diff --git a/framework/test/fuzztest/BUILD.gn b/framework/test/fuzztest/BUILD.gn index b31a04c71cb6cd0d255296c35524ead887cbb507..df30ea30a413c7295cdbfefe85d67e1214617af7 100644 --- a/framework/test/fuzztest/BUILD.gn +++ b/framework/test/fuzztest/BUILD.gn @@ -14,6 +14,7 @@ group("hdf_framework_fuzztest") { "devmgr_cpp_fuzzer/unloaddevice_fuzzer:UnloadDeviceFuzzTest", "devmgrservicestub_fuzzer:DevmgrServiceStubFuzzTest", "devsvcmanagerstub_fuzzer:DevSvcManagerStubFuzzTest", + "framework_fuzzer/hcs_fuzzer:HdfHcsFuzzTest", "ioservice_fuzzer/ioserviceadapterobtain_fuzzer:IoserviceAdapterObtainFuzzTest", "ioservice_fuzzer/ioservicebind_fuzzer:IoserviceBindFuzzTest", "ioservice_fuzzer/ioservicegrouplisten_fuzzer:IoserviceGroupListenFuzzTest", @@ -26,5 +27,6 @@ group("hdf_framework_fuzztest") { "servmgr_cpp_fuzzer/servstatlistenerstub_fuzzer:ServStatListenerStubFuzzTest", "servmgr_cpp_fuzzer/unregisterservicestatuslistener_fuzzer:UnregisterServiceStatusListenerFuzzTest", "uhdf2_utils_fuzzer/hdfxcollie_fuzzer:HdfXCollieFuzzTest", + "uhdf2_utils_fuzzer/inner_api_utils_fuzzer:HdfInnerApiUtilsFuzzTest", ] } diff --git a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/BUILD.gn b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..95b953bd13b053abfac255bf244bf43586e7edad --- /dev/null +++ b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/BUILD.gn @@ -0,0 +1,40 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# +# HDF is dual licensed: you can use it either under the terms of +# the GPL, or the BSD license, at your option. +# See the LICENSE file in the root of this repository for complete details. + +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") + +module_output_path = "hdf_core/hdf_core/framework_fuzzer" + +hdf_framework_path = "../../../../../framework" +hdf_uhdf_path = "../../../../../adapter/uhdf2" + +ohos_fuzztest("HdfHcsFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "$hdf_framework_path/test/fuzztest/framework_fuzzer/hcs_fuzzer" + + include_dirs = [ "$hdf_uhdf_path/utils/include" ] + + sources = [ "hcs_fuzzer.cpp" ] + + deps = [ + "$hdf_uhdf_path/pub_utils:libpub_utils", + "$hdf_uhdf_path/utils:libhdf_utils", + ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":HdfHcsFuzzTest" ] +} diff --git a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/corpus/init b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..f707fb4e4acfe262dfeb05dbbae64043e18526fb --- /dev/null +++ b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/corpus/init @@ -0,0 +1,7 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# +# HDF is dual licensed: you can use it either under the terms of +# the GPL, or the BSD license, at your option. +# See the LICENSE file in the root of this repository for complete details. + +FUZZ \ No newline at end of file diff --git a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..d4a2092962399c42f46c218438341a037b92cf12 --- /dev/null +++ b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp @@ -0,0 +1,364 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#include "hcs_fuzzer.h" + +#include "hcs_tree_if.h" +#include "hdf_base.h" +#include "hdf_log.h" + +namespace OHOS { +constexpr size_t THRESHOLD = 10; +#define HDF_LOG_TAG hcs_fuzzer_fuzzer + +enum FuncId { + HCS_HCSGETBOOL, + HCS_HCSGETUINT8, + HCS_HCSGETUINT32, + HCS_HCSGETUINT64, + HCS_HCSGETUINT8ARRAYELEM, + HCS_HCSGETUINT16ARRAYELEM, + HCS_HCSGETUINT32ARRAYELEM, + HCS_HCSGETUINT64ARRAYELEM, + HCS_HCSGETUINT8ARRAY, + HCS_HCSGETUINT16ARRAY, + HCS_HCSGETUINT32ARRAY, + HCS_HCSGETUINT64ARRAY, + HCS_HCSGETELEMNUM, + HCS_HCSGETNODEBYMATCHATTR, + HCS_HCSGETCHILDNODE, + HCS_HCSGETNODEBYREFATTR, + HCS_END +}; + +void FuncHcsGetBool(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + char *attrName = (char *)(data + sizeof(struct DeviceResourceNode)); + HcsGetBool(node, attrName); + return; +} + +void FuncHcsGetUint8(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint8_t value = 0; + uint8_t def = 0; + + HcsGetUint8(node, attrName, &value, def); + return; +} + +void FuncHcsGetUint32(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint32_t value = 0; + uint32_t def = 0; + + HcsGetUint32(node, attrName, &value, def); + return; +} + +void FuncHcsGetUint64(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint64_t value = 0; + uint64_t def = 0; + + HcsGetUint64(node, attrName, &value, def); + return; +} + +void FuncHcsGetUint8ArrayElem(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint32_t index = 0; + uint8_t value = 0; + uint8_t def = 0; + + HcsGetUint8ArrayElem(node, attrName, index, &value, def); + return; +} + +void FuncHcsGetUint16ArrayElem(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint32_t