1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "accessibilityconfig_fuzzer.h"
17 #include "accessibility_config.h"
18 #include "accesstoken_kit.h"
19 #include "nativetoken_kit.h"
20 #include "securec.h"
21 #include "token_setproc.h"
22
23 namespace OHOS {
24 namespace {
25 constexpr size_t DATA_MIN_SIZE = 181;
26 constexpr char END_CHAR = '\0';
27 constexpr size_t LEN = 10;
28 bool g_flag = true;
29 } // namespace
30 using namespace OHOS::Security::AccessToken;
31
32 class ConfigObserver : public OHOS::AccessibilityConfig::AccessibilityConfigObserver {
33 public:
OnConfigChanged(const OHOS::AccessibilityConfig::CONFIG_ID id,const OHOS::AccessibilityConfig::ConfigValue & value)34 void OnConfigChanged(const OHOS::AccessibilityConfig::CONFIG_ID id,
35 const OHOS::AccessibilityConfig::ConfigValue &value) override
36 {
37 }
38 };
39
40 class EnableAbilityListObserver : public OHOS::AccessibilityConfig::AccessibilityEnableAbilityListsObserver {
41 public:
OnEnableAbilityListsStateChanged()42 void OnEnableAbilityListsStateChanged() override
43 {
44 }
OnInstallAbilityListsStateChanged()45 void OnInstallAbilityListsStateChanged() override
46 {
47 }
48 };
49
50 template<class T>
GetObject(T & object,const uint8_t * data,size_t size)51 size_t GetObject(T &object, const uint8_t *data, size_t size)
52 {
53 size_t objectSize = sizeof(object);
54 if (objectSize > size) {
55 return 0;
56 }
57 return memcpy_s(&object, objectSize, data, objectSize) == EOK ? objectSize : 0;
58 }
59
AddPermission()60 void AddPermission()
61 {
62 if (g_flag) {
63 const char *perms[2];
64 perms[0] = OHOS::Accessibility::OHOS_PERMISSION_READ_ACCESSIBILITY_CONFIG.c_str();
65 perms[1] = OHOS::Accessibility::OHOS_PERMISSION_WRITE_ACCESSIBILITY_CONFIG.c_str();
66 NativeTokenInfoParams infoInstance = {
67 .dcapsNum = 0,
68 .permsNum = 2,
69 .aclsNum = 0,
70 .dcaps = nullptr,
71 .perms = perms,
72 .acls = nullptr,
73 .processName = "com.accessibility.config.fuzzer.test",
74 .aplStr = "normal",
75 };
76 uint64_t tokenId = GetAccessTokenId(&infoInstance);
77 SetSelfTokenID(tokenId);
78 AccessTokenKit::ReloadNativeTokenInfo();
79 g_flag = false;
80 }
81 }
82
GenerateCaptionProperty(OHOS::AccessibilityConfig::CaptionProperty & property,const uint8_t * data,size_t size)83 static size_t GenerateCaptionProperty(
84 OHOS::AccessibilityConfig::CaptionProperty &property, const uint8_t* data, size_t size)
85 {
86 size_t position = 0;
87 uint32_t temp = 0;
88 position += GetObject<uint32_t>(temp, &data[position], size - position);
89 property.SetFontColor(temp);
90
91 position += GetObject<uint32_t>(temp, &data[position], size - position);
92 property.SetWindowColor(temp);
93
94 position += GetObject<uint32_t>(temp, &data[position], size - position);
95 property.SetBackgroundColor(temp);
96
97 position += GetObject<uint32_t>(temp, &data[position], size - position);
98 property.SetFontScale(static_cast<int32_t>(temp));
99
100 char name[LEN + 1];
101 name[LEN] = END_CHAR;
102 for (size_t i = 0; i < LEN; i++) {
103 position += GetObject<char>(name[i], &data[position], size - position);
104 }
105 std::string family(name);
106 property.SetFontFamily(family);
107
108 for (size_t i = 0; i < LEN; i++) {
109 position += GetObject<char>(name[i], &data[position], size - position);
110 }
111 std::string type(name);
112 property.SetFontEdgeType(type);
113
114 return position;
115 }
116
DoSomethingInterestingSetConfigFirstPart(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)117 void DoSomethingInterestingSetConfigFirstPart(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
118 const uint8_t* data, size_t size, size_t& startPos)
119 {
120 abConfig.SetScreenMagnificationState(data[startPos++] & 0x01);
121 abConfig.SetShortKeyState(data[startPos++] & 0x01);
122 abConfig.SetMouseKeyState(data[startPos++] & 0x01);
123 abConfig.SetCaptionsState(data[startPos++] & 0x01);
124 abConfig.SetHighContrastTextState(data[startPos++] & 0x01);
125 abConfig.SetDaltonizationState(data[startPos++] & 0x01);
126 abConfig.SetInvertColorState(data[startPos++] & 0x01);
127 abConfig.SetAnimationOffState(data[startPos++] & 0x01);
128 abConfig.SetAudioMonoState(data[startPos++] & 0x01);
129
130 uint32_t temp = 0;
131 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
132 abConfig.SetContentTimeout(temp);
133
