1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "medialibrary_mtp_payloaddata_fuzzer.h"
16
17 #include <cstdint>
18 #include <string>
19 #include <vector>
20 #include <fstream>
21 #include <fuzzer/FuzzedDataProvider.h>
22
23 #include "system_ability_definition.h"
24 #include "iservice_registry.h"
25 #include "userfilemgr_uri.h"
26 #include "payload_data.h"
27 #include "medialibrary_errno.h"
28 #include "media_log.h"
29
30 #define private public
31 #include "close_session_data.h"
32 #include "copy_object_data.h"
33 #include "delete_object_data.h"
34 #include "get_device_info_data.h"
35 #include "get_device_prop_desc_data.h"
36 #include "get_device_prop_value_data.h"
37 #include "get_num_objects_data.h"
38 #include "get_object_data.h"
39 #include "get_object_handles_data.h"
40 #include "get_object_info_data.h"
41 #include "get_object_prop_desc_data.h"
42 #include "get_object_prop_list_data.h"
43 #include "get_object_prop_value_data.h"
44 #include "get_object_props_supported_data.h"
45 #include "get_object_references_data.h"
46 #include "get_partial_object_data.h"
47 #include "get_storage_ids_data.h"
48 #include "get_storage_info_data.h"
49 #include "get_thumb_data.h"
50 #include "move_object_data.h"
51 #include "object_event_data.h"
52 #include "open_session_data.h"
53 #include "resp_common_data.h"
54 #include "send_object_data.h"
55 #include "send_object_info_data.h"
56 #include "set_device_prop_value_data.h"
57 #include "set_object_prop_value_data.h"
58 #include "set_object_references_data.h"
59 #undef private
60
61 namespace OHOS {
62 using namespace std;
63 using namespace Media;
64 static const int32_t NUM_BYTES = 1;
65 static const int32_t MAX_BYTE_VALUE = 256;
66 static const int32_t SEED_SIZE = 1024;
67 FuzzedDataProvider *provider = nullptr;
68
FuzzVectorUInt32()69 static inline vector<uint32_t> FuzzVectorUInt32()
70 {
71 return {provider->ConsumeIntegral<uint32_t>()};
72 }
73
FuzzMtpOperationContext()74 static MtpOperationContext FuzzMtpOperationContext()
75 {
76 MtpOperationContext context;
77 context.operationCode = provider->ConsumeIntegral<uint16_t>();
78 context.transactionID = provider->ConsumeIntegral<uint32_t>();
79 context.devicePropertyCode = provider->ConsumeIntegral<uint32_t>();
80 context.storageID = provider->ConsumeIntegral<uint32_t>();
81 context.format = provider->ConsumeIntegral<uint16_t>();
82 context.parent = provider->ConsumeIntegral<uint32_t>();
83 context.handle = provider->ConsumeIntegral<uint32_t>();
84 context.property = provider->ConsumeIntegral<uint32_t>();
85 context.groupCode = provider->ConsumeIntegral<uint32_t>();
86 context.depth = provider->ConsumeIntegral<uint32_t>();
87 context.properStrValue = provider->ConsumeBytesAsString(NUM_BYTES);
88 context.properIntValue = provider->ConsumeIntegral<int64_t>();
89 context.handles = make_shared<UInt32List>(FuzzVectorUInt32());
90 context.name = provider->ConsumeBytesAsString(NUM_BYTES);
91 context.created = provider->ConsumeBytesAsString(NUM_BYTES);
92 context.modified = provider->ConsumeBytesAsString(NUM_BYTES);
93 context.indata = provider->ConsumeBool();
94 context.storageInfoID = provider->ConsumeIntegral<uint32_t>();
95 context.sessionOpen = provider->ConsumeBool();
96 context.sessionID = provider->ConsumeIntegral<uint32_t>();
97 context.mtpDriver = make_shared<MtpDriver>();
98 context.tempSessionID = provider->ConsumeIntegral<uint32_t>();
99 context.eventHandle = provider->ConsumeIntegral<uint32_t>();
100 context.eventProperty = provider->ConsumeIntegral<uint32_t>();
101 return context;
102 }
103
104 // PayloadDataTest start
CloseSessionDataTest()105 static void CloseSessionDataTest()
106 {
107 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
108 FuzzMtpOperationContext());
109 if (context == nullptr) {
110 MEDIA_ERR_LOG("context is nullptr");
111 return;
112 }
113
114 CloseSessionData closeSessionData(context);
