1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "downloaduploadmanager_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #include "accesstoken_kit.h"
22 #include "js_common.h"
23 #include "message_parcel.h"
24 #include "nativetoken_kit.h"
25 #include "request_manager.h"
26 #include "request_notify.h"
27 #include "request_service_interface.h"
28 #include "token_setproc.h"
29
30 using namespace OHOS::Request;
31
32 namespace OHOS {
33 constexpr size_t THRESHOLD = 10;
34
35 using namespace OHOS::Security::AccessToken;
ConvertToUint32(const uint8_t * ptr,size_t size)36 uint32_t ConvertToUint32(const uint8_t *ptr, size_t size)
37 {
38 if (ptr == nullptr || (size < sizeof(uint32_t))) {
39 return 0;
40 }
41 return *(reinterpret_cast<const uint32_t *>(ptr));
42 }
43
GrantNativePermission()44 void GrantNativePermission()
45 {
46 const char **perms = new const char *[1];
47 perms[0] = "ohos.permission.INTERNET";
48 TokenInfoParams infoInstance = {
49 .dcapsNum = 0,
50 .permsNum = 1,
51 .aclsNum = 0,
52 .dcaps = nullptr,
53 .perms = perms,
54 .acls = nullptr,
55 .processName = "request_service",
56 .aplStr = "system_core",
57 };
58 uint64_t tokenId = GetAccessTokenId(&infoInstance);
59 SetSelfTokenID(tokenId);
60 AccessTokenKit::ReloadNativeTokenInfo();
61 delete[] perms;
62 }
63
CreateRequestFuzzTest(const uint8_t * data,size_t size)64 void CreateRequestFuzzTest(const uint8_t *data, size_t size)
65 {
66 Config config;
67 auto tid = static_cast<int32_t>(size);
68
69 napi_env env = nullptr;
70 napi_value value = nullptr;
71 sptr<RequestNotify> listener_ = new RequestNotify(env, value);
72
73 GrantNativePermission();
74 RequestManager::GetInstance()->Create(config, tid, listener_);
75 }
76
StartRequestFuzzTest(const uint8_t * data,size_t size)77 void StartRequestFuzzTest(const uint8_t *data, size_t size)
78 {
79 std::string tid(reinterpret_cast<const char *>(data), size);
80 GrantNativePermission();
81 RequestManager::GetInstance()->Start(tid);
82 }
83
StopRequestFuzzTest(const uint8_t * data,size_t size)84 void StopRequestFuzzTest(const uint8_t *data, size_t size)
85 {
86 std::string tid(reinterpret_cast<const char *>(data), size);
87 GrantNativePermission();
88 RequestManager::GetInstance()->Stop(tid);
89 }
90
ShowRequestFuzzTest(const uint8_t * data,size_t size)91 void ShowRequestFuzzTest(const uint8_t *data, size_t size)
92 {
93 TaskInfo info;
94 std::string tid(reinterpret_cast<const char *>(data), size);
95 GrantNativePermission();
96 RequestManager::GetInstance()->Show(tid, info);
97 }
98
TouchRequestFuzzTest(const uint8_t * data,size_t size)99 void TouchRequestFuzzTest(const uint8_t *data, size_t size)
100 {
101 TaskInfo info;
102 std::string tid(reinterpret_cast<const char *>(data), size);
103 std::string token(data, data + size);
104 GrantNativePermission();
105 RequestManager::GetInstance()->Touch(tid, token, info);
106 }
107
SearchRequestFuzzTest(const uint8_t * data,size_t size)108 void SearchRequestFuzzTest(const uint8_t *data, size_t size)
109 {
110 Filter filter;
111 std::vector<std::string> tids;
112 std::string str(reinterpret_cast<const char *>(data), size);
113 tids.push_back(str);
114 GrantNativePermission();
115 RequestManager::GetInstance()->Search(filter, tids);
116 }
117
PauseRequestFuzzTest(const uint8_t * data,size_t size)118 void PauseRequestFuzzTest(const uint8_t *data, size_t size)
119 {
120 Version version = static_cast<Version>(ConvertToUint32(data, size));
121 std::string tid(reinterpret_cast<const char *>(data), size);
122 GrantNativePermission();
123 RequestManager::GetInstance()->Pause(tid, version);
124 }
125
QueryMimeTypeRequestFuzzTest(const uint8_t * data,size_t size)126 void QueryMimeTypeRequestFuzzTest(const uint8_t *data, size_t size)
127 {
128 std::string tid(reinterpret_cast<const char *>(data), size);
129 std::string mimeType(data, data + size);
130 GrantNativePermission();
131 RequestManager::GetInstance()->QueryMimeType(tid, mimeType);
132 }
133
RemoveRequestFuzzTest(const uint8_t * data,size_t size)134 void RemoveRequestFuzzTest(const uint8_t *data, size_t size)
135 {
136 Version version = static_cast<Version>(ConvertToUint32(data, size));
137 std::string tid(reinterpret_cast<const char *>(data), size);
138 GrantNativePermission();
139 RequestManager::GetInstance()->Remove(tid, version);
140 }
141
ResumeRequestFuzzTest(const uint8_t * data,size_t size)142 void ResumeRequestFuzzTest(const uint8_t *data, size_t size)
143 {
144 std::string tid(reinterpret_cast<const char *>(data), size);
145 GrantNativePermission();
146 RequestManager::GetInstance()->Resume(tid);
147 }
148
OnRequestFuzzTest(const uint8_t * data,size_t size)149 void OnRequestFuzzTest(const uint8_t *data, size_t size)
150 {
151 std::string tid(reinterpret_cast<const char *>(data), size);
152 std::string type(data, data + size);
153
154 napi_env env = nullptr;
155 napi_value value = nullptr;
156 sptr<RequestNotify> listener_ = new RequestNotify(env, value);
157
158 GrantNativePermission();
159 RequestManager::GetInstance()->On(type, tid, listener_);
160 }
161
OffRequestFuzzTest(const uint8_t * data,size_t size)162 void OffRequestFuzzTest(const uint8_t *data, size_t size)
163 {
164 std::string tid(reinterpret_cast<const char *>(data), size);
165 std::string type(data, data + size);
166 GrantNativePermission();
167 RequestManager::GetInstance()->Off(type, tid);
168 }
169 } // namespace OHOS
170
171 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)172 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
173 {
174 if (size < OHOS::THRESHOLD) {
175 return 0;
176 }
177
178 /* Run your code on data */
179 OHOS::CreateRequestFuzzTest(data, size);
180 OHOS::StartRequestFuzzTest(data, size);
181 OHOS::StopRequestFuzzTest(data, size);
182 OHOS::ShowRequestFuzzTest(data, size);
183 OHOS::TouchRequestFuzzTest(data, size);
184 OHOS::SearchRequestFuzzTest(data, size);
185 OHOS::PauseRequestFuzzTest(data, size);
186 OHOS::QueryMimeTypeRequestFuzzTest(data, size);
187 OHOS::RemoveRequestFuzzTest(data, size);
188 OHOS::ResumeRequestFuzzTest(data, size);
189 OHOS::OnRequestFuzzTest(data, size);
190 OHOS::OffRequestFuzzTest(data, size);
191 return 0;
192 }
193