1 /*
2  * Copyright (c) 2022-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "dbinderdatabusinvoker_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 #include <cstring>
21 #include "sys_binder.h"
22 
23 #define private public
24 #include "dbinder_base_invoker.h"
25 #include "dbinder_databus_invoker.h"
26 #undef private
27 
28 namespace OHOS {
AcquireHandleTest(const uint8_t * data,size_t size)29     bool AcquireHandleTest(const uint8_t* data, size_t size)
30     {
31         if (data == nullptr || size < sizeof(int32_t)) {
32             return false;
33         }
34 
35         DBinderDatabusInvoker invoker;
36         int32_t testHandle = *(reinterpret_cast<const int32_t*>(data));
37         int ret = invoker.AcquireHandle(testHandle);
38         if (ret == 0) {
39             return false;
40         }
41         return true;
42     }
43 
ReleaseHandleTest(const uint8_t * data,size_t size)44     bool ReleaseHandleTest(const uint8_t* data, size_t size)
45     {
46         if (data == nullptr || size < sizeof(int32_t)) {
47             return false;
48         }
49 
50         DBinderDatabusInvoker invoker;
51         int32_t testHandle = *(reinterpret_cast<const int32_t*>(data));
52         int ret = invoker.ReleaseHandle(testHandle);
53         if (ret == 0) {
54             return false;
55         }
56         return true;
57     }
58 
QueryClientSessionObjectTest(const uint8_t * data,size_t size)59     bool QueryClientSessionObjectTest(const uint8_t* data, size_t size)
60     {
61         if (data == nullptr || size < sizeof(int32_t)) {
62             return false;
63         }
64 
65         DBinderDatabusInvoker invoker;
66         int32_t testHandle = *(reinterpret_cast<const int32_t*>(data));
67         std::shared_ptr<DBinderSessionObject> testPeer = nullptr;
68         testPeer = invoker.QueryClientSessionObject(testHandle);
69         if (testPeer == nullptr) {
70             return false;
71         }
72         return true;
73     }
74 
QueryServerSessionObjectTest(const uint8_t * data,size_t size)75     bool QueryServerSessionObjectTest(const uint8_t* data, size_t size)
76     {
77         if (data == nullptr || size < sizeof(int32_t)) {
78             return false;
79         }
80 
81         DBinderDatabusInvoker invoker;
82         int32_t testHandle = *(reinterpret_cast<const int32_t*>(data));
83         std::shared_ptr<DBinderSessionObject> testPeer = nullptr;
84         testPeer = invoker.QueryServerSessionObject(testHandle);
85         if (testPeer == nullptr) {
86             return false;
87         }
88         return true;
89     }
90 
OnMessageAvailableTest(const uint8_t * data,size_t size)91     bool OnMessageAvailableTest(const uint8_t* data, size_t size)
92     {
93         if (data == nullptr || size < sizeof(ssize_t)) {
94             return false;
95         }
96 
97         DBinderDatabusInvoker invoker;
98         char *testData = nullptr;
99         ssize_t testLen = *(reinterpret_cast<const ssize_t*>(data));
100         int32_t socketId = *(reinterpret_cast<const int32_t*>(data));
101         invoker.OnMessageAvailable(socketId, testData, testLen);
102         return true;
103     }
104 
JoinThreadTest(const uint8_t * data,size_t size)105     bool JoinThreadTest(const uint8_t* data, size_t size)
106     {
107         if (data == nullptr || size < sizeof(bool)) {
108             return false;
109         }
110 
111         DBinderDatabusInvoker invoker;
112         bool initiative  = *(reinterpret_cast<const bool*>(data));
113         invoker.JoinThread(initiative);
114         return true;
115     }
116 
StopWorkThreadTest(const uint8_t * data,size_t size)117     bool StopWorkThreadTest(const uint8_t* data, size_t size)
118     {
119         if (data == nullptr || size == 0) {
120             return false;
121         }
122 
123         DBinderDatabusInvoker invoker;
124         invoker.StopWorkThread();
125         return true;
126     }
127 
GetCallerPidTest(const uint8_t * data,size_t size)128     bool GetCallerPidTest(const uint8_t* data, size_t size)
129     {
130         if (data == nullptr || size == 0) {
131             return false;
132         }
133 
134         DBinderDatabusInvoker invoker;
135         invoker.GetCallerPid();
136         return true;
137     }
138 
GetStatusTest(const uint8_t * data,size_t size)139     bool GetStatusTest(const uint8_t* data, size_t size)
140     {
141         if (data == nullptr || size == 0) {
142             return false;
143         }
144 