115 closeSessionData.CalculateSize();
116
117 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
118 int32_t readSize = buffer.size();
119 closeSessionData.Parser(buffer, readSize);
120
121 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
122 closeSessionData.Maker(outBuffer);
123 }
124
CopyObjectDataTest()125 static void CopyObjectDataTest()
126 {
127 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
128 FuzzMtpOperationContext());
129 if (context == nullptr) {
130 MEDIA_ERR_LOG("context is nullptr");
131 return;
132 }
133
134 CopyObjectData copyObjectData(context);
135 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
136 int32_t readSize = buffer.size();
137 copyObjectData.Parser(buffer, readSize);
138 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
139 copyObjectData.Maker(outBuffer);
140 copyObjectData.CalculateSize();
141
142 uint32_t objectHandle = provider->ConsumeIntegral<uint32_t>();
143 copyObjectData.SetObjectHandle(objectHandle);
144
145 copyObjectData.Parser(buffer, readSize);
146 copyObjectData.Maker(outBuffer);
147 copyObjectData.CalculateSize();
148 copyObjectData.SetObjectHandle(objectHandle);
149 }
150
DeleteObjectDataTest()151 static void DeleteObjectDataTest()
152 {
153 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
154 FuzzMtpOperationContext());
155 if (context == nullptr) {
156 MEDIA_ERR_LOG("context is nullptr");
157 return;
158 }
159
160 DeleteObjectData deleteObjectData(context);
161 deleteObjectData.CalculateSize();
162
163 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
164 int32_t readSize = buffer.size();
165 deleteObjectData.Parser(buffer, readSize);
166
167 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
168 deleteObjectData.Maker(outBuffer);
169 }
170
GetDeviceInfoDataTest()171 static void GetDeviceInfoDataTest()
172 {
173 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
174 FuzzMtpOperationContext());
175 if (context == nullptr) {
176 MEDIA_ERR_LOG("context is nullptr");
177 return;
178 }
179
180 GetDeviceInfoData getDeviceInfoData(context);
181 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
182 int32_t readSize = buffer.size();
183 getDeviceInfoData.Parser(buffer, readSize);
184
185 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
186 getDeviceInfoData.Maker(outBuffer);
187 getDeviceInfoData.CalculateSize();
188
189 string manufacturer = provider->ConsumeBytesAsString(NUM_BYTES);
190 getDeviceInfoData.SetManufacturer(manufacturer);
191 getDeviceInfoData.SetModel(manufacturer);
192 getDeviceInfoData.SetVersion(manufacturer);
193 getDeviceInfoData.SetSerialNum(manufacturer);
194 }
195
GetDevicePropDescDataTest()196 static void GetDevicePropDescDataTest()
197 {
198 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
199 FuzzMtpOperationContext());
200 if (context == nullptr) {
201 MEDIA_ERR_LOG("context is nullptr");
202 return;
203 }
204
205 GetDevicePropDescData getDevicePropDescData(context);
206 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
207 getDevicePropDescData.Maker(outBuffer);
208 getDevicePropDescData.CalculateSize();
209
210 shared_ptr<Property> property = make_shared<Property>();
211 getDevicePropDescData.SetProperty(property);
212
213 getDevicePropDescData.Maker(outBuffer);
214 getDevicePropDescData.CalculateSize();
215 }
216
GetDevicePropValueDataTest()217 static void GetDevicePropValueDataTest()
218 {
219 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
220 FuzzMtpOperationContext());
221 if (context == nullptr) {
222 MEDIA_ERR_LOG("context is nullptr");
223 return;
224 }
225
226 GetDevicePropValueData getDevicePropValueData(context);
227 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
228
229 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
230 getDevicePropValueData.Maker(outBuffer);
231 getDevicePropValueData.CalculateSize();
232
233 uint16_t type = provider->ConsumeIntegral<uint16_t>();
