<const int32_t*>(data));
74 std::string message(reinterpret_cast<const char*>(data), size);
75 DistributedInput::DistributedInputTransportBase::GetInstance().HandleSession(sessionId, message);
76 }
77
OnSessionClosedFuzzTest(const uint8_t * data,size_t size)78 void OnSessionClosedFuzzTest(const uint8_t *data, size_t size)
79 {
80 if ((data == nullptr) || (size < (sizeof(int32_t) + sizeof(int32_t)))) {
81 return;
82 }
83 FuzzedDataProvider fdp(data, size);
84 int32_t sessionId = fdp.ConsumeIntegral<int32_t>();
85 int32_t reasonValue = fdp.ConsumeIntegral<int32_t>();
86 ShutdownReason reason = static_cast<ShutdownReason>(reasonValue);
87
88 DistributedInput::DistributedInputTransportBase::GetInstance().RegisterSinkHandleSessionCallback(nullptr);
89 DistributedInput::DistributedInputTransportBase::GetInstance().RegisterSrcHandleSessionCallback(nullptr);
90 DistributedInput::DistributedInputTransportBase::GetInstance().RegisterSourceManagerCallback(nullptr);
91 DistributedInput::DistributedInputTransportBase::GetInstance().OnSessionClosed(sessionId, reason);
92 }
93
EraseSessionIdFuzzTest(const uint8_t * data,size_t size)94 void EraseSessionIdFuzzTest(const uint8_t *data, size_t size)
95 {
96 if ((data == nullptr) || (size == 0)) {
97 return;
98 }
99 std::string remoteDevId(reinterpret_cast<const char*>(data), size);
100 sptr<DistributedInput::ISessionStateCallback> callback = nullptr;
101 DistributedInput::DistributedInputTransportBase::GetInstance().RegisterSessionStateCb(callback);
102 DistributedInput::DistributedInputTransportBase::GetInstance().UnregisterSessionStateCb();
103 DistributedInput::DistributedInputTransportBase::GetInstance().GetCurrentSessionId();
104 DistributedInput::DistributedInputTransportBase::GetInstance().StopAllSession();
105 DistributedInput::DistributedInputTransportBase::GetInstance().EraseSessionId(remoteDevId);
106 }
107
InitFuzzTest(const uint8_t * data,size_t size)108 void InitFuzzTest(const uint8_t *data, size_t size)
109 {
110 (void)data;
111 (void)size;
112 DistributedInput::DistributedInputTransportBase::GetInstance().Init();
113 }
114
ReleaseFuzzTest(const uint8_t * data,size_t size)115 void ReleaseFuzzTest(const uint8_t *data, size_t size)
116 {
117 (void)data;
118 (void)size;
119 DistributedInput::DistributedInputTransportBase::GetInstance().Release();
120 }
121
CreateClientSocketFuzzTest(const uint8_t * data,size_t size)122 void CreateClientSocketFuzzTest(const uint8_t *data, size_t size)
123 {
124 if ((data == nullptr) || (size == 0)) {
125 return;
126 }
127 FuzzedDataProvider fdp(data, size);
128 std::string remoteDevId = fdp.ConsumeRandomLengthString();
129 DistributedInput::DistributedInputTransportBase::GetInstance().CreateClientSocket(remoteDevId);
130 if (DistributedInput::DistributedInputTransportBase::GetInstance().sessionId_ > 0) {
131 Shutdown(DistributedInput::DistributedInputTransportBase::GetInstance().sessionId_);
132 }
133 }
134 } // namespace DistributedHardware
135 } // namespace OHOS
136
137 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)138 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
139 {
140 /* Run your code on data */
141 OHOS::DistributedHardware::StartSessionFuzzTest(data, size);
142 OHOS::DistributedHardware::OnBytesReceivedFuzzTest(data, size);
143 OHOS::DistributedHardware::GetSessionIdByDevIdFuzzTest(data, size);
144 OHOS::DistributedHardware::HandleSessionFuzzTest(data, size);
145 OHOS::DistributedHardware::OnSessionClosedFuzzTest(data, size);
146 OHOS::DistributedHardware::EraseSessionIdFuzzTest(data, size);
147 OHOS::DistributedHardware::InitFuzzTest(data, size);
148 OHOS::DistributedHardware::ReleaseFuzzTest(data, size);
149 OHOS::DistributedHardware::CreateClientSocketFuzzTest(data, size);
150 return 0;
151 }