index = 0; + uint16_t value = 0; + uint16_t def = 0; + + HcsGetUint16ArrayElem(node, attrName, index, &value, def); + return; +} + +void FuncHcsGetUint32ArrayElem(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint32_t index = 0; + uint32_t value = 0; + uint32_t def = 0; + + HcsGetUint32ArrayElem(node, attrName, index, &value, def); + return; +} + +void FuncHcsGetUint64ArrayElem(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint32_t index = 0; + uint64_t value = 0; + uint64_t def = 0; + + HcsGetUint64ArrayElem(node, attrName, index, &value, def); + return; +} + +void FuncHcsGetUint8Array(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint8_t *value = (uint8_t *)(data + sizeof(struct DeviceResourceNode)); + uint32_t len = (size - sizeof(struct DeviceResourceNode)) / sizeof(uint8_t); + uint8_t def = 0; + + HcsGetUint8Array(node, attrName, value, len, def); + return; +} + +void FuncHcsGetUint16Array(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint16_t *value = (uint16_t *)(data + sizeof(struct DeviceResourceNode)); + uint32_t len = (size - sizeof(struct DeviceResourceNode)) / sizeof(uint16_t); + uint16_t def = 0; + + HcsGetUint16Array(node, attrName, value, len, def); + return; +} + +void FuncHcsGetUint32Array(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint32_t *value = (uint32_t *)(data + sizeof(struct DeviceResourceNode)); + uint32_t len = (size - sizeof(struct DeviceResourceNode)) / sizeof(uint32_t); + uint32_t def = 0; + + HcsGetUint32Array(node, attrName, value, len, def); + return; +} + +void FuncHcsGetUint64Array(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + uint64_t *value = (uint64_t *)(data + sizeof(struct DeviceResourceNode)); + uint32_t len = (size - sizeof(struct DeviceResourceNode)) / sizeof(uint64_t); + uint64_t def = 0; + + HcsGetUint64Array(node, attrName, value, len, def); + return; +} + +void FuncHcsGetElemNum(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + + HcsGetElemNum(node, attrName); + return; +} + +void FuncHcsGetNodeByMatchAttr(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrValue = "nothing"; + + HcsGetNodeByMatchAttr(node, attrValue); + return; +} + +void FuncHcsGetChildNode(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *nodeName = "nothing"; + + HcsGetChildNode(node, nodeName); + return; +} + +void FuncHcsGetNodeByRefAttr(const uint8_t *data, size_t size) +{ + if (size < sizeof(struct DeviceResourceNode)) { + return; + } + + struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; + const char *attrName = "nothing"; + + HcsGetNodeByRefAttr(node, attrName); + return; +} + +void FuncSwitch(uint32_t cmd, const uint8_t *data, size_t size) +{ + switch (cmd) { + case HCS_HCSGETBOOL: { + FuncHcsGetBool(data, size); + break; + } + case HCS_HCSGETUINT8: { + FuncHcsGetUint8(data, size); + break; + } + case HCS_HCSGETUINT32: { + FuncHcsGetUint32(data, size); + break; + } + case HCS_HCSGETUINT64: { + FuncHcsGetUint64(data, size); + break; + } + case HCS_HCSGETUINT8ARRAYELEM: { + FuncHcsGetUint8ArrayElem(data, size); + break; + } + case HCS_HCSGETUINT16ARRAYELEM: { + FuncHcsGetUint16ArrayElem(data, size); + break; + } + case HCS_HCSGETUINT32ARRAYELEM: { + FuncHcsGetUint32ArrayElem(data, size); + break; + } + case HCS_HCSGETUINT64ARRAYELEM: { + FuncHcsGetUint64ArrayElem(data, size); + break; + } + case HCS_HCSGETUINT8ARRAY: { + FuncHcsGetUint8Array(data, size); + break; + } + case HCS_HCSGETUINT16ARRAY: { + FuncHcsGetUint16Array(data, size); + break; + } + case HCS_HCSGETUINT32ARRAY: { + FuncHcsGetUint32Array(data, size); + break; + } + case HCS_HCSGETUINT64ARRAY: { + FuncHcsGetUint64Array(data, size); + break; + } + case HCS_HCSGETELEMNUM: { + FuncHcsGetElemNum(data, size); + break; + } + case HCS_HCSGETNODEBYMATCHATTR: { + FuncHcsGetNodeByMatchAttr(data, size); + break; + } + case HCS_HCSGETCHILDNODE: { + FuncHcsGetChildNode(data, size); + break; + } + case HCS_HCSGETNODEBYREFATTR: { + FuncHcsGetNodeByRefAttr(data, size); + break; + } + default: + return; + } +} + +void TraverseAllFunc(const uint8_t *data, size_t size) +{ + for (uint32_t cmd = 0; cmd < HCS_END; cmd++) { + FuncSwitch(cmd, data, size); + } +} +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + if (size < OHOS::THRESHOLD) { + return HDF_SUCCESS; + } + + OHOS::TraverseAllFunc(data, size); + return HDF_SUCCESS; +} diff --git a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.h b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..008821b93a6f8b98f2b421d92ec4c4974f7c13f3 --- /dev/null +++ b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.h @@ -0,0 +1,14 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#ifndef