1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "cfparam_fuzzer.h"
17 
18 #include <securec.h>
19 
20 #include "cf_param.h"
21 #include "cf_memory.h"
22 #include "cf_result.h"
23 
24 namespace OHOS {
25 
CfParamAddandGetFuzzTest(const uint8_t * data,size_t size)26     bool CfParamAddandGetFuzzTest(const uint8_t* data, size_t size)
27     {
28         CfParamSet *paramSet = nullptr;
29 
30         int32_t ret = CfInitParamSet(&paramSet);
31         if (ret != CF_SUCCESS) {
32             return false;
33         }
34         if (data == nullptr || size < (sizeof(uint32_t) + 1)) {
35             return false;
36         }
37         uint32_t offset = 0;
38         CfParam params[1] = {};
39         size_t i = 0;
40         params[0].tag = *reinterpret_cast<const uint32_t *>(data + offset);
41         offset += sizeof(uint32_t);
42 
43         params[i].blob.size = size - offset;
44 
45         params[i].blob.data = const_cast<uint8_t *>(data + offset);
46 
47         (void)CfAddParams(paramSet, params, 1);
48 
49         CfParam *paramsGet = nullptr;
50         CfGetParam(paramSet, params[0].tag, &paramsGet);
51         CfFreeParamSet(&paramSet);
52 
53         return true;
54     }
55 
CfBuildParamSetFuzzTest(const uint8_t * data,size_t size)56     bool CfBuildParamSetFuzzTest(const uint8_t* data, size_t size)
57     {
58         CfParamSet *paramSet = nullptr;
59         int32_t ret = CfInitParamSet(&paramSet);
60         if (ret != CF_SUCCESS) {
61             return false;
62         }
63         paramSet->paramsCnt = 1;
64         paramSet->paramSetSize += sizeof(CfParam) + size + 1; /* invalid size */
65         paramSet->params[0].tag = CF_TAG_PARAM0_BUFFER;
66         paramSet->params[0].blob.size = size;
67         paramSet->params[0].blob.data = const_cast<uint8_t *>(data);
68 
69         (void)CfBuildParamSet(&paramSet);
70 
71         CfFreeParamSet(&paramSet);
72         return true;
73     }
74 }
75 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)76 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
77 {
78     /* Run your code on data */
79     OHOS::CfParamAddandGetFuzzTest(data, size);
80     OHOS::CfBuildParamSetFuzzTest(data, size);
81     return 0;
82 }
83