xref: /base/usb/usb_manager/test/fuzztest/usbmgrbulkcancel_fuzzer/usbmgrbulkcancel_fuzzer.cpp

/*
 * Copyright (c) 2022 Huawei Device Co., Ltd.
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include "usbmgrbulkcancel_fuzzer.h"

#include <array>
#include <optional>

#include "ashmem.h"
#include "iremote_object.h"
#include "usb_callback_test.h"
#include "usb_common_fuzz.h"
#include "usb_errors.h"

namespace {
const uint32_t OFFSET = 4;
constexpr size_t THRESHOLD = 10;
const uint32_t ASHMEM_MAX_SIZE = 1024;
const uint32_t MEM_DATA = 1024 * 1024;
}
namespace OHOS {
namespace USB {
    sptr<Ashmem> GetSharedMem()
    {
        sptr<Ashmem> asmptr = Ashmem::CreateAshmem("ttashmem001", MEM_DATA);
        if (asmptr == nullptr) {
            USB_HILOGE(MODULE_USB_SERVICE, "InitAshmemOne CreateAshmem failed");
            return nullptr;
        }

        asmptr->MapReadAndWriteAshmem();

        std::array<uint8_t, ASHMEM_MAX_SIZE> tdata;
        tdata.fill('Y');
        uint32_t offset = 0;
        while (offset < MEM_DATA) {
            uint32_t tlen = (MEM_DATA - offset) < ASHMEM_MAX_SIZE ? (MEM_DATA - offset) : ASHMEM_MAX_SIZE;
            asmptr->WriteToAshmem(tdata.data(), tlen, offset);
            offset += tlen;
        }
        return asmptr;
    }

    bool UsbMgrBulkCancelFuzzTest(const uint8_t* data, size_t /* size */)
    {
        auto[res, pipe, interface] = UsbMgrPrepareFuzzEnv();
        if (!res) {
            USB_HILOGE(MODULE_USB_SERVICE, "prepare error");
            return false;
        }

        auto& usbSrvClient = UsbSrvClient::GetInstance();
        sptr<UsbCallbackTest> cb = new UsbCallbackTest();
        USBEndpoint point = const_cast<UsbInterface &>(interface).GetEndpoints().at(1);
        auto ret = usbSrvClient.RegBulkCallback(const_cast<USBDevicePipe &>(pipe), point, cb);
        if (ret != UEC_OK) {
            USB_HILOGE(MODULE_USB_SERVICE, "RegBulkCallback failed ret=%{public}d", ret);
            return false;
        }

        auto sharedMem = GetSharedMem();
        if (sharedMem == nullptr) {
            USB_HILOGE(MODULE_USB_SERVICE, "GetSharedMem failed ret=%{public}d", ret);
            return false;
        }

        ret = usbSrvClient.BulkWrite(const_cast<USBDevicePipe &>(pipe), point, sharedMem);
        if (ret != UEC_OK) {
            USB_HILOGE(MODULE_USB_SERVICE, "BulkWrite failed ret=%{public}d", ret);
            return false;
        }

        if (usbSrvClient.BulkCancel(reinterpret_cast<USBDevicePipe &>(data),
            reinterpret_cast<const USBEndpoint&>(std::move(data + OFFSET))) == UEC_OK) {
            return false;
        }
        return true;
    }
} // USB
} // OHOS

/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
    if (size < THRESHOLD) {
        return 0;
    }
    /* Run your code on data */
    OHOS::USB::UsbMgrBulkCancelFuzzTest(data, size);
    return 0;
}