1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "distributedschedstubeight_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <fuzzer/FuzzedDataProvider.h>
21 #include <singleton.h>
22
23 #include "distributed_sched_interface.h"
24 #include "distributed_sched_service.h"
25 #include "distributed_sched_stub.h"
26 #include "distributedWant/distributed_want.h"
27 #include "mock_fuzz_util.h"
28 #include "mock_distributed_sched.h"
29 #include "parcel_helper.h"
30 #include "dms_continue_time_dumper.h"
31
32 using namespace OHOS::AAFwk;
33 using namespace OHOS::AppExecFwk;
34
35 namespace OHOS {
36 namespace DistributedSchedule {
37 const std::string TAG = "DistributedSchedFuzzTest";
38 namespace {
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 }
42
GetU32Data(const uint8_t * ptr,size_t size)43 uint32_t GetU32Data(const uint8_t* ptr, size_t size)
44 {
45 if (size > FOO_MAX_LEN || size < U32_AT_SIZE) {
46 return 0;
47 }
48 char *ch = static_cast<char *>(malloc(size + 1));
49 if (ch == nullptr) {
50 std::cout << "malloc failed." << std::endl;
51 return 0;
52 }
53 (void)memset_s(ch, size + 1, 0x00, size + 1);
54 if (memcpy_s(ch, size + 1, ptr, size) != EOK) {
55 std::cout << "copy failed." << std::endl;
56 free(ch);
57 ch = nullptr;
58 return 0;
59 }
60 uint32_t data = (ch[0] << 24) | (ch[1] << 16) | (ch[2] << 8) | ch[3];
61 free(ch);
62 ch = nullptr;
63 return data;
64 }
65
NotifyMissionsChangedFromRemoteInnerFuzzTest(const uint8_t * data,size_t size)66 void NotifyMissionsChangedFromRemoteInnerFuzzTest(const uint8_t* data, size_t size)
67 {
68 if ((data == nullptr) || (size < sizeof(int32_t))) {
69 return;
70 }
71 FuzzUtil::MockPermission();
72 MessageParcel dataParcel;
73 MessageParcel reply;
74 MessageOption option;
75 FuzzedDataProvider fdp(data, size);
76 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
77 std::string str = fdp.ConsumeRandomLengthString();
78 std::vector<DstbMissionInfo> missionInfos;
79 CallerInfo callerInfo;
80 DistributedWant dstbWant;
81 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
82 std::string bundleName = fdp.ConsumeRandomLengthString();
83 std::string abilityName = fdp.ConsumeRandomLengthString();
84
85 dstbWant.SetDeviceId(dstDeviceId);
86 dstbWant.SetElementName(bundleName, abilityName);
87
88 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &dstbWant);
89 if (!DstbMissionInfo::WriteDstbMissionInfosToParcel(dataParcel, missionInfos)) {
90 return;
91 }
92 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
93 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
94 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
95 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
96 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
97 DistributedSchedService::GetInstance().NotifyMissionsChangedFromRemoteInner(dataParcel, reply);
98 }
99
ReleaseAbilityFromRemoteInnerFuzzTest(const uint8_t * data,size_t size)100 void ReleaseAbilityFromRemoteInnerFuzzTest(const uint8_t* data, size_t size)
101 {
102 if ((data == nullptr) || (size < sizeof(int32_t))) {
103 return;
104 }
105 FuzzUtil::MockPermission();
106 MessageParcel dataParcel;
107 MessageParcel reply;
108 MessageOption option;
109 sptr<IRemoteObject> connect(new MockDistributedSched());
110 AppExecFwk::ElementName element;
111 Want want;
112 const CallerInfo callerInfo;
113 FuzzedDataProvider fdp(data, size);
114 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
115 std::string str = fdp.ConsumeRandomLengthString();
116 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
117 std::string bundleName = fdp.ConsumeRandomLengthString();
118 std::string abilityName = fdp.ConsumeRandomLengthString();
119
120 want.SetDeviceId(dstDeviceId);
121 want.SetElementName(bundleName, abilityName);
122
123 PARCEL_WRITE_HELPER_NORET(dataParcel, RemoteObject, connect);
124 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &element);
125 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
126 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
127 DistributedSchedService::GetInstance().ReleaseAbilityFromRemoteInner(dataParcel, reply);
128 DistributedSchedService::GetInstance().TryStartRemoteAbilityByCall(want, connect, callerInfo);
129 DistributedSchedService::GetInstance().SaveCallerComponent(want, connect, callerInfo);
130 DistributedSchedService::GetInstance().SaveConnectToken(want, connect);
