1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "servicereverse_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <cstring>
21
22 #include <climits>
23 #include "message_parcel.h"
24 #include "b_session_backup.h"
25 #include "b_session_restore.h"
26 #include "b_incremental_backup_session.h"
27 #include "b_incremental_restore_session.h"
28 #include "i_service_reverse_ipc_interface_code.h"
29 #include "service_reverse_stub.h"
30 #include "service_reverse.h"
31 #include "securec.h"
32
33 using namespace OHOS::FileManagement::Backup;
34
35 namespace OHOS {
36 constexpr size_t U32_AT_SIZE = 4;
37 constexpr uint8_t MAX_CALL_TRANSACTION = 24;
38 constexpr int32_t SHIFT_FIRST = 24;
39 constexpr int32_t SHIFT_SECOND = 16;
40 constexpr int32_t SHIFT_THIRD = 8;
41 constexpr int32_t ZERO_NUM = 0;
42 constexpr int32_t FIRST_NUM = 1;
43 constexpr int32_t SECOND_NUM = 2;
44 constexpr int32_t THIRD_NUM = 3;
45
ConvertToUint32(const uint8_t * ptr)46 uint32_t ConvertToUint32(const uint8_t* ptr)
47 {
48 if (ptr == nullptr) {
49 return 0;
50 }
51 return (ptr[ZERO_NUM] << SHIFT_FIRST) | (ptr[FIRST_NUM] << SHIFT_SECOND) |
52 (ptr[SECOND_NUM] << SHIFT_THIRD) | (ptr[THIRD_NUM]);
53 }
54
BackupFuzzTest(const uint8_t * data,size_t size)55 bool BackupFuzzTest(const uint8_t *data, size_t size)
56 {
57 /* Validate the length of size */
58 if (data == nullptr || size < U32_AT_SIZE) {
59 return false;
60 }
61
62 uint32_t code = ConvertToUint32(data);
63 if (code > static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_BACKUP_ON_TASK_FINISHED)) {
64 return true;
65 }
66
67 MessageParcel datas;
68 datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
69 datas.WriteBuffer(data, size);
70 datas.RewindRead(0);
71 MessageParcel reply;
72 MessageOption option;
73
74 BSessionBackup::Callbacks callbacks;
75 std::shared_ptr<ServiceReverse> backupPtr =
76 std::make_shared<ServiceReverse>(callbacks);
77 backupPtr->OnRemoteRequest(code % MAX_CALL_TRANSACTION, datas, reply, option);
78 return true;
79 }
80
RestoreFuzzTest(const uint8_t * data,size_t size)81 bool RestoreFuzzTest(const uint8_t *data, size_t size)
82 {
83 /* Validate the length of size */
84 if (data == nullptr || size < U32_AT_SIZE) {
85 return false;
86 }
87
88 uint32_t code = ConvertToUint32(data);
89 if (code < static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_RESTORE_ON_SUB_TASK_STARTED) ||
90 code > static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_RESTORE_ON_FILE_READY)) {
91 return true;
92 }
93
94 MessageParcel datas;
95 datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
96 datas.WriteBuffer(data, size);
97 datas.RewindRead(0);
98 MessageParcel reply;
99 MessageOption option;
100
101 BSessionRestore::Callbacks callbacks;
102 std::shared_ptr<ServiceReverse> restorePtr =
103 std::make_shared<ServiceReverse>(callbacks);
104 restorePtr->OnRemoteRequest(code % MAX_CALL_TRANSACTION, datas, reply, option);
105 return true;
106 }
107
IncrementalBackupFuzzTest(const uint8_t * data,size_t size)108 bool IncrementalBackupFuzzTest(const uint8_t *data, size_t size)
109 {
110 /* Validate the length of size */
111 if (data == nullptr || size < U32_AT_SIZE) {
112 return false;
113 }
114
115 uint32_t code = ConvertToUint32(data);
116 if (code < static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_INCREMENTAL_BACKUP_ON_FILE_READY) ||
117 code > static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_INCREMENTAL_BACKUP_ON_TASK_FINISHED)) {
118 return true;
119 }
120
121 MessageParcel datas;
122 datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
123 datas.WriteBuffer(data, size);
124 datas.RewindRead(0);
125 MessageParcel reply;
126 MessageOption option;
127
128 BIncrementalBackupSession::Callbacks callbacks;
129 std::shared_ptr<ServiceReverse> backupPtr =
130 std::make_shared<ServiceReverse>(callbacks);
131 backupPtr->OnRemoteRequest(code % MAX_CALL_TRANSACTION, datas, reply, option);
132 return true;
133 }
134
IncrementalRestoreFuzzTest(const uint8_t * data,size_t size)135 bool IncrementalRestoreFuzzTest(const uint8_t *data, size_t size)
136 {
137 /* Validate the length of size */
138 if (data == nullptr || size < U32_AT_SIZE) {
139 return false;
140 }
141
142 uint32_t code = ConvertToUint32(data);
143 if (code < static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_INCREMENTAL_RESTORE_ON_SUB_TASK_STARTED) ||
144 code > static_cast<uint32_t>(IServiceReverseInterfaceCode::SERVICER_INCREMENTAL_RESTORE_ON_FILE_READY)) {
145 return true;
146 }
147
148 MessageParcel datas;
149 datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
150 datas.WriteBuffer(data, size);
151 datas.RewindRead(0);
152 MessageParcel reply;
153 MessageOption option;
154
155 BIncrementalRestoreSession::Callbacks callbacks;
156 std::shared_ptr<ServiceReverse> restorePtr =
157 std::make_shared<ServiceReverse>(callbacks);
158 restorePtr->OnRemoteRequest(code % MAX_CALL_TRANSACTION, datas, reply, option);
159 return true;
160 }
161 } // namespace OHOS
162
163 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)164 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
165 {
166 OHOS::BackupFuzzTest(data, size);
167 OHOS::RestoreFuzzTest(data, size);
168 OHOS::IncrementalBackupFuzzTest(data, size);
169 OHOS::IncrementalRestoreFuzzTest(data, size);
170 return 0;
171 }