diff --git a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp index dbaf3ff06242c0961de776d19f01eb3dc8a55d8a..34e28bc7863ae4038b7ad5233fd8c9af6fc23b3c 100644 --- a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp +++ b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp @@ -16,7 +16,7 @@ #include #include #include - +#include #include "avsession_errors.h" #include "avsession_log.h" #include "avsession_service_stub.h" @@ -40,7 +40,7 @@ static const uint8_t* RAW_DATA = nullptr; const size_t THRESHOLD = 10; static size_t g_dataSize = 0; static size_t g_pos; - +AvSessionServiceFuzzer AVSessionServiceFuzzer; /* * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T) * tips: only support basic type @@ -140,6 +140,337 @@ void OHOS::AVSession::AvSessionServiceTests() aVSessionService->FuzzTests(); } +int32_t AvSessionServiceFuzzer::OnRemoteRequestFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + uint32_t code = provider.ConsumeIntegral(); + MessageParcel data; + MessageParcel reply; + MessageOption option; + avSessionService->OnRemoteRequest(code, data, reply, option); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleCreateSessionInnerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleCreateSessionInner(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleGetAllSessionDescriptorsFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleGetAllSessionDescriptors(data,reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleGetSessionDescriptorsByIdFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleGetSessionDescriptorsById(data,reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleGetHistoricalSessionDescriptorsFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleGetHistoricalSessionDescriptors(data,reply); + return true; +} + +int32_t AvSessionServiceFuzzer::GetAVQueueInfosImgLengthFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + std::vector avQueueInfos; + size_t num_elements =provider.ConsumeIntegral(); + for (size_t i = 0; i < num_elements; ++i) { + if (provider.remaining_bytes() < sizeof(int32_t)) { + break; + } + OHOS::AVSession::AVQueueInfo info; + avQueueInfos.push_back(std::move(info)); + } + avSessionService->GetAVQueueInfosImgLength(avQueueInfos); + return true; +} + +void AvSessionServiceFuzzer::MarshallingAVQueueInfosFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + CHECK_AND_RETURN(avSessionService != nullptr); + MessageParcel reply; + std::vector avQueueInfos; + size_t num_elements =provider.ConsumeIntegral(); + for (size_t i = 0; i < num_elements; ++i) { + if (provider.remaining_bytes() < sizeof(int32_t)) { + break; + } + OHOS::AVSession::AVQueueInfo info; + avQueueInfos.push_back(std::move(info)); + } + avSessionService->MarshallingAVQueueInfos(reply, avQueueInfos); +} + +void AvSessionServiceFuzzer::AVQueueInfoImgToBufferFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + CHECK_AND_RETURN(avSessionService != nullptr); + std::vector avQueueInfos; + size_t num_elements =provider.ConsumeIntegral(); + for (size_t i = 0; i < num_elements; ++i) { + if (provider.remaining_bytes() < sizeof(int32_t)) { + break; + } + OHOS::AVSession::AVQueueInfo info; + avQueueInfos.push_back(std::move(info)); + } + unsigned char buffer = provider.ConsumeIntegral(); + avSessionService->AVQueueInfoImgToBuffer(avQueueInfos, &buffer); +} + +int32_t AvSessionServiceFuzzer::HandleGetHistoricalAVQueueInfosFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleGetHistoricalAVQueueInfos(data, reply); + return true; +} +int32_t AvSessionServiceFuzzer::HandleRegisterAncoMediaSessionListenerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleRegisterAncoMediaSessionListener(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleCreateControllerInnerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleCreateControllerInner(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleGetAVCastControllerInnerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleGetAVCastControllerInner(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleRegisterSessionListenerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleRegisterSessionListener(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleRegisterSessionListenerForAllUsersFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleRegisterSessionListenerForAllUsers(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleSendSystemAVKeyEventFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleSendSystemAVKeyEvent(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleSendSystemControlCommandFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleSendSystemControlCommand(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleRegisterClientDeathObserverFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleRegisterClientDeathObserver(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleCastAudioFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleCastAudio(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleCastAudioForAllFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleCastAudioForAll(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleRemoteCastAudioFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleRemoteCastAudio(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleStartCastDiscoveryFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleStartCastDiscovery(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleStopCastDiscoveryFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleStopCastDiscovery(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleStartDeviceLoggingFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleStartDeviceLogging(data, reply); + return true; +} + +int32_t AvSessionServiceFuzzer::HandleGetDistributedSessionControllersInnerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + sptr avSessionService = new AVSessionService(GetData()); + if (avSessionService == nullptr) { + return false; + } + MessageParcel data; + MessageParcel reply; + avSessionService->HandleGetDistributedSessionControllersInner(data, reply); + return true; +} + + typedef void (*TestFuncs[2])(); TestFuncs g_testFuncs = { @@ -177,4 +508,28 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) } FuzzTest(data, size); return 0; + AVSessionServiceFuzzer.OnRemoteRequestFuzzTest(); + AVSessionServiceFuzzer.HandleCreateSessionInnerFuzzTest(); + AVSessionServiceFuzzer.HandleGetAllSessionDescriptorsFuzzTest(); + AVSessionServiceFuzzer.HandleGetSessionDescriptorsByIdFuzzTest(); + AVSessionServiceFuzzer.HandleGetHistoricalSessionDescriptorsFuzzTest(); + AVSessionServiceFuzzer.GetAVQueueInfosImgLengthFuzzTest(); + AVSessionServiceFuzzer.MarshallingAVQueueInfosFuzzTest(); + AVSessionServiceFuzzer.AVQueueInfoImgToBufferFuzzTest(); + AVSessionServiceFuzzer.HandleGetHistoricalAVQueueInfosFuzzTest(); + AVSessionServiceFuzzer.HandleRegisterAncoMediaSessionListenerFuzzTest(); + AVSessionServiceFuzzer.HandleCreateControllerInnerFuzzTest(); + AVSessionServiceFuzzer.HandleGetAVCastControllerInnerFuzzTest(); + AVSessionServiceFuzzer.HandleRegisterSessionListenerFuzzTest(); + AVSessionServiceFuzzer.HandleRegisterSessionListenerForAllUsersFuzzTest(); + AVSessionServiceFuzzer.HandleSendSystemAVKeyEventFuzzTest(); + AVSessionServiceFuzzer.HandleSendSystemControlCommandFuzzTest(); + AVSessionServiceFuzzer.HandleRegisterClientDeathObserverFuzzTest(); + AVSessionServiceFuzzer.HandleCastAudioFuzzTest(); + AVSessionServiceFuzzer.HandleCastAudioForAllFuzzTest(); + AVSessionServiceFuzzer.HandleRemoteCastAudioFuzzTest(); + AVSessionServiceFuzzer.HandleStartCastDiscoveryFuzzTest(); + AVSessionServiceFuzzer.HandleStopCastDiscoveryFuzzTest(); + AVSessionServiceFuzzer.HandleStartDeviceLoggingFuzzTest(); + AVSessionServiceFuzzer.HandleGetDistributedSessionControllersInnerFuzzTest(); } diff --git a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp.rej b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp.rej new file mode 100644 index 0000000000000000000000000000000000000000..2f986f176b1986bc6c7ff02ea1a8183866cc5b81 --- /dev/null +++ b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp.rej @@ -0,0 +1,386 @@ +diff a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp (rejected hunks) +@@ -16,7 +16,7 @@ + #include + #include + #include +- ++#include + #include "avsession_errors.h" + #include "avsession_log.h" + #include "avsession_service_stub.h" +@@ -40,7 +40,7 @@ static const uint8_t* RAW_DATA = nullptr; + const size_t THRESHOLD = 10; + static size_t g_dataSize = 0; + static size_t g_pos; +- ++AvSessionServiceFuzzer AVSessionServiceFuzzer; + /* + * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T) + * tips: only support basic type +@@ -140,6 +140,337 @@ void OHOS::AVSession::AvSessionServiceTests() + aVSessionService->FuzzTests(); + } + ++int32_t AvSessionServiceFuzzer::OnRemoteRequestFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ uint32_t code = provider.ConsumeIntegral(); ++ MessageParcel data; ++ MessageParcel reply; ++ MessageOption option; ++ avSessionService->OnRemoteRequest(code, data, reply, option); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCreateSessionInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCreateSessionInner(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetAllSessionDescriptorsFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetAllSessionDescriptors(data,reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetSessionDescriptorsByIdFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetSessionDescriptorsById(data,reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetHistoricalSessionDescriptorsFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetHistoricalSessionDescriptors(data,reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::GetAVQueueInfosImgLengthFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ std::vector avQueueInfos; ++ size_t num_elements =provider.ConsumeIntegral(); ++ for (size_t i = 0; i < num_elements; ++i) { ++ if (provider.remaining_bytes() < sizeof(int32_t)) { ++ break; ++ } ++ OHOS::AVSession::AVQueueInfo info; ++ avQueueInfos.push_back(std::move(info)); ++ } ++ avSessionService->GetAVQueueInfosImgLength(avQueueInfos); ++ return true; ++} ++ ++void AvSessionServiceFuzzer::MarshallingAVQueueInfosFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ CHECK_AND_RETURN(avSessionService != nullptr); ++ MessageParcel reply; ++ std::vector avQueueInfos; ++ size_t num_elements =provider.ConsumeIntegral(); ++ for (size_t i = 0; i < num_elements; ++i) { ++ if (provider.remaining_bytes() < sizeof(int32_t)) { ++ break; ++ } ++ OHOS::AVSession::AVQueueInfo info; ++ avQueueInfos.push_back(std::move(info)); ++ } ++ avSessionService->MarshallingAVQueueInfos(reply, avQueueInfos); ++} ++ ++void AvSessionServiceFuzzer::AVQueueInfoImgToBufferFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ CHECK_AND_RETURN(avSessionService != nullptr); ++ std::vector avQueueInfos; ++ size_t num_elements =provider.ConsumeIntegral(); ++ for (size_t i = 0; i < num_elements; ++i) { ++ if (provider.remaining_bytes() < sizeof(int32_t)) { ++ break; ++ } ++ OHOS::AVSession::AVQueueInfo info; ++ avQueueInfos.push_back(std::move(info)); ++ } ++ unsigned char buffer = provider.ConsumeIntegral(); ++ avSessionService->AVQueueInfoImgToBuffer(avQueueInfos, &buffer); ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetHistoricalAVQueueInfosFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetHistoricalAVQueueInfos(data, reply); ++ return true; ++} ++int32_t AvSessionServiceFuzzer::HandleRegisterAncoMediaSessionListenerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterAncoMediaSessionListener(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCreateControllerInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCreateControllerInner(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetAVCastControllerInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetAVCastControllerInner(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRegisterSessionListenerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterSessionListener(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRegisterSessionListenerForAllUsersFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterSessionListenerForAllUsers(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleSendSystemAVKeyEventFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleSendSystemAVKeyEvent(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleSendSystemControlCommandFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleSendSystemControlCommand(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRegisterClientDeathObserverFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterClientDeathObserver(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCastAudioFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCastAudio(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCastAudioForAllFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCastAudioForAll(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRemoteCastAudioFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRemoteCastAudio(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleStartCastDiscoveryFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleStartCastDiscovery(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleStopCastDiscoveryFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleStopCastDiscovery(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleStartDeviceLoggingFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleStartDeviceLogging(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetDistributedSessionControllersInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetDistributedSessionControllersInner(data, reply); ++ return true; ++} ++ ++ + typedef void (*TestFuncs[2])(); + + TestFuncs g_testFuncs = { +@@ -177,4 +508,28 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) + } + FuzzTest(data, size); + return 0; ++ AVSessionServiceFuzzer.OnRemoteRequestFuzzTest(); ++ AVSessionServiceFuzzer.HandleCreateSessionInnerFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetAllSessionDescriptorsFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetSessionDescriptorsByIdFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetHistoricalSessionDescriptorsFuzzTest(); ++ AVSessionServiceFuzzer.GetAVQueueInfosImgLengthFuzzTest(); ++ AVSessionServiceFuzzer.MarshallingAVQueueInfosFuzzTest(); ++ AVSessionServiceFuzzer.AVQueueInfoImgToBufferFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetHistoricalAVQueueInfosFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterAncoMediaSessionListenerFuzzTest(); ++ AVSessionServiceFuzzer.HandleCreateControllerInnerFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetAVCastControllerInnerFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterSessionListenerFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterSessionListenerForAllUsersFuzzTest(); ++ AVSessionServiceFuzzer.HandleSendSystemAVKeyEventFuzzTest(); ++ AVSessionServiceFuzzer.HandleSendSystemControlCommandFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterClientDeathObserverFuzzTest(); ++ AVSessionServiceFuzzer.HandleCastAudioFuzzTest(); ++ AVSessionServiceFuzzer.HandleCastAudioForAllFuzzTest(); ++ AVSessionServiceFuzzer.HandleRemoteCastAudioFuzzTest(); ++ AVSessionServiceFuzzer.HandleStartCastDiscoveryFuzzTest(); ++ AVSessionServiceFuzzer.HandleStopCastDiscoveryFuzzTest(); ++ AVSessionServiceFuzzer.HandleStartDeviceLoggingFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetDistributedSessionControllersInnerFuzzTest(); + } diff --git a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h index 5c28aa719381a42e8f409f9853f96e3c600eddf6..b0054b06a10efe50a3aa5695f34eb25cdf50fe71 100644 --- a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h +++ b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h @@ -27,6 +27,54 @@ public: ~AvSessionServiceFuzzer() = default; void FuzzOnRemoteRequest(); void FuzzTests(); + + int32_t OnRemoteRequestFuzzTest(); + + int32_t HandleCreateSessionInnerFuzzTest(); + + int32_t HandleGetAllSessionDescriptorsFuzzTest(); + + int32_t HandleGetSessionDescriptorsByIdFuzzTest(); + + int32_t HandleGetHistoricalSessionDescriptorsFuzzTest(); + + int32_t GetAVQueueInfosImgLengthFuzzTest(); + + void MarshallingAVQueueInfosFuzzTest(); + + void AVQueueInfoImgToBufferFuzzTest(); + + int32_t HandleGetHistoricalAVQueueInfosFuzzTest(); + + int32_t HandleRegisterAncoMediaSessionListenerFuzzTest(); + + int32_t HandleCreateControllerInnerFuzzTest(); + + int32_t HandleGetAVCastControllerInnerFuzzTest(); + + int32_t HandleRegisterSessionListenerFuzzTest(); + + int32_t HandleRegisterSessionListenerForAllUsersFuzzTest(); + + int32_t HandleSendSystemAVKeyEventFuzzTest(); + + int32_t HandleSendSystemControlCommandFuzzTest(); + + int32_t HandleRegisterClientDeathObserverFuzzTest(); + + int32_t HandleCastAudioFuzzTest(); + + int32_t HandleCastAudioForAllFuzzTest(); + + int32_t HandleRemoteCastAudioFuzzTest(); + + int32_t HandleStartCastDiscoveryFuzzTest(); + + int32_t HandleStopCastDiscoveryFuzzTest(); + + int32_t HandleStartDeviceLoggingFuzzTest(); + + int32_t HandleGetDistributedSessionControllersInnerFuzzTest(); }; } #endif \ No newline at end of file diff --git a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h.rej b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h.rej new file mode 100644 index 0000000000000000000000000000000000000000..78c4bc793e15eec6e08ec65402183ef09bcd7a68 --- /dev/null +++ b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h.rej @@ -0,0 +1,34 @@ +diff a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h (rejected hunks) +@@ -27,6 +27,31 @@ public: + ~AvSessionServiceFuzzer() = default; + void FuzzOnRemoteRequest(); + void FuzzTests(); ++ ++ int32_t OnRemoteRequestFuzzTest(); ++ int32_t HandleCreateSessionInnerFuzzTest(); ++ int32_t HandleGetAllSessionDescriptorsFuzzTest(); ++ int32_t HandleGetSessionDescriptorsByIdFuzzTest(); ++ int32_t HandleGetHistoricalSessionDescriptorsFuzzTest(); ++ int32_t GetAVQueueInfosImgLengthFuzzTest(); ++ void MarshallingAVQueueInfosFuzzTest(); ++ void AVQueueInfoImgToBufferFuzzTest(); ++ int32_t HandleGetHistoricalAVQueueInfosFuzzTest(); ++ int32_t HandleRegisterAncoMediaSessionListenerFuzzTest(); ++ int32_t HandleCreateControllerInnerFuzzTest(); ++ int32_t HandleGetAVCastControllerInnerFuzzTest(); ++ int32_t HandleRegisterSessionListenerFuzzTest(); ++ int32_t HandleRegisterSessionListenerForAllUsersFuzzTest(); ++ int32_t HandleSendSystemAVKeyEventFuzzTest(); ++ int32_t HandleSendSystemControlCommandFuzzTest(); ++ int32_t HandleRegisterClientDeathObserverFuzzTest(); ++ int32_t HandleCastAudioFuzzTest(); ++ int32_t HandleCastAudioForAllFuzzTest(); ++ int32_t HandleRemoteCastAudioFuzzTest(); ++ int32_t HandleStartCastDiscoveryFuzzTest(); ++ int32_t HandleStopCastDiscoveryFuzzTest(); ++ int32_t HandleStartDeviceLoggingFuzzTest(); ++ int32_t HandleGetDistributedSessionControllersInnerFuzzTest(); + }; + } + #endif +\ No newline at end of file diff --git a/fuzz0912 b/fuzz0912 new file mode 100644 index 0000000000000000000000000000000000000000..4f4dd4bfee84288661314ebeb6d3e71108082dad --- /dev/null +++ b/fuzz0912 @@ -0,0 +1,794 @@ +diff --git a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp +index dbaf3ff0..34e28bc7 100644 +--- a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp ++++ b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.cpp +@@ -16,7 +16,7 @@ + #include + #include + #include +- ++#include + #include "avsession_errors.h" + #include "avsession_log.h" + #include "avsession_service_stub.h" +@@ -40,7 +40,7 @@ static const uint8_t* RAW_DATA = nullptr; + const size_t THRESHOLD = 10; + static size_t g_dataSize = 0; + static size_t g_pos; +- ++AvSessionServiceFuzzer AVSessionServiceFuzzer; + /* + * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T) + * tips: only support basic type +@@ -140,6 +140,337 @@ void OHOS::AVSession::AvSessionServiceTests() + aVSessionService->FuzzTests(); + } + ++int32_t AvSessionServiceFuzzer::OnRemoteRequestFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ uint32_t code = provider.ConsumeIntegral(); ++ MessageParcel data; ++ MessageParcel reply; ++ MessageOption option; ++ avSessionService->OnRemoteRequest(code, data, reply, option); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCreateSessionInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCreateSessionInner(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetAllSessionDescriptorsFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetAllSessionDescriptors(data,reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetSessionDescriptorsByIdFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetSessionDescriptorsById(data,reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetHistoricalSessionDescriptorsFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetHistoricalSessionDescriptors(data,reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::GetAVQueueInfosImgLengthFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ std::vector avQueueInfos; ++ size_t num_elements =provider.ConsumeIntegral(); ++ for (size_t i = 0; i < num_elements; ++i) { ++ if (provider.remaining_bytes() < sizeof(int32_t)) { ++ break; ++ } ++ OHOS::AVSession::AVQueueInfo info; ++ avQueueInfos.push_back(std::move(info)); ++ } ++ avSessionService->GetAVQueueInfosImgLength(avQueueInfos); ++ return true; ++} ++ ++void AvSessionServiceFuzzer::MarshallingAVQueueInfosFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ CHECK_AND_RETURN(avSessionService != nullptr); ++ MessageParcel reply; ++ std::vector avQueueInfos; ++ size_t num_elements =provider.ConsumeIntegral(); ++ for (size_t i = 0; i < num_elements; ++i) { ++ if (provider.remaining_bytes() < sizeof(int32_t)) { ++ break; ++ } ++ OHOS::AVSession::AVQueueInfo info; ++ avQueueInfos.push_back(std::move(info)); ++ } ++ avSessionService->MarshallingAVQueueInfos(reply, avQueueInfos); ++} ++ ++void AvSessionServiceFuzzer::AVQueueInfoImgToBufferFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ CHECK_AND_RETURN(avSessionService != nullptr); ++ std::vector avQueueInfos; ++ size_t num_elements =provider.ConsumeIntegral(); ++ for (size_t i = 0; i < num_elements; ++i) { ++ if (provider.remaining_bytes() < sizeof(int32_t)) { ++ break; ++ } ++ OHOS::AVSession::AVQueueInfo info; ++ avQueueInfos.push_back(std::move(info)); ++ } ++ unsigned char buffer = provider.ConsumeIntegral(); ++ avSessionService->AVQueueInfoImgToBuffer(avQueueInfos, &buffer); ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetHistoricalAVQueueInfosFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetHistoricalAVQueueInfos(data, reply); ++ return true; ++} ++int32_t AvSessionServiceFuzzer::HandleRegisterAncoMediaSessionListenerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterAncoMediaSessionListener(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCreateControllerInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCreateControllerInner(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetAVCastControllerInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetAVCastControllerInner(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRegisterSessionListenerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterSessionListener(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRegisterSessionListenerForAllUsersFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterSessionListenerForAllUsers(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleSendSystemAVKeyEventFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleSendSystemAVKeyEvent(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleSendSystemControlCommandFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleSendSystemControlCommand(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRegisterClientDeathObserverFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRegisterClientDeathObserver(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCastAudioFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCastAudio(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleCastAudioForAllFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleCastAudioForAll(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleRemoteCastAudioFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleRemoteCastAudio(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleStartCastDiscoveryFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleStartCastDiscovery(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleStopCastDiscoveryFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleStopCastDiscovery(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleStartDeviceLoggingFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleStartDeviceLogging(data, reply); ++ return true; ++} ++ ++int32_t AvSessionServiceFuzzer::HandleGetDistributedSessionControllersInnerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ sptr avSessionService = new AVSessionService(GetData()); ++ if (avSessionService == nullptr) { ++ return false; ++ } ++ MessageParcel data; ++ MessageParcel reply; ++ avSessionService->HandleGetDistributedSessionControllersInner(data, reply); ++ return true; ++} ++ ++ + typedef void (*TestFuncs[2])(); + + TestFuncs g_testFuncs = { +@@ -177,4 +508,28 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) + } + FuzzTest(data, size); + return 0; ++ AVSessionServiceFuzzer.OnRemoteRequestFuzzTest(); ++ AVSessionServiceFuzzer.HandleCreateSessionInnerFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetAllSessionDescriptorsFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetSessionDescriptorsByIdFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetHistoricalSessionDescriptorsFuzzTest(); ++ AVSessionServiceFuzzer.GetAVQueueInfosImgLengthFuzzTest(); ++ AVSessionServiceFuzzer.MarshallingAVQueueInfosFuzzTest(); ++ AVSessionServiceFuzzer.AVQueueInfoImgToBufferFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetHistoricalAVQueueInfosFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterAncoMediaSessionListenerFuzzTest(); ++ AVSessionServiceFuzzer.HandleCreateControllerInnerFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetAVCastControllerInnerFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterSessionListenerFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterSessionListenerForAllUsersFuzzTest(); ++ AVSessionServiceFuzzer.HandleSendSystemAVKeyEventFuzzTest(); ++ AVSessionServiceFuzzer.HandleSendSystemControlCommandFuzzTest(); ++ AVSessionServiceFuzzer.HandleRegisterClientDeathObserverFuzzTest(); ++ AVSessionServiceFuzzer.HandleCastAudioFuzzTest(); ++ AVSessionServiceFuzzer.HandleCastAudioForAllFuzzTest(); ++ AVSessionServiceFuzzer.HandleRemoteCastAudioFuzzTest(); ++ AVSessionServiceFuzzer.HandleStartCastDiscoveryFuzzTest(); ++ AVSessionServiceFuzzer.HandleStopCastDiscoveryFuzzTest(); ++ AVSessionServiceFuzzer.HandleStartDeviceLoggingFuzzTest(); ++ AVSessionServiceFuzzer.HandleGetDistributedSessionControllersInnerFuzzTest(); + } +diff --git a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h +index 5c28aa71..51c18114 100644 +--- a/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h ++++ b/frameworks/native/session/test/fuzztest/avsessionservicestub_fuzzer/avsession_servicestub_fuzzer.h +@@ -27,6 +27,31 @@ public: + ~AvSessionServiceFuzzer() = default; + void FuzzOnRemoteRequest(); + void FuzzTests(); ++ ++ int32_t OnRemoteRequestFuzzTest(); ++ int32_t HandleCreateSessionInnerFuzzTest(); ++ int32_t HandleGetAllSessionDescriptorsFuzzTest(); ++ int32_t HandleGetSessionDescriptorsByIdFuzzTest(); ++ int32_t HandleGetHistoricalSessionDescriptorsFuzzTest(); ++ int32_t GetAVQueueInfosImgLengthFuzzTest(); ++ void MarshallingAVQueueInfosFuzzTest(); ++ void AVQueueInfoImgToBufferFuzzTest(); ++ int32_t HandleGetHistoricalAVQueueInfosFuzzTest(); ++ int32_t HandleRegisterAncoMediaSessionListenerFuzzTest(); ++ int32_t HandleCreateControllerInnerFuzzTest(); ++ int32_t HandleGetAVCastControllerInnerFuzzTest(); ++ int32_t