1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "distributedfwkservices_fuzzer.h"
17
18 #include <algorithm>
19 #include <chrono>
20 #include <cstddef>
21 #include <cstdint>
22 #include <string>
23 #include <unistd.h>
24
25 #include "distributed_hardware_errno.h"
26 #include "distributed_hardware_service.h"
27
28 namespace OHOS {
29 namespace DistributedHardware {
30 namespace {
31 const uint32_t DH_TYPE_SIZE = 10;
32 const DHType dhTypeFuzz[DH_TYPE_SIZE] = {
33 DHType::CAMERA, DHType::AUDIO, DHType::SCREEN, DHType::VIRMODEM_AUDIO,
34 DHType::INPUT, DHType::A2D, DHType::GPS, DHType::HFP
35 };
36 const uint32_t QUERY_LOCAL_SYS_SIZE = 6;
37 const uint32_t IS_BOOL = 2;
38 const uint32_t TRANS_ROLE_SIZE = 3;
39 const QueryLocalSysSpecType specType[QUERY_LOCAL_SYS_SIZE] = {
40 QueryLocalSysSpecType::MIN, QueryLocalSysSpecType::HISTREAMER_AUDIO_ENCODER,
41 QueryLocalSysSpecType::HISTREAMER_AUDIO_DECODER, QueryLocalSysSpecType::HISTREAMER_VIDEO_ENCODER,
42 QueryLocalSysSpecType::HISTREAMER_VIDEO_DECODER, QueryLocalSysSpecType::MAX
43 };
44 const TransRole transRole[TRANS_ROLE_SIZE] = {
45 TransRole::AV_SENDER, TransRole::AV_RECEIVER, TransRole::UNKNOWN
46 };
47 }
48
49 class MyFwkServicesFuzzTest : public IRemoteStub<IPublisherListener> {
50 public:
AsObject()51 virtual sptr<IRemoteObject> AsObject() override
52 {
53 return nullptr;
54 }
OnMessage(const DHTopic topic,const std::string & message)55 void OnMessage(const DHTopic topic, const std::string& message) override
56 {
57 return;
58 }
59 };
60
FwkServicesServicesFuzzTest(const uint8_t * data,size_t size)61 void FwkServicesServicesFuzzTest(const uint8_t* data, size_t size)
62 {
63 if ((data == nullptr) || (size < sizeof(int32_t))) {
64 return;
65 }
66 const int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
67 bool runOnCreate = false;
68 if (asId == 0) {
69 runOnCreate = false;
70 } else {
71 runOnCreate = true;
72 }
73 DistributedHardwareService service(asId, runOnCreate);
74 }
75
FwkServicesInitLocalDevInfoFuzzTest(const uint8_t * data,size_t size)76 void FwkServicesInitLocalDevInfoFuzzTest(const uint8_t* data, size_t size)
77 {
78 if ((data == nullptr) || (size < sizeof(int32_t))) {
79 return;
80 }
81 const int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
82 bool runOnCreate = false;
83 if (asId == 0) {
84 runOnCreate = false;
85 } else {
86 runOnCreate = true;
87 }
88 DistributedHardwareService service(asId, runOnCreate);
89 service.InitLocalDevInfo();
90 }
91
FwkServicesOnStopFuzzTest(const uint8_t * data,size_t size)92 void FwkServicesOnStopFuzzTest(const uint8_t* data, size_t size)
93 {
94 if ((data == nullptr) || (size < sizeof(int32_t))) {
95 return;
96 }
97 const int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
98 bool runOnCreate = false;
99 if (asId == 0) {
100 runOnCreate = false;
101 } else {
102 runOnCreate = true;
103 }
104 DistributedHardwareService service(asId, runOnCreate);
105 service.OnStop();
106 }
107
FwkServicesQueryLocalSysSpecFuzzTest(const uint8_t * data,size_t size)108 void FwkServicesQueryLocalSysSpecFuzzTest(const uint8_t* data, size_t size)
109 {
110 if ((data == nullptr) || (size < sizeof(int32_t))) {
111 return;
112 }
113 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
114 bool runOnCreate = false;
115 if (asId == 0) {
116 runOnCreate = false;
117 } else {
118 runOnCreate = true;
119 }
120 DistributedHardwareService service(asId, runOnCreate);
121 QueryLocalSysSpecType spec = specType[data[0] % QUERY_LOCAL_SYS_SIZE];
122
123 service.QueryLocalSysSpec(spec);
124 }
125