134 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
135 abConfig.SetDaltonizationColorFilter(static_cast<OHOS::AccessibilityConfig::DALTONIZATION_TYPE>(temp));
136
137 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
138 abConfig.SetMouseAutoClick(static_cast<int32_t>(temp));
139
140 float tempFloat = 0;
141 startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
142 abConfig.SetBrightnessDiscount(tempFloat);
143
144 startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
145 abConfig.SetAudioBalance(tempFloat);
146
147 char name[LEN + 1];
148 name[LEN] = END_CHAR;
149 for (size_t i = 0; i < LEN; i++) {
150 startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
151 }
152 std::string nameStr(name);
153 abConfig.SetShortkeyTarget(nameStr);
154
155 std::vector<std::string> multiTargetName = {nameStr};
156 abConfig.SetShortkeyMultiTarget(multiTargetName);
157
158 OHOS::AccessibilityConfig::CaptionProperty property;
159 startPos += GenerateCaptionProperty(property, &data[startPos], size - startPos);
160 abConfig.SetCaptionsProperty(property);
161 }
162
DoSomethingInterestingSetConfigSecondPart(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)163 void DoSomethingInterestingSetConfigSecondPart(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
164 const uint8_t* data, size_t size, size_t& startPos)
165 {
166 uint32_t ResponseTime = 0;
167 startPos += GetObject<uint32_t>(ResponseTime, &data[startPos], size - startPos);
168 abConfig.SetClickResponseTime(static_cast<OHOS::AccessibilityConfig::CLICK_RESPONSE_TIME>(ResponseTime));
169
170 bool state = false;
171 startPos += GetObject<bool>(state, &data[startPos], size - startPos);
172 abConfig.SetIgnoreRepeatClickState(state);
173
174 uint32_t ignoreTime = 0;
175 startPos += GetObject<uint32_t>(ignoreTime, &data[startPos], size - startPos);
176 abConfig.SetIgnoreRepeatClickTime(static_cast<OHOS::AccessibilityConfig::IGNORE_REPEAT_CLICK_TIME>(ignoreTime));
177 }
178
DoSomethingInterestingGetAbility(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)179 void DoSomethingInterestingGetAbility(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
180 const uint8_t* data, size_t size, size_t& startPos)
181 {
182 char name[LEN + 1];
183 name[LEN] = END_CHAR;
184 uint32_t temp = 0;
185 std::shared_ptr<ConfigObserver> cObserver = std::make_shared<ConfigObserver>();
186 std::shared_ptr<EnableAbilityListObserver> eObserver = std::make_shared<EnableAbilityListObserver>();
187
188 for (size_t i = 0; i < LEN; i++) {
189 startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
190 }
191 std::string abilityName1(name);
192 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
193 abConfig.EnableAbility(abilityName1, temp);
194
195 for (size_t i = 0; i < LEN; i++) {
196 startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
197 }
198 std::string abilityName2(name);
199 abConfig.DisableAbility(abilityName2);
200
201 bool flag = data[startPos++] & 0x01;
202 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
203 abConfig.SubscribeConfigObserver(static_cast<OHOS::AccessibilityConfig::CONFIG_ID>(temp), cObserver, flag);
204 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
205 abConfig.UnsubscribeConfigObserver(static_cast<OHOS::AccessibilityConfig::CONFIG_ID>(temp), cObserver);
206 abConfig.SubscribeEnableAbilityListsObserver(eObserver);
207 abConfig.UnsubscribeEnableAbilityListsObserver(eObserver);
208 }
209
CheckCaptionProperty(OHOS::AccessibilityConfig::CaptionProperty & captionProperty,const uint8_t * data,size_t size)210 static void CheckCaptionProperty(
211 OHOS::AccessibilityConfig::CaptionProperty &captionProperty, const uint8_t* data, size_t size)
212 {
213 size_t position = 0;
214 char name[LEN + 1];
215 name[LEN] = END_CHAR;
216 for (size_t i = 0; i < LEN; i++) {
217 position += GetObject<char>(name[i], &data[position], size - position);
218 }
219 std::string property(name);
220 captionProperty.CheckProperty(property);
221
222 captionProperty.GetBackgroundColor();
223 captionProperty.GetFontScale();
224 captionProperty.GetFontColor();
225 captionProperty.GetFontEdgeType();
226 captionProperty.GetWindowColor();
227 captionProperty.GetFontFamily();
228 }
229
DoSomethingInterestingGetConfigFirstPart(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)230 void DoSomethingInterestingGetConfigFirstPart(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
