1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstdint>
17 #include <iostream>
18
19 #include "accesstoken_kit.h"
20 #include "nativetoken_kit.h"
21 #include "pixel_map.h"
22 #include "token_setproc.h"
23 #include "wallpaper_manager.h"
24 #include "wallpaper_manager_client.h"
25 #include "wallpaper_manager_common_info.h"
26
27 using namespace OHOS::Security::AccessToken;
28 using namespace OHOS::Media;
29
30 namespace OHOS {
31 constexpr size_t THRESHOLD = 10;
32 constexpr size_t LENGTH = 2;
33 constexpr int32_t OFFSET = 4;
34
GrantNativePermission()35 void GrantNativePermission()
36 {
37 const char **perms = new const char *[2];
38 perms[0] = "ohos.permission.GET_WALLPAPER";
39 perms[1] = "ohos.permission.SET_WALLPAPER";
40 TokenInfoParams infoInstance = {
41 .dcapsNum = 0,
42 .permsNum = 2,
43 .aclsNum = 0,
44 .dcaps = nullptr,
45 .perms = perms,
46 .acls = nullptr,
47 .processName = "wallpaper_service",
48 .aplStr = "system_core",
49 };
50 uint64_t tokenId = GetAccessTokenId(&infoInstance);
51 SetSelfTokenID(tokenId);
52 AccessTokenKit::ReloadNativeTokenInfo();
53 delete[] perms;
54 }
55
56 class WallpaperEventListenerFuzzTestImpl : public OHOS::WallpaperMgrService::WallpaperEventListener {
57 public:
58 std::vector<uint64_t> color_;
59 int32_t wallpaperType_;
60 WallpaperEventListenerFuzzTestImpl();
~WallpaperEventListenerFuzzTestImpl()61 ~WallpaperEventListenerFuzzTestImpl()
62 {
63 }
64
65 WallpaperEventListenerFuzzTestImpl(const WallpaperEventListenerFuzzTestImpl &) = delete;
66 WallpaperEventListenerFuzzTestImpl &operator=(const WallpaperEventListenerFuzzTestImpl &) = delete;
67 WallpaperEventListenerFuzzTestImpl(WallpaperEventListenerFuzzTestImpl &&) = delete;
68 WallpaperEventListenerFuzzTestImpl &operator=(WallpaperEventListenerFuzzTestImpl &&) = delete;
69
70 // callback function will be called when the db data is changed.
71 void OnColorsChange(const std::vector<uint64_t> &color, int32_t wallpaperType);
72
73 private:
74 unsigned long callCount_;
75 };
76
OnColorsChange(const std::vector<uint64_t> & color,int32_t wallpaperType)77 void WallpaperEventListenerFuzzTestImpl::OnColorsChange(const std::vector<uint64_t> &color, int32_t wallpaperType)
78 {
79 callCount_++;
80 std::copy(color.begin(), color.end(), std::back_inserter(color_));
81 wallpaperType_ = wallpaperType;
82 }
83
WallpaperEventListenerFuzzTestImpl()84 WallpaperEventListenerFuzzTestImpl::WallpaperEventListenerFuzzTestImpl() : wallpaperType_(-1), callCount_(0)
85 {
86 }
87
ConvertToUint32(const uint8_t * ptr)88 uint32_t ConvertToUint32(const uint8_t *ptr)
89 {
90 if (ptr == nullptr) {
91 return 0;
92 }
93 uint32_t bigVar = (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
94 return bigVar;
95 }
96
GetColorsFuzzTest(const uint8_t * data,size_t size)97 void GetColorsFuzzTest(const uint8_t *data, size_t size)
98 {
99 uint32_t wallpaperType = ConvertToUint32(data);
100 GrantNativePermission();
101 if (size < LENGTH) {
102 return;
103 }
104 WallpaperMgrService::ApiInfo apiInfo{ static_cast<bool>(data[0] % 2), static_cast<bool>(data[1] % 2) };
105 std::vector<uint64_t> colors;
