diff --git a/framework/test/fuzztest/BUILD.gn b/framework/test/fuzztest/BUILD.gn index fa07bb7db568192ab26ec71532c2acf66b368be8..00a9ab9faed08665fe4ef5a1e8f21ad56f8ea183 100644 --- a/framework/test/fuzztest/BUILD.gn +++ b/framework/test/fuzztest/BUILD.gn @@ -12,9 +12,12 @@ group("hdf_framework_fuzztest") { "devmgr_c_fuzzer/unloaddevice_fuzzer:UnloadDeviceFuzzTest", "devmgr_cpp_fuzzer/loaddevice_fuzzer:LoadDeviceFuzzTest", "devmgr_cpp_fuzzer/unloaddevice_fuzzer:UnloadDeviceFuzzTest", + "devmgr_service_fuzzer:ServiceFuzzTest", "devmgrservicestub_fuzzer:DevmgrServiceStubFuzzTest", "devsvcmanagerstub_fuzzer:DevSvcManagerStubFuzzTest", "framework_fuzzer/hcs_fuzzer:HdfHcsFuzzTest", + "framework_fuzzer/support/posix_fuzzer:HdfPosixFuzzTest", + "framework_utils_fuzzer/utils_fuzzer:HdfUtilsFuzzTest", "ioservice_fuzzer/ioserviceadapterobtain_fuzzer:IoserviceAdapterObtainFuzzTest", "ioservice_fuzzer/ioservicebind_fuzzer:IoserviceBindFuzzTest", "ioservice_fuzzer/ioservicegrouplisten_fuzzer:IoserviceGroupListenFuzzTest", @@ -27,9 +30,7 @@ group("hdf_framework_fuzztest") { "servmgr_cpp_fuzzer/servstatlistenerstub_fuzzer:ServStatListenerStubFuzzTest", "servmgr_cpp_fuzzer/unregisterservicestatuslistener_fuzzer:UnregisterServiceStatusListenerFuzzTest", "syscall_fuzzer/syscall_fuzzer:SyscallFuzzTest", - "uhdf2_hdi_fuzzer/collector_fuzzer:CollectionFuzzTest", "uhdf2_ipc_fuzzer/ipc_fuzzer:HdfIpcFuzzTest", - "uhdf2_shared_fuzzer/shared_fuzzer:SharedFuzzTest", "uhdf2_utils_fuzzer/hdfxcollie_fuzzer:HdfXCollieFuzzTest", "uhdf2_utils_fuzzer/inner_api_utils_fuzzer:HdfInnerApiUtilsFuzzTest", ] diff --git a/framework/test/fuzztest/devmgr_service_fuzzer/BUILD.gn b/framework/test/fuzztest/devmgr_service_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..98c99becb34c94f8cef0582ed4327890240bfb00 --- /dev/null +++ b/framework/test/fuzztest/devmgr_service_fuzzer/BUILD.gn @@ -0,0 +1,89 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# +# HDF is dual licensed: you can use it either under the terms of +# the GPL, or the BSD license, at your option. +# See the LICENSE file in the root of this repository for complete details. + +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") + +module_output_path = "hdf_core/hdf_core" + +hdf_framework_path = "../../../../framework" +hdf_interfaces_path = "../../../../interfaces" +hdf_manager_src_path = "../../../../adapter/uhdf2/manager/src" +hdf_uhdf_path = "../../../../adapter/uhdf2" + +ohos_fuzztest("ServiceFuzzTest") { + module_out_path = module_output_path + fuzz_config_file = "$hdf_framework_path/test/fuzztest/devmgr_service_fuzzer" + + defines = [ "__USER__" ] + include_dirs = [ + "$hdf_framework_path/core/manager/include", + "$hdf_framework_path/core/common/include/manager/", + "$hdf_framework_path/core/host/include", + "$hdf_framework_path/core/shared/include", + "$hdf_framework_path/utils/include", + "$hdf_uhdf_path/include/host", + "$hdf_uhdf_path/shared/include", + "$hdf_uhdf_path/manager/include", + "$hdf_uhdf_path/host/include", + "$hdf_uhdf_path/security/include", + "$hdf_uhdf_path/utils/include", + "$hdf_interfaces_path/inner_api/core", + "$hdf_interfaces_path/inner_api/hdi", + "$hdf_interfaces_path/inner_api/host/shared", + "$hdf_interfaces_path/inner_api/host/uhdf", + ] + + sources = [ + "$hdf_framework_path/core/common/src/hdf_attribute.c", + "$hdf_framework_path/core/manager/src/devhost_service_clnt.c", + "$hdf_framework_path/core/manager/src/device_token_clnt.c", + "$hdf_framework_path/core/manager/src/devmgr_service.c", + "$hdf_framework_path/core/manager/src/devsvc_manager.c", + "$hdf_framework_path/core/manager/src/hdf_driver_installer.c", + "$hdf_framework_path/core/manager/src/hdf_host_info.c", + "$hdf_framework_path/core/shared/src/hdf_device_info.c", + "$hdf_framework_path/core/shared/src/hdf_object_manager.c", + "$hdf_framework_path/core/shared/src/hdf_service_record.c", + "$hdf_manager_src_path/devhost_service_proxy.c", + "$hdf_manager_src_path/device_token_proxy.c", + "$hdf_manager_src_path/devmgr_dump.c", + "$hdf_manager_src_path/devmgr_object_config.c", + "$hdf_manager_src_path/devmgr_query_device.c", + "$hdf_manager_src_path/devmgr_service_full.c", + "$hdf_manager_src_path/devmgr_service_stub.c", + "$hdf_manager_src_path/devmgr_uevent.c", + "$hdf_manager_src_path/devsvc_manager_stub.c", + "$hdf_manager_src_path/driver_installer_full.c", + "$hdf_manager_src_path/servstat_listener_holder.c", + "$hdf_uhdf_path/shared/src/dev_attribute_serialize.c", + "$hdf_uhdf_path/shared/src/hcb_config_entry.c", + "service_fuzzer.cpp", + ] + deps = [ + "../../../../adapter/uhdf2/ipc:libhdf_ipc_adapter", + "../../../../adapter/uhdf2/utils:libhdf_utils", + ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + "init:libbegetutil", + ] + + if (build_selinux) { + external_deps += [ "selinux_adapter:libservice_checker" ] + cflags = [ "-DWITH_SELINUX" ] + } + + cflags_cc = [ "-gdwarf-2" ] +} + +group("fuzztest") { + testonly = true + deps = [ ":ServiceFuzzTest" ] +} diff --git a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/corpus/init b/framework/test/fuzztest/devmgr_service_fuzzer/corpus/init similarity index 100% rename from framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/corpus/init rename to framework/test/fuzztest/devmgr_service_fuzzer/corpus/init diff --git a/framework/test/fuzztest/devmgr_service_fuzzer/project.xml b/framework/test/fuzztest/devmgr_service_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..d46b7fa0279d26d77f6a1d6cded30ba6a981b901 --- /dev/null +++ b/framework/test/fuzztest/devmgr_service_fuzzer/project.xml @@ -0,0 +1,17 @@ + + + + + + 0 + + 10 + + 128 + + diff --git a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/collector_fuzzer.cpp b/framework/test/fuzztest/devmgr_service_fuzzer/service_fuzzer.cpp similarity index 41% rename from framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/collector_fuzzer.cpp rename to framework/test/fuzztest/devmgr_service_fuzzer/service_fuzzer.cpp index 6bb2118042c6c3bf0620a4f046ef0656a0e96893..83851488bca319acd0e236e11531df3a772175d6 100644 --- a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/collector_fuzzer.cpp +++ b/framework/test/fuzztest/devmgr_service_fuzzer/service_fuzzer.cpp @@ -5,18 +5,29 @@ * the GPL, or the BSD license, at your option. * See the LICENSE file in the root of this repository for complete details. */ -#include "collector_fuzzer.h" -#include "object_collector.h" + +#include "service_fuzzer.h" + #include "hdf_base.h" #include "hdf_log.h" +#ifdef __cplusplus +extern "C" { +#endif +#include "devmgr_service.h" +#ifdef __cplusplus +} // extern "C" +#endif #include "parcel.h" -#include -#include "osal_mem.h" -#include "hdi_support.h" -#include +#include +#include + + +#define HDF_LOG_TAG devicemanagerstart_fuzzer namespace OHOS { -static void CollectionFuzzTest(const uint8_t *data, size_t size) +constexpr size_t THRESHOLD = 10; + +void ServiceFuzzTest(const uint8_t *data, size_t size) { if (data == nullptr) { HDF_LOGE("%{public}s: data is nullptr!", __func__); @@ -24,19 +35,21 @@ static void CollectionFuzzTest(const uint8_t *data, size_t size) Parcel parcel; parcel.WriteBuffer(data, size); - const std::u16string INTERFACE_NAME = OHOS::Str8ToStr16(parcel.ReadString()); - HDI::HdiBase *service = (HDI::HdiBase *)OsalMemCalloc(sizeof(HDI::HdiBase)); - HDI::ObjectCollector::GetInstance().NewObject(service, INTERFACE_NAME); - HDI::ObjectCollector::GetInstance().GetOrNewObject(service, INTERFACE_NAME); - HDI::ObjectCollector::GetInstance().RemoveObject(service); - OsalMemFree(service); + struct