234 shared_ptr<Property::Value> value = make_shared<Property::Value>();
235 getDevicePropValueData.SetValue(type, value);
236
237 Property::Value writeValue;
238 getDevicePropValueData.WriteValue(buffer, type, writeValue);
239 getDevicePropValueData.WriteValue(buffer, MTP_TYPE_INT8_CODE, writeValue);
240 getDevicePropValueData.WriteValue(buffer, MTP_TYPE_UINT8_CODE, writeValue);
241 getDevicePropValueData.WriteValue(buffer, MTP_TYPE_INT16_CODE, writeValue);
242 getDevicePropValueData.WriteValue(buffer, MTP_TYPE_UINT16_CODE, writeValue);
243 getDevicePropValueData.WriteValue(buffer, MTP_TYPE_INT32_CODE, writeValue);
244 getDevicePropValueData.WriteValue(buffer, MTP_TYPE_UINT32_CODE, writeValue);
245
246 getDevicePropValueData.Maker(outBuffer);
247 getDevicePropValueData.CalculateSize();
248
249 int32_t readSize = buffer.size();
250 getDevicePropValueData.Parser(buffer, readSize);
251 getDevicePropValueData.context_ = context;
252 getDevicePropValueData.Parser(buffer, readSize);
253 }
254
GetNumObjectsDataTest()255 static void GetNumObjectsDataTest()
256 {
257 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
258 FuzzMtpOperationContext());
259 if (context == nullptr) {
260 MEDIA_ERR_LOG("context is nullptr");
261 return;
262 }
263
264 GetNumObjectsData getNumObjectsData(context);
265 getNumObjectsData.GetNum();
266 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
267 int32_t readSize = buffer.size();
268 getNumObjectsData.Parser(buffer, readSize);
269
270 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
271 getNumObjectsData.Maker(outBuffer);
272 getNumObjectsData.CalculateSize();
273
274 int num = provider->ConsumeIntegral<int32_t>();
275 getNumObjectsData.SetNum(num);
276
277 getNumObjectsData.GetNum();
278 getNumObjectsData.Maker(outBuffer);
279 getNumObjectsData.CalculateSize();
280 }
281
GetObjectDataTest()282 static void GetObjectDataTest()
283 {
284 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
285 FuzzMtpOperationContext());
286 if (context == nullptr) {
287 MEDIA_ERR_LOG("context is nullptr");
288 return;
289 }
290
291 GetObjectData getObjectData(context);
292 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
293 int32_t readSize = buffer.size();
294 getObjectData.Parser(buffer, readSize);
295
296 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
297 getObjectData.Maker(outBuffer);
298 getObjectData.CalculateSize();
299
300 uint32_t result = provider->ConsumeIntegral<uint32_t>();
301 getObjectData.SetResult(result);
302 getObjectData.Parser(buffer, readSize);
303 getObjectData.Maker(outBuffer);
304 getObjectData.CalculateSize();
305 }
306
GetObjectHandlesDataTest()307 static void GetObjectHandlesDataTest()
308 {
309 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
310 FuzzMtpOperationContext());
311 if (context == nullptr) {
312 MEDIA_ERR_LOG("context is nullptr");
313 return;
314 }
315
316 GetObjectHandlesData getObjectHandlesData(context);
317 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
318 int32_t readSize = buffer.size();
319 getObjectHandlesData.Parser(buffer, readSize);
320
321 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
322 getObjectHandlesData.Maker(outBuffer);
323 getObjectHandlesData.CalculateSize();
324 getObjectHandlesData.GetObjectHandles();
325
326 shared_ptr<UInt32List> objectHandles = make_shared<UInt32List>(FuzzVectorUInt32());
327 getObjectHandlesData.SetObjectHandles(objectHandles);
328 getObjectHandlesData.Parser(buffer, readSize);
329 getObjectHandlesData.Maker(outBuffer);
330 getObjectHandlesData.CalculateSize();
331 getObjectHandlesData.GetObjectHandles();
332 }
333
GetObjectInfoDataTest()334 static void GetObjectInfoDataTest()
335 {
336 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
337 FuzzMtpOperationContext());
338 if (context == nullptr) {
339 MEDIA_ERR_LOG("context is nullptr");
340 return;
