1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "stringtableloadstore_fuzzer.h"
17 #include "ecmascript/base/string_helper.h"
18 #include "ecmascript/ecma_string-inl.h"
19 #include "ecmascript/ecma_string_table_optimization-inl.h"
20 #include "common_components/base/utf_helper.h"
21 #include "ecmascript/napi/include/jsnapi.h"
22 #include "ecmascript/napi/jsnapi_helper.h"
23 #include <thread>
24 #include <vector>
25
26 using namespace panda;
27 using namespace panda::ecmascript;
28 using namespace common::utf_helper;
29
30 namespace OHOS {
31 constexpr int DOUBLE_SEQUENCE = 2;
32 constexpr int TRIPLE_SEQUENCE = 3;
33 constexpr int FOUR_SEQUENCE = 4;
34
IsValidMultiByteSequence(const uint8_t * data,size_t start,int seqLen,size_t size)35 bool IsValidMultiByteSequence(const uint8_t* data, size_t start, int seqLen, size_t size)
36 {
37 // 检查序列长度是否超出数据范围
38 if (start + seqLen > size) {
39 return false;
40 }
41
42 // 检查后续字节是否符合 UTF-8 格式（10xxxxxx）
43 for (int j = 1; j < seqLen; j++) {
44 if ((data[start + j] & 0xC0) != 0x80) {
45 return false;
46 }
47 }
48 return true;
49 }
50
AddReplacementCharacter(std::vector<uint8_t> & result)51 void AddReplacementCharacter(std::vector<uint8_t>& result)
52 {
53 result.push_back(0xEF);
54 result.push_back(0xBF);
55 result.push_back(0xBD);
56 }
57
CreateValidUtf8(const uint8_t * data,size_t size)58 std::vector<uint8_t> CreateValidUtf8(const uint8_t *data, size_t size)
59 {
60 std::vector<uint8_t> result;
61 result.reserve(size);
62 for (size_t i = 0; i < size;) {
63 uint8_t byte = data[i];
64 // ascii 字符直接保留
65 if (byte <= 0x7F) {
66 result.push_back(byte);
67 i++;
68 continue;
69 }
70 // 多字节序列
71 int seqLen = 0;
72 if ((byte & 0xE0) == 0xC0) {
73 seqLen = DOUBLE_SEQUENCE;
74 } else if ((byte & 0xF0) == 0xE0) {
75 seqLen = TRIPLE_SEQUENCE;
76 } else if ((byte & 0xF8) == 0xF0) {
77 seqLen = FOUR_SEQUENCE;
78 }
79
80 if (seqLen == 0) {
81 AddReplacementCharacter(result);
82 i++;
83 continue;
84 }
85 if (IsValidMultiByteSequence(data, i, seqLen, size)) {
86 for (int j = 0; j < seqLen; j++) {
87 result.push_back(data[i + j]);
88 }
89 i += seqLen;
90 } else {
91 AddReplacementCharacter(result);
92 i++;
93 }
94 }
95 return result;
96 }
97
StringTableLoadStoreFuzzTest(const uint8_t * data,size_t size)98 void StringTableLoadStoreFuzzTest(const uint8_t *data, size_t size)
99 {
100 if (data == nullptr || size <= 0) {
101 LOG_ECMA(ERROR) << "illegal input!";
102 return;
103 }
104 RuntimeOption option;
105 option.SetLogLevel(common::LOG_LEVEL::ERROR);
106 EcmaVM *vm = JSNApi::CreateJSVM(option);
107 JSThread *thread = vm->GetJSThread();
108
109 uint32_t key = size % 0x10000000;
110 std::vector<uint8_t> utf8Data = CreateValidUtf8(data, size);
111 JSHandle<EcmaString> value(thread,
112 EcmaStringAccessor::CreateFromUtf8(vm, utf8Data.data(), utf8Data.size(), true));
113 auto *map = new common::HashTrieMap<EcmaStringTableMutex, JSThread, common::TrieMapConfig::NeedSlotBarrier>();
114 map->template Load<false>([](const void *, size_t) { return nullptr; }, key, nullptr);
115 map->template LoadOrStore<true>(thread, key, [value]() { return value; },
116 [](BaseString *) { return false; });
117 delete map;
118
119 JSNApi::DestroyJSVM(vm);
120 }
121 }
122
123 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)124 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
125 {
126 // Run your code on data.
127 OHOS::StringTableLoadStoreFuzzTest(data, size);
128 return 0;
129 }