1 /*
2 * Copyright (c) 2024-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "inithaptokenstub_fuzzer.h"
17
18 #include <string>
19
20 #include "accesstoken_manager_service.h"
21 #include "fuzzer/FuzzedDataProvider.h"
22 #include "hap_info_parcel.h"
23 #include "iaccess_token_manager.h"
24
25 using namespace std;
26 using namespace OHOS::Security::AccessToken;
27 const int CONSTANTS_NUMBER_TWO = 2;
28 static const int32_t ROOT_UID = 0;
29
30 namespace OHOS {
InitHapInfoParams(const std::string & bundleName,FuzzedDataProvider & provider,HapInfoParams & param)31 void InitHapInfoParams(const std::string& bundleName, FuzzedDataProvider& provider, HapInfoParams& param)
32 {
33 param.userID = provider.ConsumeIntegral<int32_t>();
34 param.bundleName = bundleName;
35 param.instIndex = provider.ConsumeIntegral<int32_t>();
36 param.dlpType = static_cast<int32_t>(
37 provider.ConsumeIntegralInRange<uint32_t>(0, static_cast<uint32_t>(HapDlpType::BUTT_DLP_TYPE)));
38 param.appIDDesc = provider.ConsumeRandomLengthString();
39 param.apiVersion = provider.ConsumeIntegral<int32_t>();
40 param.isSystemApp = provider.ConsumeBool();
41 param.appDistributionType = provider.ConsumeRandomLengthString();
42 param.isRestore = provider.ConsumeBool();
43 param.tokenID = provider.ConsumeIntegral<AccessTokenID>();
44 param.isAtomicService = provider.ConsumeBool();
45 }
46
InitHapPolicy(const std::string & permissionName,const std::string & bundleName,FuzzedDataProvider & provider,HapPolicy & policy)47 void InitHapPolicy(const std::string& permissionName, const std::string& bundleName, FuzzedDataProvider& provider,
48 HapPolicy& policy)
49 {
50 PermissionDef def = {
51 .permissionName = permissionName,
52 .bundleName = bundleName,
53 .grantMode = static_cast<int32_t>(
54 provider.ConsumeIntegralInRange<uint32_t>(0, static_cast<uint32_t>(GrantMode::SYSTEM_GRANT))),
55 .availableLevel = static_cast<ATokenAplEnum>(
56 provider.ConsumeIntegralInRange<uint32_t>(0, static_cast<uint32_t>(ATokenAplEnum::APL_ENUM_BUTT))),
57 .provisionEnable = provider.ConsumeBool(),
58 .distributedSceneEnable = provider.ConsumeBool(),
59 .label = provider.ConsumeRandomLengthString(),
60 .labelId = provider.ConsumeIntegral<int32_t>(),
61 .description = provider.ConsumeRandomLengthString(),
62 .descriptionId = provider.ConsumeIntegral<int32_t>(),
63 .availableType = static_cast<ATokenAvailableTypeEnum>(provider.ConsumeIntegralInRange<uint32_t>(
64 0, static_cast<uint32_t>(ATokenAvailableTypeEnum::AVAILABLE_TYPE_BUTT))),
65 .isKernelEffect = provider.ConsumeBool(),
66 .hasValue = provider.ConsumeBool(),
67 };
68
69 PermissionStatus state = {
70 .permissionName = permissionName,
71 .grantStatus = static_cast<int32_t>(provider.ConsumeIntegralInRange<uint32_t>(
72 0, static_cast<uint32_t>(PermissionState::PERMISSION_GRANTED))),
73 .grantFlag = provider.ConsumeIntegralInRange<uint32_t>(
74 0, static_cast<uint32_t>(PermissionFlag::PERMISSION_ALLOW_THIS_TIME)),
75 };
76
77 PreAuthorizationInfo info = {
78 .permissionName = permissionName,
79 .userCancelable = provider.ConsumeBool(),
80 };
81
82 policy.apl = static_cast<ATokenAplEnum>(
83 provider.ConsumeIntegralInRange<uint32_t>(0, static_cast<uint32_t>(ATokenAplEnum::APL_ENUM_BUTT)));
84 policy.domain = provider.ConsumeRandomLengthString();
85 policy.permList = { def };
86 policy.permStateList = { state };
87 policy.aclRequestedList = {provider.ConsumeRandomLengthString()};
88 policy.preAuthorizationInfo = { info };
89 policy.checkIgnore = static_cast<HapPolicyCheckIgnore>(provider.ConsumeIntegralInRange<uint32_t>(
90 0, static_cast<uint32_t>(HapPolicyCheckIgnore::ACL_IGNORE_CHECK)));
91 policy.aclExtendedMap = {std::make_pair<std::string, std::string>(provider.ConsumeRandomLengthString(),
92 provider.ConsumeRandomLengthString())};
93 }
94
InitHapTokenStubFuzzTest(const uint8_t * data,size_t size)95 bool InitHapTokenStubFuzzTest(const uint8_t* data, size_t size)
96 {
97 if ((data == nullptr) || (size == 0)) {
98 return false;
99 }
100
101 FuzzedDataProvider provider(data, size);
102 std::string permissionName = provider.ConsumeRandomLengthString();
103 std::string bundleName = provider.ConsumeRandomLengthString();
104
105 HapInfoParcel hapInfoParcel;
106 InitHapInfoParams(bundleName, provider, hapInfoParcel.hapInfoParameter);
107
108 HapPolicyParcel hapPolicyParcel;
109 InitHapPolicy(permissionName, bundleName, provider, hapPolicyParcel.hapPolicy);
110
111 MessageParcel datas;
112 datas.WriteInterfaceToken(IAccessTokenManager::GetDescriptor());
113 if (!datas.WriteParcelable(&hapInfoParcel)) {
114 return false;
115 }
116 if (!datas.WriteParcelable(&hapPolicyParcel)) {
117 return false;
118 }
119
120 uint32_t code = static_cast<uint32_t>(
121 IAccessTokenManagerIpcCode::COMMAND_INIT_HAP_TOKEN);
122
123 MessageParcel reply;
124 MessageOption option;
125 bool enable = ((provider.ConsumeIntegral<int32_t>() % CONSTANTS_NUMBER_TWO) == 0);
126 if (enable) {
127 setuid(CONSTANTS_NUMBER_TWO);
128 }
129 DelayedSingleton<AccessTokenManagerService>::GetInstance()->OnRemoteRequest(code, datas, reply, option);
130 setuid(ROOT_UID);
131
132 return true;
133 }
134 } // namespace OHOS
135
136 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)137 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
138 {
139 /* Run your code on data */
140 OHOS::InitHapTokenStubFuzzTest(data, size);
141 return 0;
142 }
143