1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "gnss_fuzzer.h"
17
18 #include <vector>
19 #include <thread>
20
21 #include "ipc_skeleton.h"
22 #include "iremote_object.h"
23
24 #include "cached_locations_callback_napi.h"
25 #include "common_utils.h"
26 #include "constant_definition.h"
27 #include "country_code_callback_napi.h"
28 #include "gnss_ability.h"
29 #include "gnss_ability_proxy.h"
30 #include "gnss_status_callback_napi.h"
31 #include "location.h"
32 #include "location_switch_callback_napi.h"
33 #include "nmea_message_callback_napi.h"
34 #include "subability_common.h"
35 #include "work_record.h"
36 #include "geofence_request.h"
37 #include "if_system_ability_manager.h"
38 #include "system_ability_definition.h"
39 #include "iservice_registry.h"
40
41 namespace OHOS {
42 using namespace OHOS::Location;
43 #ifdef FEATURE_GNSS_SUPPORT
44 const int32_t MIN_DATA_LEN = 4;
45 const int32_t SLEEP_TIMES = 1000;
GnssProxyFuzzTest001(const uint8_t * data,size_t size)46 bool GnssProxyFuzzTest001(const uint8_t* data, size_t size)
47 {
48 if (size < MIN_DATA_LEN) {
49 return true;
50 }
51 int index = 0;
52 sptr<ISystemAbilityManager> sam = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
53 if (sam == nullptr) {
54 LBSLOGE(LOCATOR_STANDARD, "%{public}s: get samgr failed.", __func__);
55 return true;
56 }
57 sptr<IRemoteObject> obj = sam->CheckSystemAbility(LOCATION_GNSS_SA_ID);
58 if (obj == nullptr) {
59 LBSLOGE(LOCATOR_STANDARD, "%{public}s: get remote service failed.", __func__);
60 return true;
61 }
62 auto proxy = sptr<GnssAbilityProxy>(new (std::nothrow) GnssAbilityProxy(obj));
63 proxy->SetEnable(true);
64 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
65 proxy->SetEnable(false);
66 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
67 proxy->RefrashRequirements();
68 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
69 auto gnssCallbackHost =
70 sptr<GnssStatusCallbackNapi>(new (std::nothrow) GnssStatusCallbackNapi());
71 AppIdentity identity;
72 identity.SetPid(data[index++]);
73 proxy->RegisterGnssStatusCallback(gnssCallbackHost, identity);
74 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
75 proxy->UnregisterGnssStatusCallback(gnssCallbackHost);
76 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
77 auto nmeaCallbackHost =
78 sptr<NmeaMessageCallbackNapi>(new (std::nothrow) NmeaMessageCallbackNapi());
79 proxy->RegisterNmeaMessageCallback(nmeaCallbackHost, identity);
80 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
81 proxy->UnregisterNmeaMessageCallback(nmeaCallbackHost);
82 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
83 return true;
84 }
85
GnssProxyFuzzTest002(const uint8_t * data,size_t size)86 bool GnssProxyFuzzTest002(const uint8_t* data, size_t size)
87 {
88 if (size < MIN_DATA_LEN) {
89 return true;
90 }
91 int index = 0;
92 sptr<ISystemAbilityManager> sam = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
93 if (sam == nullptr) {
94 LBSLOGE(LOCATOR_STANDARD, "%{public}s: get samgr failed.", __func__);
95 return true;
96 }
97 sptr<IRemoteObject> obj = sam->CheckSystemAbility(LOCATION_GNSS_SA_ID);
98 if (obj == nullptr) {
99 LBSLOGE(LOCATOR_STANDARD, "%{public}s: get remote service failed.", __func__);
100 return true;
101 }
102 auto proxy = sptr<GnssAbilityProxy>(new (std::nothrow) GnssAbilityProxy(obj));
103 auto cachedRequest = std::make_unique<CachedGnssLocationsRequest>();
104 auto cachedLocationsCallbackHost =
105 sptr<CachedLocationsCallbackNapi>(new (std::nothrow) CachedLocationsCallbackNapi());
106 proxy->RegisterCachedCallback(cachedRequest, cachedLocationsCallbackHost);
107 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
108 proxy->UnregisterCachedCallback(cachedLocationsCallbackHost);
109 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
110 int locSize;
111 proxy->GetCachedGnssLocationsSize(locSize);
112 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
113 proxy->FlushCachedGnssLocations();
114 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
115 std::unique_ptr<LocationCommand> command = std::make_unique<LocationCommand>();
116 proxy->SendCommand(command);
117 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
118 std::shared_ptr<GeofenceRequest> fence = std::make_shared<GeofenceRequest>();
119 proxy->AddFence(fence);
120 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
121 proxy->RemoveFence(fence);
122 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
123 std::vector<std::shared_ptr<OHOS::Location::Location>> locations;
124 proxy->EnableMock();
125 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
126 proxy->DisableMock();
127 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
128 proxy->SetMocked(data[index++], locations);
129 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
130 return true;
131 }
132
GnssProxyFuzzTest003(const uint8_t * data,size_t size)133 bool GnssProxyFuzzTest003(const uint8_t* data, size_t size)
134 {
135 if (size < MIN_DATA_LEN) {
136 return true;
137 }
138 sptr<ISystemAbilityManager> sam = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
139 if (sam == nullptr) {
140 LBSLOGE(LOCATOR_STANDARD, "%{public}s: get samgr failed.", __func__);
141 return true;
142 }
143 sptr<IRemoteObject> obj = sam->CheckSystemAbility(LOCATION_GNSS_SA_ID);
144 if (obj == nullptr) {
145 LBSLOGE(LOCATOR_STANDARD, "%{public}s: get remote service failed.", __func__);
146 return true;
147 }
148 auto proxy = sptr<GnssAbilityProxy>(new (std::nothrow) GnssAbilityProxy(obj));
149 std::shared_ptr<GeofenceRequest> fence = std::make_shared<GeofenceRequest>();
150 int index = 0;
151 fence->SetUid(data[index++]);
152 proxy->AddGnssGeofence(fence);
153 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
154 proxy->RemoveGnssGeofence(fence);
155 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
156 std::vector<CoordinateSystemType> coordinateSystemTypes;
157 proxy->QuerySupportCoordinateSystemType(coordinateSystemTypes);
158 std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIMES));
159 return true;
160 }
161 #endif // FEATURE_GNSS_SUPPORT
162 }
163
164 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)165 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
166 {
167 #ifdef FEATURE_GNSS_SUPPORT
168 /* Run your code on data */
169 OHOS::GnssProxyFuzzTest001(data, size);
170 OHOS::GnssProxyFuzzTest002(data, size);
171 OHOS::GnssProxyFuzzTest003(data, size);
172 #endif // FEATURE_GNSS_SUPPORT
173 return 0;
174 }
175