1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "devattestadapteroem_fuzzer.h"
17
18 #include <string>
19 #include <securec.h>
20 #include "attest_adapter_oem.h"
21
22 using namespace std;
23
24 namespace OHOS {
25 constexpr int32_t OEM_TICKET_FUZZ = 0;
26 constexpr int32_t OEM_AUTH_STATUS_FUZZ = 1;
27 constexpr int32_t OEM_NETWORK_CONFIG_FUZZ = 2;
28 constexpr int32_t OEM_AUTH_RESULT_CODE_FUZZ = 3;
29 constexpr int32_t INTERFACE_NUM = 4;
30
31 const uint8_t *g_baseFuzzData = nullptr;
32 size_t g_baseFuzzSize = 0;
33 size_t g_baseFuzzPos = 0;
34
GetData()35 template <class T> T GetData()
36 {
37 T object {};
38 size_t objectSize = sizeof(object);
39 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
40 return object;
41 }
42 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
43 if (ret != EOK) {
44 return {};
45 }
46 g_baseFuzzPos += objectSize;
47 return object;
48 }
49
OEMWriteTicketData(const uint8_t * data,size_t size)50 static void OEMWriteTicketData(const uint8_t* data, size_t size)
51 {
52 int32_t demandSize = sizeof(char) + sizeof(TicketInfo);
53 if (static_cast<int32_t>(size) < demandSize) {
54 return;
55 }
56
57 TicketInfo ticketInfo = GetData<TicketInfo>();
58 (void)OEMWriteTicket(&ticketInfo);
59 return;
60 }
61
OEMWriteData(const uint8_t * data,size_t size,int32_t type)62 static void OEMWriteData(const uint8_t* data, size_t size, int32_t type)
63 {
64 uint32_t len = GetData<uint32_t>();
65 uint32_t remainSize = size - g_baseFuzzPos;
66 len = (len > remainSize) ? remainSize : len;
67
68 switch (type) {
69 case OEM_AUTH_STATUS_FUZZ:
70 (void)OEMWriteAuthStatus(reinterpret_cast<const char *>(data + g_baseFuzzPos), len);
71 break;
72 case OEM_NETWORK_CONFIG_FUZZ:
73 (void)OEMWriteNetworkConfig(reinterpret_cast<const char *>(data + g_baseFuzzPos), len);
74 break;
75 case OEM_AUTH_RESULT_CODE_FUZZ:
76 (void)OEMWriteAuthResultCode(reinterpret_cast<const char *>(data + g_baseFuzzPos), len);
77 break;
78 default:
79 break;
80 }
81 return;
82 }
83
DevattestAdapterOemFuzzTest(const uint8_t * data,size_t size)84 void DevattestAdapterOemFuzzTest(const uint8_t* data, size_t size)
85 {
86 g_baseFuzzData = data;
87 g_baseFuzzSize = size;
88 g_baseFuzzPos = 0;
89 int32_t demandSize = sizeof(int32_t) + sizeof(char);
90 if (static_cast<int32_t>(size) < demandSize) {
91 return;
92 }
93
94 char randomId = (GetData<char>() % INTERFACE_NUM);
95 if (randomId == OEM_TICKET_FUZZ) {
96 OEMWriteTicketData(data, size);
97 } else {
98 OEMWriteData(data, size, randomId);
99 }
100 return;
101 }
102 }
103
104 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)105 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
106 {
107 /* Run your code on data */
108 OHOS::DevattestAdapterOemFuzzTest(data, size);
109 return 0;
110 }
111