1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include <string>
16 #include <fuzzer/FuzzedDataProvider.h>
17 #include "avsession_log.h"
18 #include "softbussessionmanager_fuzzer.h"
19 #include "softbus_session_manager.h"
20 #include "securec.h"
21
22 using namespace std;
23 namespace OHOS::AVSession {
24 static const int32_t MIN_SIZE_NUM = 4;
25 static const uint8_t *RAW_DATA = nullptr;
26 static size_t g_dataSize = 0;
27 static size_t g_pos;
28
29 template<class T>
GetData()30 T GetData()
31 {
32 T object {};
33 size_t objectSize = sizeof(object);
34 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
35 return object;
36 }
37 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
38 if (ret != EOK) {
39 return {};
40 }
41 g_pos += objectSize;
42 return object;
43 }
44
45 class SoftbusSessionListenerDemo : public SoftbusSessionListener {
46 public:
OnBind(int32_t socket,PeerSocketInfo info)47 void OnBind(int32_t socket, PeerSocketInfo info) override {};
OnShutdown(int32_t socket,ShutdownReason reason)48 void OnShutdown(int32_t socket, ShutdownReason reason) override {};
OnBytes(int32_t socket,const void * data,int32_t dataLen)49 void OnBytes(int32_t socket, const void *data, int32_t dataLen) override {};
OnMessage(int32_t socket,const void * data,int32_t dataLen)50 void OnMessage(int32_t socket, const void *data, int32_t dataLen) override {};
51 };
52
SoftbusSessionManagerFuzzTest(uint8_t * data,size_t size)53 void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size)
54 {
55 FuzzedDataProvider proveider(RAW_DATA, g_dataSize);
56 std::shared_ptr<SoftbusSessionManager> manager_ = std::make_shared<SoftbusSessionManager>();
57 std::shared_ptr<SoftbusSessionListenerDemo> softbusSessionListenerDemo =
58 std::make_shared<SoftbusSessionListenerDemo>();
59 manager_->AddSessionListener(softbusSessionListenerDemo);
60 int32_t socket = GetData<uint8_t>();
61 std::string infoName = std::to_string(GetData<uint8_t>());
62 std::string infoNetworkId = std::to_string(GetData<uint8_t>());
63 std::string infoPkgName = std::to_string(GetData<uint8_t>());
64 PeerSocketInfo info = {
65 .name = const_cast<char *>(infoName.c_str()),
66 .networkId = const_cast<char *>(infoNetworkId.c_str()),
67 .pkgName = const_cast<char *>(infoPkgName.c_str()),
68 .dataType = DATA_TYPE_BYTES,
69 };
70 manager_->OnBind(socket, info);
71 manager_->OnShutdown(socket, ShutdownReason::SHUTDOWN_REASON_LOCAL);
72
73 MessageParcel data_;
74 data_.WriteRawData(data, size);
75
76 std::string deviceId = std::to_string(GetData<uint8_t>());
77 manager_->ObtainPeerDeviceId(socket, deviceId);
78
79 data_.RewindRead(GetData<uint8_t>());
80 auto obj = std::make_unique<int32_t>(data_.ReadInt32());
81 const void *objectId = obj.get();
82 unsigned int dataLen = GetData<unsigned int>();
83 manager_->OnBytes(socket, objectId, dataLen);
84 manager_->OnBytes(socket, nullptr, dataLen);
85 manager_->OnMessage(socket, objectId, dataLen);
86 manager_->OnMessage(socket, nullptr, dataLen);
87
88 std::string pkg;
89 bool isNUll = GetData<bool>();
90 if (!isNUll) {
91 pkg = to_string(GetData<uint8_t>());
92 }
93 auto ret = manager_->Socket(pkg);
94 manager_->Bind("localhost", pkg);
95 manager_->Shutdown(ret);
96
97 std::string inforOne = std::to_string(GetData<uint8_t>());
98 std::string inforTwo = std::to_string(GetData<uint8_t>());
99 manager_->SendMessage(socket, inforOne);
100 manager_->SendMessage(socket, inforTwo);
101 manager_->SendBytes(socket, inforOne);
102 manager_->SendBytes(socket, inforTwo);
103
104 info.networkId = nullptr;
105 manager_->OnBind(socket, info);
106
107 manager_->AddSessionListener(nullptr);
108 std::string sendData = proveider.ConsumeRandomLengthString();
109 manager_->SendBytesForNext(socket, sendData);
110 }
111
SoftbusSessionManagerOnRemoteRequest(uint8_t * data,size_t size)112 void SoftbusSessionManagerOnRemoteRequest(uint8_t* data, size_t size)
113 {
114 auto softbusSessionManager = std::make_unique<SoftbusSessionManagerFuzzer>();
115 if (softbusSessionManager == nullptr) {
116 SLOGI("softbusSessionManager is null");
117 return;
118 }
119 softbusSessionManager->SoftbusSessionManagerFuzzTest(data, size);
120 }
121 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)122 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
123 {
124 SLOGI("the maximum length of size should not be verified");
125 if ((data == nullptr) || (size < MIN_SIZE_NUM)) {
126 return 0;
127 }
128 RAW_DATA = data;
129 g_dataSize = size;
130 g_pos = 0;
131 /* Run your code on data */
132 SoftbusSessionManagerOnRemoteRequest(data, size);
133 return 0;
134 }
135 }