1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 
17 #include <string>
18 #include <refbase.h>
19 #include <securec.h>
20 #include "drm_log.h"
21 #include "ipc_skeleton.h"
22 #include "mediakeysystem_service.h"
23 #include "mediakeysystemfactory_service.h"
24 #include "key_session_service.h"
25 #include "drmservice_fuzzer.h"
26 #include "remote_request_code.h"
27 #include "iremote_proxy.h"
28 
29 using namespace std;
30 using namespace OHOS;
31 using namespace DrmStandard;
32 
33 namespace OHOS {
34 namespace DrmStandard {
35 const int32_t MEDIA_KEY_SYSTEM_SERVICE_ID = 3012;
36 const int32_t DATAMAXSIZE = 12288;
37 const std::u16string MEDIA_KEY_SYSTEM_FACTORY_TOKEN = u"IMediaKeySystemSystemFactoryService";
38 const std::u16string MEDIA_KEY_SYSTEM_TOKEN = u"IMediaKeySystemSystemService";
39 const std::u16string MEDIA_KEY_SESSION_TOKEN = u"IMediaKeySessionService";
40 const std::u16string MEDIA_DECRYPT_MODULE_TOKEN = u"IMediaDecryptModuleService";
41 
42 std::shared_ptr<MediaKeySystemFactoryService> g_mediaKeySystemFactoryServicePtr = nullptr;
43 
DrmServiceNdkFuzzer()44 DrmServiceNdkFuzzer::DrmServiceNdkFuzzer() {}
45 
~DrmServiceNdkFuzzer()46 DrmServiceNdkFuzzer::~DrmServiceNdkFuzzer() {}
47 
48 
DrmserviceIsMediaKeySystemSupportedV1Test(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)49 bool DrmServiceNdkFuzzer::DrmserviceIsMediaKeySystemSupportedV1Test(uint8_t *rawData, size_t size,
50     std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)
51 {
52     if (rawData == nullptr || size < sizeof(int32_t)) {
53         return false;
54     }
55     MessageParcel reply;
56     MessageOption option;
57     MessageParcel data;
58     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_FACTORY_TOKEN);
59     data.WriteInt32(ARGS_NUM_ONE);
60     std::string uuid(reinterpret_cast<const char *>(rawData), size);
61     data.WriteString(uuid);
62     mediaKeySystemFactoryServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_FACTORY_IS_MEDIA_KEY_SYSTEM_SURPPORTED, data,
63         reply, option);
64     return true;
65 }
66 
DrmserviceIsMediaKeySystemSupportedV2Test(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)67 bool DrmServiceNdkFuzzer::DrmserviceIsMediaKeySystemSupportedV2Test(uint8_t *rawData, size_t size,
68     std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)
69 {
70     if (rawData == nullptr || size < sizeof(int32_t)) {
71         return false;
72     }
73     MessageParcel reply;
74     MessageOption option;
75     MessageParcel data;
76     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_FACTORY_TOKEN);
77     data.WriteInt32(ARGS_NUM_TWO);
78     std::string uuid(reinterpret_cast<const char *>(rawData), size);
79     std::string mimeType(reinterpret_cast<const char *>(rawData), size);
80     data.WriteString(uuid);
81     data.WriteString(mimeType);
82     mediaKeySystemFactoryServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_FACTORY_IS_MEDIA_KEY_SYSTEM_SURPPORTED, data,
83         reply, option);
84     return true;
85 }
86 
DrmserviceIsMediaKeySystemSupportedV3Test(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)87 bool DrmServiceNdkFuzzer::DrmserviceIsMediaKeySystemSupportedV3Test(uint8_t *rawData, size_t size,
88     std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)
89 {
90     if (rawData == nullptr || size < sizeof(int32_t)) {
91         return false;
92     }
93     MessageParcel reply;
94     MessageOption option;
95     MessageParcel data;
96     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_FACTORY_TOKEN);
97     data.WriteInt32(ARGS_NUM_THREE);
98     std::string uuid(reinterpret_cast<const char *>(rawData), size);
99     std::string mimeType(reinterpret_cast<const char *>(rawData), size);
100     data.WriteString(uuid);
101     data.WriteString(mimeType);
102     int32_t securityLevel = *reinterpret_cast<const int32_t *>(rawData);
103     data.WriteInt32(securityLevel);
104     mediaKeySystemFactoryServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_FACTORY_IS_MEDIA_KEY_SYSTEM_SURPPORTED, data,
105         reply, option);
106     return true;
107 }
108 
DrmserviceCreateMediaKeySystemTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)109 bool DrmServiceNdkFuzzer::DrmserviceCreateMediaKeySystemTest(uint8_t *rawData, size_t size,
110     std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)
111 {
112     if (rawData == nullptr || size < sizeof(int32_t)) {
113         return false;
114     }
115     MessageParcel reply;
116     MessageOption option;