131 DistributedSchedService::GetInstance().NotifyStateChanged(int32Data, element, connect);
132 DistributedSchedService::GetInstance().SetCleanMissionFlag(want, int32Data);
133 }
134
NotifyStateChangedFromRemoteInnerFuzzTest(const uint8_t * data,size_t size)135 void NotifyStateChangedFromRemoteInnerFuzzTest(const uint8_t* data, size_t size)
136 {
137 if ((data == nullptr) || (size < sizeof(int32_t))) {
138 return;
139 }
140 FuzzUtil::MockPermission();
141 MessageParcel dataParcel;
142 MessageParcel reply;
143 MessageOption option;
144 const AppExecFwk::ElementName element;
145 sptr<IRemoteObject> connect(new MockDistributedSched());
146 FuzzedDataProvider fdp(data, size);
147 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
148 std::string str = fdp.ConsumeRandomLengthString();
149
150 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
151 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
152 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &element);
153 DistributedSchedService::GetInstance().NotifyStateChangedFromRemoteInner(dataParcel, reply);
154 DistributedSchedService::GetInstance().NotifyApp(connect, element, int32Data);
155 }
156
StartFreeInstallFromRemoteInnerFuzzTest(const uint8_t * data,size_t size)157 void StartFreeInstallFromRemoteInnerFuzzTest(const uint8_t* data, size_t size)
158 {
159 if ((data == nullptr) || (size < sizeof(int32_t))) {
160 return;
161 }
162 FuzzUtil::MockPermission();
163 MessageParcel dataParcel;
164 MessageParcel reply;
165 MessageOption option;
166 FuzzedDataProvider fdp(data, size);
167 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
168 std::string str = fdp.ConsumeRandomLengthString();
169 int64_t int64Data = static_cast<int64_t>(GetU32Data(data, size));
170 std::vector<std::string> strVector = {str};
171 DistributedWant dstbWant;
172 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
173 std::string bundleName = fdp.ConsumeRandomLengthString();
174 std::string abilityName = fdp.ConsumeRandomLengthString();
175
176 dstbWant.SetDeviceId(dstDeviceId);
177 dstbWant.SetElementName(bundleName, abilityName);
178
179 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &dstbWant);
180 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
181 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
182 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
183 PARCEL_WRITE_HELPER_NORET(dataParcel, StringVector, strVector);
184 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
185 PARCEL_WRITE_HELPER_NORET(dataParcel, Int64, int64Data);
186 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &dstbWant);
187 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
188 DistributedSchedService::GetInstance().StartFreeInstallFromRemoteInner(dataParcel, reply);
189 }
190
CollabMissionInnerFuzzTest(const uint8_t * data,size_t size)191 void CollabMissionInnerFuzzTest(const uint8_t* data, size_t size)
192 {
193 if ((data == nullptr) || (size < sizeof(int32_t))) {
194 return;
195 }
196 FuzzUtil::MockPermission();
197 MessageParcel dataParcel;
198 MessageParcel reply;
199 FuzzedDataProvider fdp(data, size);
200 CollabMessage massage;
201 ConnectOpt opt;
202 int32_t collabSessionId = fdp.ConsumeIntegral<int32_t>();
203 std::string srcSocketName = fdp.ConsumeRandomLengthString();
204 std::string collabToken = fdp.ConsumeRandomLengthString();
205 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, collabSessionId);
206 PARCEL_WRITE_HELPER_NORET(dataParcel, String, srcSocketName);
207 dataParcel.WriteParcelable(&massage);
208 dataParcel.WriteParcelable(&massage);
209 dataParcel.WriteParcelable(&opt);
210 PARCEL_WRITE_HELPER_NORET(dataParcel, String, collabToken);
211 DistributedSchedService::GetInstance().CollabMissionInner(dataParcel, reply);
212 }
213 }
214 }
215
216 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)217 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
218 {
219 OHOS::DistributedSchedule::NotifyMissionsChangedFromRemoteInnerFuzzTest(data, size);
220 OHOS::DistributedSchedule::ReleaseAbilityFromRemoteInnerFuzzTest(data, size);
221 OHOS::DistributedSchedule::NotifyStateChangedFromRemoteInnerFuzzTest(data, size);
222 OHOS::DistributedSchedule::StartFreeInstallFromRemoteInnerFuzzTest(data, size);
223 OHOS::DistributedSchedule::CollabMissionInnerFuzzTest(data, size);
224 return 0;
225 }
226