1 /*
2 * Copyright (C) 2022 Huawei Technologies Co., Ltd.
3 * Licensed under the Mulan PSL v2.
4 * You can use this software according to the terms and conditions of the Mulan PSL v2.
5 * You may obtain a copy of Mulan PSL v2 at:
6 * http://license.coscl.org.cn/MulanPSL2
7 * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
8 * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
9 * PURPOSE.
10 * See the Mulan PSL v2 for more details.
11 */
12
13 #include "teeclientsocket_fuzzer.h"
14
15 #include <cerrno>
16 #include <cstddef>
17 #include <cstdint>
18 #include <ctime>
19 #include <sys/socket.h>
20 #include <sys/un.h>
21 #include <securec.h>
22 #include "tee_log.h"
23 #include "tee_client_inner.h"
24 #include "tee_client_socket.h"
25 namespace OHOS {
26 #define TC_NS_SOCKET_NAME "#tc_ns_socket"
InitMessage(struct msghdr * message,CaRevMsg * revBuffer,char * ctrlBuffer,const uint8_t * data,size_t size)27 int InitMessage(struct msghdr *message, CaRevMsg *revBuffer, char *ctrlBuffer, const uint8_t *data, size_t size)
28 {
29 size_t msgLen = size >= sizeof(*message) ? sizeof(*message) : size;
30
31 if (memcpy_s(message, msgLen - 1, data, msgLen - 1) != EOK) {
32 return -1;
33 }
34 struct iovec iov[1];
35 message->msg_iov = iov;
36 message->msg_iovlen = 1;
37 (message->msg_iov[0]).iov_base = revBuffer;
38 (message->msg_iov[0]).iov_len = sizeof(*revBuffer);
39 message->msg_control = static_cast<void*>(ctrlBuffer);
40 message->msg_controllen = CMSG_SPACE(sizeof(int));
41
42 return 0;
43 }
44
TeeClientTeeSrvIpcProcCmdFuzzTest(const uint8_t * data,size_t size)45 bool TeeClientTeeSrvIpcProcCmdFuzzTest(const uint8_t *data, size_t size)
46 {
47 int ret;
48 int rc;
49 uint32_t len;
50 struct sockaddr_un remote;
51 struct msghdr message = { 0 };
52 CaRevMsg revBuffer = { 0 };
53 char ctrlBuffer[CMSG_SPACE(sizeof(int))];
54
55 if (InitMessage(&message, &revBuffer, ctrlBuffer, data, size) != EOK) {
56 return false;
57 }
58
59 int s = socket(AF_UNIX, SOCK_STREAM, 0);
60 if (s == -1) {
61 tloge("can't open stream socket, errno=%" PUBLIC "d\n", errno);
62 return false;
63 }
64
65 tlogd("Trying to connect...\n");
66 remote.sun_family = AF_UNIX;
67
68 rc = strncpy_s(remote.sun_path, sizeof(remote.sun_path), TC_NS_SOCKET_NAME, sizeof(TC_NS_SOCKET_NAME));
69 if (rc != EOK) {
70 tloge("strncpy_s failed, rc=%d, errno=%" PUBLIC "d\n", rc, errno);
71 close(s);
72 return false;
73 }
74 len = static_cast<uint32_t>((strlen(remote.sun_path) + sizeof(remote.sun_family)));
75 remote.sun_path[0] = 0;
76
77 if (connect(s, (struct sockaddr *)&remote, len) == -1) {
78 tloge("connect() failed, errno=%" PUBLIC "d\n", errno);
79 close(s);
80 return false;
81 }
82 tloge("Connected.\n");
83
84 if (sendmsg(s, &message, 0) < 0) {
85 tloge("send message error %" PUBLIC "d \n", errno);
86 close(s);
87 return false;
88 }
89 ret = recvmsg(s, &message, 0);
90 if (ret <= 0) {
91 tloge("send message error %" PUBLIC "d \n", errno);
92 close(s);
93 return false;
94 }
95 close(s);
96 return true;
97 }
98 }
99
100 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)101 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
102 {
103 /* Run your code on data */
104 OHOS::TeeClientTeeSrvIpcProcCmdFuzzTest(data, size);
105 return 0;
106 }