openharmony/security_device_auth
1
0
Fork 0
mirror of https://github.com/openharmony/security_device_auth.git synced 2026-08-25 09:19:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

!549 fix fuzz crash

Browse Source 
Merge pull request !549 from mmc/master
This commit is contained in:
openharmony_ci
2023-11-23 09:22:40 +00:00
committed by Gitee
parent 45b0efe251 30f952af7b
commit ff69130cd5
6 changed files with 59 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp
+7 -12
View File
@@ -73,19 +73,18 @@ bool AuthenticatePeerFuzz(const uint8_t* data, size_t size)
hc_handle handle = get_instance(&identity, HC_CENTRE, &callback);
hc_auth_id selfId;
hc_auth_id peerId;
if (memset_s(&selfId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) {
return false;
}
selfId.length = strnlen(reinterpret_cast<const char *>(data), HC_AUTH_ID_BUFF_LEN);
if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) {
return false;
}
hc_auth_id peerId;
if (memset_s(&peerId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) {
return false;
}
peerId.length = strnlen(reinterpret_cast<const char *>(data), HC_AUTH_ID_BUFF_LEN);
selfId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size;
if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) {
return false;
}
peerId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size;
if (memcpy_s(peerId.auth_id, HC_AUTH_ID_BUFF_LEN, data, peerId.length) != EOK) {
return false;
}
@@ -97,11 +96,7 @@ bool AuthenticatePeerFuzz(const uint8_t* data, size_t size)
}
params.self_auth_id = selfId;
params.peer_auth_id = peerId;
std::string str(reinterpret_cast<const char *>(data), 9);
for (int i = 0; i < str.length(); i++) {
str[i] = str[i] % str.length() + '0';
}
params.key_length = stoi(str);
params.key_length = *reinterpret_cast<const int *>(data);
authenticate_peer(handle, &params);
destroy(&handle);
return true;
frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp
+12 -3
View File
@@ -16,6 +16,8 @@
#include "dellocalauthinfo_fuzzer.h"
#include "hichain.h"
#include "distribution.h"
#include "securec.h"
namespace OHOS {
static void TransmitCb(const struct session_identity *identity, const void *data, uint32_t length)
@@ -61,11 +63,18 @@ namespace OHOS {
bool DelLocalaAuthInfoFuzz(const uint8_t *data, size_t size)
{
if ((data == nullptr) || (size < sizeof(int32_t))) {
if ((data == nullptr) || (size < sizeof(uint8_t))) {
return false;
}
hc_handle handle = get_instance(&identity, HC_CENTRE, &callback);
hc_auth_id authId = {sizeof({*data;}), {*data}};
hc_auth_id authId;
if (memset_s(&authId, sizeof(authId), 0, sizeof(authId)) != EOK) {
return false;
}
authId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size;
if (memcpy_s(authId.auth_id, HC_AUTH_ID_BUFF_LEN, data, authId.length) != EOK) {
return false;
}
hc_user_info userInfo = {authId, 1};
delete_local_auth_info(handle, &userInfo);
destroy(&handle);
@@ -73,7 +82,7 @@ namespace OHOS {
}
}
/* Fuzzer entry point*/
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
OHOS::DelLocalaAuthInfoFuzz(data, size);
frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp
+4 -8
View File
@@ -67,19 +67,15 @@ namespace OHOS {
return false;
}
hc_handle handle = get_instance(&identity, HC_CENTRE, &callback);
struct hichain *hichain = (struct hichain *)handle;
std::string str(reinterpret_cast<const char *>(data), 9);
for (int i = 0; i < str.length(); i++) {
str[i] = str[i] % str.length() + '0';
}
hichain->operation_code = stoi(str);
hc_handle server = (void *)hichain;
struct hichain *hichain = static_cast<struct hichain *>(handle);
hichain->operation_code = *reinterpret_cast<const int32_t *>(data);
hc_handle server = static_cast<void *>(hichain);
destroy(&server);
return true;
}
}
/* Fuzzer entry point*/
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
OHOS::DestroyFuzz(data, size);
frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp
+5 -8
View File
