1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "softbussocketrecv_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <securec.h>
21
22 #include "comm_log.h"
23 #include "fuzz_data_generator.h"
24 #include "softbus_adapter_socket.h"
25 #include "softbus_adapter_define.h"
26 #include "softbus_adapter_mem.h"
27
28 namespace OHOS {
29 const int32_t PROTOCOL_MAXLEN = 100;
30
31 struct SocketProtocol {
32 unsigned int cmd;
33 char data[PROTOCOL_MAXLEN];
34 };
35
SoftBusSocketRecvFuzzTest(const uint8_t * data,size_t size)36 void SoftBusSocketRecvFuzzTest(const uint8_t* data, size_t size)
37 {
38 if (data == nullptr || size < sizeof(int32_t)) {
39 COMM_LOGE(COMM_TEST, "Invalid param");
40 return;
41 }
42
43 struct SocketProtocol buf;
44 memset_s(&buf, sizeof(struct SocketProtocol), 0, sizeof(struct SocketProtocol));
45 int32_t socketFd = 0;
46 uint32_t len = 0;
47 int32_t flags = 0;
48 DataGenerator::Write(data, size);
49 GenerateInt32(socketFd);
50 GenerateUint32(len);
51 GenerateInt32(flags);
52 DataGenerator::Clear();
53 SoftBusSocketRecv(socketFd, &buf, len, flags);
54 return;
55 }
56
SoftBusSocketRecvFromFuzzTest(const uint8_t * data,size_t size)57 void SoftBusSocketRecvFromFuzzTest(const uint8_t* data, size_t size)
58 {
59 if (data == nullptr || size < sizeof(int32_t)) {
60 COMM_LOGE(COMM_TEST, "Invalid param");
61 return;
62 }
63
64 struct SocketProtocol buf;
65 memset_s(&buf, sizeof(struct SocketProtocol), 0, sizeof(struct SocketProtocol));
66 int32_t socketFd = 0;
67 uint32_t len = 0;
68 int32_t flags = 0;
69 DataGenerator::Write(data, size);
70 GenerateInt32(socketFd);
71 GenerateUint32(len);
72 GenerateInt32(flags);
73 DataGenerator::Clear();
74 SoftBusSockAddr fromAddr;
75 memset_s(&fromAddr, sizeof(SoftBusSockAddr), 0, sizeof(SoftBusSockAddr));
76 int32_t fromAddrLen;
77 SoftBusSocketRecvFrom(socketFd, &buf, len, flags, &fromAddr, &fromAddrLen);
78 return;
79 }
80
SoftBusSocketSendFuzzTest(const uint8_t * data,size_t size)81 void SoftBusSocketSendFuzzTest(const uint8_t* data, size_t size)
82 {
83 if (data == nullptr || size < sizeof(int32_t)) {
84 COMM_LOGE(COMM_TEST, "Invalid param");
85 return;
86 }
87
88 uint8_t *buf = static_cast<uint8_t*>(SoftBusCalloc(size * sizeof(uint8_t)));
89 if (buf == nullptr) {
90 COMM_LOGE(COMM_TEST, "calloc faild");
91 return;
92 }
93 if (memcpy_s(buf, size, data, size) != EOK) {
94 COMM_LOGE(COMM_TEST, "memcpy err");
95 SoftBusFree(buf);
96 return;
97 }
98 uint32_t len = size;
99 int32_t socketFd = 0;
100 int32_t flags = 0;
101 DataGenerator::Write(data, size);
102 GenerateInt32(socketFd);
103 GenerateInt32(flags);
104 DataGenerator::Clear();
105
106 SoftBusSocketSend(socketFd, buf, len, flags);
107 SoftBusFree(buf);
108 return;
109 }
110
SoftBusSocketSendToFuzzTest(const uint8_t * data,size_t size)111 void SoftBusSocketSendToFuzzTest(const uint8_t* data, size_t size)
112 {
113 if (data == nullptr || size < sizeof(SoftBusSockAddr)) {
114 COMM_LOGE(COMM_TEST, "Invalid param");
115 return;
116 }
117
118 uint8_t *buf = static_cast<uint8_t*>(SoftBusCalloc(size * sizeof(uint8_t)));
119 if (buf == nullptr) {
120 COMM_LOGE(COMM_TEST, "calloc faild");
121 return;
122 }
123 if (memcpy_s(buf, size, data, size) != EOK) {
124 SoftBusFree(buf);
125 return;
126 }
127 uint32_t len = size;
128 int32_t socketFd = 0;
129 int32_t flags = 0;
130 int32_t toAddrLen = 0;
131 DataGenerator::Write(data, size);
132 GenerateInt32(socketFd);
133 GenerateInt32(flags);
134 GenerateInt32(toAddrLen);
135 DataGenerator::Clear();
136 SoftBusSockAddr toAddr = {0};
137 if (memcpy_s(&toAddr, sizeof(SoftBusSockAddr), data, sizeof(SoftBusSockAddr)) != EOK) {
138 COMM_LOGE(COMM_TEST, "memcpy err");
139 SoftBusFree(buf);
140 return;
141 }
142 SoftBusSocketSendTo(socketFd, buf, len, flags, &toAddr, toAddrLen);
143 SoftBusFree(buf);
144 return;
145 }
146
147 }
148
149 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)150 extern "C" int32_t LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
151 {
152 /* Run your code on data */
153 OHOS::SoftBusSocketRecvFuzzTest(data, size);
154 OHOS::SoftBusSocketRecvFromFuzzTest(data, size);
155 OHOS::SoftBusSocketSendFuzzTest(data, size);
156 OHOS::SoftBusSocketSendToFuzzTest(data, size);
157 return 0;
158 }