1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "brproxy_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstring>
20 #include <fuzzer/FuzzedDataProvider.h>
21 #include <securec.h>
22 #include <vector>
23
24 #include "br_proxy.c"
25
26 namespace OHOS {
FillBrProxyChannelInfo(FuzzedDataProvider & provider,BrProxyChannelInfo * channelInfo)27 static void FillBrProxyChannelInfo(FuzzedDataProvider &provider, BrProxyChannelInfo *channelInfo)
28 {
29 std::string peerBRMacAddr = provider.ConsumeRandomLengthString(BR_MAC_LEN);
30 std::string peerBRUuid = provider.ConsumeRandomLengthString(UUID_LEN);
31 if (strcpy_s(channelInfo->peerBRMacAddr, BR_MAC_LEN, peerBRMacAddr.c_str()) != 0) {
32 return;
33 }
34 if (strcpy_s(channelInfo->peerBRUuid, UUID_LEN, peerBRUuid.c_str()) != 0) {
35 return;
36 }
37 channelInfo->recvPri = provider.ConsumeIntegral<int32_t>();
38 channelInfo->recvPriSet = provider.ConsumeBool();
39 }
40
onChannelOpened(int32_t sessionId,int32_t channelId,int32_t result)41 static int32_t onChannelOpened(int32_t sessionId, int32_t channelId, int32_t result)
42 {
43 return SOFTBUS_OK;
44 }
45
onDataReceived(int32_t channelId,const char * data,uint32_t dataLen)46 static void onDataReceived(int32_t channelId, const char *data, uint32_t dataLen) { }
47
onChannelStatusChanged(int32_t channelId,int32_t state)48 static void onChannelStatusChanged(int32_t channelId, int32_t state) { }
49
50 static BrProxyChannelInfo g_channelInfo = {
51 .peerBRMacAddr = "F0:FA:C7:13:56:BC",
52 .peerBRUuid = "0000FEEA-0000-1000-8000-00805F9B34FB",
53 .recvPri = 1,
54 .recvPriSet = true,
55 };
56
57 static IBrProxyListener g_listener = {
58 .onChannelOpened = onChannelOpened,
59 .onDataReceived = onDataReceived,
60 .onChannelStatusChanged = onChannelStatusChanged,
61 };
62
OpenBrProxyTest(FuzzedDataProvider & provider)63 void OpenBrProxyTest(FuzzedDataProvider &provider)
64 {
65 int32_t channelId = provider.ConsumeIntegral<int32_t>();
66 BrProxyChannelInfo channelInfo;
67 IBrProxyListener listener = {
68 .onChannelOpened = onChannelOpened,
69 .onDataReceived = onDataReceived,
70 .onChannelStatusChanged = onChannelStatusChanged,
71 };
72 (void)memset_s(&channelInfo, sizeof(BrProxyChannelInfo), 0, sizeof(BrProxyChannelInfo));
73 FillBrProxyChannelInfo(provider, &channelInfo);
74
75 (void)OpenBrProxy(channelId, &channelInfo, &listener);
76 (void)OpenBrProxy(channelId, &g_channelInfo, &g_listener);
77 }
78
CloseBrProxyTest(FuzzedDataProvider & provider)79 void CloseBrProxyTest(FuzzedDataProvider &provider)
80 {
81 int32_t channelId = provider.ConsumeIntegral<int32_t>();
82
83 (void)CloseBrProxy(channelId);
84 }
85
SendBrProxyDataTest(FuzzedDataProvider & provider)86 void SendBrProxyDataTest(FuzzedDataProvider &provider)
87 {
88 int32_t channelId = provider.ConsumeIntegral<int32_t>();
89 uint32_t dataLen = provider.ConsumeIntegralInRange<uint32_t>(0, BR_PROXY_SEND_MAX_LEN);
90 std::string data = provider.ConsumeBytesAsString(BR_PROXY_SEND_MAX_LEN);
91 char myData[BR_PROXY_SEND_MAX_LEN + 1];
92 if (strcpy_s(myData, sizeof(myData), data.c_str()) != 0) {
93 return;
94 }
95
96 (void)SendBrProxyData(channelId, myData, dataLen);
97 }
98
SetListenerStateTest(FuzzedDataProvider & provider)99 void SetListenerStateTest(FuzzedDataProvider &provider)
100 {
101 int32_t channelId = provider.ConsumeIntegral<int32_t>();
102 bool isEnable = provider.ConsumeBool();
103 ListenerType type =
104 static_cast<ListenerType>(provider.ConsumeIntegralInRange<uint32_t>(DATA_RECEIVE, LISTENER_TYPE_MAX));
105
106 (void)SetListenerState(channelId, type, isEnable);
107 }
108
