1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stringtablehashcollision_fuzzer.h"
17 #include "ecmascript/base/string_helper.h"
18 #include "ecmascript/ecma_string-inl.h"
19 #include "ecmascript/ecma_string_table_optimization-inl.h"
20 #include "common_components/base/utf_helper.h"
21 #include "ecmascript/napi/include/jsnapi.h"
22 #include "ecmascript/napi/jsnapi_helper.h"
23 #include <thread>
24 #include <vector>
25
26 using namespace panda;
27 using namespace panda::ecmascript;
28 using namespace common::utf_helper;
29
30 namespace OHOS {
31 constexpr int DOUBLE_SEQUENCE = 2;
32 constexpr int TRIPLE_SEQUENCE = 3;
33 constexpr int FOUR_SEQUENCE = 4;
34
IsValidMultiByteSequence(const uint8_t * data,size_t start,int seqLen,size_t size)35 bool IsValidMultiByteSequence(const uint8_t* data, size_t start, int seqLen, size_t size)
36 {
37 // 检查序列长度是否超出数据范围
38 if (start + seqLen > size) {
39 return false;
40 }
41
42 // 检查后续字节是否符合 UTF-8 格式（10xxxxxx）
43 for (int j = 1; j < seqLen; j++) {
44 if ((data[start + j] & 0xC0) != 0x80) {
45 return false;
46 }
47 }
48 return true;
49 }
50
AddReplacementCharacter(std::vector<uint8_t> & result)51 void AddReplacementCharacter(std::vector<uint8_t>& result)
52 {
53 result.push_back(0xEF);
54 result.push_back(0xBF);
55 result.push_back(0xBD);
56 }
57
CreateValidUtf8(const uint8_t * data,size_t size)58 std::vector<uint8_t> CreateValidUtf8(const uint8_t *data, size_t size)
59 {
60 std::vector<uint8_t> result;
61 result.reserve(size);
62 for (size_t i = 0; i < size;) {
63 uint8_t byte = data[i];
64 // ascii 字符直接保留
65 if (byte <= 0x7F) {
66 result.push_back(byte);
67 i++;
68 continue;
69 }
70 // 多字节序列
71 int seqLen = 0;
72 if ((byte & 0xE0) == 0xC0) {
73 seqLen = DOUBLE_SEQUENCE;
74 } else if ((byte & 0xF0) == 0xE0) {
75 seqLen = TRIPLE_SEQUENCE;
76 } else if ((byte & 0xF8) == 0xF0) {
77 seqLen = FOUR_SEQUENCE;
78 }
79
80 if (seqLen == 0) {
81 AddReplacementCharacter(result);
82 i++;
83 continue;
84 }
85 if (IsValidMultiByteSequence(data, i, seqLen, size)) {
86 for (int j = 0; j < seqLen; j++) {
87 result.push_back(data[i + j]);
88 }
89 i += seqLen;
90 } else {
91 AddReplacementCharacter(result);
92 i++;
93 }
94 }
95 return result;
96 }
97
StringTableHashCollisionFuzzTest(const uint8_t * data,size_t size)98 void StringTableHashCollisionFuzzTest(const uint8_t *data, size_t size)
99 {
100 if (data == nullptr || size <= 0) {
101 LOG_ECMA(ERROR) << "illegal input!";
102 return;
103 }
104 RuntimeOption option;
105 option.SetLogLevel(common::LOG_LEVEL::ERROR);
106 EcmaVM *vm = JSNApi::CreateJSVM(option);
107 JSThread *thread = vm->GetJSThread();
108
109 uint32_t key1 = 0x12345678;
110 uint32_t key2 = 0x87654321;
111 std::vector<uint8_t> utf8Data = CreateValidUtf8(data, size);
112 JSHandle<EcmaString> value(thread,
113 EcmaStringAccessor::CreateFromUtf8(vm, utf8Data.data(), utf8Data.size(), true));
114
115 auto *map = new common::HashTrieMap<EcmaStringTableMutex, JSThread, common::TrieMapConfig::NeedSlotBarrier>();
116 map->template LoadOrStore<true>(thread, key1, [value]() { return value; },
117 [](BaseString *) { return false; });
118 map->template LoadOrStore<true>(thread, key2, [value]() { return value; },
119 [](BaseString *) { return false; });
120 delete map;
121
122 JSNApi::DestroyJSVM(vm);
123 }
124 }
125
126 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)127 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
128 {
129 // Run your code on data.
130 OHOS::StringTableHashCollisionFuzzTest(data, size);
131 return 0;
132 }