• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "displaymanageripc_fuzzer.h"
17 
18 #include <iremote_broker.h>
19 #include <iservice_registry.h>
20 #include <securec.h>
21 #include <set>
22 #include <system_ability_definition.h>
23 
24 #include "display_manager_interface.h"
25 #include "window_manager_hilog.h"
26 
27 namespace OHOS ::Rosen {
28 namespace {
29     constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "DisplayManagerIPC_Fuzzer"};
30 }
31 template<class T>
GetObject(T & object,const uint8_t * data,size_t size)32 size_t GetObject(T &object, const uint8_t *data, size_t size)
33 {
34     size_t objectSize = sizeof(object);
35     if (objectSize > size) {
36         return 0;
37     }
38     return memcpy_s(&object, objectSize, data, objectSize) == EOK ? objectSize : 0;
39 }
40 
GetProxy()41 std::pair<sptr<IDisplayManager>, sptr<IRemoteObject>> GetProxy()
42 {
43     sptr<ISystemAbilityManager> systemAbilityManager =
44         SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
45     if (!systemAbilityManager) {
46         WLOGFE("Failed to get system ability mgr.");
47         return { nullptr, nullptr };
48     }
49     sptr<IRemoteObject> remoteObject = systemAbilityManager->GetSystemAbility(DISPLAY_MANAGER_SERVICE_SA_ID);
50     if (!remoteObject) {
51         WLOGFE("Failed to get display manager service.");
52         return { nullptr, nullptr };
53     }
54     sptr<IDisplayManager> displayManagerServiceProxy = iface_cast<IDisplayManager>(remoteObject);
55     if ((!displayManagerServiceProxy) || (!displayManagerServiceProxy->AsObject())) {
56         WLOGFE("Failed to get system display manager services");
57         return { nullptr, nullptr };
58     }
59     return { displayManagerServiceProxy, remoteObject };
60 }
61 
IPCFuzzTest(const uint8_t * data,size_t size)62 bool IPCFuzzTest(const uint8_t* data, size_t size)
63 {
64     std::set<uint32_t> ignore = {
65         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_CREATE_VIRTUAL_SCREEN),
66         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_SCREEN_SURFACE),
67         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_EXPAND),
68         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_MIRROR),
69         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_DISPLAY_SNAPSHOT)
70     };
71     uint32_t code;
72     int flags, waitTime;
73     if (data == nullptr || size < sizeof(code) + sizeof(flags) + sizeof(waitTime)) {
74         return false;
75     }
76     auto proxy = GetProxy();
77     if (proxy.first == nullptr || proxy.second == nullptr) {
78         return false;
79     }
80     size_t startPos = 0;
81     startPos += GetObject<uint32_t>(code, data + startPos, size - startPos);
82     startPos += GetObject<int>(flags, data + startPos, size - startPos);
83     startPos += GetObject<int>(waitTime, data + startPos, size - startPos);
84     MessageParcel sendData;
85     MessageParcel reply;
86     MessageOption option(flags, waitTime);
87     if (ignore.find(code) != ignore.end()) {
88         return false;
89     }
90     uint32_t dataSize = (size - startPos) > 1024 * 1024 ? 1024 * 1024 : (size - startPos);
91     sendData.WriteBuffer(data + startPos, dataSize);
92     proxy.second->SendRequest(code, sendData, reply, option);
93     return true;
94 }
95 
IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)96 void IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
97     MessageOption& option)
98 {
99     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_DEFAULT_DISPLAY_INFO),
100         sendData, reply, option);
101     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_DISPLAY_BY_ID),
102         sendData, reply, option);
103     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_DISPLAY_BY_SCREEN),
104         sendData, reply, option);
105     proxy->SendRequest(
106         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_REGISTER_DISPLAY_MANAGER_AGENT),
107         sendData, reply, option);
108     proxy->SendRequest(
109         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_UNREGISTER_DISPLAY_MANAGER_AGENT),
110         sendData, reply, option);
111     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_WAKE_UP_BEGIN),
112         sendData, reply, option);
113     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_WAKE_UP_END),
114         sendData, reply, option);
115     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SUSPEND_BEGIN),
116         sendData, reply, option);
117     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SUSPEND_END),
118         sendData, reply, option);
119     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_SCREEN_POWER_FOR_ALL),
120         sendData, reply, option);
121     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_DISPLAY_STATE),
122         sendData, reply, option);
123     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_DISPLAY_STATE),
124         sendData, reply, option);
125     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_ALL_DISPLAYIDS),
126         sendData, reply, option);
127     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_SCREEN_POWER),
128         sendData, reply, option);