231 const uint8_t* data, size_t size, size_t& startPos)
232 {
233 bool flag = data[startPos++] & 0x01;
234 abConfig.GetScreenMagnificationState(flag);
235 flag = data[startPos++] & 0x01;
236 abConfig.GetShortKeyState(flag);
237 flag = data[startPos++] & 0x01;
238 abConfig.GetMouseKeyState(flag);
239 flag = data[startPos++] & 0x01;
240 abConfig.GetCaptionsState(flag);
241 flag = data[startPos++] & 0x01;
242 abConfig.GetHighContrastTextState(flag);
243 flag = data[startPos++] & 0x01;
244 abConfig.GetDaltonizationState(flag);
245 flag = data[startPos++] & 0x01;
246 abConfig.GetInvertColorState(flag);
247 flag = data[startPos++] & 0x01;
248 abConfig.GetAnimationOffState(flag);
249 flag = data[startPos++] & 0x01;
250 abConfig.GetAudioMonoState(flag);
251
252 uint32_t temp = 0;
253 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
254 abConfig.GetContentTimeout(temp);
255
256 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
257 OHOS::AccessibilityConfig::DALTONIZATION_TYPE types =
258 static_cast<OHOS::AccessibilityConfig::DALTONIZATION_TYPE>(temp);
259 abConfig.GetDaltonizationColorFilter(types);
260
261 startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
262 int32_t clicks = static_cast<int32_t>(temp);
263 abConfig.GetMouseAutoClick(clicks);
264
265 float tempFloat = 0;
266 startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
267 abConfig.GetBrightnessDiscount(tempFloat);
268
269 startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
270 abConfig.GetAudioBalance(tempFloat);
271
272 OHOS::AccessibilityConfig::CaptionProperty propertyForGet;
273 GenerateCaptionProperty(propertyForGet, &data[startPos], size - startPos);
274 abConfig.GetCaptionsProperty(propertyForGet);
275 CheckCaptionProperty(propertyForGet, data, size);
276 }
277
DoSomethingInterestingGetConfigSecondPart(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)278 void DoSomethingInterestingGetConfigSecondPart(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
279 const uint8_t* data, size_t size, size_t& startPos)
280 {
281 uint32_t tempUint32 = 0;
282 startPos += GetObject<uint32_t>(tempUint32, &data[startPos], size - startPos);
283 OHOS::AccessibilityConfig::CLICK_RESPONSE_TIME ResponseTime =
284 static_cast<OHOS::AccessibilityConfig::CLICK_RESPONSE_TIME>(tempUint32);
285 abConfig.GetClickResponseTime(ResponseTime);
286
287 bool state = false;
288 startPos += GetObject<bool>(state, &data[startPos], size - startPos);
289 abConfig.GetIgnoreRepeatClickState(state);
290
291 startPos += GetObject<uint32_t>(tempUint32, &data[startPos], size - startPos);
292 OHOS::AccessibilityConfig::IGNORE_REPEAT_CLICK_TIME ignoreTime =
293 static_cast<OHOS::AccessibilityConfig::IGNORE_REPEAT_CLICK_TIME>(tempUint32);
294 abConfig.GetIgnoreRepeatClickTime(ignoreTime);
295
296 char name[LEN + 1];
297 name[LEN] = END_CHAR;
298 for (size_t i = 0; i < LEN; i++) {
299 startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
300 }
301 std::string nameStrForGet(name);
302 abConfig.GetShortkeyTarget(nameStrForGet);
303 std::vector<std::string> multiTargetName = {nameStrForGet};
304 abConfig.GetShortkeyMultiTarget(multiTargetName);
305 }
306
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)307 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
308 {
309 if (data == nullptr || size < DATA_MIN_SIZE) {
310 return false;
311 }
312
313 auto &abConfig = OHOS::AccessibilityConfig::AccessibilityConfig::GetInstance();
314 (void)abConfig.InitializeContext();
315 size_t startPos = 0;
316 DoSomethingInterestingSetConfigFirstPart(abConfig, data, size, startPos);
317 DoSomethingInterestingSetConfigSecondPart(abConfig, data, size, startPos);
318 DoSomethingInterestingGetAbility(abConfig, data, size, startPos);
319 DoSomethingInterestingGetConfigFirstPart(abConfig, data, size, startPos);
320 DoSomethingInterestingGetConfigSecondPart(abConfig, data, size, startPos);
321 abConfig.UnInitializeContext();
322
323 return true;
324 }
325 }
326
327 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)328 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
329 {
330 OHOS::AddPermission();
331 /* Run your code on data */
332 OHOS::DoSomethingInterestingWithMyAPI(data, size);
333 return 0;
334 }
335