106 WallpaperMgrService::WallpaperManager::GetInstance().GetColors(wallpaperType, apiInfo, colors);
107 }
108
GetWallpaperIdFuzzTest(const uint8_t * data,size_t size)109 void GetWallpaperIdFuzzTest(const uint8_t *data, size_t size)
110 {
111 uint32_t wallpaperType = ConvertToUint32(data);
112 GrantNativePermission();
113 WallpaperMgrService::WallpaperManager::GetInstance().GetWallpaperId(wallpaperType);
114 }
115
ResetWallpaperFuzzTest(const uint8_t * data,size_t size)116 void ResetWallpaperFuzzTest(const uint8_t *data, size_t size)
117 {
118 uint32_t wallpaperType = ConvertToUint32(data);
119 GrantNativePermission();
120 if (size < LENGTH) {
121 return;
122 }
123 WallpaperMgrService::ApiInfo apiInfo{ static_cast<bool>(data[0] % 2), static_cast<bool>(data[1] % 2) };
124 WallpaperMgrService::WallpaperManager::GetInstance().ResetWallpaper(wallpaperType, apiInfo);
125 }
126
SetWallpaperByUriFuzzTest(const uint8_t * data,size_t size)127 void SetWallpaperByUriFuzzTest(const uint8_t *data, size_t size)
128 {
129 uint32_t wallpaperType = ConvertToUint32(data);
130 data = data + OFFSET;
131 size = size - OFFSET;
132 GrantNativePermission();
133 std::string uri(reinterpret_cast<const char *>(data), size);
134 if (size < LENGTH) {
135 return;
136 }
137 WallpaperMgrService::ApiInfo apiInfo{ static_cast<bool>(data[0] % 2), static_cast<bool>(data[1] % 2) };
138 auto listener = std::make_shared<WallpaperEventListenerFuzzTestImpl>();
139 WallpaperMgrService::WallpaperManager::GetInstance().On("colorChange", listener);
140 WallpaperMgrService::WallpaperManager::GetInstance().SetWallpaper(uri, wallpaperType, apiInfo);
141 WallpaperMgrService::WallpaperManager::GetInstance().Off("colorChange", listener);
142 }
143
SetWallpaperByMapFuzzTest(const uint8_t * data,size_t size)144 void SetWallpaperByMapFuzzTest(const uint8_t *data, size_t size)
145 {
146 uint32_t wallpaperType = ConvertToUint32(data);
147 GrantNativePermission();
148 uint32_t color[100] = { 3, 7, 9, 9, 7, 6 };
149 InitializationOptions opts = { { 5, 7 }, OHOS::Media::PixelFormat::ARGB_8888 };
150 std::unique_ptr<PixelMap> uniquePixelMap = PixelMap::Create(color, sizeof(color) / sizeof(color[0]), opts);
151 std::shared_ptr<PixelMap> pixelMap = std::move(uniquePixelMap);
152 auto listener = std::make_shared<WallpaperEventListenerFuzzTestImpl>();
153 if (size < LENGTH) {
154 return;
155 }
156 WallpaperMgrService::ApiInfo apiInfo{ static_cast<bool>(data[0] % 2), static_cast<bool>(data[1] % 2) };
157 WallpaperMgrService::WallpaperManager::GetInstance().On("colorChange", listener);
158 WallpaperMgrService::WallpaperManager::GetInstance().SetWallpaper(pixelMap, wallpaperType, apiInfo);
159 WallpaperMgrService::WallpaperManager::GetInstance().Off("colorChange", listener);
160 }
161
GetFileFuzzTest(const uint8_t * data,size_t size)162 void GetFileFuzzTest(const uint8_t *data, size_t size)
163 {
164 uint32_t wallpaperType = ConvertToUint32(data);
165 GrantNativePermission();
166 int32_t wallpaperFd = 0;
167 WallpaperMgrService::WallpaperManager::GetInstance().GetFile(wallpaperType, wallpaperFd);
168 }
169
