1 /*
2 * Copyright (c) 2022-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "displaymanageripc_fuzzer.h"
17
18 #include <iremote_broker.h>
19 #include <iservice_registry.h>
20 #include <securec.h>
21 #include <system_ability_definition.h>
22
23 #include "display_manager_interface_code.h"
24 #include "idisplay_manager.h"
25 #include "window_manager_hilog.h"
26
27 namespace OHOS ::Rosen {
28 namespace {
29 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "DisplayManagerIPC_Fuzzer"};
30 }
31 template<class T>
GetObject(T & object,const uint8_t * data,size_t size)32 size_t GetObject(T &object, const uint8_t *data, size_t size)
33 {
34 size_t objectSize = sizeof(object);
35 if (objectSize > size) {
36 return 0;
37 }
38 return memcpy_s(&object, objectSize, data, objectSize) == EOK ? objectSize : 0;
39 }
40
GetProxy()41 std::pair<sptr<IDisplayManager>, sptr<IRemoteObject>> GetProxy()
42 {
43 sptr<ISystemAbilityManager> systemAbilityManager =
44 SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
45 if (!systemAbilityManager) {
46 WLOGFE("Failed to get system ability mgr.");
47 return { nullptr, nullptr };
48 }
49 sptr<IRemoteObject> remoteObject = systemAbilityManager->GetSystemAbility(DISPLAY_MANAGER_SERVICE_SA_ID);
50 if (!remoteObject) {
51 WLOGFE("Failed to get display manager service.");
52 return { nullptr, nullptr };
53 }
54 sptr<IDisplayManager> displayManagerServiceProxy = iface_cast<IDisplayManager>(remoteObject);
55 if ((!displayManagerServiceProxy) || (!displayManagerServiceProxy->AsObject())) {
56 WLOGFE("Failed to get system display manager services");
57 return { nullptr, nullptr };
58 }
59 return { displayManagerServiceProxy, remoteObject };
60 }
61
IPCFuzzTest(const uint8_t * data,size_t size)62 bool IPCFuzzTest(const uint8_t* data, size_t size)
63 {
64 uint32_t code;
65 int flags, waitTime;
66 if (data == nullptr || size < sizeof(code) + sizeof(flags) + sizeof(waitTime)) {
67 return false;
68 }
69 auto proxy = GetProxy();
70 if (proxy.first == nullptr || proxy.second == nullptr) {
71 return false;
72 }
73 size_t startPos = 0;
74 startPos += GetObject<uint32_t>(code, data + startPos, size - startPos);
75 startPos += GetObject<int>(flags, data + startPos, size - startPos);
76 startPos += GetObject<int>(waitTime, data + startPos, size - startPos);
77 MessageParcel sendData;
78 MessageParcel reply;
79 MessageOption option(flags, waitTime);
80 uint32_t dataSize = (size - startPos) > 1024 * 1024 ? 1024 * 1024 : (size - startPos);
81 sendData.WriteBuffer(data + startPos, dataSize);
82 proxy.second->SendRequest(code, sendData, reply, option);
83 return true;
84 }
85
IPCSpecificInterfaceFuzzTest1(const sptr<IRemoteObject> & proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)86 void IPCSpecificInterfaceFuzzTest1(const sptr<IRemoteObject>& proxy, MessageParcel& sendData, MessageParcel& reply,
87 MessageOption& option)
88 {
89 for (uint32_t i = 0; i <= static_cast<uint32_t>(IDisplayManagerIpcCode::COMMAND_GET_SCREEN_BRIGHTNESS); i++) {
90 proxy->SendRequest(i, sendData, reply, option);
91 }
92 }
93
IPCSpecificInterfaceFuzzTest2(const sptr<IRemoteObject> & proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option,const sptr<IDisplayManager> & manager)94 void IPCSpecificInterfaceFuzzTest2(const sptr<IRemoteObject>& proxy, MessageParcel& sendData, MessageParcel& reply,
95 MessageOption& option, const sptr<IDisplayManager>& manager)
96 {
97 int flags = option.GetFlags();
98 option.SetFlags(MessageOption::TF_SYNC);
99 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_CREATE_VIRTUAL_SCREEN),
100 sendData, reply, option);
101 int32_t dmError;
102 manager->DestroyVirtualScreen(reply.ReadUint64(), dmError);
103 option.SetFlags(flags);
104 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_DESTROY_VIRTUAL_SCREEN),
105 sendData, reply, option);
106 proxy->SendRequest(
107 static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_SCREEN_SURFACE),
108 sendData, reply, option);
109 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_SCREEN_INFO_BY_ID),
110 sendData, reply, option);
111 proxy->SendRequest(
112 static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_SCREEN_GROUP_INFO_BY_ID),
113 sendData, reply, option);
114 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_SCREEN_ACTIVE_MODE),
115 sendData, reply, option);
116 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_ALL_SCREEN_INFOS),
117 sendData, reply, option);
118 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_ORIENTATION),
119 sendData, reply, option);
120 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_PIXEL_RATIO),
121 sendData, reply, option);
122 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_MIRROR),
123 sendData, reply, option);
124 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_EXPAND),
125 sendData, reply, option);
126 proxy->SendRequest(
127 static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_REMOVE_VIRTUAL_SCREEN_FROM_SCREEN_GROUP),
128 sendData, reply, option);
129 proxy->SendRequest(
130 static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_GET_SUPPORTED_COLOR_GAMUTS),
131 sendData, reply, option);
132 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_GET_COLOR_GAMUT),
133 sendData, reply, option);
134 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_SET_COLOR_GAMUT),
135 sendData, reply, option);
136 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_GET_GAMUT_MAP),
137 sendData, reply, option);
138 proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_SET_GAMUT_MAP),
139 sendData, reply, option);
140 proxy->SendRequest(
141 static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_SET_COLOR_TRANSFORM),
142 sendData, reply, option);
143 }
144
IPCInterfaceFuzzTest(const uint8_t * data,size_t size)145 bool IPCInterfaceFuzzTest(const uint8_t* data, size_t size)
146 {
147 int flags, waitTime;
148 if (data == nullptr || size < sizeof(flags) + sizeof(waitTime)) {
149 return false;
150 }
151 auto proxy = GetProxy();
152 if (proxy.first == nullptr || proxy.second == nullptr) {
153 return false;
154 }
155 size_t startPos = 0;
156 startPos += GetObject<int>(flags, data + startPos, size - startPos);
157 startPos += GetObject<int>(waitTime, data + startPos, size - startPos);
158 MessageParcel sendData;
159 MessageParcel reply;
160 MessageOption option(flags, waitTime);
161 sendData.WriteInterfaceToken(IDisplayManager::GetDescriptor());
162 uint32_t dataSize = (size - startPos) > 1024 * 1024 ? 1024 * 1024 : (size - startPos);
163 sendData.WriteBuffer(data + startPos, dataSize);
164 IPCSpecificInterfaceFuzzTest1(proxy.second, sendData, reply, option);
165 IPCSpecificInterfaceFuzzTest2(proxy.second, sendData, reply, option, proxy.first);
166 return true;
167 }
168 } // namespace.OHOS::Rosen
169
170 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)171 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
172 {
173 /* Run your code on data */
174 OHOS::Rosen::IPCFuzzTest(data, size);
175 OHOS::Rosen::IPCInterfaceFuzzTest(data, size);
176 return 0;
177 }
178
179