1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "connectionstatemanager_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #define private public
22 #define protected public
23 #include "connection_observer_controller.h"
24 #include "connection_record.h"
25 #include "connection_state_item.h"
26 #include "connection_state_manager.h"
27 #undef protected
28 #undef private
29
30 #include "ability_record.h"
31 #include "continuous_task_callback_info.h"
32
33 using namespace OHOS::AAFwk;
34 using namespace OHOS::AppExecFwk;
35 using namespace OHOS::AbilityRuntime;
36
37 namespace OHOS {
38 namespace {
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 constexpr uint8_t ENABLE = 2;
42 class MyAbilityConnection : public IAbilityConnection {
43 public:
44 MyAbilityConnection() = default;
45 virtual ~MyAbilityConnection() = default;
OnAbilityConnectDone(const AppExecFwk::ElementName & element,const sptr<IRemoteObject> & remoteObject,int resultCode)46 void OnAbilityConnectDone(
47 const AppExecFwk::ElementName &element, const sptr<IRemoteObject> &remoteObject, int resultCode) override
48 {}
OnAbilityDisconnectDone(const AppExecFwk::ElementName & element,int resultCode)49 void OnAbilityDisconnectDone(const AppExecFwk::ElementName &element, int resultCode) override
50 {}
AsObject()51 sptr<IRemoteObject> AsObject() override
52 {
53 return {};
54 }
55 };
56 class MyAbilityConnectionObserver : public IConnectionObserver {
57 public:
58 MyAbilityConnectionObserver() = default;
59 virtual ~MyAbilityConnectionObserver() = default;
OnExtensionConnected(const ConnectionData & data)60 void OnExtensionConnected(const ConnectionData &data) override
61 {}
OnExtensionDisconnected(const ConnectionData & data)62 void OnExtensionDisconnected(const ConnectionData &data) override
63 {}
OnDlpAbilityOpened(const DlpStateData & data)64 void OnDlpAbilityOpened(const DlpStateData &data) override
65 {}
OnDlpAbilityClosed(const DlpStateData & data)66 void OnDlpAbilityClosed(const DlpStateData &data) override
67 {}
AsObject()68 sptr<IRemoteObject> AsObject() override
69 {
70 return {};
71 }
72 };
73 }
74
GetU32Data(const char * ptr)75 uint32_t GetU32Data(const char* ptr)
76 {
77 // convert fuzz input data to an integer
78 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3];
79 }
80
GetFuzzAbilityRecord()81 std::shared_ptr<AbilityRecord> GetFuzzAbilityRecord()
82 {
83 sptr<Token> token = nullptr;
84 AbilityRequest abilityRequest;
85 abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
86 abilityRequest.abilityInfo.name = "MainAbility";
87 abilityRequest.abilityInfo.type = AbilityType::DATA;
88 std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
89 if (!abilityRecord) {
90 return nullptr;
91 }
92 return abilityRecord;
93 }
94
GetFuzzAbilityToken()95 sptr<Token> GetFuzzAbilityToken()
96 {
97 sptr<Token> token = nullptr;
98 std::shared_ptr<AbilityRecord> abilityRecord = GetFuzzAbilityRecord();
99 if (abilityRecord) {
100 token = abilityRecord->GetToken();
101 }
102 return token;
103 }
104
DoSomethingInterestingWithMyAPI(const char * data,size_t size)105 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
106 {
107 bool boolParam = *data % ENABLE;
108 int intParam = static_cast<int>(GetU32Data(data));
109 int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
110 std::string stringParam(data, size);
111 Parcel wantParcel;
112 Want *want = nullptr;
113 if (wantParcel.WriteBuffer(data, size)) {
114 want = Want::Unmarshalling(wantParcel);
115 if (!want) {
116 return false;
117 }
118 }
119 sptr<IRemoteObject> token = GetFuzzAbilityToken();
120 sptr<IAbilityConnection> connect = new MyAbilityConnection();
121 sptr<AbilityRuntime::IConnectionObserver> observer = new MyAbilityConnectionObserver();
122 std::vector<std::string> info;
123 AbilityRuntime::ConnectionData connectionData;
124
125 // fuzz for ConnectionObserverController
126 auto connectionObserverController = std::make_shared<ConnectionObserverController>();
127 connectionObserverController->AddObserver(observer);
128 connectionObserverController->RemoveObserver(observer);
129 connectionObserverController->NotifyExtensionConnected(connectionData);
130 connectionObserverController->NotifyExtensionDisconnected(connectionData);
131 AbilityRuntime::DlpStateData dlpStateData;
132 connectionObserverController->NotifyDlpAbilityOpened(dlpStateData);
133 connectionObserverController->NotifyDlpAbilityClosed(dlpStateData);
134 connectionObserverController->GetObservers();
135 wptr<IRemoteObject> remote;
136 connectionObserverController->HandleRemoteDied(remote);
137 ConnectionObserverController::ObserverDeathRecipient::ObserverDeathHandler handler;
138 auto observerDeathRecipient =
139 new ConnectionObserverController::ObserverDeathRecipient(handler);
140 observerDeathRecipient->OnRemoteDied(remote);
141
142 // fuzz for ConnectionRecord
143 std::shared_ptr<AbilityRecord> targetService = GetFuzzAbilityRecord();
144 auto connectionRecord = std::make_shared<ConnectionRecord>(token, targetService, connect);
