/* * Copyright (c) 2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "fileaccessservicebaseproxy_fuzzer.h" #include #include "app_file_access_ext_connection.h" #include "file_access_observer_stub.h" #include "file_access_service_client.h" #include "accesstoken_kit.h" #include "file_access_helper.h" #include "iservice_registry.h" #include "token_setproc.h" #include "nativetoken_kit.h" namespace OHOS { using namespace std; using namespace FileAccessFwk; const int ABILITY_ID = 5003; shared_ptr g_fah = nullptr; const int UID_TRANSFORM_TMP = 20000000; const int UID_DEFAULT = 0; template T TypeCast(const uint8_t *data, int *pos = nullptr) { if (pos) { *pos += sizeof(T); } return *(reinterpret_cast(data)); } void SetNativeToken() { uint64_t tokenId; const char *perms[] = { "ohos.permission.FILE_ACCESS_MANAGER", "ohos.permission.GET_BUNDLE_INFO_PRIVILEGED", "ohos.permission.CONNECT_FILE_ACCESS_EXTENSION" }; NativeTokenInfoParams infoInstance = { .dcapsNum = 0, .permsNum = 3, .aclsNum = 0, .dcaps = nullptr, .perms = perms, .acls = nullptr, .aplStr = "system_core", }; infoInstance.processName = "SetUpTestCase"; tokenId = GetAccessTokenId(&infoInstance); const uint64_t systemAppMask = (static_cast(1) << 32); tokenId |= systemAppMask; SetSelfTokenID(tokenId); OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo(); } shared_ptr GetFileAccessHelper() { if (g_fah != nullptr) { return g_fah; } SetNativeToken(); auto saManager = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager(); if (saManager == nullptr) { return nullptr; } auto remoteObj = saManager->GetSystemAbility(ABILITY_ID); AAFwk::Want want; vector wantVec; setuid(UID_TRANSFORM_TMP); int ret = FileAccessHelper::GetRegisteredFileAccessExtAbilityInfo(wantVec); if (ret != OHOS::FileAccessFwk::ERR_OK) { printf("GetRegisteredFileAccessExtAbilityInfo failed."); return nullptr; } bool sus = false; for (size_t i = 0; i < wantVec.size(); i++) { auto element = wantVec[i].GetElement(); if (element.GetBundleName() == "com.ohos.UserFile.ExternalFileManager" && element.GetAbilityName() == "FileExtensionAbility") { want = wantVec[i]; sus = true; break; } } if (!sus) { printf("not found bundleName."); return nullptr; } vector wants {want}; g_fah = FileAccessHelper::Creator(remoteObj, wants); setuid(UID_DEFAULT); if (g_fah == nullptr) { printf("creator fileAccessHelper return nullptr."); return nullptr; } return g_fah; } class TestObserver : public FileAccessObserverStub { public: TestObserver() {}; virtual ~TestObserver() = default; int OnChange(const NotifyMessage ¬ifyMessage) override; }; int TestObserver::OnChange(const NotifyMessage ¬ifyMessage) { return 1; } bool OnChangeFuzzTest(sptr proxy, const uint8_t* data, size_t size) { if (data == nullptr || size < sizeof(NotifyType)) { return true; } int pos = 0; NotifyType notifyType = TypeCast(data, &pos); Uri uri(string(reinterpret_cast(data + pos), size - pos)); proxy->OnChange(uri, notifyType); return true; } bool ConnectFileExtAbilityFuzzTest(sptr proxy, const uint8_t* data, size_t size) { int len = size / 2; string bundleName(reinterpret_cast(data), len); string infoName(reinterpret_cast(data + len), len); AAFwk::Want want; want.SetElementName(bundleName, infoName); auto helper = GetFileAccessHelper(); if (helper == nullptr) { printf("helper is nullptr."); return 0; } auto connectInfo = helper->GetConnectInfo("com.ohos.UserFile.ExternalFileManager"); if (connectInfo == nullptr) { printf("connectInfo is nullptr"); return 0; } auto fileAccessExtConnection = connectInfo->fileAccessExtConnection; if (fileAccessExtConnection == nullptr) { printf("fileAccessExtConnection is nullptr"); } proxy->ConnectFileExtAbility(want, connectInfo->fileAccessExtConnection); proxy->DisConnectFileExtAbility(connectInfo->fileAccessExtConnection); return true; } bool UnregisterNotifyNoObserverFuzzTest(sptr proxy, const uint8_t* data, size_t size) { if (data == nullptr || size < sizeof(bool) || g_fah == nullptr) { return true; } int pos = sizeof(bool); Uri uri(string(reinterpret_cast(data + pos), size - pos)); AAFwk::Want want; want.SetElementName(EXTERNAL_BNUDLE_NAME, "FileExtensionAbility"); sptr info = sptr(new (std::nothrow) ConnectExtensionInfo(want, g_fah->token_)); proxy->UnregisterNotifyNoObserver(uri, *info); return true; } } /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { auto proxy = OHOS::FileAccessFwk::FileAccessServiceClient::GetInstance(); if (proxy == nullptr) { printf("service proxy is nullptr"); return 0; } /* Run your code on data */ OHOS::OnChangeFuzzTest(proxy, data, size); OHOS::ConnectFileExtAbilityFuzzTest(proxy, data, size); OHOS::UnregisterNotifyNoObserverFuzzTest(proxy, data, size); return 0; }