341 }
342
343 GetObjectInfoData getObjectInfoData(context);
344 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
345 int32_t readSize = buffer.size();
346 getObjectInfoData.Parser(buffer, readSize);
347
348 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
349 getObjectInfoData.Maker(outBuffer);
350 getObjectInfoData.CalculateSize();
351 getObjectInfoData.GetObjectInfo();
352
353 shared_ptr<ObjectInfo> objectInfo = make_shared<ObjectInfo>(ObjectInfo(0));
354 getObjectInfoData.SetObjectInfo(objectInfo);
355 getObjectInfoData.Parser(buffer, readSize);
356 getObjectInfoData.Maker(outBuffer);
357 getObjectInfoData.CalculateSize();
358 getObjectInfoData.GetObjectInfo();
359 }
360
GetObjectPropDescDataTest()361 static void GetObjectPropDescDataTest()
362 {
363 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
364 FuzzMtpOperationContext());
365 if (context == nullptr) {
366 MEDIA_ERR_LOG("context is nullptr");
367 return;
368 }
369
370 GetObjectPropDescData getObjectPropDescData(context);
371 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
372 int32_t readSize = buffer.size();
373 getObjectPropDescData.Parser(buffer, readSize);
374
375 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
376 getObjectPropDescData.Maker(outBuffer);
377 getObjectPropDescData.CalculateSize();
378 getObjectPropDescData.GetProp();
379 getObjectPropDescData.GetPropInt();
380 getObjectPropDescData.GetPropStr();
381 getObjectPropDescData.GetPropForm();
382 }
383
GetObjectPropListDataTest()384 static void GetObjectPropListDataTest()
385 {
386 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
387 FuzzMtpOperationContext());
388 if (context == nullptr) {
389 MEDIA_ERR_LOG("context is nullptr");
390 return;
391 }
392
393 GetObjectPropListData getObjectPropListData(context);
394 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
395 int32_t readSize = buffer.size();
396 getObjectPropListData.Parser(buffer, readSize);
397
398 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
399 getObjectPropListData.Maker(outBuffer);
400 getObjectPropListData.CalculateSize();
401
402 shared_ptr<vector<Property>> props = make_shared<vector<Property>>();
403 getObjectPropListData.SetProps(props);
404
405 getObjectPropListData.Parser(buffer, readSize);
406 getObjectPropListData.Maker(outBuffer);
407 getObjectPropListData.CalculateSize();
408
409 Property prop;
410 prop.type_ = provider->ConsumeIntegral<uint16_t>();
411 getObjectPropListData.WriteProperty(outBuffer, prop);
412 getObjectPropListData.WritePropertyStrValue(outBuffer, prop);
413 getObjectPropListData.WritePropertyIntValue(outBuffer, prop);
414 }
415
GetObjectPropValueDataTest()416 static void GetObjectPropValueDataTest()
417 {
418 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
419 FuzzMtpOperationContext());
420 if (context == nullptr) {
421 MEDIA_ERR_LOG("context is nullptr");
422 return;
423 }
424
425 GetObjectPropValueData getObjectPropValueData(context);
426 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
427 int32_t readSize = buffer.size();
428 getObjectPropValueData.Parser(buffer, readSize);
429
430 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
431 getObjectPropValueData.Maker(outBuffer);
432 getObjectPropValueData.CalculateSize();
433
434 int type = provider->ConsumeIntegral<int32_t>();
435 uint64_t int64Value = provider->ConsumeIntegral<uint64_t>();
436 uint32_t valueUInt32First = provider->ConsumeIntegral<uint32_t>();
437 uint32_t valueUInt32Second = provider->ConsumeIntegral<uint32_t>();
438 uint32_t valueUInt32Third = provider->ConsumeIntegral<uint32_t>();
439 uint32_t valueUInt32Fourth = provider->ConsumeIntegral<uint32_t>();
440 uint128_t int128Value = {valueUInt32First, valueUInt32Second,
441 valueUInt32Third, valueUInt32Fourth};
442 string strValue = provider->ConsumeBytesAsString(NUM_BYTES);
