1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stringtableconcurrentloadstore_fuzzer.h"
17 #include "ecmascript/base/string_helper.h"
18 #include "ecmascript/ecma_string-inl.h"
19 #include "ecmascript/ecma_string_table_optimization-inl.h"
20 #include "common_components/base/utf_helper.h"
21 #include "ecmascript/napi/include/jsnapi.h"
22 #include "ecmascript/napi/jsnapi_helper.h"
23 #include <thread>
24 #include <vector>
25
26 using namespace panda;
27 using namespace panda::ecmascript;
28 using namespace common::utf_helper;
29
30 namespace OHOS {
31 constexpr int DOUBLE_SEQUENCE = 2;
32 constexpr int TRIPLE_SEQUENCE = 3;
33 constexpr int FOUR_SEQUENCE = 4;
34
IsValidMultiByteSequence(const uint8_t * data,size_t start,int seqLen,size_t size)35 bool IsValidMultiByteSequence(const uint8_t* data, size_t start, int seqLen, size_t size)
36 {
37 if (start + seqLen > size) {
38 return false;
39 }
40
41 for (int j = 1; j < seqLen; j++) {
42 if ((data[start + j] & 0xC0) != 0x80) {
43 return false;
44 }
45 }
46 return true;
47 }
48
AddReplacementCharacter(std::vector<uint8_t> & result)49 void AddReplacementCharacter(std::vector<uint8_t>& result)
50 {
51 result.push_back(0xEF);
52 result.push_back(0xBF);
53 result.push_back(0xBD);
54 }
55
CreateValidUtf8(const uint8_t * data,size_t size)56 std::vector<uint8_t> CreateValidUtf8(const uint8_t *data, size_t size)
57 {
58 std::vector<uint8_t> result;
59 result.reserve(size);
60 for (size_t i = 0; i < size;) {
61 uint8_t byte = data[i];
62 if (byte <= 0x7F) {
63 result.push_back(byte);
64 i++;
65 continue;
66 }
67 int seqLen = 0;
68 if ((byte & 0xE0) == 0xC0) {
69 seqLen = DOUBLE_SEQUENCE;
70 } else if ((byte & 0xF0) == 0xE0) {
71 seqLen = TRIPLE_SEQUENCE;
72 } else if ((byte & 0xF8) == 0xF0) {
73 seqLen = FOUR_SEQUENCE;
74 }
75
76 if (seqLen == 0) {
77 AddReplacementCharacter(result);
78 i++;
79 continue;
80 }
81 if (IsValidMultiByteSequence(data, i, seqLen, size)) {
82 for (int j = 0; j < seqLen; j++) {
83 result.push_back(data[i + j]);
84 }
85 i += seqLen;
86 } else {
87 AddReplacementCharacter(result);
88 i++;
89 }
90 }
91 return result;
92 }
93
StringTableConcurrentLoadStoreFuzzTest(const uint8_t * data,size_t size)94 void StringTableConcurrentLoadStoreFuzzTest(const uint8_t *data, size_t size)
95 {
96 if (data == nullptr || size <= 0) {
97 LOG_ECMA(ERROR) << "illegal input!";
98 return;
99 }
100 RuntimeOption option;
101 option.SetLogLevel(common::LOG_LEVEL::ERROR);
102 EcmaVM *vm = JSNApi::CreateJSVM(option);
103 JSThread *thread = vm->GetJSThread();
104
105 auto *map = new common::HashTrieMap<EcmaStringTableMutex, JSThread, common::TrieMapConfig::NeedSlotBarrier>();
106 std::vector<uint8_t> utf8Data = CreateValidUtf8(data, size);
107 uint32_t hashcode = EcmaStringAccessor::ComputeHashcodeUtf8(utf8Data.data(), utf8Data.size(), true);
108 JSHandle<EcmaString> value(thread,
109 EcmaStringAccessor::CreateFromUtf8(vm, utf8Data.data(), utf8Data.size(), true));
110
111 map->template LoadOrStore<true>(thread, hashcode, [value]() { return value; },
112 [](BaseString *) { return false; });
113 delete map;
114 JSNApi::DestroyJSVM(vm);
115 }
116 }
117
118 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)119 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
120 {
121 // Run your code on data.
122 OHOS::StringTableConcurrentLoadStoreFuzzTest(data, size);
123 return 0;
124 }