@@ -58,17 +58,14 @@ namespace OHOS {
bool GetInstanceFuzz(const uint8_t *data, size_t size)
{
int ret;
std::string str(reinterpret_cast<const char *>(data), 9);
for (int i = 0; i < str.length(); i++) {
str[i] = str[i] % str.length() + '0';
if ((data == nullptr) || (size < sizeof(int32_t))) {
return false;
}
int32_t sessionId = stoi(str);
int32_t sessionId = *reinterpret_cast<const int *>(data);
hc_package_name package_name = {sizeof("hicar"), "hicar"};
hc_service_type service_type = {sizeof("CarDevice"), "CarDevice"};
struct session_identity identity;
ret = memset_s(&identity, sizeof(identity), 0, sizeof(identity));
if (ret != EOK) {
if (memset_s(&identity, sizeof(identity), 0, sizeof(identity)) != EOK) {
return false;
}
identity.session_id = sessionId;
@@ -81,7 +78,7 @@ namespace OHOS {
}
}
/* Fuzzer entry point*/
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
OHOS::GetInstanceFuzz(data, size);
frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp
+23 -8
View File
@@ -64,22 +64,37 @@ namespace OHOS {
bool ListTrustPeerFuzz(const uint8_t *data, size_t size)
{
int ret;
hc_handle handle = get_instance(&identity, HC_CENTRE, &callback);
struct hc_auth_id *peerAuthidList = (struct hc_auth_id *)malloc(MAX_LIST_NUM * sizeof(struct hc_auth_id));
ret = memset_s(peerAuthidList, MAX_LIST_NUM * sizeof(struct hc_auth_id),
0, MAX_LIST_NUM * sizeof(struct hc_auth_id));
if (ret != EOK) {
if ((data == nullptr) || (size < sizeof(uint8_t))) {
return false;
}
hc_handle handle = get_instance(&identity, HC_CENTRE, &callback);
struct hc_auth_id *peerAuthidList = new hc_auth_id[MAX_LIST_NUM];
if (peerAuthidList == nullptr) {
return false;
}
if (memset_s(peerAuthidList, MAX_LIST_NUM * sizeof(struct hc_auth_id),
0, MAX_LIST_NUM * sizeof(struct hc_auth_id)) != EOK) {
delete[] peerAuthidList;
peerAuthidList = nullptr;
return false;
}
hc_auth_id authId;
if (memset_s(&authId, sizeof(authId), 0, sizeof(authId)) != EOK) {
return false;
}
authId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size;
if (memcpy_s(authId.auth_id, HC_AUTH_ID_BUFF_LEN, data, authId.length) != EOK) {
return false;
}
struct hc_auth_id authId = {sizeof({*data;}), {*data}};
list_trust_peers(handle, 0, &authId, &peerAuthidList);
destroy(&handle);
delete[] peerAuthidList;
peerAuthidList = nullptr;
return true;
}
}
/* Fuzzer entry point*/
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
OHOS::ListTrustPeerFuzz(data, size);
frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp
+8 -13
View File
@@ -69,19 +69,18 @@ namespace OHOS {
}
hc_handle handle = get_instance(&identity, HC_CENTRE, &callback);
hc_auth_id selfId;
hc_auth_id peerId;
if (memset_s(&selfId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) {
return false;
}
selfId.length = strnlen(reinterpret_cast<const char *>(data), HC_AUTH_ID_BUFF_LEN);
if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) {
return false;
}
hc_auth_id peerId;
if (memset_s(&peerId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) {
return false;
}
peerId.length = strnlen(reinterpret_cast<const char *>(data), HC_AUTH_ID_BUFF_LEN);
selfId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size;
if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) {
return false;
}
peerId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size;
if (memcpy_s(peerId.auth_id, HC_AUTH_ID_BUFF_LEN, data, peerId.length) != EOK) {
return false;
}
@@ -92,18 +91,14 @@ namespace OHOS {
}
params.self_auth_id = selfId;
params.peer_auth_id = peerId;
std::string str(reinterpret_cast<const char *>(data), 9);
for (int i = 0; i < str.length(); i++) {
str[i] = str[i] % str.length() + '0';
}
params.key_length = stoi(str);
params.key_length = *reinterpret_cast<const uint32_t *>(data);
start_pake(handle, &params);
destroy(&handle);
return true;
}
}
/* Fuzzer entry point*/
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
OHOS::StartPakeFuzz(data, size);