1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "containershashsetconstructor_fuzzer.h"
17 
18 #include "ecmascript/containers/containers_hashset.h"
19 #include "ecmascript/containers/containers_private.h"
20 #include "ecmascript/ecma_string-inl.h"
21 #include "ecmascript/ecma_vm.h"
22 #include "ecmascript/global_env.h"
23 #include "ecmascript/js_handle.h"
24 #include "ecmascript/napi/include/jsnapi.h"
25 
26 using namespace panda;
27 using namespace panda::ecmascript;
28 using namespace panda::ecmascript::containers;
29 
30 #define MAXBYTELEN sizeof(uint32_t)
31 
32 namespace OHOS {
33 
JSObjectCreate(JSThread *thread)34     JSFunction *JSObjectCreate(JSThread *thread)
35     {
36         EcmaVM *ecmaVM = thread->GetEcmaVM();
37         JSHandle<GlobalEnv> globalEnv = ecmaVM->GetGlobalEnv();
38         return globalEnv->GetObjectFunction().GetObject<JSFunction>();
39     }
40 
CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)41     EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)
42     {
43         auto factory = thread->GetEcmaVM()->GetFactory();
44         JSHandle<JSTaggedValue> hclass(thread, JSObjectCreate(thread));
45         JSHandle<JSTaggedValue> callee(factory->NewJSObjectByConstructor(JSHandle<JSFunction>::Cast(hclass), hclass));
46         JSHandle<JSTaggedValue> undefined = thread->GlobalConstants()->GetHandledUndefined();
47         EcmaRuntimeCallInfo *objCallInfo =
48             EcmaInterpreter::NewRuntimeCallInfo(thread, undefined, callee, undefined, numArgs);
49         return objCallInfo;
50     }
InitializeHashSetConstructor(JSThread *thread)51     JSTaggedValue InitializeHashSetConstructor(JSThread *thread)
52     {
53         ObjectFactory *factory = thread->GetEcmaVM()->GetFactory();
54         JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
55 
56         JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject();
57         JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate"));
58         JSHandle<JSTaggedValue> value =
59             JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue();
60 
61         auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6);
62         objCallInfo->SetFunction(JSTaggedValue::Undefined());
63         objCallInfo->SetThis(value.GetTaggedValue());
64         objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(ContainerTag::HashSet)));
65         JSTaggedValue result = ContainersPrivate::Load(objCallInfo);
66         return result;
67     }
68 
CreateJSAPIHashSet(JSThread *thread)69     JSHandle<JSAPIHashSet> CreateJSAPIHashSet(JSThread *thread)
70     {
71         JSHandle<JSFunction> newTarget(thread, InitializeHashSetConstructor(thread));
72         auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 4);
73         objCallInfo->SetFunction(newTarget.GetTaggedValue());
74         objCallInfo->SetNewTarget(newTarget.GetTaggedValue());
75         objCallInfo->SetThis(JSTaggedValue::Undefined());
76 
77         JSTaggedValue result = ContainersHashSet::HashSetConstructor(objCallInfo);
78         JSHandle<JSAPIHashSet> map(thread, result);
79         return map;
80     }
81 
ContainersHashSetConstructorFuzzTest(const uint8_t* data, size_t size)82     void ContainersHashSetConstructorFuzzTest(const uint8_t* data, size_t size)
83     {
84         RuntimeOption option;
85         option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
86         EcmaVM *vm = JSNApi::CreateJSVM(option);
87         {
88             JsiFastNativeScope scope(vm);
89             auto thread = vm->GetAssociatedJSThread();
90 
91             uint32_t input;
92             if (size <= 0) {
93                 return;
94             }
95             if (size > MAXBYTELEN) {
96                 size = MAXBYTELEN;
97             }
98             if (memcpy_s(&input, MAXBYTELEN, data, size) != 0) {
99                 std::cout << "memcpy_s failed!";
100                 UNREACHABLE();
101             }
102 
103             JSHandle<JSAPIHashSet> hashSet = CreateJSAPIHashSet(thread);
104             EcmaRuntimeCallInfo *callInfo = CreateEcmaRuntimeCallInfo(thread, 6);
105             callInfo->SetFunction(JSTaggedValue::Undefined());
106             callInfo->SetThis(hashSet.GetTaggedValue());
107             callInfo->SetCallArg(0, JSTaggedValue(input));
108             [[maybe_unused]] JSTaggedValue result = ContainersHashSet::HashSetConstructor(callInfo);
109         }
110         JSNApi::DestroyJSVM(vm);
111     }
112 }
113 
114 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)115 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
116 {
117     // Run your code on data.
118     OHOS::ContainersHashSetConstructorFuzzTest(data, size);
119     return 0;
120 }