117     MessageParcel data;
118     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_FACTORY_TOKEN);
119     std::string name(reinterpret_cast<const char *>(rawData), size);
120     data.WriteString(name);
121     mediaKeySystemFactoryServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_FACTORY_CREATE_MEDIA_KEYSYSTEM, data, reply,
122         option);
123     return true;
124 }
125 
DrmserviceGetMediaKeySystemsTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)126 bool DrmServiceNdkFuzzer::DrmserviceGetMediaKeySystemsTest(uint8_t *rawData, size_t size,
127     std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)
128 {
129     if (rawData == nullptr || size < sizeof(int32_t)) {
130         return false;
131     }
132     MessageParcel reply;
133     MessageOption option;
134     MessageParcel data;
135     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_FACTORY_TOKEN);
136     mediaKeySystemFactoryServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_FACTORY_GET_MEDIA_KEYSYSTEM_NAME, data, reply,
137         option);
138     return true;
139 }
140 
DrmserviceGetMediaKeySystemUuidTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)141 bool DrmServiceNdkFuzzer::DrmserviceGetMediaKeySystemUuidTest(uint8_t *rawData, size_t size,
142     std::shared_ptr<MediaKeySystemFactoryService> mediaKeySystemFactoryServicePtr)
143 {
144     if (rawData == nullptr || size < sizeof(int32_t)) {
145         return false;
146     }
147     MessageParcel reply;
148     MessageOption option;
149     MessageParcel data;
150     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_FACTORY_TOKEN);
151     std::string name(reinterpret_cast<const char *>(rawData), size);
152     data.WriteString(name);
153     mediaKeySystemFactoryServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_FACTORY_GET_MEDIA_KEYSYSTEM_UUID, data, reply,
154         option);
155     return true;
156 }
157 
DrmserviceCreateMediaKeySessionTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)158 bool DrmServiceNdkFuzzer::DrmserviceCreateMediaKeySessionTest(uint8_t *rawData, size_t size,
159     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
160 {
161     if (rawData == nullptr || size < sizeof(int32_t)) {
162         return false;
163     }
164     MessageParcel reply;
165     MessageOption option;
166     MessageParcel data;
167     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
168     int32_t securityLevel = *reinterpret_cast<const int32_t *>(rawData);
169     data.WriteInt32(securityLevel);
170     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_CREATE_KEY_SESSION, data, reply, option);
171     return true;
172 }
173 
DrmserviceCloseMediaKeySessionServiceTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)174 bool DrmServiceNdkFuzzer::DrmserviceCloseMediaKeySessionServiceTest(uint8_t *rawData, size_t size,
175     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
176 {
177     if (rawData == nullptr || size < sizeof(int32_t)) {
178         return false;
179     }
180     sptr<IMediaKeySession> hdiMediaKeySession = new (std::nothrow) IMediaKeySessionMock();
181     sptr<MediaKeySessionService> mediaKeySessionService =
182         new (std::nothrow) MediaKeySessionService(hdiMediaKeySession);
183     mediaKeySystemServicePtr->CloseMediaKeySessionService(mediaKeySessionService);
184     return true;
185 }
186 
DrmserviceGenerateKeySystemRequestTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)187 bool DrmServiceNdkFuzzer::DrmserviceGenerateKeySystemRequestTest(uint8_t *rawData, size_t size,
188     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
189 {
190     if (rawData == nullptr || size < sizeof(int32_t)) {
191         return false;
192     }
193     MessageParcel reply;
194     MessageOption option;
195     MessageParcel data;
196     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
197     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GENERATE_KEYSYSTEM_REQUEST, data, reply, option);
198     return true;
199 }
200 
DrmserviceProcessKeySystemResponseTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)201 bool DrmServiceNdkFuzzer::DrmserviceProcessKeySystemResponseTest(uint8_t *rawData, size_t size,
202     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
203 {
204     if (rawData == nullptr || size < sizeof(int32_t)) {
205         return false;
206     }
207     MessageParcel reply;
208     MessageOption option;
209     MessageParcel data;
210     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
