1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "devicestandby_fuzzer.h"
17 #include "securec.h"
18 #ifdef DEVICE_STANDBY_ACCESS_TOKEN_ENABLE
19 #include "access_token.h"
20 #include "accesstoken_kit.h"
21 #include "access_token_error.h"
22 #include "nativetoken_kit.h"
23 #include "token_setproc.h"
24 #endif
25 #include "resource_request.h"
26 #include "istandby_service_subscriber.h"
27 #include "standby_service.h"
28 #include "standby_service_log.h"
29 #include "standby_service_subscriber_stub.h"
30
31 namespace OHOS {
32 namespace DevStandbyMgr {
33 constexpr size_t U32_AT_SIZE = 17;
34 constexpr uint32_t MAX_CODE = 13;
35 constexpr uint32_t CONSTANT_ONE = 1;
36 constexpr int32_t CONSTANT_TWO = 2;
37 const std::string STR_TEST = "test";
38 const std::string RSS_NAME = "resource_schedule_service";
39 const std::u16string DEVICE_STANDBY_TOKEN = u"ohos.resourceschedule.IStandbyService";
40 bool g_initFlag = false;
41 sptr<IStandbyServiceSubscriber> subscriber = new StandbyServiceSubscriberStub();
42 std::unique_ptr<ResourceRequest> resourceRequest = std::make_unique<ResourceRequest>(CONSTANT_ONE, CONSTANT_TWO,
43 STR_TEST, CONSTANT_TWO, STR_TEST, CONSTANT_ONE);
44 const uint8_t *g_baseFuzzData = nullptr;
45 size_t g_baseFuzzSize = 0;
46 size_t g_baseFuzzPos;
47 bool g_paramBool;
48 int32_t g_paramInt32;
49 uint32_t g_paramUint32;
50 uint64_t g_paramUint64;
51 std::string g_paramString;
52
GetData()53 template <class T> T GetData()
54 {
55 T object{};
56 size_t objectSize = sizeof(object);
57 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
58 return object;
59 }
60 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
61 if (ret != EOK) {
62 return {};
63 }
64 g_baseFuzzPos += objectSize;
65 return object;
66 }
67
InitParam()68 void InitParam()
69 {
70 g_paramBool = GetData<bool>();
71 g_paramInt32 = GetData<int32_t>();
72 g_paramUint32 = GetData<uint32_t>();
73 g_paramUint64 = GetData<uint64_t>();
74 std::string strParam((const char *) g_baseFuzzData + g_baseFuzzPos, g_baseFuzzSize - g_baseFuzzPos);
75 g_paramString = strParam;
76 }
77
CoverageHandleIsStrategyEnabled()78 void CoverageHandleIsStrategyEnabled()
79 {
80 MessageParcel datas;
81 MessageParcel reply;
82 MessageOption option = {MessageOption::TF_SYNC};
83 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
84 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_IS_STRATEGY_ENABLED),
85 datas, reply, option);
86 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
87 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
88 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_IS_STRATEGY_ENABLED),
89 datas, reply, option);
90 datas.WriteString(g_paramString);
91 datas.RewindRead(0);
92 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
93 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_IS_STRATEGY_ENABLED),
94 datas, reply, option);
95 }
96
CoverageHandleReportWorkSchedulerStatus()97 void CoverageHandleReportWorkSchedulerStatus()
98 {
99 MessageParcel datas;
100 MessageParcel reply;
101 MessageOption option = {MessageOption::TF_SYNC};
102 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
103 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
104 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_REPORT_WORK_SCHEDULER_STATUS),
105 datas, reply, option);
106 datas.WriteBool(g_paramBool);
107 datas.WriteInt32(g_paramInt32);
108 datas.WriteString(g_paramString);
109 datas.RewindRead(0);
110 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
111 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_REPORT_WORK_SCHEDULER_STATUS),
112 datas, reply, option);
113 }
114
CoverageHandleGetAllowList()115 void CoverageHandleGetAllowList()
116 {
117 MessageParcel datas;
118 MessageParcel reply;
119 MessageOption option = {MessageOption::TF_SYNC};
120 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
121 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
122 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_GET_ALLOW_LIST),
123 datas, reply, option);
124 datas.WriteUint32(g_paramUint32);
125 datas.WriteUint32(g_paramUint32);
126 datas.RewindRead(0);
127 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
128 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_GET_ALLOW_LIST),
129 datas, reply, option);
130 }
131
CoverageHandleSubscribeStandbyCallback()132 void CoverageHandleSubscribeStandbyCallback()
133 {
134 MessageParcel datas;
135 MessageParcel reply;
136 MessageOption option;
137 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
138 datas.WriteRemoteObject(subscriber->AsObject());
139 datas.WriteString(g_paramString);
140 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