145         DBinderDatabusInvoker invoker;
146         invoker.GetStatus();
147         return true;
148     }
149 
GetCallerUidTest(const uint8_t * data,size_t size)150     bool GetCallerUidTest(const uint8_t* data, size_t size)
151     {
152         if (data == nullptr || size == 0) {
153             return false;
154         }
155 
156         DBinderDatabusInvoker invoker;
157         invoker.GetCallerUid();
158         return true;
159     }
160 
GetCallerTokenIDTest(const uint8_t * data,size_t size)161     bool GetCallerTokenIDTest(const uint8_t* data, size_t size)
162     {
163         if (data == nullptr || size == 0) {
164             return false;
165         }
166 
167         DBinderDatabusInvoker invoker;
168         invoker.GetCallerTokenID();
169         return true;
170     }
171 
GetFirstTokenIDTest(const uint8_t * data,size_t size)172     bool GetFirstTokenIDTest(const uint8_t* data, size_t size)
173     {
174         if (data == nullptr || size == 0) {
175             return false;
176         }
177 
178         DBinderDatabusInvoker invoker;
179         invoker.GetFirstCallerTokenID();
180         return true;
181     }
182 
IsLocalCallingTest(const uint8_t * data,size_t size)183     bool IsLocalCallingTest(const uint8_t* data, size_t size)
184     {
185         if (data == nullptr || size == 0) {
186             return false;
187         }
188 
189         DBinderDatabusInvoker invoker;
190         if (invoker.IsLocalCalling() != false) {
191             return false;
192         }
193         return true;
194     }
195 
FlushCommandsTest(const uint8_t * data,size_t size)196     bool FlushCommandsTest(const uint8_t* data, size_t size)
197     {
198         if (data == nullptr || size == 0) {
199             return false;
200         }
201 
202         DBinderDatabusInvoker invoker;
203         IRemoteObject *object = nullptr;
204         if (invoker.FlushCommands(object) == 0) {
205             return false;
206         }
207         return true;
208     }
209 
ResetCallingIdentityTest(const uint8_t * data,size_t size)210     bool ResetCallingIdentityTest(const uint8_t* data, size_t size)
211     {
212         if (data == nullptr || size == 0) {
213             return false;
214         }
215 
216         DBinderDatabusInvoker invoker;
217         std::string identity = invoker.ResetCallingIdentity();
218         if (identity.empty()) {
219             return false;
220         }
221         return true;
222     }
223 
MakeThreadProcessInfoTest(const uint8_t * data,size_t size)224     bool MakeThreadProcessInfoTest(const uint8_t* data, size_t size)
225     {
226         if (data == nullptr || size < sizeof(uint32_t)) {
227             return false;
228         }
229 
230         uint32_t handle = *(reinterpret_cast<const uint32_t*>(data));
231         const char* indata  = reinterpret_cast<const char*>(data);
232         DBinderDatabusInvoker invoker;
233         std::shared_ptr<ThreadProcessInfo> processInfo = invoker.MakeThreadProcessInfo(handle, indata, size);
234         if (processInfo == nullptr) {
235             return false;
236         }
237         return true;
238     }
239 
ProcessTransactionTest(const uint8_t * data,size_t size)240     void ProcessTransactionTest(const uint8_t* data, size_t size)
241     {
242         if (data == nullptr || size < sizeof(int32_t)) {
243             return;
244         }
245 
246         dbinder_transaction_data *tr = new dbinder_transaction_data();
247         uint32_t listenFd = *(reinterpret_cast<const uint32_t*>(data));
248         DBinderDatabusInvoker invoker;
249         invoker.ProcessTransaction(tr, listenFd);
250         delete tr;
251         return;
252     }
253 
CheckTransactionDataTest(const uint8_t * data,size_t size)254     bool CheckTransactionDataTest(const uint8_t* data, size_t size)
255     {
256         if (data == nullptr || size == 0) {
257             return false;
258         }
259 
260         dbinder_transaction_data *tr = new dbinder_transaction_data();
261         DBinderDatabusInvoker invoker;
262         bool ret = invoker.CheckTransactionData(tr);
263         delete tr;
264         return ret;
265     }
266 }
267 
268 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)269 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
270 {
271     /* Run your code on data */
272     OHOS::MakeThreadProcessInfoTest(data, size);
273     OHOS::ProcessTransactionTest(data, size);
274     OHOS::CheckTransactionDataTest(data, size);
275     return 0;
276 }
277