211     data.WriteInt32(size);
212     uint8_t *response = rawData;
213     data.WriteBuffer(response, size);
214     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_PROCESS_KEYSYSTEM_RESPONSE, data, reply, option);
215     return true;
216 }
217 
DrmserviceGenerateSetConfigurationStringTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)218 bool DrmServiceNdkFuzzer::DrmserviceGenerateSetConfigurationStringTest(uint8_t *rawData, size_t size,
219     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
220 {
221     if (rawData == nullptr || size < sizeof(int32_t)) {
222         return false;
223     }
224     MessageParcel reply;
225     MessageOption option;
226     MessageParcel data;
227     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
228     std::string configName(reinterpret_cast<const char *>(rawData), size);
229     std::string value(reinterpret_cast<const char *>(rawData), size);
230     data.WriteString(configName);
231     data.WriteString(value);
232     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_SETCONFIGURATION_STRING, data, reply, option);
233     return true;
234 }
235 
DrmserviceSetConfigurationStringTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)236 bool DrmServiceNdkFuzzer::DrmserviceSetConfigurationStringTest(uint8_t *rawData, size_t size,
237     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
238 {
239     if (rawData == nullptr || size < sizeof(int32_t)) {
240         return false;
241     }
242     MessageParcel reply;
243     MessageOption option;
244     MessageParcel data;
245     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
246     std::string configName(reinterpret_cast<const char *>(rawData), size);
247     std::string value(reinterpret_cast<const char *>(rawData), size);
248     data.WriteString(configName);
249     data.WriteString(value);
250     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_SETCONFIGURATION_STRING, data, reply, option);
251     return true;
252 }
253 
DrmserviceGetConfigurationStringTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)254 bool DrmServiceNdkFuzzer::DrmserviceGetConfigurationStringTest(uint8_t *rawData, size_t size,
255     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
256 {
257     if (rawData == nullptr || size < sizeof(int32_t)) {
258         return false;
259     }
260     MessageParcel reply;
261     MessageOption option;
262     MessageParcel data;
263     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
264     std::string configName(reinterpret_cast<const char *>(rawData), size);
265     data.WriteString(configName);
266     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GETCONFIGURATION_STRING, data, reply, option);
267     return true;
268 }
269 
DrmserviceSetConfigurationByteArrayTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)270 bool DrmServiceNdkFuzzer::DrmserviceSetConfigurationByteArrayTest(uint8_t *rawData, size_t size,
271     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
272 {
273     if (rawData == nullptr || size < sizeof(int32_t)) {
274         return false;
275     }
276     MessageParcel reply;
277     MessageOption option;
278     MessageParcel data;
279     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
280     std::string configName(reinterpret_cast<const char *>(rawData), size);
281     data.WriteString(configName);
282     data.WriteBuffer(rawData, size);
283     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_SETCONFIGURATION_BYTEARRAY, data, reply, option);
284     return true;
285 }
286 
DrmserviceGetConfigurationByteArrayTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)287 bool DrmServiceNdkFuzzer::DrmserviceGetConfigurationByteArrayTest(uint8_t *rawData, size_t size,
288     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
289 {
290     if (rawData == nullptr || size < sizeof(int32_t)) {
291         return false;
292     }
293     MessageParcel reply;
294     MessageOption option;
295     MessageParcel data;
296     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
297     std::string configName(reinterpret_cast<const char *>(rawData), size);
298     data.WriteString(configName);
299     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GETCONFIGURATION_BYTEARRAY, data, reply, option);
300     return true;
301 }
302 
DrmserviceGetStatisticsTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)303 bool DrmServiceNdkFuzzer::DrmserviceGetStatisticsTest(uint8_t *rawData, size_t size,