443 getObjectPropValueData.SetPropValue(type, int64Value, int128Value, strValue);
444
445 getObjectPropValueData.Parser(buffer, readSize);
446 getObjectPropValueData.Maker(outBuffer);
447 getObjectPropValueData.CalculateSize();
448 }
449
GetObjectPropsSupportedDataTest()450 static void GetObjectPropsSupportedDataTest()
451 {
452 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
453 FuzzMtpOperationContext());
454 if (context == nullptr) {
455 MEDIA_ERR_LOG("context is nullptr");
456 return;
457 }
458
459 GetObjectPropsSupportedData getObjectPropsSupportedData(context);
460 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
461 int32_t readSize = buffer.size();
462 getObjectPropsSupportedData.Parser(buffer, readSize);
463
464 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
465 getObjectPropsSupportedData.Maker(outBuffer);
466 getObjectPropsSupportedData.CalculateSize();
467
468 UInt16List properties = {provider->ConsumeIntegral<uint16_t>()};
469 getObjectPropsSupportedData.GetObjectProps(properties);
470
471 getObjectPropsSupportedData.Parser(buffer, readSize);
472 getObjectPropsSupportedData.Maker(outBuffer);
473 getObjectPropsSupportedData.CalculateSize();
474 }
475
GetObjectReferencesDataTest()476 static void GetObjectReferencesDataTest()
477 {
478 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
479 FuzzMtpOperationContext());
480 if (context == nullptr) {
481 MEDIA_ERR_LOG("context is nullptr");
482 return;
483 }
484
485 GetObjectReferencesData getObjectReferencesData(context);
486 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
487 int32_t readSize = buffer.size();
488 getObjectReferencesData.Parser(buffer, readSize);
489
490 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
491 getObjectReferencesData.Maker(outBuffer);
492 getObjectReferencesData.CalculateSize();
493
494 getObjectReferencesData.GetObjectHandles();
495
496 shared_ptr<UInt32List> objectHandles = make_shared<UInt32List>(FuzzVectorUInt32());
497 getObjectReferencesData.SetObjectHandles(objectHandles);
498
499 getObjectReferencesData.GetObjectHandles();
500 getObjectReferencesData.Parser(buffer, readSize);
501 getObjectReferencesData.Maker(outBuffer);
502 getObjectReferencesData.CalculateSize();
503 }
504
GetPartialObjectDataTest()505 static void GetPartialObjectDataTest()
506 {
507 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
508 FuzzMtpOperationContext());
509 if (context == nullptr) {
510 MEDIA_ERR_LOG("context is nullptr");
511 return;
512 }
513
514 GetPartialObjectData getPartialObjectData(context);
515 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
516 int32_t readSize = buffer.size();
517 getPartialObjectData.Parser(buffer, readSize);
518
519 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
520 getPartialObjectData.Maker(outBuffer);
521 getPartialObjectData.CalculateSize();
522
523 uint32_t length = provider->ConsumeIntegral<uint32_t>();
524 getPartialObjectData.SetLength(length);
525
526 getPartialObjectData.Parser(buffer, readSize);
527 getPartialObjectData.Maker(outBuffer);
528 getPartialObjectData.CalculateSize();
529 }
530
GetStorageIdsDataTest()531 static void GetStorageIdsDataTest()
532 {
533 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
534 FuzzMtpOperationContext());
535 if (context == nullptr) {
536 MEDIA_ERR_LOG("context is nullptr");
537 return;
538 }
539
540 GetStorageIdsData getStorageIdsData(context);
541 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
542 int32_t readSize = buffer.size();
543 getStorageIdsData.Parser(buffer, readSize);
544
545 vector<shared_ptr<Storage>> storages;
546 getStorageIdsData.SetStorages(storages);
547 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
548 getStorageIdsData.Maker(outBuffer);
549 getStorageIdsData.CalculateSize();
550 }
551
GetStorageInfoDataTest()552 static void GetStorageInfoDataTest()
553 {
554 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