HdfObject *object = DevmgrServiceCreate(); + struct IDevmgrService *service = DevmgrServiceGetInstance(); + struct DevmgrService *dmService = reinterpret_cast(service); + DevmgrServiceLoadLeftDriver(dmService); + service->PowerStateChange(service, POWER_STATE_SUSPEND); + DevmgrServiceRelease(object); } } -/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { - /* Run your code on data */ - OHOS::CollectionFuzzTest(data, size); + if (size < OHOS::THRESHOLD) { + return HDF_SUCCESS; + } + + OHOS::ServiceFuzzTest(data, size); return HDF_SUCCESS; } \ No newline at end of file diff --git a/framework/test/fuzztest/devmgr_service_fuzzer/service_fuzzer.h b/framework/test/fuzztest/devmgr_service_fuzzer/service_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..22598fae905aea9b3f35e0a4eac4788bc58525db --- /dev/null +++ b/framework/test/fuzztest/devmgr_service_fuzzer/service_fuzzer.h @@ -0,0 +1,14 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#ifndef DEVICE_MANAGER_START_FUZZER_H +#define DEVICE_MANAGER_START_FUZZER_H + +#define FUZZ_PROJECT_NAME "devicemanagerstart_fuzzer" + +#endif // DEVICE_MANAGER_START_FUZZER_H \ No newline at end of file diff --git a/framework/test/fuzztest/devsvcmanagerstub_fuzzer/devsvcmanagerstub_fuzzer.cpp b/framework/test/fuzztest/devsvcmanagerstub_fuzzer/devsvcmanagerstub_fuzzer.cpp index 2dc432b82e92f3ef272ae5f44c927ba8dee7fae0..2c46998160251ec17612edef2ac768e97e9130c4 100644 --- a/framework/test/fuzztest/devsvcmanagerstub_fuzzer/devsvcmanagerstub_fuzzer.cpp +++ b/framework/test/fuzztest/devsvcmanagerstub_fuzzer/devsvcmanagerstub_fuzzer.cpp @@ -102,6 +102,8 @@ static bool DevsvcManagerFuzzTest(int32_t code, const uint8_t *data, size_t size HdfSbufRecycle(dataBuf); HdfSbufRecycle(replyBuf); + HdfObject *object = DevSvcManagerStubCreate(); + DevSvcManagerStubRelease(object); return true; } diff --git a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp index d4a2092962399c42f46c218438341a037b92cf12..5ab927b278a714916ea8632b84014592c33a77ac 100644 --- a/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp +++ b/framework/test/fuzztest/framework_fuzzer/hcs_fuzzer/hcs_fuzzer.cpp @@ -43,7 +43,7 @@ void FuncHcsGetBool(const uint8_t *data, size_t size) } struct DeviceResourceNode *node = (struct DeviceResourceNode *)data; - char *attrName = (char *)(data + sizeof(struct DeviceResourceNode)); + const char *attrName = "nothing"; HcsGetBool(node, attrName); return; } diff --git a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/BUILD.gn b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/BUILD.gn similarity index 35% rename from framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/BUILD.gn rename to framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/BUILD.gn index 7a2d731f429ba62b99ae1ad608d6bf3be885291c..15803fc85fccb569f56c4c5f6be6ead409fd77d7 100644 --- a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/BUILD.gn +++ b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/BUILD.gn @@ -8,45 +8,33 @@ import("//build/config/features.gni") import("//build/ohos.gni") import("//build/test.gni") -module_output_path = "hdf_core/hdf_core/uhdf2_shared_fuzzer" +module_output_path = "hdf_core/hdf_core/framework_fuzzer" -hdf_framework_path = "../../../../../framework" -hdf_uhdf_path = "../../../../../adapter/uhdf2" +hdf_framework_path = "../../../../../../framework" +hdf_uhdf_path = "../../../../../../adapter/uhdf2" -ohos_fuzztest("SharedFuzzTest") { +ohos_fuzztest("HdfPosixFuzzTest") { module_out_path = module_output_path fuzz_config_file = - "$hdf_framework_path/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer" - - include_dirs = [ - "$hdf_uhdf_path/shared/include", - "$hdf_uhdf_path/utils/include", - "$hdf_uhdf_path/ipc/include", - "$hdf_framework_path/include", - "$hdf_framework_path/include", - "$hdf_framework_path/core/manager/include", - "$hdf_framework_path/core/common/include/manager/", - "$hdf_framework_path/core/host/include", - "$hdf_framework_path/core/shared/include", - "$hdf_framework_path/utils/include", - ] + "$hdf_framework_path/test/fuzztest/framework_fuzzer/support/posix_fuzzer" + + include_dirs = [ "$hdf_uhdf_path/utils/include" ] + + sources = [ "posix_fuzzer.cpp" ] - sources = [ "shared_fuzzer.cpp" ] deps = [ - "../../../../../adapter/uhdf2/host:libhdf_host", - "../../../../../adapter/uhdf2/utils:libhdf_utils", + "$hdf_uhdf_path/pub_utils:libpub_utils", + "$hdf_uhdf_path/utils:libhdf_utils", ] external_deps = [ "c_utils:utils", "hilog:libhilog", - "init:libbegetutil", - "ipc:ipc_single", ] } group("fuzztest") { testonly = true - deps = [ ":SharedFuzzTest" ] + deps = [ ":HdfPosixFuzzTest" ] } diff --git a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/corpus/init b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/corpus/init similarity index 100% rename from framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/corpus/init rename to framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/corpus/init diff --git a/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/posix_fuzzer.cpp b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/posix_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..91baa98c3ffbe9af257d65b0d63c3666408cfc06 --- /dev/null +++ b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/posix_fuzzer.cpp @@ -0,0 +1,185 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#include "hdf_base.h" +#include "hdf_log.h" +#include "osal_mem.h" +#include "osal_sem.h" +#include "osal_time.h" +#include "osal_spinlock.h" +#include "posix_fuzzer.h" +#include + +namespace OHOS { +constexpr size_t THRESHOLD = 10; +#define HDF_LOG_TAG posix_fuzzer + +enum FuncId { + POSIX_OSALMEMALLOC, + POSIX_OSALMEMCALLOC, + POSIX_OSALMEMALLOCALIGN, + POSIX_OSALSEMWAIT, + POSIX_OSALSEMPOST, + POSIX_OSALSPINLOCK, + POSIX_OSALTIME, + HCS_END +}; + +void FuncOsalMemAlloc(const uint8_t *data, size_t size) +{ + if (size < sizeof(size_t)) { + return; + } + + size_t sz = *(size_t *)data; + uint8_t *mem = (uint8_t *)OsalMemAlloc(sz); + if (mem != nullptr) { + OsalMemFree(mem); + } + return; +} + +void FuncOsalMemCalloc(const uint8_t *data, size_t size) +{ + if (size < sizeof(size_t)) { + return; + } + + size_t sz = *(size_t *)data; + uint8_t *mem = (uint8_t *)OsalMemCalloc(sz); + if (mem != nullptr) { + OsalMemFree(mem); + } + return; +} + +void FuncOsalMemAllocAlign(const uint8_t *data, size_t size) +{ + if (size < sizeof(size_t)) { + return; + } + size_t alignment = 8; + size_t sz = 0; + + uint8_t *mem = (uint8_t *)OsalMemAllocAlign(alignment, sz); + if (mem != nullptr) { + OsalMemFree(mem); + } + const size_t NUM = 4; + sz = NUM; + mem = (uint8_t *)OsalMemAllocAlign(alignment, sz); + if (mem != nullptr) { + OsalMemFree(mem); + } + return; +} + +void FuncOsalSemWait(const uint8_t *data, size_t size) +{ + OsalSemWait(NULL, 0); + + struct OsalSem sem; + OsalSemInit(&sem, 1); + OsalSemWait(&sem, ~HDF_WAIT_FOREVER); + OsalSemDestroy(&sem); + return; +} + +void FuncOsalSemPost(const uint8_t *data, size_t size) +{ + struct OsalSem sem; + OsalSemInit(&sem, 1); + OsalSemPost(&sem); + OsalSemDestroy(&sem); + return; +} + +void FuncOsalSpinLock(const uint8_t *data, size_t size) +{ + OsalSpinInit(NULL); + OsalSpinlock spinlock; + OsalSpinInit(&spinlock); + const uint32_t SLEEPTIME = 2000; + std::thread thrd([&spinlock] { + OsalMSleep(SLEEPTIME); + OsalSpinUnlock(&spinlock); + }); + OsalSpinLock(&spinlock); + OsalSpinDestroy(&spinlock); + thrd.join(); + return; +} + +void FuncOsalTime(const uint8_t *data, size_t size) +{ + OsalGetTime(NULL); + OsalTimespec