304     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
305 {
306     if (rawData == nullptr || size < sizeof(int32_t)) {
307         return false;
308     }
309     MessageParcel reply;
310     MessageOption option;
311     MessageParcel data;
312     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
313     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GETMETRIC, data, reply, option);
314     return true;
315 }
316 
DrmserviceReleaseTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)317 bool DrmServiceNdkFuzzer::DrmserviceReleaseTest(uint8_t *rawData, size_t size,
318     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
319 {
320     if (rawData == nullptr || size < sizeof(int32_t)) {
321         return false;
322     }
323     MessageParcel reply;
324     MessageOption option;
325     MessageParcel data;
326     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
327     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_RELEASE, data, reply, option);
328     return true;
329 }
330 
DrmserviceGetMaxContentProtectionLevelTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)331 bool DrmServiceNdkFuzzer::DrmserviceGetMaxContentProtectionLevelTest(uint8_t *rawData, size_t size,
332     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
333 {
334     if (rawData == nullptr || size < sizeof(int32_t)) {
335         return false;
336     }
337     MessageParcel reply;
338     MessageOption option;
339     MessageParcel data;
340     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
341     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GETMAXSECURITYLEVEL, data, reply, option);
342     return true;
343 }
344 
DrmserviceGetCertificateStatusTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)345 bool DrmServiceNdkFuzzer::DrmserviceGetCertificateStatusTest(uint8_t *rawData, size_t size,
346     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
347 {
348     if (rawData == nullptr || size < sizeof(int32_t)) {
349         return false;
350     }
351     MessageParcel reply;
352     MessageOption option;
353     MessageParcel data;
354     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
355     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GETCERTIFICATESTATUS, data, reply, option);
356     return true;
357 }
358 
DrmserviceGetOfflineMediaKeyIdsTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)359 bool DrmServiceNdkFuzzer::DrmserviceGetOfflineMediaKeyIdsTest(uint8_t *rawData, size_t size,
360     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
361 {
362     if (rawData == nullptr || size < sizeof(int32_t)) {
363         return false;
364     }
365     MessageParcel reply;
366     MessageOption option;
367     MessageParcel data;
368     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
369     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GET_OFFLINELICENSEIDS, data, reply, option);
370     return true;
371 }
372 
DrmserviceGetOfflineMediaKeyStatusTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)373 bool DrmServiceNdkFuzzer::DrmserviceGetOfflineMediaKeyStatusTest(uint8_t *rawData, size_t size,
374     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
375 {
376     if (rawData == nullptr || size < sizeof(int32_t)) {
377         return false;
378     }
379     MessageParcel reply;
380     MessageOption option;
381     MessageParcel data;
382     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
383     data.WriteInt32(size);
384     data.WriteBuffer(rawData, size);
385     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_GET_OFFLINEKEY_STATUS, data, reply, option);
386     return true;
387 }
388 
DrmserviceClearOfflineMediaKeysTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)389 bool DrmServiceNdkFuzzer::DrmserviceClearOfflineMediaKeysTest(uint8_t *rawData, size_t size,
390     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr)
391 {
392     if (rawData == nullptr || size < sizeof(int32_t)) {
393         return false;
394     }
395     MessageParcel reply;
396     MessageOption option;
397     MessageParcel data;
398     data.WriteInterfaceToken(MEDIA_KEY_SYSTEM_TOKEN);
399     data.WriteInt32(size);
400     data.WriteBuffer(rawData, size);
401     mediaKeySystemServicePtr->OnRemoteRequest(MEDIA_KEY_SYSTEM_REMOVE_OFFLINELICENSE, data, reply, option);
402     return true;
403 }
404 
DrmserviceGetMediaDecryptModuleTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)405 bool DrmServiceNdkFuzzer::DrmserviceGetMediaDecryptModuleTest(uint8_t *rawData, size_t size,