555 FuzzMtpOperationContext());
556 if (context == nullptr) {
557 MEDIA_ERR_LOG("context is nullptr");
558 return;
559 }
560
561 GetStorageInfoData getStorageInfoData(context);
562 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
563 int32_t readSize = buffer.size();
564 getStorageInfoData.Parser(buffer, readSize);
565
566 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
567 getStorageInfoData.Maker(outBuffer);
568 getStorageInfoData.CalculateSize();
569
570 shared_ptr<Storage> storage = make_shared<Storage>();
571 getStorageInfoData.SetStorage(storage);
572
573 getStorageInfoData.Parser(buffer, readSize);
574 getStorageInfoData.Maker(outBuffer);
575 getStorageInfoData.CalculateSize();
576 }
577
GetThumbDataTest()578 static void GetThumbDataTest()
579 {
580 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
581 FuzzMtpOperationContext());
582 if (context == nullptr) {
583 MEDIA_ERR_LOG("context is nullptr");
584 return;
585 }
586
587 GetThumbData getThumbData(context);
588 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
589 int32_t readSize = buffer.size();
590 getThumbData.Parser(buffer, readSize);
591
592 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
593 getThumbData.Maker(outBuffer);
594 getThumbData.CalculateSize();
595
596 shared_ptr<UInt8List> thumb = make_shared<UInt8List>(provider->ConsumeBytes<uint8_t>(NUM_BYTES));
597 getThumbData.SetThumb(thumb);
598
599 getThumbData.Parser(buffer, readSize);
600 getThumbData.Maker(outBuffer);
601 getThumbData.CalculateSize();
602 }
603
MoveObjectDataTest()604 static void MoveObjectDataTest()
605 {
606 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
607 FuzzMtpOperationContext());
608 if (context == nullptr) {
609 MEDIA_ERR_LOG("context is nullptr");
610 return;
611 }
612
613 MoveObjectData moveObjectData(context);
614 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
615 int32_t readSize = buffer.size();
616 moveObjectData.Parser(buffer, readSize);
617
618 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
619 moveObjectData.Maker(outBuffer);
620 moveObjectData.CalculateSize();
621 }
622
ObjectEventDataTest()623 static void ObjectEventDataTest()
624 {
625 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
626 FuzzMtpOperationContext());
627 if (context == nullptr) {
628 MEDIA_ERR_LOG("context is nullptr");
629 return;
630 }
631
632 ObjectEventData objectEventData(context);
633 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
634 int32_t readSize = buffer.size();
635 objectEventData.Parser(buffer, readSize);
636
637 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
638 objectEventData.Maker(outBuffer);
639 objectEventData.CalculateSize();
640
641 const int32_t payload = provider->ConsumeIntegral<int32_t>();
642 objectEventData.SetPayload(payload);
643
644 objectEventData.Parser(buffer, readSize);
645 objectEventData.Maker(outBuffer);
646 objectEventData.CalculateSize();
647 }
648
OpenSessionDataTest()649 static void OpenSessionDataTest()
650 {
651 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
652 FuzzMtpOperationContext());
653 if (context == nullptr) {
654 MEDIA_ERR_LOG("context is nullptr");
655 return;
656 }
657
658 OpenSessionData OpenSessionData(context);
659 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
660 int32_t readSize = buffer.size();
661 OpenSessionData.Parser(buffer, readSize);
662
663 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
664 OpenSessionData.Maker(outBuffer);
665 OpenSessionData.CalculateSize();
666
667 uint32_t sessionID = provider->ConsumeIntegral<uint32_t>();
668 OpenSessionData.SetSessionId(sessionID);
669
670 OpenSessionData.Parser(buffer, readSize);
671 OpenSessionData.Maker(outBuffer);
672 OpenSessionData.CalculateSize();
673 }
674
RespCommonDataTest()675 static void RespCommonDataTest()
676 {
677 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
