1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "registerselfpermstatechangecallbackstub_fuzzer.h"
17
18 #include <string>
19 #include <thread>
20 #include <vector>
21 #undef private
22 #include "access_token.h"
23 #include "accesstoken_fuzzdata.h"
24 #define private public
25 #include "accesstoken_id_manager.h"
26 #include "accesstoken_kit.h"
27 #include "accesstoken_manager_client.h"
28 #include "accesstoken_manager_service.h"
29 #include "i_accesstoken_manager.h"
30 #include "token_setproc.h"
31
32 using namespace std;
33 using namespace OHOS::Security::AccessToken;
34 static uint64_t g_selfTokenId = 0;
35 static uint64_t g_mockTokenId = 0;
36 const int32_t CONSTANTS_NUMBER_TWO = 2;
37
38 class CbCustomizeTest2 : public PermStateChangeCallbackCustomize {
39 public:
CbCustomizeTest2(const PermStateChangeScope & scopeInfo)40 explicit CbCustomizeTest2(const PermStateChangeScope &scopeInfo)
41 : PermStateChangeCallbackCustomize(scopeInfo)
42 {
43 }
44
~CbCustomizeTest2()45 ~CbCustomizeTest2()
46 {}
47
PermStateChangeCallback(PermStateChangeInfo & result)48 virtual void PermStateChangeCallback(PermStateChangeInfo& result)
49 {
50 ready_ = true;
51 }
52
53 bool ready_ = false;
54 };
55
56 namespace OHOS {
GetHapToken()57 void GetHapToken()
58 {
59 if (g_mockTokenId != 0) {
60 SetSelfTokenID(g_mockTokenId);
61 return;
62 }
63 HapInfoParams infoParams = {
64 .userID = 0,
65 .bundleName = "registerselfpermstatechangecallbackstub.fuzzer",
66 .instIndex = 0,
67 .appIDDesc = "fuzzer",
68 .apiVersion = 8
69 };
70
71 HapPolicyParams policyParams = {
72 .apl = APL_SYSTEM_CORE,
73 .domain = "test_domain"
74 };
75
76 AccessTokenIDEx fullTokenId = AccessTokenKit::AllocHapToken(infoParams, policyParams);
77 g_mockTokenId = fullTokenId.tokenIDEx;
78 SetSelfTokenID(g_mockTokenId);
79 AccessTokenIDManager::GetInstance().tokenIdSet_.insert(fullTokenId.tokenIdExStruct.tokenID);
80 }
81
RegisterSelfPermStateChangeCallbackStubFuzzTest(const uint8_t * data,size_t size)82 bool RegisterSelfPermStateChangeCallbackStubFuzzTest(const uint8_t* data, size_t size)
83 {
84 if ((data == nullptr) || (size == 0)) {
85 return false;
86 }
87
88 AccessTokenFuzzData fuzzData(data, size);
89 AccessTokenID tokenId = fuzzData.GetData<AccessTokenID>();
90 std::string testName(fuzzData.GenerateStochasticString());
91
92 PermStateChangeScope scopeInfo;
93 scopeInfo.permList = { testName };
94 scopeInfo.tokenIDs = { tokenId };
95 auto callbackPtr = std::make_shared<CbCustomizeTest2>(scopeInfo);
96
97 PermStateChangeScopeParcel scopeParcel;
98 scopeParcel.scope = scopeInfo;
99
100 sptr<PermissionStateChangeCallback> callback;
101 callback = new (std::nothrow) PermissionStateChangeCallback(callbackPtr);
102
103 MessageParcel datas;
104 datas.WriteInterfaceToken(IAccessTokenManager::GetDescriptor());
105 if (!datas.WriteParcelable(&scopeParcel)) {
106 return false;
107 }
108 if (!datas.WriteRemoteObject(callback->AsObject())) {
109 return false;
110 }
111
112 uint32_t code = static_cast<uint32_t>(
113 AccessTokenInterfaceCode::REGISTER_SELF_PERM_STATE_CHANGE_CALLBACK);
114
115 MessageParcel reply;
116 MessageOption option;
117 bool enable = ((size % CONSTANTS_NUMBER_TWO) == 0);
118 if (enable) {
119 GetHapToken();
120 } else {
121 SetSelfTokenID(g_selfTokenId);
122 }
123 DelayedSingleton<AccessTokenManagerService>::GetInstance()->OnRemoteRequest(code, datas, reply, option);
124
125 return true;
126 }
127 } // namespace OHOS
128
129 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)130 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
131 {
132 /* Run your code on data */
133 OHOS::RegisterSelfPermStateChangeCallbackStubFuzzTest(data, size);
134 return 0;
135 }
136