• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "operationfirst_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 #include <iostream>
21 
22 #define private public
23 #include "operation.h"
24 #undef private
25 #include "securec.h"
26 
27 using namespace OHOS::AAFwk;
28 
29 namespace OHOS {
30 namespace {
31 constexpr size_t FOO_MAX_LEN = 1024;
32 constexpr size_t U32_AT_SIZE = 4;
33 const uint32_t BYTE0_SHIFT = 24;
34 const uint32_t BYTE1_SHIFT = 16;
35 const uint32_t BYTE2_SHIFT = 8;
36 } // namespace
GetU32Data(const char * ptr,size_t size)37 uint32_t GetU32Data(const char* ptr, size_t size)
38 {
39     if (ptr == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
40         return 0;
41     }
42     return (static_cast<uint32_t>(ptr[0]) << BYTE0_SHIFT) | (static_cast<uint32_t>(ptr[1]) << BYTE1_SHIFT) |
43            (static_cast<uint32_t>(ptr[2]) << BYTE2_SHIFT) | static_cast<uint32_t>(ptr[3]);
44 }
45 
DoSomethingInterestingWithMyAPI(const char * data,size_t size)46 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
47 {
48     std::shared_ptr<Operation> operation = std::make_shared<Operation>();
49     std::string abilityName(data, size);
50     operation->SetAbilityName(abilityName);
51     operation->GetAbilityName();
52     std::string action(data, size);
53     operation->SetAction(action);
54     operation->GetAction();
55     std::string bundleName(data, size);
56     operation->SetBundleName(bundleName);
57     operation->GetBundleName();
58     std::vector<std::string> entities;
59     std::string entity(data, size);
60     entities.push_back(entity);
61     operation->SetEntities(entities);
62     operation->GetEntities();
63     unsigned int flags = static_cast<unsigned int>(GetU32Data(data, size));
64     operation->SetFlags(flags);
65     operation->GetFlags();
66     operation->AddFlags(flags);
67     std::shared_ptr<Operation> otherOperation = std::make_shared<Operation>(*operation);
68     if (*operation == *otherOperation) {};
69     std::string otherAbilityName(data, size);
70     otherAbilityName.append(abilityName);
71     otherOperation->SetAbilityName(otherAbilityName);
72     if (*operation == *otherOperation) {};
73     otherOperation->SetAbilityName(abilityName);
74     std::string otherAction(data, size);
75     otherAction.append(action);
76     otherOperation->SetAction(otherAction);
77     if (*operation == *otherOperation) {};
78     return true;
79 }
80 } // namespace OHOS
81 
82 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)83 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
84 {
85     /* Run your code on data */
86     if (data == nullptr) {
87         std::cout << "invalid data" << std::endl;
88         return 0;
89     }
90 
91     /* Validate the length of size */
92     if (size < OHOS::U32_AT_SIZE) {
93         return 0;
94     }
95 
96     char* ch = reinterpret_cast<char *>(malloc(size + 1));
97     if (ch == nullptr) {
98         std::cout << "malloc failed." << std::endl;
99         return 0;
100     }
101 
102     (void)memset_s(ch, size + 1, 0x00, size + 1);
103     if (memcpy_s(ch, size, data, size) != EOK) {
104         std::cout << "copy failed." << std::endl;
105         free(ch);
106         ch = nullptr;
107         return 0;
108     }
109 
110     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
111     free(ch);
112     ch = nullptr;
113     return 0;
114 }