1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "timer_fuzzer.h"
17
18 #include <thread>
19
20 #include "fuzz_log.h"
21 #include "fuzzer/FuzzedDataProvider.h"
22 #include "securec.h"
23 #include "timer.h"
24
25 using namespace std;
26
27 namespace OHOS {
28 const uint8_t MAX_OPS = 100;
29 const uint8_t MAX_STRING_LENGTH = 255;
30 const int MAX_TIME_MS = 100;
31 std::atomic<int> g_data(0);
32
TimeOutCallback()33 void TimeOutCallback()
34 {
35 g_data++;
36 }
37
38 const std::vector<std::function<void(FuzzedDataProvider*, Utils::Timer&, vector<uint32_t>&)>> ops = {
__anon70cc5f930102() 39 [](FuzzedDataProvider* dataProvider, Utils::Timer& timer, vector<uint32_t>& val) {
40 uint32_t interval = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_TIME_MS);
41 bool once = dataProvider->ConsumeBool();
42 uint32_t timerId = timer.Register(TimeOutCallback, interval, once);
43 val.push_back(timerId);
44 FUZZ_LOGI("Register, interval = %{public}d, once = %{public}d, timerId = %{public}d", interval, once, timerId);
45 uint32_t sleepTime = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_TIME_MS);
46 std::this_thread::sleep_for(std::chrono::milliseconds(sleepTime));
47 FUZZ_LOGI("sleep_for, time = %{public}d, g_data = %{public}d",
48 sleepTime, g_data.load(std::memory_order_relaxed));
49 },
50
__anon70cc5f930202() 51 [](FuzzedDataProvider* dataProvider, Utils::Timer& timer, vector<uint32_t>& val) {
52 if (val.size() == 0) {
53 return;
54 }
55 size_t id = dataProvider->ConsumeIntegralInRange<size_t>(0, val.size() - 1);
56 timer.Unregister(val[id]);
57 FUZZ_LOGI("Unregister, timerId = %{public}d", val[id]);
58 for (size_t i = id; i < val.size() - 1; i++) {
59 swap(val[i], val[i + 1]);
60 }
61 val.pop_back();
62 },
63 };
64
TimerTestFunc(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)65 void TimerTestFunc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
66 {
67 FUZZ_LOGI("TimerTestFunc start");
68 string teststr = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
69 uint32_t timeoutMs = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_TIME_MS);
70 Utils::Timer timer(teststr, timeoutMs);
71 FUZZ_LOGI("Timer, str = %{public}s, ms = %{public}d", teststr.c_str(), timeoutMs);
72 vector<uint32_t> timerIds;
73 g_data = 0;
74
75 while (dataProvider->remaining_bytes() > 0) {
76 timer.Setup();
77 FUZZ_LOGI("Setup");
78 int opCnt = 0;
79 while (dataProvider->remaining_bytes() > 0 && opCnt++ < MAX_OPS) {
80 uint8_t op = dataProvider->ConsumeIntegral<uint8_t>() % ops.size();
81 ops[op](dataProvider, timer, timerIds);
82 }
83 timer.Shutdown();
84 timerIds.clear();
85 FUZZ_LOGI("Shutdown");
86 }
87 FUZZ_LOGI("TimerTestFunc end");
88 }
89
90 } // namespace OHOS
91
92 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)93 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
94 {
95 FuzzedDataProvider dataProvider(data, size);
96 OHOS::TimerTestFunc(data, size, &dataProvider);
97 return 0;
98 }
99