From 9c10fbea8f285a07cef6e80ab74a7f3289fb3d10 Mon Sep 17 00:00:00 2001 From: mmc_mmc Date: Thu, 23 Nov 2023 10:14:23 +0800 Subject: [PATCH 1/2] fix fuzz Signed-off-by: mmc_mmc --- .../authenticatepeer_fuzzer.cpp | 22 ++++++------ .../dellocalauthinfo_fuzzer.cpp | 18 ++++++++-- .../destroy_fuzzer/destroy_fuzzer.cpp | 15 ++++---- .../getinstance_fuzzer/getinstance_fuzzer.cpp | 16 ++++----- .../listtrustpeer_fuzzer.cpp | 34 ++++++++++++++----- .../startpake_fuzzer/startpake_fuzzer.cpp | 24 ++++++------- 6 files changed, 77 insertions(+), 52 deletions(-) diff --git a/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp index 39c87c46..39fadb2d 100644 --- a/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp @@ -1,3 +1,6 @@ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. + */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); @@ -73,19 +76,18 @@ bool AuthenticatePeerFuzz(const uint8_t* data, size_t size) hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); hc_auth_id selfId; + hc_auth_id peerId; if (memset_s(&selfId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - selfId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); - if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { - return false; - } - - hc_auth_id peerId; if (memset_s(&peerId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - peerId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); + selfId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { + return false; + } + peerId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; if (memcpy_s(peerId.auth_id, HC_AUTH_ID_BUFF_LEN, data, peerId.length) != EOK) { return false; } @@ -97,11 +99,7 @@ bool AuthenticatePeerFuzz(const uint8_t* data, size_t size) } params.self_auth_id = selfId; params.peer_auth_id = peerId; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; - } - params.key_length = stoi(str); + params.key_length = *reinterpret_cast(data); authenticate_peer(handle, ¶ms); destroy(&handle); return true; diff --git a/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp index 27e59510..2b787e03 100644 --- a/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp @@ -1,3 +1,6 @@ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. + */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); @@ -16,6 +19,8 @@ #include "dellocalauthinfo_fuzzer.h" #include "hichain.h" +#include "distribution.h" +#include "securec.h" namespace OHOS { static void TransmitCb(const struct session_identity *identity, const void *data, uint32_t length) @@ -61,11 +66,18 @@ namespace OHOS { bool DelLocalaAuthInfoFuzz(const uint8_t *data, size_t size) { - if ((data == nullptr) || (size < sizeof(int32_t))) { + if ((data == nullptr) || (size < sizeof(uint8_t))) { return false; } hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); - hc_auth_id authId = {sizeof({*data;}), {*data}}; + hc_auth_id authId; + if (memset_s(&authId, sizeof(authId), 0, sizeof(authId)) != EOK) { + return false; + } + authId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(authId.auth_id, HC_AUTH_ID_BUFF_LEN, data, authId.length) != EOK) { + return false; + } hc_user_info userInfo = {authId, 1}; delete_local_auth_info(handle, &userInfo); destroy(&handle); @@ -73,7 +85,7 @@ namespace OHOS { } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::DelLocalaAuthInfoFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp index cf3ecd15..26a2619a 100644 --- a/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp @@ -1,3 +1,6 @@ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. + */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); @@ -67,19 +70,15 @@ namespace OHOS { return false; } hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); - struct hichain *hichain = (struct hichain *)handle; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; - } - hichain->operation_code = stoi(str); - hc_handle server = (void *)hichain; + struct hichain *hichain = static_cast(handle); + hichain->operation_code = *reinterpret_cast(data); + hc_handle server = static_cast(hichain); destroy(&server); return true; } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::DestroyFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp index e733858c..12e6fb5e 100644 --- a/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp @@ -1,3 +1,6 @@ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. + */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); @@ -58,17 +61,14 @@ namespace OHOS { bool GetInstanceFuzz(const uint8_t *data, size_t size) { - int ret; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; + if ((data == nullptr) || (size < sizeof(int32_t))) { + return false; } - int32_t sessionId = stoi(str); + int32_t sessionId = *reinterpret_cast(data); hc_package_name package_name = {sizeof("hicar"), "hicar"}; hc_service_type service_type = {sizeof("CarDevice"), "CarDevice"}; struct session_identity identity; - ret = memset_s(&identity, sizeof(identity), 0, sizeof(identity)); - if (ret != EOK) { + if (memset_s(&identity, sizeof(identity), 0, sizeof(identity)) != EOK) { return false; } identity.session_id = sessionId; @@ -81,7 +81,7 @@ namespace OHOS { } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::GetInstanceFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp index 0e6aa880..f6d4995e 100644 --- a/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp @@ -1,3 +1,6 @@ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. + */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); @@ -64,22 +67,37 @@ namespace OHOS { bool