1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "addwatcher_fuzzer.h"
17 #include "if_system_ability_manager.h"
18 #include "iservice_registry.h"
19 #include "iwatcher.h"
20 #include "iwatcher_manager.h"
21 #include "message_parcel.h"
22 #include "param_message.h"
23 #include "init_param.h"
24 #include "param_utils.h"
25 #include "parcel.h"
26 #include "securec.h"
27 #include "system_ability_definition.h"
28 #include "string_ex.h"
29 #include "watcher.h"
30 #include "watcher_proxy.h"
31 #include "watcher_utils.h"
32 #define private public
33 #define protected public
34 #include "watcher_manager.h"
35 #undef protected
36 #undef private
37
38 using namespace OHOS::init_param;
39 using WatcherManagerPtr = WatcherManager *;
40 class TestWatcher final : public Watcher {
41 public:
TestWatcher()42 TestWatcher() {}
43 ~TestWatcher() = default;
44
OnParameterChange(const std::string & prefix,const std::string & name,const std::string & value)45 int32_t OnParameterChange(const std::string &prefix, const std::string &name, const std::string &value) override
46 {
47 printf("TestWatcher::OnParameterChange name %s %s \n", name.c_str(), value.c_str());
48 return 0;
49 }
50 };
51 namespace OHOS {
GetWatcherManager()52 WatcherManagerPtr GetWatcherManager()
53 {
54 static WatcherManagerPtr watcherManager_ = nullptr;
55 if (watcherManager_ == nullptr) {
56 watcherManager_ = new WatcherManager(0, true);
57 if (watcherManager_ == nullptr) {
58 return nullptr;
59 }
60 watcherManager_->OnStart();
61 }
62 return watcherManager_;
63 }
64
FuzzTestAddRemoteWatcher(uint32_t agentId,uint32_t & watcherId)65 int FuzzTestAddRemoteWatcher(uint32_t agentId, uint32_t &watcherId)
66 {
67 WatcherManagerPtr watcherManager = GetWatcherManager();
68 WATCHER_CHECK(watcherManager != nullptr, return -1, "Failed to create manager");
69 MessageParcel data;
70 MessageParcel reply;
71 MessageOption option;
72
73 data.WriteInterfaceToken(IWatcherManager::GetDescriptor());
74 data.WriteUint32(agentId);
75 sptr<IWatcher> watcher = new TestWatcher();
76 bool ret = data.WriteRemoteObject(watcher->AsObject());
77
78 WATCHER_CHECK(ret, return 0, "Can not get remote");
79 watcherManager->OnRemoteRequest(
80 static_cast<uint32_t> (IWatcherManagerIpcCode::COMMAND_ADD_REMOTE_WATCHER), data, reply, option);
81 reply.ReadInt32();
82 watcherId = reply.ReadUint32();
83
84 auto remoteWatcher = watcherManager->GetRemoteWatcher(watcherId);
85 if (remoteWatcher == nullptr) {
86 return -1;
87 }
88 return 0;
89 }
90
FuzzTestAddWatcher(const std::string & keyPrefix,uint32_t watcherId)91 int FuzzTestAddWatcher(const std::string &keyPrefix, uint32_t watcherId)
92 {
93 WatcherManagerPtr watcherManager = GetWatcherManager();
94 WATCHER_CHECK(watcherManager != nullptr, return -1, "Failed to create manager");
95 MessageParcel data;
96 MessageParcel reply;
97 MessageOption option;
98
99 data.WriteInterfaceToken(IWatcherManager::GetDescriptor());
100 data.WriteString16(Str8ToStr16(keyPrefix));
101 data.WriteUint32(watcherId);
102 watcherManager->OnRemoteRequest(
103 static_cast<uint32_t> (IWatcherManagerIpcCode::COMMAND_ADD_WATCHER), data, reply, option);
104 return 0;
105 }
106
FuzzTestWatchAgentDump(const std::string & keyPrefix)107 int FuzzTestWatchAgentDump(const std::string &keyPrefix)
108 {
109 WatcherManagerPtr watcherManager = GetWatcherManager();
110 std::vector<std::u16string> args = {};
111 watcherManager->Dump(STDOUT_FILENO, args);
112 // dump parameter
113 args.push_back(Str8ToStr16("-h"));
114 watcherManager->Dump(STDOUT_FILENO, args);
115 args.clear();
116 args.push_back(Str8ToStr16("-k"));
117 args.push_back(Str8ToStr16(keyPrefix.c_str()));
118 watcherManager->Dump(STDOUT_FILENO, args);
119 return 0;
120 }
121
FuzzTestDelWatcher(const std::string & keyPrefix,uint32_t watcherId)122 int FuzzTestDelWatcher(const std::string &keyPrefix, uint32_t watcherId)
123 {
124 WatcherManagerPtr watcherManager = GetWatcherManager();
125 WATCHER_CHECK(watcherManager != nullptr, return -1, "Failed to create manager");
126 MessageParcel data;
127 MessageParcel reply;
128 MessageOption option;
129 data.WriteInterfaceToken(IWatcherManager::GetDescriptor());
130 data.WriteString16(Str8ToStr16(keyPrefix));
131 data.WriteUint32(watcherId);
132 watcherManager->OnRemoteRequest(
133 static_cast<uint32_t> (IWatcherManagerIpcCode::COMMAND_DEL_WATCHER), data, reply, option);
134 return 0;
135 }
136
FuzzAddWatcher(const uint8_t * data,size_t size)137 bool FuzzAddWatcher(const uint8_t* data, size_t size)
138 {
139 if (size < sizeof(uint32_t)) {
140 return false;
141 }
142 std::unique_ptr<WatcherManager> watcherManager = std::make_unique<WatcherManager>(0, true);
143 std::string str(reinterpret_cast<const char*>(data), size);
144 uint32_t watcherId = 0;
145
146 FuzzTestAddRemoteWatcher(getpid(), watcherId);
147 FuzzTestAddWatcher("test.permission.watcher.test1", 0);
148 FuzzTestAddWatcher("test.permission.watcher.test1", 0);
149 FuzzTestDelWatcher("test.permission.watcher.test1", 0);
150 watcherId = 1;
151 FuzzTestAddRemoteWatcher(getpid(), watcherId);
152 FuzzTestAddWatcher("test.permission.watcher.test1", 1);
153 FuzzTestWatchAgentDump("test.permission.watcher.test1");
154 FuzzTestDelWatcher("test.permission.watcher.test1", 1);
155
156 uint32_t randomValue = 0;
157 errno_t ret = memcpy_s(&randomValue, sizeof(randomValue), data, sizeof(uint32_t));
158 if (ret != 0) {
159 return false;
160 }
161 if (!FuzzTestAddWatcher(str, randomValue)) {
162 FuzzTestWatchAgentDump(str);
163 FuzzTestDelWatcher(str, randomValue);
164 return true;
165 };
166 return false;
167 }
168 }
169
170 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)171 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
172 {
173 /* Run your code on data */
174 OHOS::FuzzAddWatcher(data, size);
175 return 0;
176 }