129     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_DISPLAY_STATE),
130         sendData, reply, option);
131     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_DISPLAY_STATE),
132         sendData, reply, option);
133     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_ALL_DISPLAYIDS),
134         sendData, reply, option);
135     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_NOTIFY_DISPLAY_EVENT),
136         sendData, reply, option);
137     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_NOTIFY_DISPLAY_EVENT),
138         sendData, reply, option);
139     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_ALL_DISPLAYIDS),
140         sendData, reply, option);
141     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_NOTIFY_DISPLAY_EVENT),
142         sendData, reply, option);
143     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_FREEZE_EVENT),
144         sendData, reply, option);
145 }
146 
IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option,sptr<IDisplayManager> manager)147 void IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
148     MessageOption& option, sptr<IDisplayManager> manager)
149 {
150     int flags = option.GetFlags();
151     option.SetFlags(MessageOption::TF_SYNC);
152     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_CREATE_VIRTUAL_SCREEN),
153         sendData, reply, option);
154     manager->DestroyVirtualScreen(static_cast<ScreenId>(reply.ReadUint64()));
155     option.SetFlags(flags);
156     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_DESTROY_VIRTUAL_SCREEN),
157         sendData, reply, option);
158     proxy->SendRequest(
159         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_SCREEN_SURFACE),
160         sendData, reply, option);
161     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_SCREEN_INFO_BY_ID),
162         sendData, reply, option);
163     proxy->SendRequest(
164         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_SCREEN_GROUP_INFO_BY_ID),
165         sendData, reply, option);
166     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_SCREEN_ACTIVE_MODE),
167         sendData, reply, option);
168     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_GET_ALL_SCREEN_INFOS),
169         sendData, reply, option);
170     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_ORIENTATION),
171         sendData, reply, option);
172     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_PIXEL_RATIO),
173         sendData, reply, option);
174     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_MIRROR),
175         sendData, reply, option);
176     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_EXPAND),
177         sendData, reply, option);
178     proxy->SendRequest(
179         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_REMOVE_VIRTUAL_SCREEN_FROM_SCREEN_GROUP),
180         sendData, reply, option);
181     proxy->SendRequest(
182         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_GET_SUPPORTED_COLOR_GAMUTS),
183         sendData, reply, option);
184     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_GET_COLOR_GAMUT),
185         sendData, reply, option);
186     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_SET_COLOR_GAMUT),
187         sendData, reply, option);
188     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_GET_GAMUT_MAP),
189         sendData, reply, option);
190     proxy->SendRequest(static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_SET_GAMUT_MAP),
191         sendData, reply, option);
192     proxy->SendRequest(
193         static_cast<uint32_t>(IDisplayManager::DisplayManagerMessage::TRANS_ID_SCREEN_SET_COLOR_TRANSFORM),
194         sendData, reply, option);
195 }
196 
IPCInterfaceFuzzTest(const uint8_t * data,size_t size)197 bool IPCInterfaceFuzzTest(const uint8_t* data, size_t size)
198 {
199     int flags, waitTime;
200     if (data == nullptr || size < sizeof(flags) + sizeof(waitTime)) {
201         return false;
202     }
203     auto proxy = GetProxy();
204     if (proxy.first == nullptr || proxy.second == nullptr) {
205         return false;
206     }
207     size_t startPos = 0;
208     startPos += GetObject<int>(flags, data + startPos, size - startPos);
209     startPos += GetObject<int>(waitTime, data + startPos, size - startPos);
210     MessageParcel sendData;
211     MessageParcel reply;
212     MessageOption option(flags, waitTime);
213     sendData.WriteInterfaceToken(proxy.first->GetDescriptor());
214     uint32_t dataSize = (size - startPos) > 1024 * 1024 ? 1024 * 1024 : (size - startPos);
215     sendData.WriteBuffer(data + startPos, dataSize);
216     IPCSpecificInterfaceFuzzTest1(proxy.second, sendData, reply, option);
217     IPCSpecificInterfaceFuzzTest2(proxy.second, sendData, reply, option, proxy.first);
218     return true;
219 }
220 } // namespace.OHOS::Rosen
221 
222 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)223 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
224 {
225     /* Run your code on data */
226     OHOS::Rosen::IPCFuzzTest(data, size);
227     OHOS::Rosen::IPCInterfaceFuzzTest(data, size);
228     return 0;
229 }
230 
231