406     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
407 {
408     if (rawData == nullptr || size < sizeof(int32_t)) {
409         return false;
410     }
411     MessageParcel reply;
412     MessageOption option;
413     MessageParcel data;
414     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
415     mediaKeySessionService->OnRemoteRequest(GET_MEDIA_DECRYPT_MODULE, data, reply, option);
416     return true;
417 }
418 
DrmserviceGenerateMediaKeyRequestTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)419 bool DrmServiceNdkFuzzer::DrmserviceGenerateMediaKeyRequestTest(uint8_t *rawData, size_t size,
420     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
421 {
422     if (rawData == nullptr || size < sizeof(int32_t)) {
423         return false;
424     }
425     MessageParcel reply;
426     MessageOption option;
427     MessageParcel data;
428     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
429     data.WriteInt32(size);
430     std::string mimeType(reinterpret_cast<const char *>(rawData), size);
431     data.WriteString(mimeType);
432     data.WriteString(mimeType);
433     data.WriteInt32(size);
434     data.WriteString(mimeType);
435     data.WriteInt32(size);
436     data.WriteBuffer(rawData, size);
437     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_GENERATE_LICENSE_REQUEST, data, reply, option);
438     return true;
439 }
440 
DrmserviceProcessMediaKeyResponseTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)441 bool DrmServiceNdkFuzzer::DrmserviceProcessMediaKeyResponseTest(uint8_t *rawData, size_t size,
442     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
443 {
444     if (rawData == nullptr || size < sizeof(int32_t)) {
445         return false;
446     }
447     MessageParcel reply;
448     MessageOption option;
449     MessageParcel data;
450     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
451     data.WriteInt32(size);
452     data.WriteBuffer(rawData, size);
453     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_PROCESS_LICENSE_RESPONSE, data, reply, option);
454     return true;
455 }
456 
DrmserviceGenerateOfflineReleaseRequestTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)457 bool DrmServiceNdkFuzzer::DrmserviceGenerateOfflineReleaseRequestTest(uint8_t *rawData, size_t size,
458     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
459 {
460     if (rawData == nullptr || size < sizeof(int32_t)) {
461         return false;
462     }
463     MessageParcel reply;
464     MessageOption option;
465     MessageParcel data;
466     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
467     data.WriteInt32(size);
468     data.WriteBuffer(rawData, size);
469     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_GENERATE_OFFLINE_RELEASE_REQUEST, data, reply, option);
470     return true;
471 }
472 
DrmserviceProcessOfflineReleaseResponseTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)473 bool DrmServiceNdkFuzzer::DrmserviceProcessOfflineReleaseResponseTest(uint8_t *rawData, size_t size,
474     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
475 {
476     if (rawData == nullptr || size < sizeof(int32_t)) {
477         return false;
478     }
479     MessageParcel reply;
480     MessageOption option;
481     MessageParcel data;
482     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
483     data.WriteInt32(size);
484     data.WriteBuffer(rawData, size);
485     data.WriteInt32(size);
486     data.WriteBuffer(rawData, size);
487     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_PROCESS_OFFLINE_RELEASE_RESPONSE, data, reply, option);
488     return true;
489 }
490 
DrmserviceCheckMediaKeyStatusTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)491 bool DrmServiceNdkFuzzer::DrmserviceCheckMediaKeyStatusTest(uint8_t *rawData, size_t size,
492     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
493 {
494     if (rawData == nullptr || size < sizeof(int32_t)) {
495         return false;
496     }
497     MessageParcel reply;
498     MessageOption option;
499     MessageParcel data;
500     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
501     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_GENERATE_CHECK_LICENSE_STATUS, data, reply, option);
502     return true;
503 }
504 
DrmserviceRestoreOfflineMediaKeysTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)505 bool DrmServiceNdkFuzzer::DrmserviceRestoreOfflineMediaKeysTest(uint8_t *rawData, size_t size,
506     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
