1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "usbmgrsubmittransfer_fuzzer.h"
17
18 #include "securec.h"
19
20 #include "ashmem.h"
21 #include "usb_errors.h"
22 #include "usb_common_fuzz.h"
23
24 using namespace OHOS::HDI::Usb::V1_2;
25
26 namespace OHOS {
27 const int32_t ASHMEM_MAX_SIZE = 1024;
28 const int32_t BITS_PER_BYTE = 8;
29 const int32_t NUM_THREE = 3;
30 const int32_t NUM_TWO = 2;
31 const int32_t NUM_ONE = 1;
32 constexpr size_t THRESHOLD = 10;
33 const int32_t ASYNC_TRANSFER_TIME_OUT = 1000;
34 const int32_t LIBUSB_TRANSFER_TYPE_BULK = 2;
35 namespace USB {
Convert2Uint32(const uint8_t * ptr)36 uint32_t Convert2Uint32(const uint8_t *ptr)
37 {
38 if (ptr == nullptr) {
39 return 0;
40 }
41 /*
42 * Move the 0th digit 24 to the left, the first digit 16 to the left, the second digit 8 to the left,
43 * and the third digit no left
44 */
45 return (ptr[0] << BITS_PER_BYTE * NUM_THREE) | (ptr[NUM_ONE] << BITS_PER_BYTE * NUM_TWO) |
46 (ptr[NUM_TWO] << BITS_PER_BYTE) | (ptr[NUM_THREE]);
47 }
48
InitAshmem(sptr<Ashmem> & asmptr,int32_t asmSize,uint8_t rflg)49 bool InitAshmem(sptr<Ashmem> &asmptr, int32_t asmSize, uint8_t rflg)
50 {
51 asmptr = Ashmem::CreateAshmem("ttashmem000", asmSize);
52 if (asmptr == nullptr) {
53 USB_HILOGE(MODULE_USB_SERVICE, "InitAshmem CreateAshmem failed");
54 return false;
55 }
56
57 asmptr->MapReadAndWriteAshmem();
58
59 if (rflg == 0) {
60 uint8_t tdata[ASHMEM_MAX_SIZE];
61 int32_t offset = 0;
62 int32_t tlen = 0;
63
64 // std::fill(std::begin(tdata), std::end(tdata), 'Y');
65 int32_t retSafe = memset_s(tdata, sizeof(tdata), 'Y', ASHMEM_MAX_SIZE);
66 if (retSafe != EOK) {
67 USB_HILOGI(MODULE_USB_SERVICE, "InitAshmemOne memset_s failed");
68 return false;
69 }
70
71 while (offset < asmSize) {
72 tlen = (asmSize - offset) < ASHMEM_MAX_SIZE ? (asmSize - offset) : ASHMEM_MAX_SIZE;
73 asmptr->WriteToAshmem(tdata, tlen, offset);
74 offset += tlen;
75 }
76 }
77 asmptr->UnmapAshmem();
78 return true;
79 }
80
UsbMgrSubmitTransferFuzzTest(const uint8_t * data,size_t size)81 bool UsbMgrSubmitTransferFuzzTest(const uint8_t *data, size_t size)
82 {
83 if (data == nullptr || size < sizeof(uint32_t)) {
84 USB_HILOGE(MODULE_USB_SERVICE, "data is null");
85 return false;
86 }
87 uint32_t ashmemSize = Convert2Uint32(data);
88
89 sptr<Ashmem> ashmPtr = nullptr;
90 InitAshmem(ashmPtr, ashmemSize, 0);
91 auto[res, pipe, interface] = UsbMgrPrepareFuzzEnv();
92 if (!res) {
93 USB_HILOGE(MODULE_USB_SERVICE, "prepare error");
94 return false;
95 }
96
97 USBTransferInfo usbInfo;
98 usbInfo.endpoint = 0x1;
99 usbInfo.flags = 0;
100 usbInfo.type = LIBUSB_TRANSFER_TYPE_BULK;
101 usbInfo.timeOut = ASYNC_TRANSFER_TIME_OUT;
102 usbInfo.userData = 0;
103 usbInfo.numIsoPackets = 0;
104 usbInfo.length = 0;
105
106 static auto func = [] () -> void {
107 USB_HILOGI(MODULE_USB_SERVICE, "enter fuzz func callback");
108 return;
109 };
110
111 auto &usbSrvClient = UsbSrvClient::GetInstance();
112
113 if (usbSrvClient.UsbSubmitTransfer(const_cast<USBDevicePipe &>(pipe), usbInfo, nullptr, ashmPtr)) {
114 return false;
115 }
116 return true;
117 }
118 } // USB
119 } // OHOS
120
121 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)122 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
123 {
124 if (size < OHOS::THRESHOLD) {
125 return 0;
126 }
127 /* Run your code on data */
128 OHOS::USB::UsbMgrSubmitTransferFuzzTest(data, size);
129 return 0;
130 }
131