start, end, diff; + OsalGetTime(&start); + OsalGetTime(&end); + OsalDiffTime(&start, &end, &diff); + OsalUSleep(1); + OsalUDelay(1); + OsalMDelay(1); + uint64_t st = OsalGetSysTimeMs(); + (void)st; + return; +} + +void FuncSwitch(uint32_t cmd, const uint8_t *data, size_t size) +{ + switch (cmd) { + case POSIX_OSALMEMALLOC: { + FuncOsalMemAlloc(data, size); + break; + } + case POSIX_OSALMEMCALLOC: { + FuncOsalMemCalloc(data, size); + break; + } + case POSIX_OSALMEMALLOCALIGN: { + FuncOsalMemAllocAlign(data, size); + break; + } + case POSIX_OSALSEMWAIT: { + FuncOsalSemWait(data, size); + break; + } + case POSIX_OSALSEMPOST: { + FuncOsalSemPost(data, size); + break; + } + case POSIX_OSALSPINLOCK: { + FuncOsalSpinLock(data, size); + break; + } + case POSIX_OSALTIME: { + FuncOsalTime(data, size); + break; + } + default: + return; + } +} + +void TraverseAllFunc(const uint8_t *data, size_t size) +{ + for (uint32_t cmd = 0; cmd < HCS_END; cmd++) { + FuncSwitch(cmd, data, size); + } +} +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + if (size < OHOS::THRESHOLD) { + return HDF_SUCCESS; + } + + OHOS::TraverseAllFunc(data, size); + return HDF_SUCCESS; +} diff --git a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/shared_fuzzer.h b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/posix_fuzzer.h similarity index 62% rename from framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/shared_fuzzer.h rename to framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/posix_fuzzer.h index f3ed9b94f30360130def2b97e9f871b8eaed2d53..c30667a392b7279b8a0f0c7e48c283a43b06fd97 100644 --- a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/shared_fuzzer.h +++ b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/posix_fuzzer.h @@ -1,14 +1,14 @@ -/* - * Copyright (c) 2024 Huawei Device Co., Ltd. - * - * HDF is dual licensed: you can use it either under the terms of - * the GPL, or the BSD license, at your option. - * See the LICENSE file in the root of this repository for complete details. - */ - -#ifndef HDI_COLLECTION_FUZZER_H -#define HDI_COLLECTION_FUZZER_H - -#define FUZZ_PROJECT_NAME "shared_fuzzer" - -#endif // HDI_COLLECTION_FUZZER_H \ No newline at end of file +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ + +#ifndef HDF_POSIX_H +#define HDF_POSIX_H + +#define FUZZ_PROJECT_NAME "posix_fuzzer" + +#endif // HDF_POSIX_H \ No newline at end of file diff --git a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/project.xml b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/project.xml similarity index 82% rename from framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/project.xml rename to framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/project.xml index e47b18640e151ce8f11a708c2e2a7f209b166fb9..c390575101bdbc1d0df5bd1e5ff4a077c888604d 100644 --- a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/project.xml +++ b/framework/test/fuzztest/framework_fuzzer/support/posix_fuzzer/project.xml @@ -8,10 +8,10 @@ - 1000 + 0 - 120 + 10 - 2048 + 128 diff --git a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/BUILD.gn b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/BUILD.gn similarity index 65% rename from framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/BUILD.gn rename to framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/BUILD.gn index 787cd8bbe485306bfbce789aa88481397425dc5b..1760762dd3beb7f29dc2ee6b9577c14e2f64c0aa 100644 --- a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/BUILD.gn +++ b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/BUILD.gn @@ -8,26 +8,33 @@ import("//build/config/features.gni") import("//build/ohos.gni") import("//build/test.gni") -module_output_path = "hdf_core/hdf_core/uhdf2_hdi_fuzzer" +module_output_path = "hdf_core/hdf_core/framework_utils_fuzzer" hdf_framework_path = "../../../../../framework" hdf_uhdf_path = "../../../../../adapter/uhdf2" hdf_interfaces_path = "../../../../interfaces" -ohos_fuzztest("CollectionFuzzTest") { +ohos_fuzztest("HdfUtilsFuzzTest") { module_out_path = module_output_path fuzz_config_file = - "$hdf_framework_path/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer" + "$hdf_framework_path/test/fuzztest/framework_utils_fuzzer/utils_fuzzer" include_dirs = [ "$hdf_uhdf_path/utils/include", "$hdf_uhdf_path/hdi/include", "$hdf_framework_path/include", + "$hdf_framework_path/utils/include", "$hdf_interfaces_path/inner_api/hdi", + "$hdf_interfaces_path/inner_api/utils", ] - sources = [ "collector_fuzzer.cpp" ] + sources = [ + "$hdf_framework_path/utils/src/hdf_sbuf.c", + "$hdf_framework_path/utils/src/hdf_sbuf_impl_raw.c", + "$hdf_framework_path/utils/src/hdf_cstring.c", + "utils_fuzzer.cpp", + ] deps = [ "../../../../../adapter/uhdf2/hdi:libhdi", @@ -43,5 +50,5 @@ ohos_fuzztest("CollectionFuzzTest") { group("fuzztest") { testonly = true - deps = [ ":CollectionFuzzTest" ] + deps = [ ":HdfUtilsFuzzTest" ] } diff --git a/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/corpus/init b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..f707fb4e4acfe262dfeb05dbbae64043e18526fb --- /dev/null +++ b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/corpus/init @@ -0,0 +1,7 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# +# HDF is dual licensed: you can use it either under the terms of +# the GPL, or the BSD license, at your option. +# See the LICENSE file in the root of this repository for complete details. + +FUZZ \ No newline at end of file diff --git a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/project.xml b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/project.xml similarity index 100% rename from framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/project.xml rename to framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/project.xml diff --git a/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/utils_fuzzer.cpp b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/utils_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..8570964ec2683f37cf754a93d24ca5f78a9c21f8 --- /dev/null +++ b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/utils_fuzzer.cpp @@ -0,0 +1,106 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * + * HDF is dual licensed: you can use it either under the terms of + * the GPL, or the BSD license, at your option. + * See the LICENSE file in the root of this repository for complete details. + */ +#include "utils_fuzzer.h" +#include "hdf_base.h" +#include "hdf_log.h" +#include "parcel.h" +#include +#include "osal_mem.h" +#include "hdi_support.h" +#include +#include "hdf_map.h" +#include "hdf_sbuf.h" +#include "hdf_sbuf_impl.h" +#include "hdf_cstring.h" +#include "hdf_thread_ex.h" +#include "osal_message.h" + +namespace OHOS { + const int NUM = 23; + const static char *g_hdfSecStrArray[NUM] = { + "i2c", + "spi", + "gpio", + "pinctl", + "clock", + "regulator", + "mipi", + "uart", + "sdio", + "mdio", + "apb", + "pcie", + "pcm", + "i2s", + "pwm", + "dma", + "efuse", + "flash", + "emmc", + "rtc", + "adc", + "wdt", + "i3c", + }; +static void HdfUtilsFuzzTest(const uint8_t *data, size_t size) +{ + if (data == nullptr) { + HDF_LOGE("%{public}s: data is nullptr!", __func__); + } + Parcel parcel; + parcel.WriteBuffer(data, size); + const std::u16string INTERFACE_NAME = OHOS::Str8ToStr16(parcel.ReadString()); + Map testMap; + Map testMap1; + MapInit(&testMap); + MapDelete(&testMap); + for (int i = 0; i < NUM; ++i) { + MapSet(&testMap1, g_hdfSecStrArray[i], &i, sizeof(int *)); + } + const char *name = "i2c"; + MapGet(&testMap1, ""); + MapGet(&testMap1, name); + MapErase(&testMap1, ""); + MapErase(&testMap1, name); + MapDelete(&testMap1); + + struct HdfMessage *message = HdfMessageObtain(size); + HdfMessageDelete(reinterpret_cast(message)); + + const char *str = "123"; + struct HdfCString *cstr = HdfCStringObtain(str); + HdfCStringRecycle(cstr); + struct HdfThread *thread = HdfThreadNewInstance(); + HdfThreadFreeInstance(thread); + + struct HdfSBuf *sbuf = HdfSbufObtainDefaultSize(); + struct HdfSBuf *copy = HdfSbufCopy(sbuf); + HdfSbufSetDataSize(copy, size); + HdfSbufGetDataSize(copy); + HdfSbufGetData(copy); + struct HdfSBufImpl *impl = HdfSbufGetImpl(copy); + if (impl == nullptr) { + impl = (struct HdfSBufImpl *)OsalMemCalloc(sizeof(struct HdfSBufImpl)); + } + HdfSbufMove(copy); + HdfSbufTransDataOwnership(copy); + HdfSbufTypedObtainInplace(static_cast(size), impl); + HdfSbufFlush(copy); + HdfSbufGetCapacity(copy); + HdfSbufRecycle(sbuf); + HdfSbufRecycle(copy); +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + OHOS::HdfUtilsFuzzTest(data, size); + return HDF_SUCCESS; +} \ No newline at end of file diff --git a/framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/collector_fuzzer.h b/framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/utils_fuzzer.h similarity index 100% rename from framework/test/fuzztest/uhdf2_hdi_fuzzer/collector_fuzzer/collector_fuzzer.h rename to framework/test/fuzztest/framework_utils_fuzzer/utils_fuzzer/utils_fuzzer.h diff --git a/framework/test/fuzztest/syscall_fuzzer/syscall_fuzzer/syscall_fuzzer.cpp b/framework/test/fuzztest/syscall_fuzzer/syscall_fuzzer/syscall_fuzzer.cpp index 5f09ecbfc747aa14d372800edf535ba6a695ed46..b8b81e218cdcf04775623fe81524ca6dd7d688a1 100644 --- a/framework/test/fuzztest/syscall_fuzzer/syscall_fuzzer/syscall_fuzzer.cpp +++ b/framework/test/fuzztest/syscall_fuzzer/syscall_fuzzer/syscall_fuzzer.cpp @@ -42,6 +42,14 @@ static void SyscallFuzzTest(const uint8_t *data, size_t size) HdfIoServiceRecycle(serv); } } + HdfIoserviceGetListenerCount(serv); + struct HdfIoServiceGroup *group = HdfIoServiceGroupObtain(); + HdfIoServiceGroupAddService(nullptr, nullptr); + HdfIoServiceGroupAddService(group, serv); + HdfIoserviceGroupGetListenerCount(group); + HdfIoserviceGroupGetServiceCount(group); + HdfIoServiceGroupRemoveService(group, serv); + HdfIoServiceGroupRecycle(group); OsalMemFree(listener); HdfIoServiceRecycle(serv); } diff --git a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/shared_fuzzer.cpp b/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/shared_fuzzer.cpp deleted file mode 100644 index 0bc30ce59a0d5dda24a730623398e970ddde35f7..0000000000000000000000000000000000000000 --- a/framework/test/fuzztest/uhdf2_shared_fuzzer/shared_fuzzer/shared_fuzzer.cpp +++ /dev/null @@ -1,35 +0,0 @@ -/* - * Copyright (c) 2024 Huawei Device Co., Ltd. - * - * HDF is dual licensed: you can use it either under the terms of - * the GPL, or the BSD license, at your option. - * See the LICENSE file in the root of this repository for complete details. - */ -#include "shared_fuzzer.h" -#include "dev_attribute_serialize.h" -#include "hdf_base.h" -#include "hdf_log.h" -#include - -namespace OHOS { -static void SharedFuzzTest(const uint8_t *data, size_t size) -{ - if (data == nullptr) { - HDF_LOGE("%{public}s: data is nullptr!", __func__); - } - - struct HdfDeviceInfo *attribute = (struct HdfDeviceInfo *)data; - struct HdfSBuf *sbuf = (struct HdfSBuf *)data; - DeviceAttributeSerialize(attribute, sbuf); - DeviceAttributeDeserialize(sbuf); - DeviceSerializedAttributeRelease(attribute); -} -} - -/* Fuzzer entry point */ -extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) -{ - /* Run your code on data */ - OHOS::SharedFuzzTest(data, size); - return HDF_SUCCESS; -} \ No newline at end of file