1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "uiabilitylifecyclemanagera_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #define private public
22 #include "ui_ability_lifecycle_manager.h"
23 #undef private
24
25 #include "ability_record.h"
26
27 using namespace OHOS::AAFwk;
28 using namespace OHOS::AppExecFwk;
29
30 namespace OHOS {
31 namespace {
32 constexpr int INPUT_ZERO = 0;
33 constexpr int INPUT_ONE = 1;
34 constexpr int INPUT_TWO = 2;
35 constexpr int INPUT_THREE = 3;
36 constexpr size_t U32_AT_SIZE = 4;
37 constexpr size_t OFFSET_ZERO = 24;
38 constexpr size_t OFFSET_ONE = 16;
39 constexpr size_t OFFSET_TWO = 8;
40 constexpr uint8_t ENABLE = 2;
41 } // namespace
42
GetU32Data(const char * ptr)43 uint32_t GetU32Data(const char* ptr)
44 {
45 // convert fuzz input data to an integer
46 return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
47 ptr[INPUT_THREE];
48 }
49
GetFuzzAbilityToken()50 sptr<Token> GetFuzzAbilityToken()
51 {
52 sptr<Token> token = nullptr;
53 AbilityRequest abilityRequest;
54 abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
55 abilityRequest.abilityInfo.name = "MainAbility";
56 abilityRequest.abilityInfo.type = AbilityType::DATA;
57 std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
58 if (abilityRecord) {
59 token = abilityRecord->GetToken();
60 }
61 return token;
62 }
63
DoSomethingInterestingWithMyAPI1(const char * data,size_t size)64 void DoSomethingInterestingWithMyAPI1(const char *data, size_t size)
65 {
66 int32_t userId = static_cast<int32_t>(GetU32Data(data));
67 auto uIAbilityLifecycleManager = std::make_shared<UIAbilityLifecycleManager>(userId);
68 Want want1;
69 bool boolParam = *data % ENABLE;
70 std::string strParam(data, size);
71 int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
72 uint32_t requestId = static_cast<uint32_t>(GetU32Data(data));
73 uIAbilityLifecycleManager->OnAcceptWantResponse(want1, strParam, requestId);
74 uIAbilityLifecycleManager->OnStartSpecifiedProcessResponse(want1, strParam, requestId);
75 uIAbilityLifecycleManager->OnStartSpecifiedAbilityTimeoutResponse(want1, requestId);
76 uIAbilityLifecycleManager->OnStartSpecifiedProcessTimeoutResponse(want1, requestId);
77 uIAbilityLifecycleManager->StartSpecifiedAbilityBySCB(want1);
78 sptr<IRemoteObject> callStub;
79 std::shared_ptr<AbilityRecord> abilityRecord4;
80 uIAbilityLifecycleManager->CallRequestDone(abilityRecord4, callStub);
81 sptr<IAbilityConnection> connect;
82 AppExecFwk::ElementName element;
83 sptr<IRemoteObject> token = GetFuzzAbilityToken();
84 uIAbilityLifecycleManager->ReleaseCallLocked(connect, element);
85 std::shared_ptr<CallRecord> callRecord;
86 uIAbilityLifecycleManager->OnCallConnectDied(callRecord);
87 uIAbilityLifecycleManager->GetSessionIdByAbilityToken(token);
88 std::vector<std::string> abilityList;
89 uIAbilityLifecycleManager->GetActiveAbilityList(int32Param, abilityList, int32Param);
90 std::shared_ptr<AbilityRecord> abilityRecord5;
91 uIAbilityLifecycleManager->PrepareTerminateAbility(abilityRecord5, false);
92 uIAbilityLifecycleManager->GetAbilityRecordsById(int32Param);
93 uIAbilityLifecycleManager->CheckAbilityNumber(strParam, strParam, strParam);
94 uIAbilityLifecycleManager->MoreAbilityNumbersSendEventInfo(int32Param, strParam, strParam, strParam);
95 AppInfo info;
96 info.state = AppState::TERMINATED;
97 uIAbilityLifecycleManager->OnAppStateChanged(info);
98 info.state = AppState::END;
99 uIAbilityLifecycleManager->OnAppStateChanged(info);
100 }
101
