1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "externalfileaccessscanfile_fuzzer.h"
16
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include <memory>
21
22 #include "extension_base.h"
23 #include "extension_context.h"
24 #include "message_parcel.h"
25 #include "file_access_ext_stub.h"
26 #include "file_access_ext_stub_impl.h"
27 #include "file_access_ext_ability.h"
28 #include "js_file_access_ext_ability.h"
29 #include "js_runtime.h"
30 #include "securec.h"
31 #include "nativetoken_kit.h"
32 #include "token_setproc.h"
33 #include "accesstoken_kit.h"
34
35 namespace OHOS {
36 using namespace std;
37 using namespace OHOS;
38 using namespace FileAccessFwk;
39 using namespace AbilityRuntime;
40 constexpr size_t FOO_MAX_LEN = 1024;
41 constexpr size_t U32_AT_SIZE = 4;
42
43
44 enum {
45 TOKEN_INDEX_ONE = 0,
46 };
47
SetNativeToken()48 void SetNativeToken()
49 {
50 uint64_t tokenId;
51 const char **perms = new const char *[2];
52 perms[0] = "ohos.permission.FILE_ACCESS_MANAGER";
53 perms[1] = "ohos.permission.GET_BUNDLE_INFO_PRIVILEGED";
54 NativeTokenInfoParams infoInstance = {
55 .dcapsNum = 0,
56 .permsNum = 2,
57 .aclsNum = 0,
58 .dcaps = nullptr,
59 .perms = perms,
60 .acls = nullptr,
61 .aplStr = "system_core",
62 };
63
64 infoInstance.processName = "ExternalFileAccessScanFileFuzzTest";
65 tokenId = GetAccessTokenId(&infoInstance);
66 const uint64_t systemAppMask = (static_cast<uint64_t>(1) << 32);
67 tokenId |= systemAppMask;
68 SetSelfTokenID(tokenId);
69 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
70 delete[] perms;
71 }
72
ExternalFileAccessScanFileFuzzTest(std::unique_ptr<char[]> data,size_t size)73 bool ExternalFileAccessScanFileFuzzTest(std::unique_ptr<char[]> data, size_t size)
74 {
75 SetNativeToken();
76 // CMD_SCANFILE
77 uint32_t code = 9;
78 MessageParcel datas;
79 datas.WriteInterfaceToken(FileAccessExtStub::GetDescriptor());
80 datas.WriteBuffer(data.get(), size);
81 datas.RewindRead(0);
82 MessageParcel reply;
83 MessageOption option;
84
85 auto fileAccessExtAbility = FileAccessExtAbility::Create(nullptr);
86 auto fileAccessExtAbilitySharePtr = std::shared_ptr<FileAccessExtAbility>(fileAccessExtAbility);
87
88 sptr<FileAccessExtStubImpl> fileAccessExtStubObj(new (std::nothrow) FileAccessExtStubImpl(
89 fileAccessExtAbilitySharePtr, nullptr));
90
91 fileAccessExtStubObj->OnRemoteRequest(code, datas, reply, option);
92
93 fileAccessExtAbility = nullptr;
94 fileAccessExtStubObj = nullptr;
95
96 return true;
97 }
98 } // namespace OHOS
99
100 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)101 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
102 {
103 /* Run your code on data */
104 if (data == nullptr) {
105 return 0;
106 }
107
108 /* Validate the length of size */
109 if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
110 return 0;
111 }
112
113 auto str = std::make_unique<char[]>(size + 1);
114 (void)memset_s(str.get(), size + 1, 0x00, size + 1);
115 if (memcpy_s(str.get(), size, data, size) != EOK) {
116 return 0;
117 }
118
119 OHOS::ExternalFileAccessScanFileFuzzTest(move(str), size);
120 return 0;
121 }
122