1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "scsiverify10_fuzzer.h"
17 #include <cstring>
18 #include <securec.h>
19 #include <scsi/sg.h>
20 #include "hdf_log.h"
21 #include "scsicommonfunction_fuzzer.h"
22
23 using namespace OHOS::HDI::Usb::ScsiDdk::V1_0;
24
25 namespace OHOS {
26 namespace SCSI {
ConstructParamsFromData(ScsiPeripheralVerifyRequest & request,const uint8_t * data,size_t size)27 static void ConstructParamsFromData(ScsiPeripheralVerifyRequest& request, const uint8_t* data, size_t size)
28 {
29 if (data == nullptr || size < sizeof(uint32_t)) {
30 return;
31 }
32
33 size_t offset = 0;
34 (void)memcpy_s(&request.lbAddress, sizeof(uint32_t), data + offset, sizeof(uint32_t));
35 offset += sizeof(uint32_t);
36
37 if (size >= offset + sizeof(uint16_t)) {
38 (void)memcpy_s(&request.verificationLength, sizeof(uint16_t), data + offset, sizeof(uint16_t));
39 offset += sizeof(uint16_t);
40 }
41
42 if (size >= offset + sizeof(uint8_t)) {
43 request.control = *(data + offset);
44 offset += sizeof(uint8_t);
45 }
46
47 if (size >= offset + sizeof(uint8_t)) {
48 request.byte1 = *(data + offset);
49 offset += sizeof(uint8_t);
50 }
51
52 if (size >= offset + sizeof(uint8_t)) {
53 request.byte6 = *(data + offset);
54 offset += sizeof(uint8_t);
55 }
56
57 if (size >= offset + sizeof(uint32_t)) {
58 (void)memcpy_s(&request.timeout, sizeof(uint32_t), data + offset, sizeof(uint32_t));
59 }
60 }
61
ScsiVerify10FuzzTest(const uint8_t * data,size_t size)62 bool ScsiVerify10FuzzTest(const uint8_t *data, size_t size)
63 {
64 sptr<IScsiPeripheralDdk> scsiPeripheralDdk = IScsiPeripheralDdk::Get();
65 if (scsiPeripheralDdk == nullptr) {
66 HDF_LOGE("%{public}s: get ddk failed", __func__);
67 return false;
68 }
69 int32_t ret = scsiPeripheralDdk->Init();
70 if (ret != HDF_SUCCESS) {
71 HDF_LOGE("%{public}s: init failed, ret = %{public}d", __func__, ret);
72 return false;
73 }
74
75 ScsiPeripheralDevice device;
76 ret = ScsiFuzzTestHostModeInit(scsiPeripheralDdk, device);
77 if (ret != HDF_SUCCESS) {
78 HDF_LOGE("%{public}s: scsi peripheral open device failed, ret = %{public}d", __func__, ret);
79 return false;
80 }
81 ScsiPeripheralVerifyRequest request = {};
82 ConstructParamsFromData(request, data, size);
83 ScsiPeripheralResponse response;
84 ret = scsiPeripheralDdk->Verify10(device, request, response);
85
86 ret = scsiPeripheralDdk->Close(device);
87 if (ret != HDF_SUCCESS) {
88 HDF_LOGE("%{public}s: close device failed", __func__);
89 scsiPeripheralDdk->Release();
90 return false;
91 }
92 ret = scsiPeripheralDdk->Release();
93 if (ret != HDF_SUCCESS) {
94 HDF_LOGE("%{public}s: release failed", __func__);
95 return false;
96 }
97 return true;
98 }
99 } // namespace SCSI
100 } // namespace OHOS
101
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)102 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
103 {
104 OHOS::SCSI::ScsiVerify10FuzzTest(data, size);
105 return 0;
106 }