1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #define TDD_ENABLE 1
17
18 #include "fuzzer/FuzzedDataProvider.h"
19 #include "napi/native_api.h"
20 #include "scan_callback.h"
21 #include "scancallbackstub_fuzzer.h"
22
23 namespace OHOS::Scan {
24 constexpr int MAX_SET_NUMBER = 100;
25 constexpr size_t FOO_MAX_LEN = 1024;
26 constexpr size_t U32_AT_SIZE = 4;
27
OnRemoteRequestFuzzTest(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)28 void OnRemoteRequestFuzzTest(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
29 {
30 uint32_t code = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
31 MessageParcel parcelData;
32 parcelData.WriteInterfaceToken(u"OHOS.Scan.IScanCallback");
33 MessageParcel reply;
34 ScanCallback callBack(nullptr, nullptr);
35 MessageOption option;
36 callBack.OnRemoteRequest(code, parcelData, reply, option);
37 }
38
HandleDeviceInfoEventFuzzTest(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)39 void HandleDeviceInfoEventFuzzTest(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
40 {
41 MessageParcel parcelData;
42 uint32_t state = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
43 parcelData.WriteUint32(state);
44 ScanCallback callBack(nullptr, nullptr);
45 MessageParcel reply;
46 callBack.HandleDeviceInfoEvent(parcelData, reply);
47 }
48
HandleDeviceInfoSyncEventFuzzTest(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)49 void HandleDeviceInfoSyncEventFuzzTest(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
50 {
51 MessageParcel parcelData;
52 uint32_t state = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
53 parcelData.WriteUint32(state);
54 ScanCallback callBack(nullptr, nullptr);
55 MessageParcel reply;
56 callBack.HandleDeviceInfoSyncEvent(parcelData, reply);
57 }
58
HandleSendDeviceListFuzzTest(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)59 void HandleSendDeviceListFuzzTest(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
60 {
61 MessageParcel parcelData;
62 int32_t infosSize = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
63 parcelData.WriteInt32(infosSize);
64 std::vector<ScanDeviceInfo> infos(infosSize);
65 for (size_t i = 0; i < infos.size(); i++) {
66 infos[i].Marshalling(parcelData);
67 }
68 ScanCallback callBack(nullptr, nullptr);
69 MessageParcel reply;
70 callBack.HandleSendDeviceList(parcelData, reply);
71 }
72
73 }
74
75 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)76 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
77 {
78 if (data == nullptr) {
79 return 0;
80 }
81
82 if (size < OHOS::Scan::U32_AT_SIZE || size > OHOS::Scan::FOO_MAX_LEN) {
83 return 0;
84 }
85 FuzzedDataProvider dataProvider(data, size);
86 OHOS::Scan::OnRemoteRequestFuzzTest(data, size, &dataProvider);
87 OHOS::Scan::HandleDeviceInfoEventFuzzTest(data, size, &dataProvider);
88 OHOS::Scan::HandleDeviceInfoSyncEventFuzzTest(data, size, &dataProvider);
89 OHOS::Scan::HandleSendDeviceListFuzzTest(data, size, &dataProvider);
90 return 0;
91 }
92
93