FwkServicesQueryDhSysSpecFuzzTest(const uint8_t * data,size_t size)126 void FwkServicesQueryDhSysSpecFuzzTest(const uint8_t* data, size_t size)
127 {
128 if ((data == nullptr) || (size < sizeof(int32_t))) {
129 return;
130 }
131 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
132 bool runOnCreate = false;
133 if (asId == 0) {
134 runOnCreate = false;
135 } else {
136 runOnCreate = true;
137 }
138 DistributedHardwareService service(asId, runOnCreate);
139 std::string targetKey(reinterpret_cast<const char*>(data), size);
140 std::string attrs(reinterpret_cast<const char*>(data), size);
141
142 service.QueryDhSysSpec(targetKey, attrs);
143 }
144
FwkServicesInitializeAVCenterFuzzTest(const uint8_t * data,size_t size)145 void FwkServicesInitializeAVCenterFuzzTest(const uint8_t* data, size_t size)
146 {
147 if ((data == nullptr) || (size < sizeof(int32_t))) {
148 return;
149 }
150 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
151 bool runOnCreate = false;
152 if (asId == 0) {
153 runOnCreate = false;
154 } else {
155 runOnCreate = true;
156 }
157 DistributedHardwareService service(asId, runOnCreate);
158 TransRole transRoleType = transRole[data[0] % TRANS_ROLE_SIZE];
159 int32_t engineId = *(reinterpret_cast<const uint32_t*>(data));
160
161 service.InitializeAVCenter(transRoleType, engineId);
162 }
163
FwkServicesReleaseAVCenterFuzzTest(const uint8_t * data,size_t size)164 void FwkServicesReleaseAVCenterFuzzTest(const uint8_t* data, size_t size)
165 {
166 if ((data == nullptr) || (size < sizeof(int32_t))) {
167 return;
168 }
169 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
170 bool runOnCreate = false;
171 if (asId == 0) {
172 runOnCreate = false;
173 } else {
174 runOnCreate = true;
175 }
176 DistributedHardwareService service(asId, runOnCreate);
177 int32_t engineId = *(reinterpret_cast<const uint32_t*>(data));
178
179 service.ReleaseAVCenter(engineId);
180 }
181
FwkServicesCreateControlChannelFuzzTest(const uint8_t * data,size_t size)182 void FwkServicesCreateControlChannelFuzzTest(const uint8_t* data, size_t size)
183 {
184 if ((data == nullptr) || (size < sizeof(int32_t))) {
185 return;
186 }
187 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
188 bool runOnCreate = false;
189 if (asId == 0) {
190 runOnCreate = false;
191 } else {
192 runOnCreate = true;
193 }
194 DistributedHardwareService service(asId, runOnCreate);
195 int32_t engineId = *(reinterpret_cast<const uint32_t*>(data));
196 std::string peerDevId(reinterpret_cast<const char*>(data), size);
197
198 service.CreateControlChannel(engineId, peerDevId);
199 }
200
FwkServicesRegisterCtlCenterCallbackFuzzTest(const uint8_t * data,size_t size)201 void FwkServicesRegisterCtlCenterCallbackFuzzTest(const uint8_t* data, size_t size)
202 {
203 if ((data == nullptr) || (size < sizeof(int32_t))) {
204 return;
205 }
206 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
207 bool runOnCreate = false;
208 if (asId == 0) {
209 runOnCreate = false;
210 } else {
211 runOnCreate = true;
212 }
213 sptr<IAVTransControlCenterCallback> callback = nullptr;
214
215 DistributedHardwareService service(asId, runOnCreate);
216 int32_t engineId = *(reinterpret_cast<const uint32_t*>(data));
217
218 service.RegisterCtlCenterCallback(engineId, callback);
219 }
220
FwkServicesNotifySourceRemoteSinkStartedFuzzTest(const uint8_t * data,size_t size)221 void FwkServicesNotifySourceRemoteSinkStartedFuzzTest(const uint8_t* data, size_t size)
222 {
223 if ((data == nullptr) || (size < sizeof(int32_t))) {
224 return;
225 }
226 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