WallpaperManagerFuzzTest(const uint8_t * data,size_t size)170 void WallpaperManagerFuzzTest(const uint8_t *data, size_t size)
171 {
172 auto minHeight = static_cast<int32_t>(size);
173 auto minWidth = static_cast<int32_t>(size);
174 if (size < LENGTH) {
175 return;
176 }
177 WallpaperMgrService::ApiInfo apiInfo{ static_cast<bool>(data[0] % 2), static_cast<bool>(data[1] % 2) };
178 GrantNativePermission();
179 WallpaperMgrService::WallpaperManager::GetInstance().GetWallpaperMinHeight(apiInfo, minHeight);
180 WallpaperMgrService::WallpaperManager::GetInstance().GetWallpaperMinWidth(apiInfo, minWidth);
181 WallpaperMgrService::WallpaperManager::GetInstance().IsChangePermitted();
182 WallpaperMgrService::WallpaperManager::GetInstance().IsOperationAllowed();
183 }
184
GetPixelMapFuzzTest(const uint8_t * data,size_t size)185 void GetPixelMapFuzzTest(const uint8_t *data, size_t size)
186 {
187 uint32_t wallpaperType = ConvertToUint32(data);
188 GrantNativePermission();
189 std::shared_ptr<OHOS::Media::PixelMap> pixelMap;
190 if (size < LENGTH) {
191 return;
192 }
193 WallpaperMgrService::ApiInfo apiInfo{ static_cast<bool>(data[0] % 2), static_cast<bool>(data[1] % 2) };
194 WallpaperMgrService::WallpaperManager::GetInstance().GetPixelMap(wallpaperType, apiInfo, pixelMap);
195 }
196
SetVideoFuzzTest(const uint8_t * data,size_t size)197 void SetVideoFuzzTest(const uint8_t *data, size_t size)
198 {
199 uint32_t wallpaperType = ConvertToUint32(data);
200 data = data + OFFSET;
201 size = size - OFFSET;
202 GrantNativePermission();
203 std::string uri(reinterpret_cast<const char *>(data), size);
204 WallpaperMgrService::WallpaperManager::GetInstance().SetVideo(uri, wallpaperType);
205 }
206
SendEventFuzzTest(const uint8_t * data,size_t size)207 void SendEventFuzzTest(const uint8_t *data, size_t size)
208 {
209 data = data + OFFSET;
210 size = size - OFFSET;
211 GrantNativePermission();
212 std::string eventType(reinterpret_cast<const char *>(data), size);
213 WallpaperMgrService::WallpaperManager::GetInstance().SendEvent(eventType);
214 }
215
SetCustomWallpaperFuzzTest(const uint8_t * data,size_t size)216 void SetCustomWallpaperFuzzTest(const uint8_t *data, size_t size)
217 {
218 uint32_t wallpaperType = ConvertToUint32(data);
219 data = data + OFFSET;
220 size = size - OFFSET;
221 GrantNativePermission();
222 std::string uri(reinterpret_cast<const char *>(data), size);
223 if (size < LENGTH) {
224 return;
225 }
226 WallpaperMgrService::WallpaperManager::GetInstance().SetCustomWallpaper(uri, wallpaperType);
227 }
228
SetAllWallpapersFuzzTest(const uint8_t * data,size_t size)229 void SetAllWallpapersFuzzTest(const uint8_t *data, size_t size)
230 {
231 uint32_t wallpaperType = ConvertToUint32(data);
232 data = data + OFFSET;
233 size = size - OFFSET;
234 GrantNativePermission();
235 std::vector<WallpaperInfo> allWallpaperInfos;
236 WallpaperInfo wallpaperInfo;
237 wallpaperInfo.foldState = FoldState::NORMAL;
238 wallpaperInfo.rotateState = RotateState::PORT;
239 wallpaperInfo.source = std::string(reinterpret_cast<const char *>(data), size);
240 allWallpaperInfos.push_back(wallpaperInfo);
