/* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "jsvaluerefiscontainer_fuzzer.h" #include "ecmascript/base/utf_helper.h" #include "ecmascript/ecma_string-inl.h" #include "ecmascript/global_env.h" #include "ecmascript/js_api/js_api_tree_map.h" #include "ecmascript/js_api/js_api_vector.h" #include "ecmascript/js_api/js_api_tree_set.h" #include "ecmascript/js_regexp.h" #include "ecmascript/js_set.h" #include "ecmascript/js_typed_array.h" #include "ecmascript/linked_hash_table.h" #include "ecmascript/napi/include/jsnapi.h" #include "ecmascript/napi/jsnapi_helper.h" #include "ecmascript/tagged_tree.h" using namespace panda; using namespace panda::ecmascript; using namespace panda::ecmascript::base::utf_helper; namespace OHOS { void JSValueRefIsVectorFuzzTest([[maybe_unused]]const uint8_t *data, size_t size) { RuntimeOption option; option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); EcmaVM *vm = JSNApi::CreateJSVM(option); { JsiFastNativeScope scope(vm); if (size <= 0) { return; } JSThread *thread = vm->GetJSThread(); ObjectFactory *factory = thread->GetEcmaVM()->GetFactory(); auto globalEnv = thread->GetEcmaVM()->GetGlobalEnv(); JSHandle proto = globalEnv->GetObjectFunctionPrototype(); JSHandle vectorClass = factory->NewEcmaHClass(JSAPIVector::SIZE, JSType::JS_API_VECTOR, proto); JSHandle jsVector = JSHandle::Cast(factory->NewJSObjectWithInit(vectorClass)); jsVector->SetLength(0); JSHandle argumentTag = JSHandle::Cast(jsVector); Local isVector = JSNApiHelper::ToLocal(argumentTag); isVector->IsVector(vm); } JSNApi::DestroyJSVM(vm); return; } void JSValueRefIsMapFuzzTest([[maybe_unused]]const uint8_t *data, size_t size) { RuntimeOption option; option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); EcmaVM *vm = JSNApi::CreateJSVM(option); if (size <= 0) { return; } Local map = MapRef::New(vm); map->IsMap(vm); JSNApi::DestroyJSVM(vm); return; } void JSValueRefIsRegExpFuzzTest([[maybe_unused]]const uint8_t *data, size_t size) { RuntimeOption option; option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); EcmaVM *vm = JSNApi::CreateJSVM(option); { JsiFastNativeScope scope(vm); if (size <= 0) { return; } JSThread *thread = vm->GetJSThread(); ObjectFactory *factory = thread->GetEcmaVM()->GetFactory(); JSHandle globalEnv = thread->GetEcmaVM()->GetGlobalEnv(); JSHandle proto = globalEnv->GetObjectFunctionPrototype(); JSHandle jSRegExpClass = factory->NewEcmaHClass(JSRegExp::SIZE, JSType::JS_REG_EXP, proto); JSHandle jSRegExp = JSHandle::Cast(factory->NewJSObject(jSRegExpClass)); jSRegExp->SetByteCodeBuffer(thread, JSTaggedValue::Undefined()); jSRegExp->SetOriginalSource(thread, JSTaggedValue::Undefined()); jSRegExp->SetGroupName(thread, JSTaggedValue::Undefined()); jSRegExp->SetOriginalFlags(thread, JSTaggedValue(0)); jSRegExp->SetLength(0); JSHandle argumentTag = JSHandle::Cast(jSRegExp); Local regexp = JSNApiHelper::ToLocal(argumentTag); regexp->IsRegExp(vm); } JSNApi::DestroyJSVM(vm); return; } void JSValueRefIsSetFuzzTest([[maybe_unused]]const uint8_t *data, size_t size) { RuntimeOption option; option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); EcmaVM *vm = JSNApi::CreateJSVM(option); { JsiFastNativeScope scope(vm); if (size <= 0) { return; } JSThread *thread = vm->GetJSThread(); ObjectFactory *factory = thread->GetEcmaVM()->GetFactory(); JSHandle env = thread->GetEcmaVM()->GetGlobalEnv(); JSHandle constructor = env->GetBuiltinsSetFunction(); JSHandle set = JSHandle::Cast(factory->NewJSObjectByConstructor(JSHandle(constructor), constructor)); JSHandle hashSet = LinkedHashSet::Create(thread); set->SetLinkedSet(thread, hashSet); JSHandle setTag = JSHandle::Cast(set); Local isSet = JSNApiHelper::ToLocal(setTag); isSet->IsSet(vm); } JSNApi::DestroyJSVM(vm); return; } void JSValueRefIsTreeMapFuzzTest([[maybe_unused]]const uint8_t *data, size_t size) { RuntimeOption option; option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); EcmaVM *vm = JSNApi::CreateJSVM(option); { JsiFastNativeScope scope(vm); if (size <= 0) { return; } JSThread *thread = vm->GetJSThread(); ObjectFactory *factory = thread->GetEcmaVM()->GetFactory(); auto globalEnv = thread->GetEcmaVM()->GetGlobalEnv(); JSHandle proto = globalEnv->GetObjectFunctionPrototype(); JSHandle mapClass = factory->NewEcmaHClass(JSAPITreeMap::SIZE, JSType::JS_API_TREE_MAP, proto); JSHandle jsTreeMap = JSHandle::Cast(factory->NewJSObjectWithInit(mapClass)); JSHandle treeMap(thread, TaggedTreeMap::Create(thread)); jsTreeMap->SetTreeMap(thread, treeMap); JSHandle argumentTag = JSHandle::Cast(jsTreeMap); Local isTreeMap = JSNApiHelper::ToLocal(argumentTag); isTreeMap->IsTreeMap(vm); } JSNApi::DestroyJSVM(vm); } void JSValueRefIsTreeSetFuzzTest([[maybe_unused]]const uint8_t *data, size_t size) { RuntimeOption option; option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); EcmaVM *vm = JSNApi::CreateJSVM(option); { JsiFastNativeScope scope(vm); if (size <= 0) { return; } JSThread *thread = vm->GetJSThread(); ObjectFactory *factory = thread->GetEcmaVM()->GetFactory(); auto globalEnv = thread->GetEcmaVM()->GetGlobalEnv(); JSHandle proto = globalEnv->GetObjectFunctionPrototype(); JSHandle setClass = factory->NewEcmaHClass(JSAPITreeSet::SIZE, JSType::JS_API_TREE_SET, proto); JSHandle jsTreeSet = JSHandle::Cast(factory->NewJSObjectWithInit(setClass)); JSHandle treeSet(thread, TaggedTreeSet::Create(thread)); jsTreeSet->SetTreeSet(thread, treeSet); JSHandle argumentTag = JSHandle::Cast(jsTreeSet); Local isTreeSet = JSNApiHelper::ToLocal(argumentTag); isTreeSet->IsTreeSet(vm); } JSNApi::DestroyJSVM(vm); } } // Fuzzer entry point. extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { // Run your code on data. OHOS::JSValueRefIsVectorFuzzTest(data, size); OHOS::JSValueRefIsMapFuzzTest(data, size); OHOS::JSValueRefIsRegExpFuzzTest(data, size); OHOS::JSValueRefIsSetFuzzTest(data, size); OHOS::JSValueRefIsTreeMapFuzzTest(data, size); OHOS::JSValueRefIsTreeSetFuzzTest(data, size); return 0; }