HDF_HCS_H +#define HDF_HCS_H + +#define FUZZ_PROJECT_NAME "hcs_fuzzer" + +#endif // HDF_HCS_H \ No newline at end of file diff --git a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/project.xml b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..c390575101bdbc1d0df5bd1e5ff4a077c888604d --- /dev/null +++ b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/project.xml @@ -0,0 +1,17 @@ + + + + + + 0 + + 10 + + 128 + + diff --git a/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/BUILD.gn b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..52e359a4147d736a809cc4ea50bae3417fc3fb6b --- /dev/null +++ b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/BUILD.gn @@ -0,0 +1,39 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# +# HDF is dual licensed: you can use it either under the terms of +# the GPL, or the BSD license, at your option. +# See the LICENSE file in the root of this repository for complete details. + +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") + +module_output_path = "hdf_core/hdf_core/uhdf2_utils_fuzzer" + +hdf_framework_path = "../../../../../framework" +hdf_uhdf_path = "../../../../../adapter/uhdf2" + +ohos_fuzztest("HdfInnerApiUtilsFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = "$hdf_framework_path/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer" + + include_dirs = [ "$hdf_uhdf_path/utils/include" ] + + sources = [ "innerapi_utils_fuzzer.cpp" ] + + deps = [ + "$hdf_uhdf_path/pub_utils:libpub_utils", + "$hdf_uhdf_path/utils:libhdf_utils", + ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":HdfInnerApiUtilsFuzzTest" ] +} diff --git a/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/corpus/init b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..f707fb4e4acfe262dfeb05dbbae64043e18526fb --- /dev/null +++ b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/corpus/init @@ -0,0 +1,7 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# +# HDF is dual licensed: you can use it either under the terms of +# the GPL, or the BSD license, at your option. +# See the LICENSE file in the root of this repository for complete details. + +FUZZ \ No newline at end of file diff --git a/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/innerapi_utils_fuzzer.cpp b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/innerapi_utils_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..e10decdc037f40ecaf38b7198b6ef18af47df3fd --- /dev/null +++ b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/innerapi_utils_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#include "innerapi_utils_fuzzer.h" + +#include "hdf_dlist.h" +#include "hdf_base.h" +#include "hdf_log.h" + +namespace OHOS { +constexpr size_t THRESHOLD = 10; +#define HDF_LOG_TAG innerapi_utils_fuzzer + +enum FuncId { + INNERAPI_UTILS_DLISTINSERTHEAD, + INNERAPI_UTILS_END +}; + +void FuncdListInsertHead(const uint8_t *data, size_t size) +{ + constexpr uint16_t cnt = 2; + if (size < sizeof(struct DListHead) * cnt) { + return; + } + + struct DListHead *entry = (struct DListHead *)data; + struct DListHead *head = (struct DListHead *)(data + sizeof(struct DListHead)); + DListInsertHead(entry, head); + return; +} + + +void FuncSwitch(uint32_t cmd, const uint8_t *data, size_t size) +{ + switch (cmd) { + case INNERAPI_UTILS_DLISTINSERTHEAD: { + FuncdListInsertHead(data, size); + break; + } + + default: + return; + } +} + +void TraverseAllFunc(const uint8_t *data, size_t size) +{ + for (uint32_t cmd = 0; cmd < INNERAPI_UTILS_END; cmd++) { + FuncSwitch(cmd, data, size); + } +} +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + if (size < OHOS::THRESHOLD) { + return HDF_SUCCESS; + } + + OHOS::TraverseAllFunc(data, size); + return HDF_SUCCESS; +} diff --git a/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/innerapi_utils_fuzzer.h b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/innerapi_utils_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..3bf39b55e3df4529de70c386cbd604e914b7670d --- /dev/null +++ b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/innerapi_utils_fuzzer.h @@ -0,0 +1,14 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#ifndef HDF_INNER_API_UTILS_H +#define HDF_INNER_API_UTILS_H + +#define FUZZ_PROJECT_NAME "innerapi_utils_fuzzer" + +#endif // HDF_INNER_API_UTILS_H \ No newline at end of file diff --git a/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/project.xml b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..c390575101bdbc1d0df5bd1e5ff4a077c888604d --- /dev/null +++ b/framework/test/fuzztest/uhdf2_utils_fuzzer/inner_api_utils_fuzzer/project.xml @@ -0,0 +1,17 @@ + + + + + + 0 + + 10 + + 128 + +