141 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_SUBSCRIBE_STANDBY_CALLBACK),
142 datas, reply, option);
143 }
144
CoverageHandleUnSubscribeStandbyCallback()145 void CoverageHandleUnSubscribeStandbyCallback()
146 {
147 MessageParcel datas;
148 MessageParcel reply;
149 MessageOption option;
150 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
151 datas.WriteRemoteObject(subscriber->AsObject());
152 datas.WriteString(g_paramString);
153 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
154 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_UNSUBSCRIBE_STANDBY_CALLBACK),
155 datas, reply, option);
156 }
157
CoverageHandleApplyAllowResource()158 void CoverageHandleApplyAllowResource()
159 {
160 MessageParcel datas;
161 MessageParcel reply;
162 MessageOption option;
163 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
164 resourceRequest->Marshalling(datas);
165 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
166 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_APPLY_ALLOW_RESOURCE),
167 datas, reply, option);
168 }
169
CoverageUnHandleApplyAllowResource()170 void CoverageUnHandleApplyAllowResource()
171 {
172 MessageParcel datas;
173 MessageParcel reply;
174 MessageOption option;
175 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
176 resourceRequest->Marshalling(datas);
177 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
178 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_UNAPPLY_ALLOW_RESOURCE),
179 datas, reply, option);
180 }
181
CoverageHandleCommonEvent()182 void CoverageHandleCommonEvent()
183 {
184 MessageParcel datas;
185 MessageParcel reply;
186 MessageOption option;
187 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
188 datas.WriteUint32(g_paramUint32);
189 datas.WriteInt64(g_paramUint64);
190 datas.WriteString(g_paramString);
191 datas.RewindRead(0);
192 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
193 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_HANDLE_EVENT),
194 datas, reply, option);
195 }
196
CoverageHandleSetNatInterval()197 void CoverageHandleSetNatInterval()
198 {
199 MessageParcel datas;
200 MessageParcel reply;
201 MessageOption option;
202 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
203 datas.WriteUint32(g_paramUint32);
204 datas.WriteBool(g_paramBool);
205 datas.WriteUint32(g_paramUint32);
206 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
207 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_SET_NAT_INTERVAL),
208 datas, reply, option);
209 }
210
CoverageHandleDelayHeartBeat()211 void CoverageHandleDelayHeartBeat()
212 {
213 MessageParcel datas;
214 MessageParcel reply;
215 MessageOption option;
216 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
217 datas.WriteInt64(g_paramUint64);
218 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
219 static_cast<uint32_t>(IStandbyServiceIpcCode::COMMAND_DELAY_HEART_BEAT),
220 datas, reply, option);
221 }
222
PreciseCoverage()223 void PreciseCoverage()
224 {
225 CoverageHandleIsStrategyEnabled();
226 CoverageHandleReportWorkSchedulerStatus();
227 CoverageHandleGetAllowList();
228 CoverageHandleSubscribeStandbyCallback();
229 CoverageHandleUnSubscribeStandbyCallback();
230 CoverageHandleApplyAllowResource();
231 CoverageUnHandleApplyAllowResource();
232 CoverageHandleCommonEvent();
233 CoverageHandleSetNatInterval();
234 CoverageHandleDelayHeartBeat();
235 if (g_initFlag) {
236 return;
237 }
238 g_initFlag = true;
239 #ifdef DEVICE_STANDBY_ACCESS_TOKEN_ENABLE
240 auto tokenId = Security::AccessToken::AccessTokenKit::GetNativeTokenId(RSS_NAME);
241 SetSelfTokenID(tokenId);
242 #endif
243 }
244
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)245 bool DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
246 {
247 g_baseFuzzData = data;
248 g_baseFuzzSize = size;
249 g_baseFuzzPos = 0;
250 PreciseCoverage();
251 for (uint32_t i = 0; i < MAX_CODE; i++) {
252 MessageParcel datas;
253 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
254 datas.WriteString(g_paramString);
255 datas.WriteUint32(g_paramUint32);
256 datas.WriteUint32(g_paramUint32);
257 datas.WriteBuffer(data, size);
258 datas.RewindRead(0);
259 MessageParcel reply;
260 MessageOption option;
261 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(i, datas, reply, option);
262 }
263 return true;
264 }
265 } // namespace DevStandbyMgr
266 } // namespace OHOS
267
268 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)269 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
270 {
271 /* Run your code on data */
272 if (data == nullptr) {
273 return 0;
274 }
275
276 if (size < OHOS::DevStandbyMgr::U32_AT_SIZE) {
277 return 0;
278 }
279 OHOS::DevStandbyMgr::DoSomethingInterestingWithMyAPI(data, size);
280 return 0;
281 }
282