diff --git a/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp index 39c87c46..a5b692a1 100644 --- a/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp @@ -73,19 +73,18 @@ bool AuthenticatePeerFuzz(const uint8_t* data, size_t size) hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); hc_auth_id selfId; + hc_auth_id peerId; if (memset_s(&selfId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - selfId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); - if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { - return false; - } - - hc_auth_id peerId; if (memset_s(&peerId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - peerId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); + selfId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { + return false; + } + peerId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; if (memcpy_s(peerId.auth_id, HC_AUTH_ID_BUFF_LEN, data, peerId.length) != EOK) { return false; } @@ -97,11 +96,7 @@ bool AuthenticatePeerFuzz(const uint8_t* data, size_t size) } params.self_auth_id = selfId; params.peer_auth_id = peerId; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; - } - params.key_length = stoi(str); + params.key_length = *reinterpret_cast(data); authenticate_peer(handle, ¶ms); destroy(&handle); return true; diff --git a/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp index 27e59510..efc87555 100644 --- a/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp @@ -16,6 +16,8 @@ #include "dellocalauthinfo_fuzzer.h" #include "hichain.h" +#include "distribution.h" +#include "securec.h" namespace OHOS { static void TransmitCb(const struct session_identity *identity, const void *data, uint32_t length) @@ -61,11 +63,18 @@ namespace OHOS { bool DelLocalaAuthInfoFuzz(const uint8_t *data, size_t size) { - if ((data == nullptr) || (size < sizeof(int32_t))) { + if ((data == nullptr) || (size < sizeof(uint8_t))) { return false; } hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); - hc_auth_id authId = {sizeof({*data;}), {*data}}; + hc_auth_id authId; + if (memset_s(&authId, sizeof(authId), 0, sizeof(authId)) != EOK) { + return false; + } + authId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(authId.auth_id, HC_AUTH_ID_BUFF_LEN, data, authId.length) != EOK) { + return false; + } hc_user_info userInfo = {authId, 1}; delete_local_auth_info(handle, &userInfo); destroy(&handle); @@ -73,7 +82,7 @@ namespace OHOS { } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::DelLocalaAuthInfoFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp index cf3ecd15..e00915a2 100644 --- a/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp @@ -67,19 +67,15 @@ namespace OHOS { return false; } hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); - struct hichain *hichain = (struct hichain *)handle; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; - } - hichain->operation_code = stoi(str); - hc_handle server = (void *)hichain; + struct hichain *hichain = static_cast(handle); + hichain->operation_code = *reinterpret_cast(data); + hc_handle server = static_cast(hichain); destroy(&server); return true; } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::DestroyFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp index e733858c..54f94fc3 100644 --- a/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp @@ -58,17 +58,14 @@ namespace OHOS { bool GetInstanceFuzz(const uint8_t *data, size_t size) { - int ret; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; + if ((data == nullptr) || (size < sizeof(int32_t))) { + return false; } - int32_t sessionId = stoi(str); + int32_t sessionId = *reinterpret_cast(data); hc_package_name package_name = {sizeof("hicar"), "hicar"}; hc_service_type service_type = {sizeof("CarDevice"), "CarDevice"}; struct session_identity identity; - ret = memset_s(&identity, sizeof(identity), 0, sizeof(identity)); - if (ret != EOK) { + if (memset_s(&identity, sizeof(identity), 0, sizeof(identity)) != EOK) { return false; } identity.session_id = sessionId; @@ -81,7 +78,7 @@ namespace OHOS { } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::GetInstanceFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp index 0e6aa880..5eaa9127 100644 --- a/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp @@ -64,22 +64,37 @@ namespace OHOS { bool ListTrustPeerFuzz(const uint8_t *data, size_t size) { - int ret; - hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); - struct hc_auth_id *peerAuthidList = (struct hc_auth_id *)malloc(MAX_LIST_NUM * sizeof(struct hc_auth_id)); - ret = memset_s(peerAuthidList, MAX_LIST_NUM * sizeof(struct hc_auth_id), - 0, MAX_LIST_NUM * sizeof(struct hc_auth_id)); - if (ret != EOK) { + if ((data == nullptr) || (size < sizeof(uint8_t))) { + return false; + } + hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); + struct hc_auth_id *peerAuthidList = new hc_auth_id[MAX_LIST_NUM]; + if (peerAuthidList == nullptr) { + return false; + } + if (memset_s(peerAuthidList, MAX_LIST_NUM * sizeof(struct hc_auth_id), + 0, MAX_LIST_NUM * sizeof(struct hc_auth_id)) != EOK) { + delete[] peerAuthidList; + peerAuthidList = nullptr; + return false; + } + hc_auth_id authId; + if (memset_s(&authId, sizeof(authId), 0, sizeof(authId)) != EOK) { + return false; + } + authId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(authId.auth_id, HC_AUTH_ID_BUFF_LEN, data, authId.length) != EOK) { return false; } - struct hc_auth_id authId = {sizeof({*data;}), {*data}}; list_trust_peers(handle, 0, &authId, &peerAuthidList); destroy(&handle); + delete[] peerAuthidList; + peerAuthidList = nullptr; return true; } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::ListTrustPeerFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp index 19fb60f2..2a05d85c 100644 --- a/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp @@ -69,19 +69,18 @@ namespace OHOS { } hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); hc_auth_id selfId; + hc_auth_id peerId; if (memset_s(&selfId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - selfId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); - if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { - return false; - } - - hc_auth_id peerId; if (memset_s(&peerId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - peerId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); + selfId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { + return false; + } + peerId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; if (memcpy_s(peerId.auth_id, HC_AUTH_ID_BUFF_LEN, data, peerId.length) != EOK) { return false; } @@ -92,18 +91,14 @@ namespace OHOS { } params.self_auth_id = selfId; params.peer_auth_id = peerId; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; - } - params.key_length = stoi(str); + params.key_length = *reinterpret_cast(data); start_pake(handle, ¶ms); destroy(&handle); return true; } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::StartPakeFuzz(data, size);