507 {
508     if (rawData == nullptr || size < sizeof(int32_t)) {
509         return false;
510     }
511     MessageParcel reply;
512     MessageOption option;
513     MessageParcel data;
514     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
515     data.WriteInt32(size);
516     data.WriteBuffer(rawData, size);
517     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_RESTORE_OFFLINEKEYS, data, reply, option);
518     return true;
519 }
520 
DrmserviceClearMediaKeysTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)521 bool DrmServiceNdkFuzzer::DrmserviceClearMediaKeysTest(uint8_t *rawData, size_t size,
522     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
523 {
524     if (rawData == nullptr || size < sizeof(int32_t)) {
525         return false;
526     }
527     MessageParcel reply;
528     MessageOption option;
529     MessageParcel data;
530     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
531     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_REMOVE_LICENSE, data, reply, option);
532     return true;
533 }
534 
DrmserviceRequireSecureDecoderModuleTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)535 bool DrmServiceNdkFuzzer::DrmserviceRequireSecureDecoderModuleTest(uint8_t *rawData, size_t size,
536     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
537 {
538     if (rawData == nullptr || size < sizeof(int32_t)) {
539         return false;
540     }
541     MessageParcel reply;
542     MessageOption option;
543     MessageParcel data;
544     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
545     std::string mimeType(reinterpret_cast<const char *>(rawData), size);
546     data.WriteString(mimeType);
547     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_REQUIRE_SECURE_DECODER, data, reply, option);
548     return true;
549 }
550 
DrmserviceGetContentProtectionLevelTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaKeySessionService> mediaKeySessionService)551 bool DrmServiceNdkFuzzer::DrmserviceGetContentProtectionLevelTest(uint8_t *rawData, size_t size,
552     std::shared_ptr<MediaKeySessionService> mediaKeySessionService)
553 {
554     if (rawData == nullptr || size < sizeof(int32_t)) {
555         return false;
556     }
557     MessageParcel reply;
558     MessageOption option;
559     MessageParcel data;
560     data.WriteInterfaceToken(MEDIA_KEY_SESSION_TOKEN);
561     mediaKeySessionService->OnRemoteRequest(MEDIA_KEY_SESSION_GETSECURITYLEVEL, data, reply, option);
562     return true;
563 }
564 
DrmserviceDecryptMediaDataTest(uint8_t * rawData,size_t size,std::shared_ptr<MediaDecryptModuleService> mediaDecryptService)565 bool DrmServiceNdkFuzzer::DrmserviceDecryptMediaDataTest(uint8_t *rawData, size_t size,
566     std::shared_ptr<MediaDecryptModuleService> mediaDecryptService)
567 {
568     if (rawData == nullptr || size < sizeof(int32_t)) {
569         return false;
570     }
571     MessageParcel reply;
572     MessageOption option;
573     MessageParcel data;
574     data.WriteInterfaceToken(MEDIA_DECRYPT_MODULE_TOKEN);
575     mediaDecryptService->OnRemoteRequest(DECRYPT_MODULE_DECRYPT_DATA, data, reply, option);
576     return true;
577 }
578 } // namespace DrmStandard
579 
FuzzMediaKeySystemFactoryNdk(uint8_t * data,size_t size)580 bool FuzzMediaKeySystemFactoryNdk(uint8_t *data, size_t size)
581 {
582     if (data == nullptr) {
583         return true;
584     }
585     DrmServiceNdkFuzzer testMediaKeySystemFactory;
586     /* KeySystemFactory */
587     if (g_mediaKeySystemFactoryServicePtr == nullptr) {
588         g_mediaKeySystemFactoryServicePtr =
589             std::make_shared<MediaKeySystemFactoryService>(MEDIA_KEY_SYSTEM_SERVICE_ID, true);
590         if (g_mediaKeySystemFactoryServicePtr == nullptr) {
591             return false;
592         }
593     }
594     testMediaKeySystemFactory.DrmserviceIsMediaKeySystemSupportedV1Test(data, size, g_mediaKeySystemFactoryServicePtr);
595     testMediaKeySystemFactory.DrmserviceIsMediaKeySystemSupportedV2Test(data, size, g_mediaKeySystemFactoryServicePtr);
596     testMediaKeySystemFactory.DrmserviceIsMediaKeySystemSupportedV3Test(data, size, g_mediaKeySystemFactoryServicePtr);
597     testMediaKeySystemFactory.DrmserviceCreateMediaKeySystemTest(data, size, g_mediaKeySystemFactoryServicePtr);
598     testMediaKeySystemFactory.DrmserviceGetMediaKeySystemsTest(data, size, g_mediaKeySystemFactoryServicePtr);
599     testMediaKeySystemFactory.DrmserviceGetMediaKeySystemUuidTest(data, size, g_mediaKeySystemFactoryServicePtr);