227 bool runOnCreate = false;
228 if (asId == 0) {
229 runOnCreate = false;
230 } else {
231 runOnCreate = true;
232 }
233
234 DistributedHardwareService service(asId, runOnCreate);
235 std::string deviceId(reinterpret_cast<const char*>(data), size);
236
237 service.NotifySourceRemoteSinkStarted(deviceId);
238 }
239
FwkServicesPauseDistributedHardwareFuzzTest(const uint8_t * data,size_t size)240 void FwkServicesPauseDistributedHardwareFuzzTest(const uint8_t* data, size_t size)
241 {
242 if ((data == nullptr) || (size < sizeof(int32_t))) {
243 return;
244 }
245 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
246 bool runOnCreate = false;
247 if (asId == 0) {
248 runOnCreate = false;
249 } else {
250 runOnCreate = true;
251 }
252
253 DistributedHardwareService service(asId, runOnCreate);
254 DHType dhType = dhTypeFuzz[data[0] % DH_TYPE_SIZE];
255 std::string networkId(reinterpret_cast<const char*>(data), size);
256
257 service.PauseDistributedHardware(dhType, networkId);
258 }
259
FwkServicesResumeDistributedHardwareFuzzTest(const uint8_t * data,size_t size)260 void FwkServicesResumeDistributedHardwareFuzzTest(const uint8_t* data, size_t size)
261 {
262 if ((data == nullptr) || (size < sizeof(int32_t))) {
263 return;
264 }
265 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
266 bool runOnCreate = false;
267 if (asId == 0) {
268 runOnCreate = false;
269 } else {
270 runOnCreate = true;
271 }
272
273 DistributedHardwareService service(asId, runOnCreate);
274 DHType dhType = dhTypeFuzz[data[0] % DH_TYPE_SIZE];
275 std::string networkId(reinterpret_cast<const char*>(data), size);
276
277 service.ResumeDistributedHardware(dhType, networkId);
278 }
279
FwkServicesStopDistributedHardwareFuzzTest(const uint8_t * data,size_t size)280 void FwkServicesStopDistributedHardwareFuzzTest(const uint8_t* data, size_t size)
281 {
282 if ((data == nullptr) || (size < sizeof(int32_t))) {
283 return;
284 }
285 int32_t asId = *(reinterpret_cast<const uint32_t*>(data)) % IS_BOOL;
286 bool runOnCreate = false;
287 if (asId == 0) {
288 runOnCreate = false;
289 } else {
290 runOnCreate = true;
291 }
292
293 DistributedHardwareService service(asId, runOnCreate);
294 DHType dhType = dhTypeFuzz[data[0] % DH_TYPE_SIZE];
295 std::string networkId(reinterpret_cast<const char*>(data), size);
296
297 service.StopDistributedHardware(dhType, networkId);
298 }
299 }
300 }
301
302 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)303 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
304 {
305 /* Run your code on data */
306 OHOS::DistributedHardware::FwkServicesServicesFuzzTest(data, size);
307 OHOS::DistributedHardware::FwkServicesInitLocalDevInfoFuzzTest(data, size);
308 OHOS::DistributedHardware::FwkServicesOnStopFuzzTest(data, size);
309 OHOS::DistributedHardware::FwkServicesQueryLocalSysSpecFuzzTest(data, size);
310 OHOS::DistributedHardware::FwkServicesQueryDhSysSpecFuzzTest(data, size);
311 OHOS::DistributedHardware::FwkServicesInitializeAVCenterFuzzTest(data, size);
312 OHOS::DistributedHardware::FwkServicesReleaseAVCenterFuzzTest(data, size);
313 OHOS::DistributedHardware::FwkServicesCreateControlChannelFuzzTest(data, size);
314 OHOS::DistributedHardware::FwkServicesRegisterCtlCenterCallbackFuzzTest(data, size);
315 OHOS::DistributedHardware::FwkServicesPauseDistributedHardwareFuzzTest(data, size);
316 OHOS::DistributedHardware::FwkServicesResumeDistributedHardwareFuzzTest(data, size);
317 OHOS::DistributedHardware::FwkServicesStopDistributedHardwareFuzzTest(data, size);
318 return 0;
319 }
320