DoSomethingInterestingWithMyAPI(const char * data,size_t size)102 bool DoSomethingInterestingWithMyAPI(const char *data, size_t size)
103 {
104 int32_t userId = static_cast<int32_t>(GetU32Data(data));
105 auto uIAbilityLifecycleManager = std::make_shared<UIAbilityLifecycleManager>(userId);
106 std::string strParam(data, size);
107 int32_t uid = static_cast<int32_t>(GetU32Data(data));
108 uIAbilityLifecycleManager->SignRestartAppFlag(uid, strParam);
109 AbilityRequest abilityRequest;
110 sptr<SessionInfo> sessionInfo;
111 uint32_t sceneFlag = GetU32Data(data);
112 bool boolParam = *data % ENABLE;
113 uIAbilityLifecycleManager->StartUIAbility(abilityRequest, sessionInfo, sceneFlag, boolParam);
114 sptr<IRemoteObject> token = GetFuzzAbilityToken();
115 int intParam = static_cast<int>(GetU32Data(data));
116 AppExecFwk::PacMap saveData;
117 uIAbilityLifecycleManager->AbilityTransactionDone(token, intParam, saveData);
118 sptr<IAbilityScheduler> scheduler;
119 uIAbilityLifecycleManager->AttachAbilityThread(scheduler, token);
120 int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
121 uIAbilityLifecycleManager->OnAbilityRequestDone(token, int32Param);
122 uIAbilityLifecycleManager->IsContainsAbility(token);
123 uIAbilityLifecycleManager->NotifySCBToMinimizeUIAbility(token);
124 std::shared_ptr<AbilityRecord> abilityRecord1;
125 uIAbilityLifecycleManager->MinimizeUIAbility(abilityRecord1, boolParam, sceneFlag);
126 sptr<SessionInfo> sessionInfo1;
127 uIAbilityLifecycleManager->GetUIAbilityRecordBySessionInfo(sessionInfo1);
128 Want *want;
129 std::shared_ptr<AbilityRecord> abilityRecord2;
130 uIAbilityLifecycleManager->CloseUIAbility(abilityRecord2, intParam, want, boolParam);
131 sptr<IRemoteObject> rootSceneSession;
132 uIAbilityLifecycleManager->SetRootSceneSession(rootSceneSession);
133 AbilityRequest abilityRequest1;
134 uIAbilityLifecycleManager->NotifySCBToStartUIAbility(abilityRequest1);
135 sptr<SessionInfo> sessionInfo2;
136 AbilityRequest abilityRequest2;
137 uIAbilityLifecycleManager->NotifySCBToPreStartUIAbility(abilityRequest2, sessionInfo2);
138 uint32_t msgId = static_cast<uint32_t>(GetU32Data(data));
139 int64_t abilityRecordId = static_cast<int64_t>(GetU32Data(data));
140 uIAbilityLifecycleManager->OnTimeOut(msgId, abilityRecordId, boolParam);
141 std::shared_ptr<AbilityRecord> abilityRecord3;
142 AbilityRequest abilityRequest3;
143 uIAbilityLifecycleManager->OnAbilityDied(abilityRecord3);
144 uIAbilityLifecycleManager->ResolveLocked(abilityRequest3);
145 sptr<SessionInfo> sessionInfo3;
146 uIAbilityLifecycleManager->CallUIAbilityBySCB(sessionInfo3, boolParam);
147 DoSomethingInterestingWithMyAPI1(data, size);
148
149 return true;
150 }
151 } // namespace OHOS
152
153 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)154 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
155 {
156 /* Run your code on data */
157 if (data == nullptr) {
158 std::cout << "invalid data" << std::endl;
159 return 0;
160 }
161
162 /* Validate the length of size */
163 if (size < OHOS::U32_AT_SIZE) {
164 return 0;
165 }
166
167 char *ch = static_cast<char*>(malloc(size + 1));
168 if (ch == nullptr) {
169 std::cout << "malloc failed." << std::endl;
170 return 0;
171 }
172
173 (void)memset_s(ch, size + 1, 0x00, size + 1);
174 if (memcpy_s(ch, size + 1, data, size) != EOK) {
175 std::cout << "copy failed." << std::endl;
176 free(ch);
177 ch = nullptr;
178 return 0;
179 }
180
181 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
182 free(ch);
183 ch = nullptr;
184 return 0;
185 }