241 WallpaperMgrService::WallpaperManager::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
242 wallpaperType = 0;
243 WallpaperMgrService::WallpaperManager::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
244 }
245
GetCorrespondWallpaperFuzzTest(const uint8_t * data,size_t size)246 void GetCorrespondWallpaperFuzzTest(const uint8_t *data, size_t size)
247 {
248 uint32_t wallpaperType = ConvertToUint32(data);
249 GrantNativePermission();
250 std::shared_ptr<OHOS::Media::PixelMap> pixelMap;
251 WallpaperMgrService::WallpaperManager::GetInstance().GetCorrespondWallpaper(
252 wallpaperType, FoldState::NORMAL, RotateState::PORT, pixelMap);
253 }
254
IsDefaultWallpaperResourceFuzzTest(const uint8_t * data,size_t size)255 void IsDefaultWallpaperResourceFuzzTest(const uint8_t *data, size_t size)
256 {
257 uint32_t userId = ConvertToUint32(data);
258 data = data + OFFSET;
259 size = size - OFFSET;
260 uint32_t wallpaperType = ConvertToUint32(data);
261 GrantNativePermission();
262 WallpaperMgrService::WallpaperManagerClient::GetInstance().IsDefaultWallpaperResource(userId, wallpaperType);
263 WallpaperMgrService::WallpaperManager::GetInstance().IsDefaultWallpaperResource(userId, wallpaperType);
264 }
265
SetAllWallpapersClientFuzzTest(const uint8_t * data,size_t size)266 void SetAllWallpapersClientFuzzTest(const uint8_t *data, size_t size)
267 {
268 uint32_t wallpaperType = ConvertToUint32(data);
269 data = data + OFFSET;
270 size = size - OFFSET;
271 GrantNativePermission();
272 std::vector<WallpaperInfo> allWallpaperInfos;
273 WallpaperInfo wallpaperInfo;
274 wallpaperInfo.foldState = FoldState::NORMAL;
275 wallpaperInfo.rotateState = RotateState::PORT;
276 wallpaperInfo.source = std::string(reinterpret_cast<const char *>(data), size);
277 allWallpaperInfos.push_back(wallpaperInfo);
278 WallpaperMgrService::WallpaperManagerClient::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
279 wallpaperType = 0;
280 WallpaperMgrService::WallpaperManagerClient::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
281 WallpaperMgrService::WallpaperManager::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
282 }
283
284 } // namespace OHOS
285
286 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)287 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
288 {
289 if (data == nullptr || size < OHOS::THRESHOLD) {
290 return 0;
291 }
292 /* Run your code on data */
293 OHOS::GetColorsFuzzTest(data, size);
294 OHOS::GetWallpaperIdFuzzTest(data, size);
295 OHOS::ResetWallpaperFuzzTest(data, size);
296 OHOS::SetWallpaperByUriFuzzTest(data, size);
297 OHOS::SetWallpaperByMapFuzzTest(data, size);
298 OHOS::GetFileFuzzTest(data, size);
299 OHOS::WallpaperManagerFuzzTest(data, size);
300 OHOS::GetPixelMapFuzzTest(data, size);
301 OHOS::SendEventFuzzTest(data, size);
302 OHOS::SetVideoFuzzTest(data, size);
303 OHOS::SetCustomWallpaperFuzzTest(data, size);
304 OHOS::SetAllWallpapersFuzzTest(data, size);
305 OHOS::GetCorrespondWallpaperFuzzTest(data, size);
306 OHOS::IsDefaultWallpaperResourceFuzzTest(data, size);
307 OHOS::SetAllWallpapersClientFuzzTest(data, size);
308 return 0;
309 }