1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "abilitychildprocessrecord_fuzzer.h"
16
17 #define private public
18 #include "app_running_record.h"
19 #include "child_process_record.h"
20 #undef private
21 #include "child_process_request.h"
22 #include <cstddef>
23 #include <cstdint>
24 #include <iostream>
25 #include "securec.h"
26 #include "configuration.h"
27 using namespace OHOS::AppExecFwk;
28 using namespace OHOS::AAFwk;
29 namespace OHOS {
30 namespace {
31 constexpr size_t U32_AT_SIZE = 4;
32 constexpr uint8_t ENABLE = 2;
33 }
34
35
GetU32Data(const char * ptr)36 uint32_t GetU32Data(const char* ptr)
37 {
38 // convert fuzz input data to an integer
39 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3];
40 }
41
DoSomethingInterestingWithMyAPI(const char * data,size_t size)42 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
43 {
44 int32_t hostPid = static_cast<int32_t>(GetU32Data(data));
45 ChildProcessRequest request;
46 std::shared_ptr<AppRunningRecord> hostRecord;
47 ChildProcessRecord::CreateChildProcessRecord(hostPid, request, hostRecord);
48 std::string stringParam(data, size);
49 sptr<IRemoteObject> mP;
50 int32_t cd = static_cast<int32_t>(GetU32Data(data));
51 bool flag = *data % ENABLE;
52 ChildProcessRecord::CreateNativeChildProcessRecord(hostPid, stringParam, hostRecord, mP, cd, flag, "");
53 std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
54 int32_t recordId = static_cast<int32_t>(GetU32Data(data));
55 auto appRecord = std::make_shared<AppRunningRecord>(appInfo, recordId, stringParam);
56 auto childRecord = std::make_shared<ChildProcessRecord>(hostPid, request, appRecord);
57 childRecord->SetPid(hostPid);
58 childRecord->GetPid();
59 childRecord->GetHostPid();
60 int32_t uid = static_cast<int32_t>(GetU32Data(data));
61 childRecord->SetUid(uid);
62 childRecord->GetUid();
63 childRecord->GetProcessName();
64 childRecord->GetSrcEntry();
65 childRecord->GetHostRecord();
66 sptr<IChildScheduler> scheduler;
67 childRecord->SetScheduler(scheduler);
68 sptr<AppDeathRecipient> recipient;
69 childRecord->SetDeathRecipient(recipient);
70 childRecord->RegisterDeathRecipient();
71 childRecord-> RemoveDeathRecipient();
72 childRecord-> ScheduleExitProcessSafely();
73 childRecord->isStartWithDebug();
74 childRecord-> GetChildProcessType();
75 childRecord->GetMainProcessCallback();
76 childRecord->ClearMainProcessCallback();
77 std::string entryParams(data, size);
78 childRecord->GetEntryParams();
79 childRecord->MakeProcessName(hostRecord, "");
80 return true;
81 }
82 }
83
84 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)85 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
86 {
87 /* Run your code on data */
88 if (data == nullptr) {
89 std::cout << "invalid data" << std::endl;
90 return 0;
91 }
92
93 /* Validate the length of size */
94 if (size < OHOS::U32_AT_SIZE) {
95 return 0;
96 }
97
98 char* ch = (char*)malloc(size + 1);
99 if (ch == nullptr) {
100 std::cout << "malloc failed." << std::endl;
101 return 0;
102 }
103
104 (void)memset_s(ch, size + 1, 0x00, size + 1);
105 if (memcpy_s(ch, size, data, size) != EOK) {
106 std::cout << "copy failed." << std::endl;
107 free(ch);
108 ch = nullptr;
109 return 0;
110 }
111
112 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
113 free(ch);
114 ch = nullptr;
115 return 0;
116 }
117
118