1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "connectionstatemanager_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #define private public
22 #define protected public
23 #include "connection_observer_controller.h"
24 #include "connection_record.h"
25 #include "connection_state_item.h"
26 #include "connection_state_manager.h"
27 #undef protected
28 #undef private
29
30 #include "ability_record.h"
31 #include "continuous_task_callback_info.h"
32
33 using namespace OHOS::AAFwk;
34 using namespace OHOS::AppExecFwk;
35 using namespace OHOS::AbilityRuntime;
36
37 namespace OHOS {
38 namespace {
39 constexpr size_t U32_AT_SIZE = 4;
40 constexpr uint8_t ENABLE = 2;
41 class MyAbilityConnection : public IAbilityConnection {
42 public:
43 MyAbilityConnection() = default;
44 virtual ~MyAbilityConnection() = default;
OnAbilityConnectDone(const AppExecFwk::ElementName & element,const sptr<IRemoteObject> & remoteObject,int resultCode)45 void OnAbilityConnectDone(
46 const AppExecFwk::ElementName& element, const sptr<IRemoteObject>& remoteObject, int resultCode) override
47 {}
OnAbilityDisconnectDone(const AppExecFwk::ElementName & element,int resultCode)48 void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override
49 {}
AsObject()50 sptr<IRemoteObject> AsObject() override
51 {
52 return {};
53 }
54 };
55 class MyAbilityConnectionObserver : public IConnectionObserver {
56 public:
57 MyAbilityConnectionObserver() = default;
58 virtual ~MyAbilityConnectionObserver() = default;
OnExtensionConnected(const ConnectionData & data)59 void OnExtensionConnected(const ConnectionData& data) override
60 {}
OnExtensionDisconnected(const ConnectionData & data)61 void OnExtensionDisconnected(const ConnectionData& data) override
62 {}
63 #ifdef WITH_DLP
OnDlpAbilityOpened(const DlpStateData & data)64 void OnDlpAbilityOpened(const DlpStateData& data) override
65 {}
OnDlpAbilityClosed(const DlpStateData & data)66 void OnDlpAbilityClosed(const DlpStateData& data) override
67 {}
68 #endif // WITH_DLP
AsObject()69 sptr<IRemoteObject> AsObject() override
70 {
71 return {};
72 }
73 };
74 }
75
GetU32Data(const char * ptr)76 uint32_t GetU32Data(const char* ptr)
77 {
78 // convert fuzz input data to an integer
79 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3];
80 }
81
GetFuzzAbilityRecord()82 std::shared_ptr<AbilityRecord> GetFuzzAbilityRecord()
83 {
84 sptr<Token> token = nullptr;
85 AbilityRequest abilityRequest;
86 abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
87 abilityRequest.abilityInfo.name = "MainAbility";
88 abilityRequest.abilityInfo.type = AbilityType::DATA;
89 std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
90 if (!abilityRecord) {
91 return nullptr;
92 }
93 return abilityRecord;
94 }
95
GetFuzzAbilityToken()96 sptr<Token> GetFuzzAbilityToken()
97 {
98 sptr<Token> token = nullptr;
99 std::shared_ptr<AbilityRecord> abilityRecord = GetFuzzAbilityRecord();
100 if (abilityRecord) {
101 token = abilityRecord->GetToken();
102 }
103 return token;
104 }
105
DoSomethingInterestingWithMyAPI(const char * data,size_t size)106 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
107 {
108 bool boolParam = *data % ENABLE;
109 int intParam = static_cast<int>(GetU32Data(data));
110 int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
111 std::string stringParam(data, size);
112 Parcel wantParcel;
113 Want* want = nullptr;
114 if (wantParcel.WriteBuffer(data, size)) {
115 want = Want::Unmarshalling(wantParcel);
116 if (!want) {
117 return false;
118 }
119 }
120 sptr<IRemoteObject> token = GetFuzzAbilityToken();
121 sptr<IAbilityConnection> connect = new MyAbilityConnection();
122 sptr<AbilityRuntime::IConnectionObserver> observer = new MyAbilityConnectionObserver();
123 std::vector<std::string> info;
124 AbilityRuntime::ConnectionData connectionData;
125
126 // fuzz for ConnectionObserverController
127 auto connectionObserverController = std::make_shared<ConnectionObserverController>();
128 connectionObserverController->AddObserver(observer);
129 connectionObserverController->RemoveObserver(observer);
130 connectionObserverController->NotifyExtensionConnected(connectionData);
131 connectionObserverController->NotifyExtensionDisconnected(connectionData);
132 #ifdef WITH_DLP
133 AbilityRuntime::DlpStateData dlpStateData;
134 connectionObserverController->NotifyDlpAbilityOpened(dlpStateData);
135 connectionObserverController->NotifyDlpAbilityClosed(dlpStateData);
136 #endif // WITH_DLP
137 connectionObserverController->GetObservers();
138 wptr<IRemoteObject> remote;
139 connectionObserverController->HandleRemoteDied(remote);
140 ConnectionObserverController::ObserverDeathRecipient::ObserverDeathHandler handler;
141 std::shared_ptr<ConnectionObserverController::ObserverDeathRecipient> observerDeathRecipient =
142 std::make_shared<ConnectionObserverController::ObserverDeathRecipient>(handler);
143 observerDeathRecipient->OnRemoteDied(remote);
144
145 // fuzz for ConnectionRecord
146 std::shared_ptr<AbilityRecord> targetService = GetFuzzAbilityRecord();
147 auto connectionRecord = std::make_shared<ConnectionRecord>(token, targetService, connect, nullptr);
148 connectionRecord->CreateConnectionRecord(token, targetService, connect, nullptr);