IsProxyChannelEnabledTest(FuzzedDataProvider & provider)109 void IsProxyChannelEnabledTest(FuzzedDataProvider &provider)
110 {
111 int32_t uid = provider.ConsumeIntegral<int32_t>();
112
113 (void)IsProxyChannelEnabled(uid);
114 }
115
TransClientInitTest(FuzzedDataProvider & provider)116 void TransClientInitTest(FuzzedDataProvider &provider)
117 {
118 (void)provider;
119 (void)TransClientInit();
120 }
121
ClientAddChannelToListTest(FuzzedDataProvider & provider)122 void ClientAddChannelToListTest(FuzzedDataProvider &provider)
123 {
124 int32_t sessionId = provider.ConsumeIntegral<int32_t>();
125 BrProxyChannelInfo channelInfo;
126 IBrProxyListener listener = {
127 .onChannelOpened = onChannelOpened,
128 .onDataReceived = onDataReceived,
129 .onChannelStatusChanged = onChannelStatusChanged,
130 };
131 (void)memset_s(&channelInfo, sizeof(BrProxyChannelInfo), 0, sizeof(BrProxyChannelInfo));
132 FillBrProxyChannelInfo(provider, &channelInfo);
133
134 (void)ClientAddChannelToList(sessionId, nullptr, nullptr);
135 (void)ClientAddChannelToList(sessionId, &channelInfo, &listener);
136 }
137
ClientDeleteChannelFromListTest(FuzzedDataProvider & provider)138 void ClientDeleteChannelFromListTest(FuzzedDataProvider &provider)
139 {
140 int32_t channelId = provider.ConsumeIntegral<int32_t>();
141 std::string providerBrMac = provider.ConsumeBytesAsString(UINT8_MAX - 1);
142 std::string providerUuid = provider.ConsumeBytesAsString(UINT8_MAX - 1);
143 char brMac[UINT8_MAX] = { 0 };
144 char uuid[UINT8_MAX] = { 0 };
145 if (strcpy_s(brMac, UINT8_MAX, providerBrMac.c_str()) != EOK ||
146 strcpy_s(uuid, UINT8_MAX, providerUuid.c_str()) != EOK) {
147 return;
148 }
149
150 (void)ClientDeleteChannelFromList(channelId, nullptr, uuid);
151 (void)ClientDeleteChannelFromList(channelId, brMac, uuid);
152 }
153
ClientUpdateListtTest(FuzzedDataProvider & provider)154 void ClientUpdateListtTest(FuzzedDataProvider &provider)
155 {
156 int32_t channelId = provider.ConsumeIntegral<int32_t>();
157 std::string providerMac = provider.ConsumeBytesAsString(UINT8_MAX - 1);
158 std::string providerUuid = provider.ConsumeBytesAsString(UINT8_MAX - 1);
159 char mac[UINT8_MAX] = { 0 };
160 char uuid[UINT8_MAX] = { 0 };
161 if (strcpy_s(mac, UINT8_MAX, providerMac.c_str()) != EOK ||
162 strcpy_s(uuid, UINT8_MAX, providerUuid.c_str()) != EOK) {
163 return;
164 }
165
166 (void)ClientUpdateList(mac, uuid, channelId);
167 }
168
ClientQueryListTest(FuzzedDataProvider & provider)169 void ClientQueryListTest(FuzzedDataProvider &provider)
170 {
171 int32_t channelId = provider.ConsumeIntegral<int32_t>();
172 std::string providerPeerBRMacAddr = provider.ConsumeBytesAsString(UINT8_MAX - 1);
173 std::string providerUuid = provider.ConsumeBytesAsString(UINT8_MAX - 1);
174 char peerBRMacAddr[UINT8_MAX] = { 0 };
175 char uuid[UINT8_MAX] = { 0 };
176 if (strcpy_s(peerBRMacAddr, UINT8_MAX, providerPeerBRMacAddr.c_str()) != EOK ||
177 strcpy_s(uuid, UINT8_MAX, providerUuid.c_str()) != EOK) {
178 return;
179 }
180 ClientBrProxyChannelInfo info;
181 (void)memset_s(&info, sizeof(ClientBrProxyChannelInfo), 0, sizeof(ClientBrProxyChannelInfo));
182
183 (void)ClientQueryList(channelId, peerBRMacAddr, uuid, &info);
184 }
185
ClientRecordListenerStateTest(FuzzedDataProvider & provider)186 void ClientRecordListenerStateTest(FuzzedDataProvider &provider)
187 {
188 int32_t channelId = provider.ConsumeIntegral<int32_t>();
189 ListenerType type =
190 static_cast<ListenerType>(provider.ConsumeIntegralInRange<uint32_t>(DATA_RECEIVE, LISTENER_TYPE_MAX));
191 bool isEnable = provider.ConsumeBool();
192
193 (void)ClientRecordListenerState(channelId, type, isEnable);
194 }
195