ListTrustPeerFuzz(const uint8_t *data, size_t size) { - int ret; - hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); - struct hc_auth_id *peerAuthidList = (struct hc_auth_id *)malloc(MAX_LIST_NUM * sizeof(struct hc_auth_id)); - ret = memset_s(peerAuthidList, MAX_LIST_NUM * sizeof(struct hc_auth_id), - 0, MAX_LIST_NUM * sizeof(struct hc_auth_id)); - if (ret != EOK) { + if ((data == nullptr) || (size < sizeof(uint8_t))) { + return false; + } + hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); + struct hc_auth_id *peerAuthidList = new hc_auth_id[MAX_LIST_NUM]; + if (peerAuthidList == nullptr) { + return false; + } + if (memset_s(peerAuthidList, MAX_LIST_NUM * sizeof(struct hc_auth_id), + 0, MAX_LIST_NUM * sizeof(struct hc_auth_id)) != EOK) { + delete[] peerAuthidList; + peerAuthidList = nullptr; + return false; + } + hc_auth_id authId; + if (memset_s(&authId, sizeof(authId), 0, sizeof(authId)) != EOK) { + return false; + } + authId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(authId.auth_id, HC_AUTH_ID_BUFF_LEN, data, authId.length) != EOK) { return false; } - struct hc_auth_id authId = {sizeof({*data;}), {*data}}; list_trust_peers(handle, 0, &authId, &peerAuthidList); destroy(&handle); + delete[] peerAuthidList; + peerAuthidList = nullptr; return true; } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::ListTrustPeerFuzz(data, size); diff --git a/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp index 19fb60f2..4157abd1 100644 --- a/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp @@ -1,3 +1,6 @@ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. + */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); @@ -69,19 +72,18 @@ namespace OHOS { } hc_handle handle = get_instance(&identity, HC_CENTRE, &callback); hc_auth_id selfId; + hc_auth_id peerId; if (memset_s(&selfId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - selfId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); - if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { - return false; - } - - hc_auth_id peerId; if (memset_s(&peerId, sizeof(struct hc_auth_id), 0, sizeof(struct hc_auth_id)) != EOK) { return false; } - peerId.length = strnlen(reinterpret_cast(data), HC_AUTH_ID_BUFF_LEN); + selfId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; + if (memcpy_s(selfId.auth_id, HC_AUTH_ID_BUFF_LEN, data, selfId.length) != EOK) { + return false; + } + peerId.length = size > HC_AUTH_ID_BUFF_LEN ? HC_AUTH_ID_BUFF_LEN : size; if (memcpy_s(peerId.auth_id, HC_AUTH_ID_BUFF_LEN, data, peerId.length) != EOK) { return false; } @@ -92,18 +94,14 @@ namespace OHOS { } params.self_auth_id = selfId; params.peer_auth_id = peerId; - std::string str(reinterpret_cast(data), 9); - for (int i = 0; i < str.length(); i++) { - str[i] = str[i] % str.length() + '0'; - } - params.key_length = stoi(str); + params.key_length = *reinterpret_cast(data); start_pake(handle, ¶ms); destroy(&handle); return true; } } -/* Fuzzer entry point*/ +/* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { OHOS::StartPakeFuzz(data, size); From 30f952af7bf665c1743a21b20923e3ca859c126d Mon Sep 17 00:00:00 2001 From: mmc_mmc Date: Thu, 23 Nov 2023 11:47:26 +0800 Subject: [PATCH 2/2] fix fuzz Signed-off-by: mmc_mmc --- .../authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp | 3 --- .../dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp | 3 --- .../deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp | 3 --- .../fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp | 3 --- .../fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp | 3 --- .../fuzztest/startpake_fuzzer/startpake_fuzzer.cpp | 3 --- 6 files changed, 18 deletions(-) diff --git a/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp index 39fadb2d..a5b692a1 100644 --- a/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/authenticatepeer_fuzzer/authenticatepeer_fuzzer.cpp @@ -1,6 +1,3 @@ -/* - * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. - */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp index 2b787e03..efc87555 100644 --- a/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/dellocalauthinfo_fuzzer/dellocalauthinfo_fuzzer.cpp @@ -1,6 +1,3 @@ -/* - * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. - */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp index 26a2619a..e00915a2 100644 --- a/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/destroy_fuzzer/destroy_fuzzer.cpp @@ -1,6 +1,3 @@ -/* - * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. - */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp index 12e6fb5e..54f94fc3 100644 --- a/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/getinstance_fuzzer/getinstance_fuzzer.cpp @@ -1,6 +1,3 @@ -/* - * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. - */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp index f6d4995e..5eaa9127 100644 --- a/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/listtrustpeer_fuzzer/listtrustpeer_fuzzer.cpp @@ -1,6 +1,3 @@ -/* - * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. - */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp b/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp index 4157abd1..2a05d85c 100644 --- a/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp +++ b/frameworks/deviceauth_lite/fuzztest/startpake_fuzzer/startpake_fuzzer.cpp @@ -1,6 +1,3 @@ -/* - * Copyright (c) Huawei Technologies Co., Ltd. 2020-2020. All rights reserved. - */ /* * Copyright (c) 2023 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License");