1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "cmonremoterequest_fuzzer.h"
17 
18 #include "cm_fuzz_test_common.h"
19 #include "cm_sa.h"
20 #include "cm_test_common.h"
21 #include "message_option.h"
22 #include "message_parcel.h"
23 
24 using namespace CmFuzzTest;
25 namespace OHOS {
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)26     bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
27     {
28         uint32_t minSize = sizeof(uint32_t) + sizeof(uint32_t) + sizeof(struct CmBlob);
29         uint8_t *myData = nullptr;
30         if (!CopyMyData(data, size, minSize, &myData)) {
31             return false;
32         }
33 
34         uint32_t remainSize = static_cast<uint32_t>(size);
35         uint32_t offset = 0;
36 
37         // get code
38         uint32_t code;
39         if (!GetUintFromBuffer(myData, &remainSize, &offset, &code)) {
40             CmFree(myData);
41             return false;
42         }
43         code = (code % static_cast<uint32_t>(CM_MSG_MAX - CM_MSG_BASE) + static_cast<uint32_t>(CM_MSG_BASE));
44 
45         // get data
46         uint32_t outSize;
47         if (!GetUintFromBuffer(myData, &remainSize, &offset, &outSize)) {
48             CmFree(myData);
49             return false;
50         }
51         struct CmParamSet *paramSet = nullptr;
52         if (ConstructParamSet(myData, &remainSize, &offset,
53             static_cast<CertManagerInterfaceCode>(code), &paramSet) == false) {
54             CmFree(myData);
55             return false;
56         }
57         struct CmBlob srcDataBlob = { paramSet->paramSetSize, reinterpret_cast<uint8_t *>(paramSet) };
58 
59         Security::CertManager::CertManagerService &myService = Security::CertManager::CertManagerService::GetInstance();
60 
61         std::u16string descriptor = myService.GetDescriptor();
62         MessageParcel messageData;
63         messageData.WriteInterfaceToken(descriptor);
64         messageData.WriteUint32(outSize);
65         messageData.WriteUint32(srcDataBlob.size);
66         messageData.WriteBuffer(srcDataBlob.data, static_cast<size_t>(srcDataBlob.size));
67 
68         MessageParcel reply;
69         MessageOption option;
70         CertmanagerTest::SetATPermission();
71         SystemAbilityOnDemandReason reason;
72         (void)myService.OnStart(reason);
73         (void)myService.OnRemoteRequest(code, messageData, reply, option);
74 
75         CmFree(myData);
76         CmFreeParamSet(&paramSet);
77         return true;
78     }
79 }
80 
81 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)82 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
83 {
84     /* Run your code on data */
85     OHOS::DoSomethingInterestingWithMyAPI(data, size);
86     return 0;
87 }
88