ClientTransBrProxyDataReceivedTest(FuzzedDataProvider & provider)196 void ClientTransBrProxyDataReceivedTest(FuzzedDataProvider &provider)
197 {
198 int32_t channelId = provider.ConsumeIntegral<int32_t>();
199 uint32_t len = provider.ConsumeIntegral<uint32_t>();
200
201 (void)ClientTransBrProxyDataReceived(channelId, nullptr, len);
202 }
203
SoftbusErrConvertChannelStateTest(FuzzedDataProvider & provider)204 void SoftbusErrConvertChannelStateTest(FuzzedDataProvider &provider)
205 {
206 int32_t err = provider.ConsumeIntegral<int32_t>();
207
208 (void)SoftbusErrConvertChannelState(err);
209 }
210
ClientTransBrProxyChannelChangeTest(FuzzedDataProvider & provider)211 void ClientTransBrProxyChannelChangeTest(FuzzedDataProvider &provider)
212 {
213 int32_t channelId = provider.ConsumeIntegral<int32_t>();
214 int32_t errCode = provider.ConsumeIntegral<int32_t>();
215
216 (void)ClientTransBrProxyChannelChange(channelId, errCode);
217 }
218
ClientTransOnBrProxyOpenedTest(FuzzedDataProvider & provider)219 void ClientTransOnBrProxyOpenedTest(FuzzedDataProvider &provider)
220 {
221 int32_t channelId = provider.ConsumeIntegral<int32_t>();
222 int32_t result = provider.ConsumeIntegral<int32_t>();
223 std::string providerBrMac = provider.ConsumeBytesAsString(UINT8_MAX - 1);
224 std::string providerUuid = provider.ConsumeBytesAsString(UINT8_MAX - 1);
225 char brMac[UINT8_MAX] = { 0 };
226 char uuid[UINT8_MAX] = { 0 };
227 if (strcpy_s(brMac, UINT8_MAX, providerBrMac.c_str()) != EOK ||
228 strcpy_s(uuid, UINT8_MAX, providerUuid.c_str()) != EOK) {
229 return;
230 }
231
232 (void)ClientTransOnBrProxyOpened(channelId, nullptr, nullptr, result);
233 (void)ClientTransOnBrProxyOpened(channelId, brMac, uuid, result);
234 }
235
RegisterAccessHookTest(FuzzedDataProvider & provider)236 void RegisterAccessHookTest(FuzzedDataProvider &provider)
237 {
238 (void)provider;
239 PermissonHookCb cb;
240 (void)memset_s(&cb, sizeof(PermissonHookCb), 0, sizeof(PermissonHookCb));
241
242 (void)RegisterAccessHook(nullptr);
243 (void)RegisterAccessHook(&cb);
244 }
245
ClientTransBrProxyQueryPermissionTest(FuzzedDataProvider & provider)246 void ClientTransBrProxyQueryPermissionTest(FuzzedDataProvider &provider)
247 {
248 std::string providerBundleName = provider.ConsumeBytesAsString(UINT8_MAX - 1);
249 char bundleName[UINT8_MAX] = { 0 };
250 if (strcpy_s(bundleName, UINT8_MAX, providerBundleName.c_str()) != EOK) {
251 return;
252 }
253 bool isEmpowered;
254
255 (void)ClientTransBrProxyQueryPermission(nullptr, nullptr);
256 (void)ClientTransBrProxyQueryPermission(bundleName, &isEmpowered);
257 }
258 } // namespace OHOS
259
260 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)261 extern "C" int32_t LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
262 {
263 /* Run your code on data */
264 FuzzedDataProvider provider(data, size);
265 OHOS::OpenBrProxyTest(provider);
266 OHOS::CloseBrProxyTest(provider);
267 OHOS::SendBrProxyDataTest(provider);
268 OHOS::SetListenerStateTest(provider);
269 OHOS::IsProxyChannelEnabledTest(provider);
270 OHOS::TransClientInitTest(provider);
271 OHOS::ClientAddChannelToListTest(provider);
272 OHOS::ClientUpdateListtTest(provider);
273 OHOS::ClientQueryListTest(provider);
274 OHOS::ClientRecordListenerStateTest(provider);
275 OHOS::ClientTransBrProxyDataReceivedTest(provider);
276 OHOS::SoftbusErrConvertChannelStateTest(provider);
277 OHOS::ClientTransBrProxyChannelChangeTest(provider);
278 OHOS::ClientTransOnBrProxyOpenedTest(provider);
279 OHOS::RegisterAccessHookTest(provider);
280 OHOS::ClientTransBrProxyQueryPermissionTest(provider);
281 OHOS::ClientDeleteChannelFromListTest(provider);
282
283 return 0;
284 }