678 FuzzMtpOperationContext());
679 if (context == nullptr) {
680 MEDIA_ERR_LOG("context is nullptr");
681 return;
682 }
683
684 RespCommonData respCommonData(context);
685 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
686 int32_t readSize = buffer.size();
687 respCommonData.Parser(buffer, readSize);
688
689 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
690 respCommonData.Maker(outBuffer);
691 respCommonData.CalculateSize();
692
693 int paramIndex = provider->ConsumeIntegral<int32_t>();
694 uint32_t value = provider->ConsumeIntegral<uint32_t>();
695 respCommonData.SetParam(paramIndex, value);
696
697 respCommonData.Parser(buffer, readSize);
698 respCommonData.Maker(outBuffer);
699 respCommonData.CalculateSize();
700 }
701
SendObjectDataTest()702 static void SendObjectDataTest()
703 {
704 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
705 FuzzMtpOperationContext());
706 if (context == nullptr) {
707 MEDIA_ERR_LOG("context is nullptr");
708 return;
709 }
710
711 SendObjectData sendObjectData(context);
712 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
713 int32_t readSize = buffer.size();
714 sendObjectData.Parser(buffer, readSize);
715
716 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
717 sendObjectData.Maker(outBuffer);
718 sendObjectData.CalculateSize();
719 }
720
SendObjectInfoDataTest()721 static void SendObjectInfoDataTest()
722 {
723 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
724 FuzzMtpOperationContext());
725 if (context == nullptr) {
726 MEDIA_ERR_LOG("context is nullptr");
727 return;
728 }
729
730 SendObjectInfoData sendObjectInfoData(context);
731 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
732 int32_t readSize = buffer.size();
733 sendObjectInfoData.Parser(buffer, readSize);
734
735 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
736 sendObjectInfoData.Maker(outBuffer);
737 sendObjectInfoData.CalculateSize();
738
739 uint32_t storageID = provider->ConsumeIntegral<uint32_t>();
740 uint32_t parent = provider->ConsumeIntegral<uint32_t>();
741 uint32_t handle = provider->ConsumeIntegral<uint32_t>();
742 sendObjectInfoData.SetSetParam(storageID, parent, handle);
743
744 sendObjectInfoData.Parser(buffer, readSize);
745 sendObjectInfoData.Maker(outBuffer);
746 sendObjectInfoData.CalculateSize();
747
748 size_t offsetTest = 1;
749 buffer.push_back(provider->ConsumeIntegral<uint8_t>());
750 sendObjectInfoData.ParserData(buffer, offsetTest);
751 sendObjectInfoData.ParserDataForImageInfo(buffer, offsetTest);
752 sendObjectInfoData.ParserDataForFileInfo(buffer, offsetTest);
753 }
754
SetDevicePropValueDataTest()755 static void SetDevicePropValueDataTest()
756 {
757 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
758 FuzzMtpOperationContext());
759 if (context == nullptr) {
760 MEDIA_ERR_LOG("context is nullptr");
761 return;
762 }
763
764 SetDevicePropValueData setDevicePropValueData(context);
765 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
766 int32_t readSize = buffer.size();
767 setDevicePropValueData.Parser(buffer, readSize);
768
769 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
770 setDevicePropValueData.Maker(outBuffer);
771 setDevicePropValueData.CalculateSize();
772 }
773
SetObjectPropValueDataTest()774 static void SetObjectPropValueDataTest()
775 {
776 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
777 FuzzMtpOperationContext());
778 SetObjectPropValueData setObjectPropValueData(context);
779 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
780 int32_t readSize = buffer.size();
781 setObjectPropValueData.Parser(buffer, readSize);
782
783 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
784 setObjectPropValueData.Maker(outBuffer);
785 setObjectPropValueData.CalculateSize();
786
787 uint16_t result = provider->ConsumeIntegral<uint16_t>();
788 setObjectPropValueData.SetResult(result);
789
