1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fuzzer/FuzzedDataProvider.h>
17 #include "containersfastbufferfill_fuzzer.h"
18
19 #include "ecmascript/containers/containers_bitvector.h"
20 #include "ecmascript/containers/containers_buffer.h"
21 #include "ecmascript/containers/containers_private.h"
22 #include "ecmascript/ecma_string-inl.h"
23 #include "ecmascript/ecma_vm.h"
24 #include "ecmascript/global_env.h"
25 #include "ecmascript/js_api/js_api_buffer.h"
26 #include "ecmascript/js_handle.h"
27 #include "ecmascript/object_factory.h"
28
29 using namespace panda;
30 using namespace panda::ecmascript;
31 using namespace panda::ecmascript::containers;
32
33 #define MAXBYTELEN sizeof(uint32_t)
34
35 namespace OHOS {
36
JSObjectCreate(JSThread * thread)37 JSFunction *JSObjectCreate(JSThread *thread)
38 {
39 EcmaVM *ecmaVM = thread->GetEcmaVM();
40 JSHandle<GlobalEnv> globalEnv = ecmaVM->GetGlobalEnv();
41 return globalEnv->GetObjectFunction().GetObject<JSFunction>();
42 }
43
CreateEcmaRuntimeCallInfo(JSThread * thread,uint32_t numArgs)44 EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)
45 {
46 auto factory = thread->GetEcmaVM()->GetFactory();
47 JSHandle<JSTaggedValue> hclass(thread, JSObjectCreate(thread));
48 JSHandle<JSTaggedValue> callee(factory->NewJSObjectByConstructor(JSHandle<JSFunction>::Cast(hclass), hclass));
49 JSHandle<JSTaggedValue> undefined = thread->GlobalConstants()->GetHandledUndefined();
50 EcmaRuntimeCallInfo *objCallInfo =
51 EcmaInterpreter::NewRuntimeCallInfo(thread, undefined, callee, undefined, numArgs);
52 return objCallInfo;
53 }
InitializeFastBufferConstructor(JSThread * thread)54 JSTaggedValue InitializeFastBufferConstructor(JSThread *thread)
55 {
56 ObjectFactory *factory = thread->GetEcmaVM()->GetFactory();
57 JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
58
59 JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject();
60 JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate"));
61 JSHandle<JSTaggedValue> value =
62 JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue();
63
64 auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6);
65 objCallInfo->SetFunction(JSTaggedValue::Undefined());
66 objCallInfo->SetThis(value.GetTaggedValue());
67 objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(ContainerTag::FastBuffer)));
68 JSTaggedValue result = ContainersPrivate::Load(objCallInfo);
69 return result;
70 }
71
CreateJSAPIFastBuffer(JSThread * thread,uint32_t length)72 JSHandle<JSAPIFastBuffer> CreateJSAPIFastBuffer(JSThread *thread, uint32_t length)
73 {
74 JSHandle<JSFunction> newTarget(thread, InitializeFastBufferConstructor(thread));
75 auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6);
76 objCallInfo->SetFunction(newTarget.GetTaggedValue());
77 objCallInfo->SetNewTarget(newTarget.GetTaggedValue());
78 objCallInfo->SetThis(JSTaggedValue::Undefined());
79 objCallInfo->SetCallArg(0, JSTaggedValue(length));
80
81 JSTaggedValue result = ContainersBuffer::BufferConstructor(objCallInfo);
82 JSHandle<JSAPIFastBuffer> buffer(thread, result);
83 return buffer;
84 }
85
ContainersFastBufferFillFuzzTest(const uint8_t * data,size_t size)86 void ContainersFastBufferFillFuzzTest(const uint8_t* data, size_t size)
87 {
88 constexpr size_t STRING_MAX_LENGTH = 100;
89 RuntimeOption option;
90 option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
91 EcmaVM *vm = JSNApi::CreateJSVM(option);
92 {
93 JsiFastNativeScope scope(vm);
94 auto thread = vm->GetAssociatedJSThread();
95
96 const int32_t MaxMenory = 1024;
97 if (size > MaxMenory) {
98 size = MaxMenory;
99 }
100 FuzzedDataProvider fdp(data, size);
101
102 int32_t value = fdp.ConsumeIntegral<int32_t>();
103 int32_t offset = fdp.ConsumeIntegral<int32_t>();
104 int32_t end = fdp.ConsumeIntegral<int32_t>();
105 ObjectFactory *factory = vm->GetFactory();
106 std::string encoding = fdp.ConsumeRandomLengthString(STRING_MAX_LENGTH);
107 JSHandle<EcmaString> str = factory->NewFromStdString(encoding);
108
109 JSHandle<JSAPIFastBuffer> buffer = CreateJSAPIFastBuffer(thread, STRING_MAX_LENGTH);
110 EcmaRuntimeCallInfo *callInfo = CreateEcmaRuntimeCallInfo(thread, 12);
111 callInfo->SetFunction(JSTaggedValue::Undefined());
112 callInfo->SetThis(buffer.GetTaggedValue());
113 // 0 : means the first parameter
114 callInfo->SetCallArg(0, JSTaggedValue(value));
115 // 1 : means the second parameter
116 callInfo->SetCallArg(1, JSTaggedValue(offset));
117 // 2 : means the third parameter
118 callInfo->SetCallArg(2, JSTaggedValue(end));
119 // 3 : means the fourth parameter
120 callInfo->SetCallArg(3, JSTaggedValue(*str));
121 [[maybe_unused]] JSTaggedValue resultAdd = ContainersBuffer::Fill(callInfo);
122 }
123 JSNApi::DestroyJSVM(vm);
124 }
125 }
126
127 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)128 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
129 {
130 // Run your code on data.
131 OHOS::ContainersFastBufferFillFuzzTest(data, size);
132 return 0;
133 }