149 ConnectionState state = ConnectionState::CONNECTED;
150 connectionRecord->SetConnectState(state);
151 connectionRecord->GetConnectState();
152 connectionRecord->GetToken();
153 connectionRecord->GetAbilityRecord();
154 connectionRecord->GetAbilityConnectCallback();
155 connectionRecord->ClearConnCallBack();
156 connectionRecord->DisconnectAbility();
157 connectionRecord->CompleteConnect();
158 connectionRecord->CompleteDisconnect(intParam, boolParam);
159 connectionRecord->ScheduleDisconnectAbilityDone();
160 connectionRecord->ScheduleConnectAbilityDone();
161 connectionRecord->DisconnectTimeout();
162 connectionRecord->ConvertConnectionState(state);
163 connectionRecord->Dump(info);
164 connectionRecord->AttachCallerInfo();
165 connectionRecord->GetCallerUid();
166 connectionRecord->GetCallerPid();
167 connectionRecord->GetCallerName();
168 connectionRecord->GetTargetToken();
169 connectionRecord->GetConnection();
170
171 // fuzz for ConnectionRecord
172 auto connectionStateItem = std::make_shared<ConnectionStateItem>(int32Param, int32Param, stringParam);
173 std::shared_ptr<ConnectionRecord> record;
174 connectionStateItem->CreateConnectionStateItem(record);
175 DataAbilityCaller dataCaller;
176 connectionStateItem->CreateConnectionStateItem(dataCaller);
177 connectionStateItem->AddConnection(record, connectionData);
178 connectionStateItem->RemoveConnection(record, connectionData);
179 std::shared_ptr<DataAbilityRecord> dataAbility;
180 connectionStateItem->AddDataAbilityConnection(dataCaller, dataAbility, connectionData);
181 connectionStateItem->RemoveDataAbilityConnection(dataCaller, dataAbility, connectionData);
182 connectionStateItem->HandleDataAbilityDied(token, connectionData);
183 connectionStateItem->IsEmpty();
184 std::vector<AbilityRuntime::ConnectionData> datas;
185 connectionStateItem->GenerateAllConnectionData(datas);
186 std::shared_ptr<ConnectedExtension> connectedExtension;
187 connectionStateItem->GenerateConnectionData(connectedExtension, connectionData);
188 std::shared_ptr<ConnectedDataAbility> connectedDataAbility;
189 connectionStateItem->GenerateConnectionData(connectedDataAbility, connectionData);
190
191 // fuzz for ConnectionStateManager
192 auto connectionStateManager = std::make_shared<ConnectionStateManager>();
193 connectionStateManager->GetProcessNameByPid(int32Param);
194 connectionStateManager->Init();
195 connectionStateManager->RegisterObserver(observer);
196 connectionStateManager->UnregisterObserver(observer);
197 connectionStateManager->AddConnection(record);
198 connectionStateManager->RemoveConnection(record, boolParam);
199 connectionStateManager->AddDataAbilityConnection(dataCaller, dataAbility);
200 connectionStateManager->RemoveDataAbilityConnection(dataCaller, dataAbility);
201 connectionStateManager->CheckDataAbilityConnectionParams(dataCaller, dataAbility);
202 connectionStateManager->HandleDataAbilityDied(dataAbility);
203 connectionStateManager->HandleDataAbilityCallerDied(int32Param);
204 #ifdef WITH_DLP
205 std::shared_ptr<AbilityRecord> dlpManger = GetFuzzAbilityRecord();
206 connectionStateManager->AddDlpManager(dlpManger);
207 connectionStateManager->RemoveDlpManager(dlpManger);
208 connectionStateManager->AddDlpAbility(dlpManger);
209 connectionStateManager->RemoveDlpAbility(dlpManger);
210 #endif // WITH_DLP
211 connectionStateManager->HandleAppDied(int32Param);
212 #ifdef WITH_DLP
213 std::vector<AbilityRuntime::DlpConnectionInfo> infos;
214 connectionStateManager->GetDlpConnectionInfos(infos);
215 #endif // WITH_DLP
216 connectionStateManager->AddConnectionInner(connectionRecord, connectionData);
217 connectionStateManager->RemoveConnectionInner(connectionRecord, connectionData);
218 connectionStateManager->HandleCallerDied(int32Param);
219 connectionStateManager->RemoveDiedCaller(int32Param);
220 connectionStateManager->AddDataAbilityConnectionInner(dataCaller, dataAbility, connectionData);
221 connectionStateManager->RemoveDataAbilityConnectionInner(dataCaller, dataAbility, connectionData);
222 connectionStateManager->HandleDataAbilityDiedInner(token, datas);
223 #ifdef WITH_DLP
224 AbilityRuntime::DlpStateData dlpData;
225 connectionStateManager->HandleDlpAbilityInner(dlpManger, boolParam, dlpData);
226 #endif // WITH_DLP
227 connectionStateManager->InitAppStateObserver();
228 if (want) {
229 delete want;
230 want = nullptr;
231 }
232 return true;
233 }
234 }
235
236 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)237 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
238 {
239 /* Run your code on data */
240 if (data == nullptr) {
241 return 0;
242 }
243
244 /* Validate the length of size */
245 if (size < OHOS::U32_AT_SIZE) {
246 return 0;
247 }
248
249 char* ch = static_cast<char*>(malloc(size + 1));
250 if (ch == nullptr) {
251 std::cout << "malloc failed." << std::endl;
252 return 0;
253 }
254
255 (void)memset_s(ch, size + 1, 0x00, size + 1);
256 if (memcpy_s(ch, size, data, size) != EOK) {
257 std::cout << "copy failed." << std::endl;
258 free(ch);
259 ch = nullptr;
260 return 0;
261 }
262
263 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
264 free(ch);
265 ch = nullptr;
266 return 0;
267 }
268
269