145 connectionRecord->CreateConnectionRecord(token, targetService, connect);
146 ConnectionState state = ConnectionState::CONNECTED;
147 connectionRecord->SetConnectState(state);
148 connectionRecord->GetConnectState();
149 connectionRecord->GetToken();
150 connectionRecord->GetAbilityRecord();
151 connectionRecord->GetAbilityConnectCallback();
152 connectionRecord->ClearConnCallBack();
153 connectionRecord->DisconnectAbility();
154 connectionRecord->CompleteConnect(intParam);
155 connectionRecord->CompleteDisconnect(intParam, boolParam);
156 connectionRecord->ScheduleDisconnectAbilityDone();
157 connectionRecord->ScheduleConnectAbilityDone();
158 connectionRecord->DisconnectTimeout();
159 connectionRecord->ConvertConnectionState(state);
160 connectionRecord->Dump(info);
161 connectionRecord->AttachCallerInfo();
162 connectionRecord->GetCallerUid();
163 connectionRecord->GetCallerPid();
164 connectionRecord->GetCallerName();
165 connectionRecord->GetTargetToken();
166 connectionRecord->GetConnection();
167
168 // fuzz for ConnectionRecord
169 auto connectionStateItem = std::make_shared<ConnectionStateItem>(int32Param, int32Param, stringParam);
170 std::shared_ptr<ConnectionRecord> record;
171 connectionStateItem->CreateConnectionStateItem(record);
172 DataAbilityCaller dataCaller;
173 connectionStateItem->CreateConnectionStateItem(dataCaller);
174 connectionStateItem->AddConnection(record, connectionData);
175 connectionStateItem->RemoveConnection(record, connectionData);
176 std::shared_ptr<DataAbilityRecord> dataAbility;
177 connectionStateItem->AddDataAbilityConnection(dataCaller, dataAbility, connectionData);
178 connectionStateItem->RemoveDataAbilityConnection(dataCaller, dataAbility, connectionData);
179 connectionStateItem->HandleDataAbilityDied(token, connectionData);
180 connectionStateItem->IsEmpty();
181 std::vector<AbilityRuntime::ConnectionData> datas;
182 connectionStateItem->GenerateAllConnectionData(datas);
183 std::shared_ptr<ConnectedExtension> connectedExtension;
184 connectionStateItem->GenerateConnectionData(connectedExtension, connectionData);
185 std::shared_ptr<ConnectedDataAbility> connectedDataAbility;
186 connectionStateItem->GenerateConnectionData(connectedDataAbility, connectionData);
187
188 // fuzz for ConnectionStateManager
189 auto connectionStateManager = std::make_shared<ConnectionStateManager>();
190 connectionStateManager->GetProcessNameByPid(int32Param);
191 connectionStateManager->Init();
192 connectionStateManager->RegisterObserver(observer);
193 connectionStateManager->UnregisterObserver(observer);
194 connectionStateManager->AddConnection(record);
195 connectionStateManager->RemoveConnection(record, boolParam);
196 connectionStateManager->AddDataAbilityConnection(dataCaller, dataAbility);
197 connectionStateManager->RemoveDataAbilityConnection(dataCaller, dataAbility);
198 connectionStateManager->CheckDataAbilityConnectionParams(dataCaller, dataAbility);
199 connectionStateManager->HandleDataAbilityDied(dataAbility);
200 connectionStateManager->HandleDataAbilityCallerDied(int32Param);
201 std::shared_ptr<AbilityRecord> dlpManger = GetFuzzAbilityRecord();
202 connectionStateManager->AddDlpManager(dlpManger);
203 connectionStateManager->RemoveDlpManager(dlpManger);
204 connectionStateManager->AddDlpAbility(dlpManger);
205 connectionStateManager->RemoveDlpAbility(dlpManger);
206 connectionStateManager->HandleAppDied(int32Param);
207 std::vector<AbilityRuntime::DlpConnectionInfo> infos;
208 connectionStateManager->GetDlpConnectionInfos(infos);
209 connectionStateManager->AddConnectionInner(connectionRecord, connectionData);
210 connectionStateManager->RemoveConnectionInner(connectionRecord, connectionData);
211 connectionStateManager->HandleCallerDied(int32Param);
212 connectionStateManager->RemoveDiedCaller(int32Param);
213 connectionStateManager->AddDataAbilityConnectionInner(dataCaller, dataAbility, connectionData);
214 connectionStateManager->RemoveDataAbilityConnectionInner(dataCaller, dataAbility, connectionData);
215 connectionStateManager->HandleDataAbilityDiedInner(token, datas);
216 AbilityRuntime::DlpStateData dlpData;
217 connectionStateManager->HandleDlpAbilityInner(dlpManger, boolParam, dlpData);
218 connectionStateManager->InitAppStateObserver();
219
220 return true;
221 }
222 }
223
224 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)225 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
226 {
227 /* Run your code on data */
228 if (data == nullptr) {
229 return 0;
230 }
231
232 /* Validate the length of size */
233 if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
234 return 0;
235 }
236
237 char* ch = (char *)malloc(size + 1);
238 if (ch == nullptr) {
239 std::cout << "malloc failed." << std::endl;
240 return 0;
241 }
242
243 (void)memset_s(ch, size + 1, 0x00, size + 1);
244 if (memcpy_s(ch, size, data, size) != EOK) {
245 std::cout << "copy failed." << std::endl;
246 free(ch);
247 ch = nullptr;
248 return 0;
249 }
250
251 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
252 free(ch);
253 ch = nullptr;
254 return 0;
255 }
256
257