HandleRegisterSessionListenerFuzzTest(); ++ int32_t HandleRegisterSessionListenerForAllUsersFuzzTest(); ++ int32_t HandleSendSystemAVKeyEventFuzzTest(); ++ int32_t HandleSendSystemControlCommandFuzzTest(); ++ int32_t HandleRegisterClientDeathObserverFuzzTest(); ++ int32_t HandleCastAudioFuzzTest(); ++ int32_t HandleCastAudioForAllFuzzTest(); ++ int32_t HandleRemoteCastAudioFuzzTest(); ++ int32_t HandleStartCastDiscoveryFuzzTest(); ++ int32_t HandleStopCastDiscoveryFuzzTest(); ++ int32_t HandleStartDeviceLoggingFuzzTest(); ++ int32_t HandleGetDistributedSessionControllersInnerFuzzTest(); + }; + } + #endif +\ No newline at end of file +diff --git a/services/session/server/test/fuzztest/BUILD.gn b/services/session/server/test/fuzztest/BUILD.gn +index 9bc3e739..506efe45 100644 +--- a/services/session/server/test/fuzztest/BUILD.gn ++++ b/services/session/server/test/fuzztest/BUILD.gn +@@ -36,6 +36,7 @@ group("fuzztest") { + "permissionchecker_fuzzer:PermissionCheckerFuzzTest", + "sessionlistenerproxy_fuzzer:SessionListenerProxyFuzzTest", + "softbussessionmanager_fuzzer:SoftbusSessionManagerFuzzTest", ++ "softbussessionproxy_fuzzer:SoftbusSessionProxyFuzzTest", + "avsessionserviceext_fuzzer:AVSessionServiceExtFuzzTest", + ] + } +\ No newline at end of file +diff --git a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp +index caaf0b31..006ab295 100644 +--- a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp ++++ b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp +@@ -25,6 +25,7 @@ static const int32_t MIN_SIZE_NUM = 4; + static const uint8_t *RAW_DATA = nullptr; + static size_t g_dataSize = 0; + static size_t g_pos; ++SoftbusSessionManagerFuzzer softbusSessionManagerFuzzer; + + template + T GetData() +@@ -52,7 +53,7 @@ public: + + void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size) + { +- FuzzedDataProvider proveider(RAW_DATA, g_dataSize); ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); + std::shared_ptr manager_ = std::make_shared(); + std::shared_ptr softbusSessionListenerDemo = + std::make_shared(); +@@ -105,19 +106,257 @@ void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, s + manager_->OnBind(socket, info); + + manager_->AddSessionListener(nullptr); +- std::string sendData = proveider.ConsumeRandomLengthString(); ++ std::string sendData = provider.ConsumeRandomLengthString(); + manager_->SendBytesForNext(socket, sendData); + } + +-void SoftbusSessionManagerOnRemoteRequest(uint8_t* data, size_t size) ++void OnBindFuzzTest() + { +- auto softbusSessionManager = std::make_unique(); ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ PeerSocketInfo peerSocketInfo; ++ softbusSessionManager->OnBind(socket, peerSocketInfo); ++} ++ ++void OnShutdownFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ ShutdownReason reason={}; ++ softbusSessionManager->OnShutdown(socket, reason); ++} ++ ++void OnBytesFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ uint32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnBytes(socket, &data, dataLen); ++} ++ ++void OnMessageFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ uint32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnMessage(socket, &data, dataLen); ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SocketFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ std::string pKgName = std::to_string(GetData()); ++ softbusSessionManager-> SoftbusSessionManager::Socket(pKgName); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::BindFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ std::string peerNetworkId = std::to_string(GetData()); ++ std::string pKgName = std::to_string(GetData()); ++ softbusSessionManager->Bind(peerNetworkId, pKgName); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendMessageFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendMessage(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendMessageFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendMessage(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendBytesFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendBytes(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendBytesForNextFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendBytesForNext(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendBytesForNextFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendBytesForNext(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::ObtainPeerDeviceIdFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { +- SLOGI("softbusSessionManager is null"); ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string deviceId = std::to_string(GetData()); ++ softbusSessionManager->ObtainPeerDeviceId(socket, deviceId); ++ return true; ++} ++ ++void SoftbusSessionManagerFuzzer::AddSessionListenerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ softbusSessionManager->AddSessionListener(nullptr); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBindFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ PeerSocketInfo info ={}; ++ softbusSessionManager->OnBind(socket, info); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBindFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ PeerSocketInfo peerSocketInfo; ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { ++ return; ++ } ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnBind(socket, peerSocketInfo); ++} ++ ++void SoftbusSessionManagerFuzzer::OnShutdownFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ ShutdownReason reason={}; ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { ++ return; ++ } ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnShutdown(socket, reason); ++} ++ ++void SoftbusSessionManagerFuzzer::OnMessageFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnMessage(socket, &data, dataLen); ++} ++ ++void SoftbusSessionManagerFuzzer::OnMessageFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { ++ return; ++ } ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnMessage(socket, &data, dataLen); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBytesFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnBytes(socket, &data, dataLen); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBytesFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { + return; + } +- softbusSessionManager->SoftbusSessionManagerFuzzTest(data, size); ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnBytes(socket, &data, dataLen); + } ++ + /* Fuzzer entry point */ + extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) + { +@@ -129,7 +368,25 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) + g_dataSize = size; + g_pos = 0; + /* Run your code on data */ +- SoftbusSessionManagerOnRemoteRequest(data, size); ++ // SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size); ++ // SoftbusSessionManagerOnRemoteRequest(data, size); ++ OnBindFuzzTest(); ++ OnShutdownFuzzTest(); ++ OnBytesFuzzTest(); ++ OnMessageFuzzTest(); ++ softbusSessionManagerFuzzer.SocketFuzzTest(); ++ softbusSessionManagerFuzzer.BindFuzzTest(); ++ softbusSessionManagerFuzzer.SendMessageFuzzTest(); ++ softbusSessionManagerFuzzer.SendMessageFuzzTest01(); ++ softbusSessionManagerFuzzer.SendBytesFuzzTest(); ++ softbusSessionManagerFuzzer.SendBytesForNextFuzzTest(); ++ softbusSessionManagerFuzzer.SendBytesForNextFuzzTest01(); ++ softbusSessionManagerFuzzer.ObtainPeerDeviceIdFuzzTest(); ++ softbusSessionManagerFuzzer.AddSessionListenerFuzzTest(); ++ softbusSessionManagerFuzzer.OnBindFuzzTest(); ++ softbusSessionManagerFuzzer.OnShutdownFuzzTest(); ++ softbusSessionManagerFuzzer.OnMessageFuzzTest(); ++ softbusSessionManagerFuzzer.OnBytesFuzzTest(); + return 0; + } + } +\ No newline at end of file +diff --git a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h +index 98cb14b0..f5ed4e07 100644 +--- a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h ++++ b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h +@@ -32,6 +32,38 @@ public: + SoftbusSessionManagerFuzzer() = default; + ~SoftbusSessionManagerFuzzer() = default; + void SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size); ++ ++ int32_t SocketFuzzTest(); ++ ++ int32_t BindFuzzTest(); ++ ++ int32_t SendMessageFuzzTest(); ++ ++ int32_t SendMessageFuzzTest01(); ++ ++ int32_t SendBytesFuzzTest(); ++ ++ int32_t SendBytesForNextFuzzTest(); ++ ++ int32_t SendBytesForNextFuzzTest01(); ++ ++ int32_t ObtainPeerDeviceIdFuzzTest(); ++ ++ void AddSessionListenerFuzzTest(); ++ ++ void OnBindFuzzTest(); ++ ++ void OnBindFuzzTest01(); ++ ++ void OnShutdownFuzzTest(); ++ ++ void OnMessageFuzzTest(); ++ ++ void OnMessageFuzzTest01(); ++ ++ void OnBytesFuzzTest(); ++ ++ void OnBytesFuzzTest01(); + }; + } + #endif diff --git a/services/session/server/test/fuzztest/BUILD.gn b/services/session/server/test/fuzztest/BUILD.gn index 9bc3e73993fc3a8d95e3073e2c8465c0eacb5a35..506efe456bbcfc787f2c73686d40392fd091415f 100644 --- a/services/session/server/test/fuzztest/BUILD.gn +++ b/services/session/server/test/fuzztest/BUILD.gn @@ -36,6 +36,7 @@ group("fuzztest") { "permissionchecker_fuzzer:PermissionCheckerFuzzTest", "sessionlistenerproxy_fuzzer:SessionListenerProxyFuzzTest", "softbussessionmanager_fuzzer:SoftbusSessionManagerFuzzTest", + "softbussessionproxy_fuzzer:SoftbusSessionProxyFuzzTest", "avsessionserviceext_fuzzer:AVSessionServiceExtFuzzTest", ] } \ No newline at end of file diff --git a/services/session/server/test/fuzztest/BUILD.gn.oS1NIs1 b/services/session/server/test/fuzztest/BUILD.gn.oS1NIs1 new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/services/session/server/test/fuzztest/BUILD.gn.rej b/services/session/server/test/fuzztest/BUILD.gn.rej new file mode 100644 index 0000000000000000000000000000000000000000..b7a2148e70edbaa0b1cb8504da9f33f9b55f1210 --- /dev/null +++ b/services/session/server/test/fuzztest/BUILD.gn.rej @@ -0,0 +1,10 @@ +diff a/services/session/server/test/fuzztest/BUILD.gn b/services/session/server/test/fuzztest/BUILD.gn (rejected hunks) +@@ -36,6 +36,7 @@ group("fuzztest") { + "permissionchecker_fuzzer:PermissionCheckerFuzzTest", + "sessionlistenerproxy_fuzzer:SessionListenerProxyFuzzTest", + "softbussessionmanager_fuzzer:SoftbusSessionManagerFuzzTest", ++ "softbussessionproxy_fuzzer:SoftbusSessionProxyFuzzTest", + "avsessionserviceext_fuzzer:AVSessionServiceExtFuzzTest", + ] + } +\ No newline at end of file diff --git a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp index caaf0b31df3ee5822808df2b10bd4c64f31f355a..1a95345cff80345b150643e11559f2d5dcc5617d 100644 --- a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp +++ b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp @@ -25,6 +25,7 @@ static const int32_t MIN_SIZE_NUM = 4; static const uint8_t *RAW_DATA = nullptr; static size_t g_dataSize = 0; static size_t g_pos; +SoftbusSessionManagerFuzzer softbusSessionManagerFuzzer; template T GetData() @@ -52,7 +53,7 @@ public: void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size) { - FuzzedDataProvider proveider(RAW_DATA, g_dataSize); + FuzzedDataProvider provider(RAW_DATA, g_dataSize); std::shared_ptr manager_ = std::make_shared(); std::shared_ptr softbusSessionListenerDemo = std::make_shared(); @@ -105,19 +106,264 @@ void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, s manager_->OnBind(socket, info); manager_->AddSessionListener(nullptr); - std::string sendData = proveider.ConsumeRandomLengthString(); + std::string sendData = provider.ConsumeRandomLengthString(); manager_->SendBytesForNext(socket, sendData); } -void SoftbusSessionManagerOnRemoteRequest(uint8_t* data, size_t size) +// void SoftbusSessionManagerOnRemoteRequest(uint8_t* data, size_t size) +// { +// auto softbusSessionManager = std::make_unique(); +// CHECK_AND_RETURN(softbusSessionManager != nullptr); +// softbusSessionManager->OnRemoteRequest(); +// } + +void OnBindFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + PeerSocketInfo peerSocketInfo; + softbusSessionManager->OnBind(socket, peerSocketInfo); +} + +void OnShutdownFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + ShutdownReason reason={}; + softbusSessionManager->OnShutdown(socket, reason); +} + +void OnBytesFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + int32_t data = provider.ConsumeIntegral(); + uint32_t dataLen = provider.ConsumeIntegral(); + softbusSessionManager->OnBytes(socket, &data, dataLen); +} + +void OnMessageFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + int32_t data = provider.ConsumeIntegral(); + uint32_t dataLen = provider.ConsumeIntegral(); + softbusSessionManager->OnMessage(socket, &data, dataLen); +} + +int32_t SoftbusSessionManagerFuzzer::SocketFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + std::string pKgName = ""; + softbusSessionManager-> SoftbusSessionManager::Socket(pKgName); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::BindFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + std::string peerNetworkId = "test"; + std::string pKgName = ""; + softbusSessionManager->Bind(peerNetworkId, pKgName); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::SendMessageFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + int32_t socket = provider.ConsumeIntegral(); + std::string data = "test"; + softbusSessionManager->SendMessage(socket, data); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::SendMessageFuzzTest01() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + int32_t socket = 1.0; + std::string data = "test"; + softbusSessionManager->SendMessage(socket, data); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::SendBytesFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + int32_t socket = provider.ConsumeIntegral(); + std::string data = "test"; + softbusSessionManager->SendBytes(socket, data); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::SendBytesForNextFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + int32_t socket = provider.ConsumeIntegral(); + std::string data = "test"; + softbusSessionManager->SendBytesForNext(socket, data); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::SendBytesForNextFuzzTest01() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { + return false; + } + int32_t socket = provider.ConsumeIntegral(); + std::string data = "test"; + softbusSessionManager->SendBytesForNext(socket, data); + return true; +} + +int32_t SoftbusSessionManagerFuzzer::ObtainPeerDeviceIdFuzzTest() { - auto softbusSessionManager = std::make_unique(); + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); if (softbusSessionManager == nullptr) { - SLOGI("softbusSessionManager is null"); + return false; + } + int32_t socket = provider.ConsumeIntegral(); + std::string deviceId = "test"; + softbusSessionManager->ObtainPeerDeviceId(socket, deviceId); + return true; +} + +void SoftbusSessionManagerFuzzer::AddSessionListenerFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + softbusSessionManager->AddSessionListener(nullptr); +} + +void SoftbusSessionManagerFuzzer::OnBindFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + PeerSocketInfo info ={}; + softbusSessionManager->OnBind(socket, info); +} + +void SoftbusSessionManagerFuzzer::OnBindFuzzTest01() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + PeerSocketInfo peerSocketInfo; + auto softbusSessionListener = std::make_shared(); + if (softbusSessionListener == nullptr) { + return; + } + softbusSessionManager->AddSessionListener(softbusSessionListener); + softbusSessionManager->OnBind(socket, peerSocketInfo); +} + +void SoftbusSessionManagerFuzzer::OnShutdownFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + ShutdownReason reason={}; + auto softbusSessionListener = std::make_shared(); + if (softbusSessionListener == nullptr) { + return; + } + softbusSessionManager->AddSessionListener(softbusSessionListener); + softbusSessionManager->OnShutdown(socket, reason); +} + +void SoftbusSessionManagerFuzzer::OnMessageFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + int32_t data = 0; + int32_t dataLen = provider.ConsumeIntegral(); + softbusSessionManager->OnMessage(socket, &data, dataLen); +} + +void SoftbusSessionManagerFuzzer::OnMessageFuzzTest01() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + int32_t data = provider.ConsumeIntegral(); + int32_t dataLen = provider.ConsumeIntegral(); + auto softbusSessionListener = std::make_shared(); + if (softbusSessionListener == nullptr) { + return; + } + softbusSessionManager->AddSessionListener(softbusSessionListener); + softbusSessionManager->OnMessage(socket, &data, dataLen); +} + +void SoftbusSessionManagerFuzzer::OnBytesFuzzTest() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + int32_t data = 0; + int32_t dataLen = provider.ConsumeIntegral(); + softbusSessionManager->OnBytes(socket, &data, dataLen); +} + +void SoftbusSessionManagerFuzzer::OnBytesFuzzTest01() +{ + FuzzedDataProvider provider(RAW_DATA, g_dataSize); + auto softbusSessionManager = std::make_unique(); + CHECK_AND_RETURN(softbusSessionManager != nullptr); + int32_t socket = provider.ConsumeIntegral(); + int32_t data = provider.ConsumeIntegral(); + int32_t dataLen = provider.ConsumeIntegral(); + auto softbusSessionListener = std::make_shared(); + if (softbusSessionListener == nullptr) { return; } - softbusSessionManager->SoftbusSessionManagerFuzzTest(data, size); + softbusSessionManager->AddSessionListener(softbusSessionListener); + softbusSessionManager->OnBytes(socket, &data, dataLen); } + /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) { @@ -129,7 +375,25 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) g_dataSize = size; g_pos = 0; /* Run your code on data */ - SoftbusSessionManagerOnRemoteRequest(data, size); + // SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size); + // SoftbusSessionManagerOnRemoteRequest(data, size); + OnBindFuzzTest(); + OnShutdownFuzzTest(); + OnBytesFuzzTest(); + OnMessageFuzzTest(); + softbusSessionManagerFuzzer.SocketFuzzTest(); + softbusSessionManagerFuzzer.BindFuzzTest(); + softbusSessionManagerFuzzer.SendMessageFuzzTest(); + softbusSessionManagerFuzzer.SendMessageFuzzTest01(); + softbusSessionManagerFuzzer.SendBytesFuzzTest(); + softbusSessionManagerFuzzer.SendBytesForNextFuzzTest(); + softbusSessionManagerFuzzer.SendBytesForNextFuzzTest01(); + softbusSessionManagerFuzzer.ObtainPeerDeviceIdFuzzTest(); + softbusSessionManagerFuzzer.AddSessionListenerFuzzTest(); + softbusSessionManagerFuzzer.OnBindFuzzTest(); + softbusSessionManagerFuzzer.OnShutdownFuzzTest(); + softbusSessionManagerFuzzer.OnMessageFuzzTest(); + softbusSessionManagerFuzzer.OnBytesFuzzTest(); return 0; } } \ No newline at end of file diff --git a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp.rej b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp.rej new file mode 100644 index 0000000000000000000000000000000000000000..ae1e5ec970baf1ea9684b71ee0bbced56775810a --- /dev/null +++ b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp.rej @@ -0,0 +1,309 @@ +diff a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.cpp (rejected hunks) +@@ -25,6 +25,7 @@ static const int32_t MIN_SIZE_NUM = 4; + static const uint8_t *RAW_DATA = nullptr; + static size_t g_dataSize = 0; + static size_t g_pos; ++SoftbusSessionManagerFuzzer softbusSessionManagerFuzzer; + + template + T GetData() +@@ -52,7 +53,7 @@ public: + + void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size) + { +- FuzzedDataProvider proveider(RAW_DATA, g_dataSize); ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); + std::shared_ptr manager_ = std::make_shared(); + std::shared_ptr softbusSessionListenerDemo = + std::make_shared(); +@@ -105,19 +106,257 @@ void SoftbusSessionManagerFuzzer::SoftbusSessionManagerFuzzTest(uint8_t* data, s + manager_->OnBind(socket, info); + + manager_->AddSessionListener(nullptr); +- std::string sendData = proveider.ConsumeRandomLengthString(); ++ std::string sendData = provider.ConsumeRandomLengthString(); + manager_->SendBytesForNext(socket, sendData); + } + +-void SoftbusSessionManagerOnRemoteRequest(uint8_t* data, size_t size) ++void OnBindFuzzTest() + { +- auto softbusSessionManager = std::make_unique(); ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ PeerSocketInfo peerSocketInfo; ++ softbusSessionManager->OnBind(socket, peerSocketInfo); ++} ++ ++void OnShutdownFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ ShutdownReason reason={}; ++ softbusSessionManager->OnShutdown(socket, reason); ++} ++ ++void OnBytesFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ uint32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnBytes(socket, &data, dataLen); ++} ++ ++void OnMessageFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ uint32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnMessage(socket, &data, dataLen); ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SocketFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ std::string pKgName = std::to_string(GetData()); ++ softbusSessionManager-> SoftbusSessionManager::Socket(pKgName); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::BindFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ std::string peerNetworkId = std::to_string(GetData()); ++ std::string pKgName = std::to_string(GetData()); ++ softbusSessionManager->Bind(peerNetworkId, pKgName); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendMessageFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendMessage(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendMessageFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendMessage(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendBytesFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendBytes(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendBytesForNextFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendBytesForNext(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::SendBytesForNextFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ if (softbusSessionManager == nullptr) { ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string data = std::to_string(GetData()); ++ softbusSessionManager->SendBytesForNext(socket, data); ++ return true; ++} ++ ++int32_t SoftbusSessionManagerFuzzer::ObtainPeerDeviceIdFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); + if (softbusSessionManager == nullptr) { +- SLOGI("softbusSessionManager is null"); ++ return false; ++ } ++ int32_t socket = provider.ConsumeIntegral(); ++ std::string deviceId = std::to_string(GetData()); ++ softbusSessionManager->ObtainPeerDeviceId(socket, deviceId); ++ return true; ++} ++ ++void SoftbusSessionManagerFuzzer::AddSessionListenerFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ softbusSessionManager->AddSessionListener(nullptr); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBindFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ PeerSocketInfo info ={}; ++ softbusSessionManager->OnBind(socket, info); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBindFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ PeerSocketInfo peerSocketInfo; ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { ++ return; ++ } ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnBind(socket, peerSocketInfo); ++} ++ ++void SoftbusSessionManagerFuzzer::OnShutdownFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ ShutdownReason reason={}; ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { ++ return; ++ } ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnShutdown(socket, reason); ++} ++ ++void SoftbusSessionManagerFuzzer::OnMessageFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnMessage(socket, &data, dataLen); ++} ++ ++void SoftbusSessionManagerFuzzer::OnMessageFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { ++ return; ++ } ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnMessage(socket, &data, dataLen); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBytesFuzzTest() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ softbusSessionManager->OnBytes(socket, &data, dataLen); ++} ++ ++void SoftbusSessionManagerFuzzer::OnBytesFuzzTest01() ++{ ++ FuzzedDataProvider provider(RAW_DATA, g_dataSize); ++ auto softbusSessionManager = std::make_unique(); ++ CHECK_AND_RETURN(softbusSessionManager != nullptr); ++ int32_t socket = provider.ConsumeIntegral(); ++ int32_t data = provider.ConsumeIntegral(); ++ int32_t dataLen = provider.ConsumeIntegral(); ++ auto softbusSessionListener = std::make_shared(); ++ if (softbusSessionListener == nullptr) { + return; + } +- softbusSessionManager->SoftbusSessionManagerFuzzTest(data, size); ++ softbusSessionManager->AddSessionListener(softbusSessionListener); ++ softbusSessionManager->OnBytes(socket, &data, dataLen); + } ++ + /* Fuzzer entry point */ + extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) + { +@@ -129,7 +368,25 @@ extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size) + g_dataSize = size; + g_pos = 0; + /* Run your code on data */ +- SoftbusSessionManagerOnRemoteRequest(data, size); ++ // SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size); ++ // SoftbusSessionManagerOnRemoteRequest(data, size); ++ OnBindFuzzTest(); ++ OnShutdownFuzzTest(); ++ OnBytesFuzzTest(); ++ OnMessageFuzzTest(); ++ softbusSessionManagerFuzzer.SocketFuzzTest(); ++ softbusSessionManagerFuzzer.BindFuzzTest(); ++ softbusSessionManagerFuzzer.SendMessageFuzzTest(); ++ softbusSessionManagerFuzzer.SendMessageFuzzTest01(); ++ softbusSessionManagerFuzzer.SendBytesFuzzTest(); ++ softbusSessionManagerFuzzer.SendBytesForNextFuzzTest(); ++ softbusSessionManagerFuzzer.SendBytesForNextFuzzTest01(); ++ softbusSessionManagerFuzzer.ObtainPeerDeviceIdFuzzTest(); ++ softbusSessionManagerFuzzer.AddSessionListenerFuzzTest(); ++ softbusSessionManagerFuzzer.OnBindFuzzTest(); ++ softbusSessionManagerFuzzer.OnShutdownFuzzTest(); ++ softbusSessionManagerFuzzer.OnMessageFuzzTest(); ++ softbusSessionManagerFuzzer.OnBytesFuzzTest(); + return 0; + } + } +\ No newline at end of file diff --git a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h index 98cb14b036b143649356665ffe66738d2bee45ea..f5ed4e070d7ca4a719fa1722105147021e477ed5 100644 --- a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h +++ b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h @@ -32,6 +32,38 @@ public: SoftbusSessionManagerFuzzer() = default; ~SoftbusSessionManagerFuzzer() = default; void SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size); + + int32_t SocketFuzzTest(); + + int32_t BindFuzzTest(); + + int32_t SendMessageFuzzTest(); + + int32_t SendMessageFuzzTest01(); + + int32_t SendBytesFuzzTest(); + + int32_t SendBytesForNextFuzzTest(); + + int32_t SendBytesForNextFuzzTest01(); + + int32_t ObtainPeerDeviceIdFuzzTest(); + + void AddSessionListenerFuzzTest(); + + void OnBindFuzzTest(); + + void OnBindFuzzTest01(); + + void OnShutdownFuzzTest(); + + void OnMessageFuzzTest(); + + void OnMessageFuzzTest01(); + + void OnBytesFuzzTest(); + + void OnBytesFuzzTest01(); }; } #endif diff --git a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h.rej b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h.rej new file mode 100644 index 0000000000000000000000000000000000000000..faa6c975d6036ef302e114f2af4200b6ac979834 --- /dev/null +++ b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h.rej @@ -0,0 +1,40 @@ +diff a/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h b/services/session/server/test/fuzztest/softbussessionmanager_fuzzer/softbussessionmanager_fuzzer.h (rejected hunks) +@@ -32,6 +32,38 @@ public: + SoftbusSessionManagerFuzzer() = default; + ~SoftbusSessionManagerFuzzer() = default; + void SoftbusSessionManagerFuzzTest(uint8_t* data, size_t size); ++ ++ int32_t SocketFuzzTest(); ++ ++ int32_t BindFuzzTest(); ++ ++ int32_t SendMessageFuzzTest(); ++ ++ int32_t SendMessageFuzzTest01(); ++ ++ int32_t SendBytesFuzzTest(); ++ ++ int32_t SendBytesForNextFuzzTest(); ++ ++ int32_t SendBytesForNextFuzzTest01(); ++ ++ int32_t ObtainPeerDeviceIdFuzzTest(); ++ ++ void AddSessionListenerFuzzTest(); ++ ++ void OnBindFuzzTest(); ++ ++ void OnBindFuzzTest01(); ++ ++ void OnShutdownFuzzTest(); ++ ++ void OnMessageFuzzTest(); ++ ++ void OnMessageFuzzTest01(); ++ ++ void OnBytesFuzzTest(); ++ ++ void OnBytesFuzzTest01(); + }; + } + #endif