1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "bind_fuzzer.h"
17 #include <memory>
18 #include <securec.h>
19 #include "socket.h"
20
21 namespace OHOS {
OnBindFuzzTest(int32_t socket,PeerSocketInfo info)22 static void OnBindFuzzTest(int32_t socket, PeerSocketInfo info)
23 {
24 (void)socket;
25 (void)info;
26 }
27
OnShutdownFuzzTest(int32_t socket,ShutdownReason reason)28 static void OnShutdownFuzzTest(int32_t socket, ShutdownReason reason)
29 {
30 (void)socket;
31 (void)reason;
32 }
33
OnBytesFuzzTest(int32_t socket,const void * data,uint32_t dataLen)34 static void OnBytesFuzzTest(int32_t socket, const void *data, uint32_t dataLen)
35 {
36 (void)socket;
37 (void)data;
38 (void)dataLen;
39 }
40
OnMessageFuzzTest(int32_t socket,const void * data,uint32_t dataLen)41 static void OnMessageFuzzTest(int32_t socket, const void *data, uint32_t dataLen)
42 {
43 (void)socket;
44 (void)data;
45 (void)dataLen;
46 }
47
OnStreamFuzzTest(int32_t socket,const StreamData * data,const StreamData * ext,const StreamFrameInfo * param)48 static void OnStreamFuzzTest(int32_t socket, const StreamData *data, const StreamData *ext,
49 const StreamFrameInfo *param)
50 {
51 (void)socket;
52 (void)data;
53 (void)ext;
54 (void)param;
55 }
56
OnFileFuzzTest(int32_t socket,FileEvent * event)57 static void OnFileFuzzTest(int32_t socket, FileEvent *event)
58 {
59 (void)socket;
60 (void)event;
61 }
62
OnQosFuzzTest(int32_t socket,QoSEvent eventId,const QosTV * qos,uint32_t qosCount)63 static void OnQosFuzzTest(int32_t socket, QoSEvent eventId, const QosTV *qos, uint32_t qosCount)
64 {
65 (void)socket;
66 (void)eventId;
67 (void)qos;
68 (void)qosCount;
69 }
70
OnErrorFuzzTest(int32_t socket,int32_t errCode)71 static void OnErrorFuzzTest(int32_t socket, int32_t errCode)
72 {
73 (void)socket;
74 (void)errCode;
75 }
76
OnNegotiateFuzzTest(int32_t socket,PeerSocketInfo info)77 static bool OnNegotiateFuzzTest(int32_t socket, PeerSocketInfo info)
78 {
79 (void)socket;
80 (void)info;
81 return true;
82 }
83
BindTestWithSocketId(const uint8_t * data,size_t size)84 void BindTestWithSocketId(const uint8_t *data, size_t size)
85 {
86 if ((data == nullptr) || (size == 0)) {
87 return;
88 }
89
90 int32_t socketId = -1;
91 if (memcpy_s(&socketId, sizeof(int32_t), data, sizeof(size)) != EOK) {
92 return;
93 }
94
95 QosTV qosInfo[] = {
96 {.qos = QOS_TYPE_MIN_BW, .value = 160 * 1024 * 1024},
97 {.qos = QOS_TYPE_MAX_WAIT_TIMEOUT, .value = 10},
98 {.qos = QOS_TYPE_MIN_LATENCY, .value = 5},
99 };
100
101 ISocketListener listener = {
102 .OnBind = OnBindFuzzTest,
103 .OnShutdown = OnShutdownFuzzTest,
104 .OnBytes = OnBytesFuzzTest,
105 .OnMessage = OnMessageFuzzTest,
106 .OnStream = OnStreamFuzzTest,
107 .OnFile = OnFileFuzzTest,
108 .OnQos = OnQosFuzzTest,
109 .OnError = OnErrorFuzzTest,
110 .OnNegotiate = OnNegotiateFuzzTest
111 };
112
113 (void)Bind(socketId, qosInfo, sizeof(qosInfo)/sizeof(qosInfo[0]), &listener);
114 }
115
BindTestWithQosInfo(const uint8_t * data,size_t size)116 void BindTestWithQosInfo(const uint8_t *data, size_t size)
117 {
118 if ((data == nullptr) || (size < sizeof(QosTV))) {
119 return;
120 }
121
122 int32_t socketId = 1;
123
124 size_t count = size / sizeof(QosTV);
125 if (count == 0) {
126 return;
127 }
128
129 std::unique_ptr<QosTV[]> qosInfo = std::make_unique<QosTV[]>(count);
130 if (memcpy_s(qosInfo.get(), sizeof(QosTV) * count, data, sizeof(QosTV) * count) != EOK) {
131 return;
132 }
133
134 ISocketListener listener = {
135 .OnBind = OnBindFuzzTest,
136 .OnShutdown = OnShutdownFuzzTest,
137 .OnBytes = OnBytesFuzzTest,
138 .OnMessage = OnMessageFuzzTest,
139 .OnStream = OnStreamFuzzTest,
140 .OnFile = OnFileFuzzTest,
141 .OnQos = OnQosFuzzTest,
142 .OnError = OnErrorFuzzTest,
143 .OnNegotiate = OnNegotiateFuzzTest
144 };
145
146 (void)Bind(socketId, qosInfo.get(), count, &listener);
147 }
148 } // namespace OHOS
149
150 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)151 extern "C" int32_t LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
152 {
153 OHOS::BindTestWithSocketId(data, size);
154 OHOS::BindTestWithQosInfo(data, size);
155 return 0;
156 }
157