1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <string>
19 #include <unistd.h>
20 #include <unordered_map>
21 #include <fuzzer/FuzzedDataProvider.h>
22
23 #include "dm_transport_msg.h"
24 #include "dm_transport_msg_fuzzer.h"
25 #include "dm_comm_tool.h"
26 #include "cJSON.h"
27
28
29 namespace OHOS {
30 namespace DistributedHardware {
31
32 namespace {
33 constexpr uint32_t FORUSERID = 10;
34 constexpr uint32_t BACKUSERID = 20;
35 constexpr uint32_t USERID = 30;
36 constexpr uint32_t USERFIRSTID = 40;
37 }
38
DmTransPortMsgFuzzTest(const uint8_t * data,size_t size)39 void DmTransPortMsgFuzzTest(const uint8_t* data, size_t size)
40 {
41 if ((data == nullptr) || (size < sizeof(int32_t))) {
42 return;
43 }
44 FuzzedDataProvider fdp(data, size);
45 int32_t code = fdp.ConsumeIntegral<int32_t>();
46 std::string msg(reinterpret_cast<const char*>(data), size);
47 std::string remoteUdid(reinterpret_cast<const char*>(data), size);
48 const char* jsonString = R"({
49 "MsgType": "0",
50 "userId": "12345",
51 "accountId": "a******3",
52 "peerUdids": ["u******1", "u******2"],
53 "peerUdid": "p******d",
54 "accountName": "t******t",
55 "syncUserIdFlag": 1,
56 "userIds": [
57 {"type": 1, "userId": 111},
58 {"type": 0, "userId": 222}
59 ]
60 })";
61 cJSON *jsonObject = nullptr;
62 std::vector<uint32_t> foregroundUserIds;
63 foregroundUserIds.push_back(FORUSERID);
64 std::vector<uint32_t> backgroundUserIds;
65 backgroundUserIds.push_back(BACKUSERID);
66 UserIdsMsg userIdsMsg(foregroundUserIds, backgroundUserIds, true);
67 CommMsg commMsg(code, msg);
68 std::vector<uint32_t> userIds;
69 userIds.push_back(USERID);
70 userIds.push_back(USERFIRSTID);
71 NotifyUserIds notifyUserIds(remoteUdid, userIds);
72 ToJson(jsonObject, userIdsMsg);
73 FromJson(jsonObject, userIdsMsg);
74 ToJson(jsonObject, commMsg);
75 FromJson(jsonObject, commMsg);
76 ToJson(jsonObject, notifyUserIds);
77 FromJson(jsonObject, notifyUserIds);
78 jsonObject = cJSON_Parse(jsonString);
79 ToJson(jsonObject, userIdsMsg);
80 FromJson(jsonObject, userIdsMsg);
81 ToJson(jsonObject, commMsg);
82 FromJson(jsonObject, commMsg);
83 GetCommMsgString(commMsg);
84 ToJson(jsonObject, notifyUserIds);
85 FromJson(jsonObject, notifyUserIds);
86 notifyUserIds.ToString();
87 cJSON_Delete(jsonObject);
88 }
89
DmTransPortMsgFirstFuzzTest(const uint8_t * data,size_t size)90 void DmTransPortMsgFirstFuzzTest(const uint8_t* data, size_t size)
91 {
92 if ((data == nullptr) || (size < sizeof(int32_t))) {
93 return;
94 }
95 FuzzedDataProvider fdp(data, size);
96 int32_t code = fdp.ConsumeIntegral<int32_t>();
97 std::string msg(reinterpret_cast<const char*>(data), size);
98 std::string remoteUdid(reinterpret_cast<const char*>(data), size);
99 const char* jsonString = R"({
100 "accountId": "a******3",
101 "userId": 123,
102 "tokenId": 123456,
103 "extra": "extra",
104 "udid": "p******d",
105 })";
106 cJSON* jsonObject = nullptr;
107 LogoutAccountMsg accountInfo;
108 ToJson(jsonObject, accountInfo);
109 FromJson(jsonObject, accountInfo);
110 UninstAppMsg uninstAppMsg;
111 ToJson(jsonObject, uninstAppMsg);
112 FromJson(jsonObject, uninstAppMsg);
113 UnBindAppMsg unBindAppMsg;
114 ToJson(jsonObject, unBindAppMsg);
115 FromJson(jsonObject, unBindAppMsg);
116
117 jsonObject = cJSON_Parse(jsonString);
118 ToJson(jsonObject, accountInfo);
119 FromJson(jsonObject, accountInfo);
120 ToJson(jsonObject, uninstAppMsg);
121 FromJson(jsonObject, uninstAppMsg);
122 ToJson(jsonObject, unBindAppMsg);
123 FromJson(jsonObject, unBindAppMsg);
124 cJSON_Delete(jsonObject);
125 }
126 }
127 }
128
129 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)130 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
131 {
132 /* Run your code on data */
133 OHOS::DistributedHardware::DmTransPortMsgFuzzTest(data, size);
134 OHOS::DistributedHardware::DmTransPortMsgFirstFuzzTest(data, size);
135 return 0;
136 }
137