1  /*
2   * Copyright (c) 2024 Huawei Device Co., Ltd.
3   * Licensed under the Apache License, Version 2.0 (the "License");
4   * you may not use this file except in compliance with the License.
5   * You may obtain a copy of the License at
6   *
7   *     http://www.apache.org/licenses/LICENSE-2.0
8   *
9   * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  #include "dschedsoftbussession_fuzzer.h"
17  
18  #include <cstddef>
19  #include <cstdint>
20  #include <securec.h>
21  
22  #include "dsched_data_buffer.h"
23  #include "dsched_softbus_session.h"
24  
25  namespace OHOS {
26  namespace DistributedSchedule {
27  namespace {
28  static const uint32_t DSCHED_MAX_BUFFER_SIZE = 80 * 1024 * 1024;
29  constexpr size_t FOO_MAX_LEN = 1024;
30  constexpr size_t U32_AT_SIZE = 4;
31  constexpr int32_t POS_0 = 0;
32  constexpr int32_t POS_1 = 1;
33  constexpr int32_t POS_2 = 2;
34  constexpr int32_t POS_3 = 3;
35  constexpr int32_t OFFSET_24 = 24;
36  constexpr int32_t OFFSET_16 = 16;
37  constexpr int32_t OFFSET_8 = 8;
38  }
39  
Get32Data(const uint8_t * ptr,size_t size)40  int32_t Get32Data(const uint8_t* ptr, size_t size)
41  {
42      if (size > FOO_MAX_LEN || size < U32_AT_SIZE) {
43          return 0;
44      }
45      char *ch = static_cast<char*>(malloc(size + 1));
46      if (ch == nullptr) {
47          return 0;
48      }
49      (void)memset_s(ch, size + 1, 0x00, size + 1);
50      if (memcpy_s(ch, size + 1, ptr, size) != EOK) {
51          free(ch);
52          ch = nullptr;
53          return 0;
54      }
55      int32_t data = (ch[POS_0] << OFFSET_24) | (ch[POS_1] << OFFSET_16) | (ch[POS_2] << OFFSET_8) | ch[POS_3];
56      free(ch);
57      ch = nullptr;
58      return data;
59  }
60  
FuzzOnBytesReceived(const uint8_t * data,size_t size)61  void FuzzOnBytesReceived(const uint8_t* data, size_t size)
62  {
63      if ((data == nullptr) || (size < U32_AT_SIZE)) {
64          return;
65      }
66      size_t intParam = static_cast<size_t>(Get32Data(data, size));
67      if (intParam >= DSCHED_MAX_BUFFER_SIZE) {
68          return;
69      }
70      std::shared_ptr<DSchedDataBuffer> buffer = std::make_shared<DSchedDataBuffer>(intParam);
71      DSchedSoftbusSession dschedSoftbusSession;
72      dschedSoftbusSession.OnBytesReceived(buffer);
73      dschedSoftbusSession.OnConnect();
74      dschedSoftbusSession.GetPeerDeviceId();
75      int32_t dataType = Get32Data(data, size);
76      dschedSoftbusSession.SendData(buffer, dataType);
77      dschedSoftbusSession.OnDisconnect();
78  }
79  }
80  }
81  
82  /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)83  extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
84  {
85      OHOS::DistributedSchedule::FuzzOnBytesReceived(data, size);
86      return 0;
87  }