1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "ForwardReadStream_fuzzer.h"
17 #include <uv.h>
18 #include "forward.h"
19
20 namespace Hdc {
21
FuzzForwardReadStream(const uint8_t * data,size_t size)22 bool FuzzForwardReadStream(const uint8_t *data, size_t size)
23 {
24 if (size <= 0) {
25 return true;
26 }
27 uv_loop_t loop;
28 uv_loop_init(&loop);
29 LoopStatus ls(&loop, "not support");
30 HTaskInfo hTaskInfo = new TaskInformation();
31 hTaskInfo->runLoopStatus = &ls;
32 HdcSessionBase *daemon = new HdcSessionBase(false);
33 hTaskInfo->ownerSessionClass = daemon;
34 HdcForwardBase *forward = new(std::nothrow) HdcForwardBase(hTaskInfo);
35 if (forward == nullptr) {
36 delete daemon;
37 delete hTaskInfo;
38 WRITE_LOG(LOG_FATAL, "FuzzForwardReadStream forward is null");
39 return false;
40 }
41 HdcForwardBase::HCtxForward ctx = (HdcForwardBase::HCtxForward)forward->MallocContext(true);
42 if (ctx == nullptr) {
43 delete daemon;
44 delete forward;
45 delete hTaskInfo;
46 WRITE_LOG(LOG_FATAL, "FuzzForwardReadStream ctx is null");
47 return false;
48 }
49 uv_stream_t *stream = (uv_stream_t *)&ctx->tcp;
50 uint8_t *base = new uint8_t[size];
51 if (memcpy_s(base, size, const_cast<uint8_t *>(data), size) == EOK) {
52 uv_buf_t rbf = uv_buf_init(reinterpret_cast<char *>(base), size);
53 forward->ReadForwardBuf(stream, (ssize_t)size, &rbf);
54 } else {
55 delete[] base;
56 }
57 delete ctx;
58 delete daemon;
59 delete forward;
60 delete hTaskInfo;
61 uv_stop(&loop);
62 uv_loop_close(&loop);
63 return true;
64 }
65 } // namespace Hdc
66
67 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)68 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
69 {
70 /* Run your code on data */
71 Hdc::FuzzForwardReadStream(data, size);
72 return 0;
73 }
74