1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "dschedsoftbussession_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <securec.h>
21
22 #include "dsched_data_buffer.h"
23 #include "dsched_softbus_session.h"
24
25 namespace OHOS {
26 namespace DistributedSchedule {
27 namespace {
28 static const uint32_t DSCHED_MAX_BUFFER_SIZE = 80 * 1024 * 1024;
29 constexpr size_t FOO_MAX_LEN = 1024;
30 constexpr size_t U32_AT_SIZE = 4;
31 constexpr int32_t POS_0 = 0;
32 constexpr int32_t POS_1 = 1;
33 constexpr int32_t POS_2 = 2;
34 constexpr int32_t POS_3 = 3;
35 constexpr int32_t OFFSET_24 = 24;
36 constexpr int32_t OFFSET_16 = 16;
37 constexpr int32_t OFFSET_8 = 8;
38 }
39
Get32Data(const uint8_t * ptr,size_t size)40 int32_t Get32Data(const uint8_t* ptr, size_t size)
41 {
42 if (size > FOO_MAX_LEN || size < U32_AT_SIZE) {
43 return 0;
44 }
45 char *ch = static_cast<char*>(malloc(size + 1));
46 if (ch == nullptr) {
47 return 0;
48 }
49 (void)memset_s(ch, size + 1, 0x00, size + 1);
50 if (memcpy_s(ch, size + 1, ptr, size) != EOK) {
51 free(ch);
52 ch = nullptr;
53 return 0;
54 }
55 int32_t data = (ch[POS_0] << OFFSET_24) | (ch[POS_1] << OFFSET_16) | (ch[POS_2] << OFFSET_8) | ch[POS_3];
56 free(ch);
57 ch = nullptr;
58 return data;
59 }
60
FuzzOnBytesReceived(const uint8_t * data,size_t size)61 void FuzzOnBytesReceived(const uint8_t* data, size_t size)
62 {
63 if ((data == nullptr) || (size < U32_AT_SIZE)) {
64 return;
65 }
66 size_t intParam = static_cast<size_t>(Get32Data(data, size));
67 if (intParam >= DSCHED_MAX_BUFFER_SIZE) {
68 return;
69 }
70 std::shared_ptr<DSchedDataBuffer> buffer = std::make_shared<DSchedDataBuffer>(intParam);
71 DSchedSoftbusSession dschedSoftbusSession;
72 dschedSoftbusSession.OnBytesReceived(buffer);
73 dschedSoftbusSession.OnConnect();
74 dschedSoftbusSession.GetPeerDeviceId();
75 int32_t dataType = Get32Data(data, size);
76 dschedSoftbusSession.SendData(buffer, dataType);
77 dschedSoftbusSession.OnDisconnect();
78 }
79 }
80 }
81
82 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)83 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
84 {
85 OHOS::DistributedSchedule::FuzzOnBytesReceived(data, size);
86 return 0;
87 }