From 68e9f4b25e99c5ef583c27bbd52aaa3dcc8cdb70 Mon Sep 17 00:00:00 2001 From: gWX1231951 Date: Thu, 8 Jun 2023 10:06:37 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0fuzz=E7=94=A8=E4=BE=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: gWX1231951 --- BUILD.gn | 7 +- test/fuzztest/BUILD.gn | 21 ++ test/fuzztest/data.h | 63 +++++ test/fuzztest/hdinnrtdevice_fuzzer/BUILD.gn | 43 ++++ .../fuzztest/hdinnrtdevice_fuzzer/corpus/init | 16 ++ .../hdinnrtdevice_fuzzer.cpp | 68 +++++ .../hdinnrtdevice_fuzzer.h | 21 ++ .../fuzztest/hdinnrtdevice_fuzzer/project.xml | 25 ++ .../hdinnrtpreparedmodel_fuzzer/BUILD.gn | 50 ++++ .../hdinnrtpreparedmodel_fuzzer/corpus/init | 16 ++ .../hdinnrtpreparedmodel_fuzzer.cpp | 237 ++++++++++++++++++ .../hdinnrtpreparedmodel_fuzzer.h | 21 ++ .../hdinnrtpreparedmodel_fuzzer/project.xml | 25 ++ 13 files changed, 612 insertions(+), 1 deletion(-) create mode 100644 test/fuzztest/BUILD.gn create mode 100644 test/fuzztest/data.h create mode 100644 test/fuzztest/hdinnrtdevice_fuzzer/BUILD.gn create mode 100644 test/fuzztest/hdinnrtdevice_fuzzer/corpus/init create mode 100644 test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.cpp create mode 100644 test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.h create mode 100644 test/fuzztest/hdinnrtdevice_fuzzer/project.xml create mode 100644 test/fuzztest/hdinnrtpreparedmodel_fuzzer/BUILD.gn create mode 100644 test/fuzztest/hdinnrtpreparedmodel_fuzzer/corpus/init create mode 100644 test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.cpp create mode 100644 test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.h create mode 100644 test/fuzztest/hdinnrtpreparedmodel_fuzzer/project.xml diff --git a/BUILD.gn b/BUILD.gn index 95f2896..d5186b9 100644 --- a/BUILD.gn +++ b/BUILD.gn @@ -9,14 +9,19 @@ # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and -# limitations under the License. +# limitations under the License. import("//build/ohos.gni") group("nnrt_target") { deps = [ "frameworks:libneural_network_runtime" ] } + # group("nnrt_test_target") { # testonly = true # deps = [ "test/unittest:unittest" ] # } +group("nnrt_fuzztest") { + testonly = true + deps = [ "test/fuzztest:fuzztest" ] +} diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn new file mode 100644 index 0000000..3835be8 --- /dev/null +++ b/test/fuzztest/BUILD.gn @@ -0,0 +1,21 @@ +# Copyright (C) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/test.gni") +group("fuzztest") { + testonly = true + deps = [] + + deps += [ "hdinnrtdevice_fuzzer:HdiNnrtDeviceFuzzTest" ] + deps += [ "hdinnrtpreparedmodel_fuzzer:HdiNnrtPreparedModelFuzzTest" ] +} diff --git a/test/fuzztest/data.h b/test/fuzztest/data.h new file mode 100644 index 0000000..c530b44 --- /dev/null +++ b/test/fuzztest/data.h @@ -0,0 +1,63 @@ +#ifndef TEST_FUZZTEST_GETDATA_H +#define TEST_FUZZTEST_GETDATA_H + +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include + +#include "../../common/log.h" +#include "securec.h" + +namespace OHOS { +namespace NeuralNetworkRuntime { +class Data { +public: + Data(const uint8_t* data, size_t size) + { + dataFuzz = data; + dataSize = size; + } + template T GetData() + { + T object {}; + size_t objectSize = sizeof(object); + if (dataFuzz == nullptr || objectSize > dataSize - dataPos) { + LOGE("[GetData]Data is not enough."); + return {}; + } + if (memcpy_s(&object, objectSize, dataFuzz + dataPos, objectSize) != EOK) { + LOGE("[GetData]Memcpy_s failed."); + return {}; + } + dataPos = dataPos + objectSize; + return object; + } + const uint8_t* getNowData() + { + return dataFuzz + dataPos; + } + size_t getNowDataSize() + { + return dataSize - dataPos; + } +private: + const uint8_t* dataFuzz = nullptr; + size_t dataSize = 0; + size_t dataPos = 0; +}; +} // namespace NeuralNetworkRuntime +} // namespace OHOS + +#endif \ No newline at end of file diff --git a/test/fuzztest/hdinnrtdevice_fuzzer/BUILD.gn b/test/fuzztest/hdinnrtdevice_fuzzer/BUILD.gn new file mode 100644 index 0000000..49bd2b8 --- /dev/null +++ b/test/fuzztest/hdinnrtdevice_fuzzer/BUILD.gn @@ -0,0 +1,43 @@ +# Copyright (C) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +module_output_path = "drivers_interface_nnrt/drivers_interface_nnrt" + +##############################fuzztest########################################## +ohos_fuzztest("HdiNnrtDeviceFuzzTest") { + module_out_path = module_output_path + fuzz_config_file = "../hdinnrtdevice_fuzzer" + + include_dirs = [ "//third_party/bounds_checking_function/include" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "hdinnrtdevice_fuzzer.cpp" ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_nnrt:libnnrt_stub_2.0", + "hdf_core:libhdi", + "hilog_native:libhilog", + "ipc:ipc_core", + ] +} diff --git a/test/fuzztest/hdinnrtdevice_fuzzer/corpus/init b/test/fuzztest/hdinnrtdevice_fuzzer/corpus/init new file mode 100644 index 0000000..71b8efd --- /dev/null +++ b/test/fuzztest/hdinnrtdevice_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.cpp b/test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.cpp new file mode 100644 index 0000000..d034e8a --- /dev/null +++ b/test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.cpp @@ -0,0 +1,68 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include "hdinnrtdevice_fuzzer.h" +#include "../data.h" +#include "../../../common/log.h" + +#include +#include "message_parcel.h" +#include "message_option.h" +#include "securec.h" + +namespace V2_0 = OHOS::HDI::Nnrt::V2_0; + +namespace OHOS { +namespace NeuralNetworkRuntime { +constexpr size_t U32_AT_SIZE = 4; +bool HdiNnrtDeviceFuzzTest(const uint8_t* data, size_t size) +{ + OHOS::sptr device = V2_0::INnrtDevice::Get(); + if (device == nullptr) { + LOGE("[HdiNnrtDeviceFuzzTest]Nnrt device get failed."); + return false; + } + + Data dataFuzz(data, size); + uint32_t code = dataFuzz.GetData() + % (V2_0::CMD_NNRT_DEVICE_RELEASE_BUFFER - V2_0::CMD_NNRT_DEVICE_GET_VERSION + 1); + MessageParcel datas; + datas.WriteInterfaceToken(V2_0::INnrtDevice::GetDescriptor()); + datas.WriteBuffer(dataFuzz.getNowData(), dataFuzz.getNowDataSize()); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + std::shared_ptr nnrtDeviceStub = std::make_shared(device); + nnrtDeviceStub->OnRemoteRequest(code, datas, reply, option); + return true; +} +} // namespace NeuralNetworkRuntime +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + if (data == nullptr) { + LOGE("Pass data is nullptr."); + return 0; + } + + if (size < OHOS::NeuralNetworkRuntime::U32_AT_SIZE) { + LOGE("Pass size is too small."); + return 0; + } + + OHOS::NeuralNetworkRuntime::HdiNnrtDeviceFuzzTest(data, size); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.h b/test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.h new file mode 100644 index 0000000..87f599a --- /dev/null +++ b/test/fuzztest/hdinnrtdevice_fuzzer/hdinnrtdevice_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef NNRT_FUZZ_HDI_DEVICE_H_ +#define NNRT_FUZZ_HDI_DEVICE_H_ + +#define FUZZ_PROJECT_NAME "hdinnrtdevice_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/hdinnrtdevice_fuzzer/project.xml b/test/fuzztest/hdinnrtdevice_fuzzer/project.xml new file mode 100644 index 0000000..4d483f4 --- /dev/null +++ b/test/fuzztest/hdinnrtdevice_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/hdinnrtpreparedmodel_fuzzer/BUILD.gn b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/BUILD.gn new file mode 100644 index 0000000..5eed6bd --- /dev/null +++ b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/BUILD.gn @@ -0,0 +1,50 @@ +# Copyright (C) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +module_output_path = "drivers_interface_nnrt/drivers_interface_nnrt" + +##############################fuzztest########################################## +ohos_fuzztest("HdiNnrtPreparedModelFuzzTest") { + module_out_path = module_output_path + fuzz_config_file = "../hdinnrtpreparedmodel_fuzzer" + + include_dirs = [ + "../../../", + "//third_party/bounds_checking_function/include", + "//third_party/mindspore/mindspore-src/source/mindspore/lite/mindir/include", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "hdinnrtpreparedmodel_fuzzer.cpp" ] + + external_deps = [ + "c_utils:utils", + "drivers_interface_nnrt:libnnrt_proxy_2.0", + "drivers_interface_nnrt:libnnrt_stub_2.0", + "hdf_core:libhdi", + "hilog_native:libhilog", + "ipc:ipc_core", + "mindspore:mindir", + "neural_network_runtime:nnrt_target", + ] +} diff --git a/test/fuzztest/hdinnrtpreparedmodel_fuzzer/corpus/init b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/corpus/init new file mode 100644 index 0000000..71b8efd --- /dev/null +++ b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.cpp b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.cpp new file mode 100644 index 0000000..11fcaa0 --- /dev/null +++ b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.cpp @@ -0,0 +1,237 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include "hdinnrtpreparedmodel_fuzzer.h" +#include "../data.h" +#include "common/log.h" +#include "frameworks/native/inner_model.h" +#include "interfaces/kits/c/neural_network_runtime.h" + +#include +#include +#include +#include "message_parcel.h" +#include "message_option.h" +#include "securec.h" + +namespace V2_0 = OHOS::HDI::Nnrt::V2_0; + +namespace OHOS { +namespace NeuralNetworkRuntime { +constexpr size_t U32_AT_SIZE = 4; +bool BuildModel(OH_NNModel* model) +{ + // 指定Add算子的输入、参数和输出索引 + uint32_t inputIndicesValues[2] = {0, 1}; + uint32_t paramIndicesValues = 2; + uint32_t outputIndicesValues = 3; + OH_NN_UInt32Array paramIndices = {¶mIndicesValues, 1}; + OH_NN_UInt32Array inputIndices = {inputIndicesValues, 2}; + OH_NN_UInt32Array outputIndices = {&outputIndicesValues, 1}; + + // 向模型实例添加Add算子 + OH_NN_ReturnCode ret = OH_NNModel_AddOperation(model, OH_NN_OPS_ADD, ¶mIndices, &inputIndices, &outputIndices); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildModel]Add operation failed."); + return false; + } + + // 设置模型实例的输入、输出索引 + ret = OH_NNModel_SpecifyInputsAndOutputs(model, &inputIndices, &outputIndices); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildModel]Specify inputs and outputs failed."); + return false; + } + + // 完成模型实例的构建 + ret = OH_NNModel_Finish(model); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildModel]Error happened when finishing model construction."); + return false; + } + return true; +} + +bool BuildAddGraph(OH_NNModel **pModel) +{ + // 创建模型实例，进行模型构造 + OH_NNModel* model = OH_NNModel_Construct(); + if (model == nullptr) { + LOGE("[BuildAddGraph]Create model failed."); + return false; + } + + // 添加Add算子的第一个输入Tensor，类型为float32，张量形状为[1, 2, 2, 3] + int32_t inputDims[4] = {1, 2, 2, 3}; + OH_NN_Tensor input1 = {OH_NN_FLOAT32, 4, inputDims, nullptr, OH_NN_TENSOR}; + OH_NN_ReturnCode ret = OH_NNModel_AddTensor(model, &input1); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildAddGraph]Add Tensor of first input failed."); + return false; + } + + // 添加Add算子的第二个输入Tensor，类型为float32，张量形状为[1, 2, 2, 3] + OH_NN_Tensor input2 = {OH_NN_FLOAT32, 4, inputDims, nullptr, OH_NN_TENSOR}; + ret = OH_NNModel_AddTensor(model, &input2); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildAddGraph]Add Tensor of second input failed."); + return false; + } + + // 添加Add算子的参数Tensor，该参数Tensor用于指定激活函数的类型，Tensor的数据类型为int8。 + int32_t activationDims = 1; + int8_t activationValue = OH_NN_FUSED_NONE; + OH_NN_Tensor activation = {OH_NN_INT8, 1, &activationDims, nullptr, OH_NN_ADD_ACTIVATIONTYPE}; + ret = OH_NNModel_AddTensor(model, &activation); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildAddGraph]Add Tensor of activation failed."); + return false; + } + + int opCnt = 2; + // 将激活函数类型设置为OH_NN_FUSED_NONE，表示该算子不添加激活函数。 + ret = OH_NNModel_SetTensorData(model, opCnt, &activationValue, sizeof(int8_t)); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildAddGraph]Set value of activation failed."); + return false; + } + + // 设置Add算子的输出，类型为float32，张量形状为[1, 2, 2, 3] + OH_NN_Tensor output = {OH_NN_FLOAT32, 4, inputDims, nullptr, OH_NN_TENSOR}; + ret = OH_NNModel_AddTensor(model, &output); + if (ret != OH_NN_SUCCESS) { + LOGE("[BuildAddGraph]Add Tensor of output failed."); + return false; + } + + bool isSuccess = BuildModel(model); + if (!isSuccess) { + LOGE("[BuildAddGraph]Compilation model failed."); + return false; + } + + *pModel = model; + return true; +} + +bool ConvertModel(OHOS::sptr device_, OH_NNModel *model, + V2_0::SharedBuffer &tensorBuffer, V2_0::Model **iModel) +{ + auto *innerModel = reinterpret_cast(model); + std::shared_ptr m_liteGraph = innerModel->GetLiteGraphs(); + if (m_liteGraph == nullptr) { + LOGE("[ConvertModel]Model is nullptr, cannot query supported operation."); + return false; + } + + size_t tensorSize = mindspore::lite::MindIR_LiteGraph_GetConstTensorSize(m_liteGraph.get()); + int32_t hdiRet {0}; + if (tensorSize > 0) { + hdiRet = device_->AllocateBuffer(tensorSize, tensorBuffer); + int nnrt_fd = -1; + if (hdiRet != HDF_SUCCESS || tensorBuffer.fd == nnrt_fd) { + LOGE("[ConvertModel]Allocate tensor buffer failed"); + return false; + } + } + *iModel = mindspore::lite::MindIR_LiteGraph_To_Model(m_liteGraph.get(), tensorBuffer); + if (iModel == nullptr) { + LOGE("[ConvertModel]Parse litegraph to hdi model failed."); + device_->ReleaseBuffer(tensorBuffer); + return false; + } + // release model + OH_NNModel_Destroy(&model); + model = nullptr; + return true; +} + +bool CreatePreparedModel(OHOS::sptr& iPreparedModel) +{ + OHOS::sptr device = V2_0::INnrtDevice::Get(); + if (device == nullptr) { + LOGE("[CreatePreparedModel]Nnrt device get failed."); + return false; + } + OH_NNModel *model = nullptr; + bool isSuccess = false; + isSuccess = BuildAddGraph(&model); + if (!isSuccess) { + LOGE("[CreatePreparedModel]Build add graph failed."); + return false; + } + + V2_0::Model *iModel = nullptr; + int nnrt_fd = -1; + V2_0::SharedBuffer tensorBuffer {nnrt_fd, 0, 0, 0}; + isSuccess = ConvertModel(device, model, tensorBuffer, &iModel); + if (!isSuccess) { + LOGE("[CreatePreparedModel]ConvertModel failed."); + return false; + } + V2_0::ModelConfig config; + config.enableFloat16 = false; + config.mode = V2_0::PERFORMANCE_EXTREME; + config.priority = V2_0::PRIORITY_HIGH; + // prepared model + int32_t nnrtDeviceRet = device->PrepareModel(*iModel, config, iPreparedModel); + if (nnrtDeviceRet != HDF_SUCCESS) { + LOGE("[CreatePreparedModel]Prepare model failed."); + return false; + } + return true; +} + +bool HdiNnrtPreparedModelFuzzTest(const uint8_t* data, size_t size) +{ + OHOS::sptr preparedModel; + bool isSuccess = CreatePreparedModel(preparedModel); + if (!isSuccess) { + LOGE("[HdiNnrtPreparedModelFuzzTest]Create prepare model failed."); + return false; + } + + Data dataFuzz(data, size); + uint32_t code = dataFuzz.GetData() + % (V2_0::CMD_PREPARED_MODEL_RUN - V2_0::CMD_PREPARED_MODEL_GET_VERSION + 1); + MessageParcel datas; + datas.WriteInterfaceToken(V2_0::IPreparedModel::GetDescriptor()); + datas.WriteBuffer(dataFuzz.getNowData(), dataFuzz.getNowDataSize()); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + std::shared_ptr preparedModelStub = + std::make_shared(preparedModel); + preparedModelStub->OnRemoteRequest(code, datas, reply, option); + return true; +} +} // namespace NeuralNetworkRuntime +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + if (data == nullptr) { + LOGE("Pass data is nullptr."); + return 0; + } + + if (size < OHOS::NeuralNetworkRuntime::U32_AT_SIZE) { + LOGE("Pass size is too small."); + return 0; + } + + OHOS::NeuralNetworkRuntime::HdiNnrtPreparedModelFuzzTest(data, size); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.h b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.h new file mode 100644 index 0000000..e3c7ceb --- /dev/null +++ b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/hdinnrtpreparedmodel_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (C) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef NNRT_FUZZ_HDI_PREPARED_MODEL_H_ +#define NNRT_FUZZ_HDI_PREPARED_MODEL_H_ + +#define FUZZ_PROJECT_NAME "hdinnrtpreparedmodel_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/hdinnrtpreparedmodel_fuzzer/project.xml b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/project.xml new file mode 100644 index 0000000..4d483f4 --- /dev/null +++ b/test/fuzztest/hdinnrtpreparedmodel_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + -- Gitee