790 setObjectPropValueData.Parser(buffer, readSize);
791 setObjectPropValueData.Maker(outBuffer);
792 setObjectPropValueData.CalculateSize();
793
794 size_t offsetTest = 0;
795 int type = provider->ConsumeIntegral<int32_t>();
796 int64_t int64Value = -1;
797 setObjectPropValueData.ReadIntValue(buffer, offsetTest, type, int64Value);
798 type = provider->ConsumeIntegral<int32_t>();
799 setObjectPropValueData.ReadInt8Value(buffer, offsetTest, type, int64Value);
800 type = provider->ConsumeIntegral<int32_t>();
801 setObjectPropValueData.ReadInt16Value(buffer, offsetTest, type, int64Value);
802 type = provider->ConsumeIntegral<int32_t>();
803 setObjectPropValueData.ReadInt32Value(buffer, offsetTest, type, int64Value);
804 type = provider->ConsumeIntegral<int32_t>();
805 setObjectPropValueData.ReadInt64Value(buffer, offsetTest, type, int64Value);
806 }
807
SetObjectReferencesDataTest()808 static void SetObjectReferencesDataTest()
809 {
810 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
811 FuzzMtpOperationContext());
812 if (context == nullptr) {
813 MEDIA_ERR_LOG("context is nullptr");
814 return;
815 }
816
817 SetObjectReferencesData setObjectReferencesData(context);
818 vector<uint8_t> buffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
819 int32_t readSize = buffer.size();
820 setObjectReferencesData.Parser(buffer, readSize);
821
822 vector<uint8_t> outBuffer = provider->ConsumeBytes<uint8_t>(NUM_BYTES);
823 setObjectReferencesData.Maker(outBuffer);
824 setObjectReferencesData.CalculateSize();
825
826 uint16_t result = provider->ConsumeIntegral<uint16_t>();
827 setObjectReferencesData.SetResult(result);
828
829 setObjectReferencesData.Parser(buffer, readSize);
830 setObjectReferencesData.Maker(outBuffer);
831 setObjectReferencesData.CalculateSize();
832 }
833
PayloadDataTest()834 static void PayloadDataTest()
835 {
836 CloseSessionDataTest();
837 CopyObjectDataTest();
838 DeleteObjectDataTest();
839 GetDeviceInfoDataTest();
840 GetDevicePropDescDataTest();
841 GetDevicePropValueDataTest();
842 GetNumObjectsDataTest();
843 GetObjectDataTest();
844 GetObjectHandlesDataTest();
845 GetObjectInfoDataTest();
846 GetObjectPropDescDataTest();
847 GetObjectPropListDataTest();
848 GetObjectPropValueDataTest();
849 GetObjectPropsSupportedDataTest();
850 GetObjectReferencesDataTest();
851 GetPartialObjectDataTest();
852 GetStorageIdsDataTest();
853 GetStorageInfoDataTest();
854 GetThumbDataTest();
855 MoveObjectDataTest();
856 ObjectEventDataTest();
857 OpenSessionDataTest();
858 RespCommonDataTest();
859 SendObjectDataTest();
860 SendObjectInfoDataTest();
861 SetDevicePropValueDataTest();
862 SetObjectPropValueDataTest();
863 SetObjectReferencesDataTest();
864 }
865
AddSeed()866 static int32_t AddSeed()
867 {
868 char *seedData = new char[OHOS::SEED_SIZE];
869 for (int i = 0; i < OHOS::SEED_SIZE; i++) {
870 seedData[i] = static_cast<char>(i % MAX_BYTE_VALUE);
871 }
872
873 const char* filename = "corpus/seed.txt";
874 std::ofstream file(filename, std::ios::binary | std::ios::trunc);
875 if (!file) {
876 MEDIA_ERR_LOG("Cannot open file filename:%{public}s", filename);
877 delete[] seedData;
878 return Media::E_ERR;
879 }
880 file.write(seedData, OHOS::SEED_SIZE);
881 file.close();
882 delete[] seedData;
883 MEDIA_INFO_LOG("seedData has been successfully written to file filename:%{public}s", filename);
884 return Media::E_OK;
885 }
886 } // namespace OHOS
887
LLVMFuzzerInitialize(int * argc,char *** argv)888 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
889 {
890 OHOS::AddSeed();
891 return 0;
892 }
893
894 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)895 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
896 {
897 /* Run your code on data */
898 FuzzedDataProvider fdp(data, size);
899 OHOS::provider = &fdp;
900 if (data == nullptr) {
901 return 0;
902 }
903 OHOS::PayloadDataTest();
904 return 0;
905 }