600     return true;
601 }
602 
FuzzSystemFactoryNdk(uint8_t * data,size_t size)603 bool FuzzSystemFactoryNdk(uint8_t *data, size_t size)
604 {
605     if (data == nullptr) {
606         return true;
607     }
608     DrmServiceNdkFuzzer testMediaSystemFactory;
609     /* KeySystem */
610     sptr<IMediaKeySystem> hdiMediaKeySystem = new (std::nothrow) IMediaKeySystemMock();
611     std::shared_ptr<MediaKeySystemService> mediaKeySystemServicePtr =
612         std::make_shared<MediaKeySystemService>(hdiMediaKeySystem);
613     testMediaSystemFactory.DrmserviceCreateMediaKeySessionTest(data, size, mediaKeySystemServicePtr);
614     testMediaSystemFactory.DrmserviceCloseMediaKeySessionServiceTest(data, size, mediaKeySystemServicePtr);
615     testMediaSystemFactory.DrmserviceGenerateKeySystemRequestTest(data, size, mediaKeySystemServicePtr);
616     testMediaSystemFactory.DrmserviceProcessKeySystemResponseTest(data, size, mediaKeySystemServicePtr);
617     testMediaSystemFactory.DrmserviceGenerateSetConfigurationStringTest(data, size, mediaKeySystemServicePtr);
618     testMediaSystemFactory.DrmserviceSetConfigurationStringTest(data, size, mediaKeySystemServicePtr);
619     testMediaSystemFactory.DrmserviceGetConfigurationStringTest(data, size, mediaKeySystemServicePtr);
620     testMediaSystemFactory.DrmserviceSetConfigurationByteArrayTest(data, size, mediaKeySystemServicePtr);
621     testMediaSystemFactory.DrmserviceGetConfigurationByteArrayTest(data, size, mediaKeySystemServicePtr);
622     testMediaSystemFactory.DrmserviceGetStatisticsTest(data, size, mediaKeySystemServicePtr);
623     testMediaSystemFactory.DrmserviceGetMaxContentProtectionLevelTest(data, size, mediaKeySystemServicePtr);
624     testMediaSystemFactory.DrmserviceGetCertificateStatusTest(data, size, mediaKeySystemServicePtr);
625     testMediaSystemFactory.DrmserviceGetOfflineMediaKeyIdsTest(data, size, mediaKeySystemServicePtr);
626     testMediaSystemFactory.DrmserviceGetOfflineMediaKeyStatusTest(data, size, mediaKeySystemServicePtr);
627     testMediaSystemFactory.DrmserviceClearOfflineMediaKeysTest(data, size, mediaKeySystemServicePtr);
628     testMediaSystemFactory.DrmserviceReleaseTest(data, size, mediaKeySystemServicePtr);
629     /* MediaKeySession */
630     sptr<IMediaKeySession> hdiMediaKeySession = new (std::nothrow) IMediaKeySessionMock();
631     std::shared_ptr<MediaKeySessionService> mediaKeySessionService =
632         std::make_shared<MediaKeySessionService>(hdiMediaKeySession);
633     testMediaSystemFactory.DrmserviceGetMediaDecryptModuleTest(data, size, mediaKeySessionService);
634     testMediaSystemFactory.DrmserviceGenerateMediaKeyRequestTest(data, size, mediaKeySessionService);
635     testMediaSystemFactory.DrmserviceProcessMediaKeyResponseTest(data, size, mediaKeySessionService);
636     testMediaSystemFactory.DrmserviceGenerateOfflineReleaseRequestTest(data, size, mediaKeySessionService);
637     testMediaSystemFactory.DrmserviceProcessOfflineReleaseResponseTest(data, size, mediaKeySessionService);
638     testMediaSystemFactory.DrmserviceCheckMediaKeyStatusTest(data, size, mediaKeySessionService);
639     testMediaSystemFactory.DrmserviceRestoreOfflineMediaKeysTest(data, size, mediaKeySessionService);
640     testMediaSystemFactory.DrmserviceClearMediaKeysTest(data, size, mediaKeySessionService);
641     testMediaSystemFactory.DrmserviceRequireSecureDecoderModuleTest(data, size, mediaKeySessionService);
642     testMediaSystemFactory.DrmserviceGetContentProtectionLevelTest(data, size, mediaKeySessionService);
643     /* DecryptModule */
644     sptr<IMediaDecryptModule> hdiDecryptModule = new (std::nothrow) IMediaDecryptModuleMock();
645     std::shared_ptr<MediaDecryptModuleService> mediaDecryptService =
646         std::make_shared<MediaDecryptModuleService>(hdiDecryptModule);
647     testMediaSystemFactory.DrmserviceDecryptMediaDataTest(data, size, mediaDecryptService);
648     return true;
649 }
650 } // namesapce OHOS
651 
652 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)653 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size)
654 {
655     /* Run your code on data */
656     uint8_t rawData[DATAMAXSIZE] = { 0 };
657     int32_t ret = memcpy_s(rawData, DATAMAXSIZE - 1, data, size);
658     if (ret != 0) {
659         return -1;
660     }
661     OHOS::FuzzSystemFactoryNdk(rawData, size);
662     OHOS::FuzzMediaKeySystemFactoryNdk(rawData, size);
663     return 0;
664 }
665