1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "medialibrary_mtp_datautils_fuzzer.h"
16
17 #include <cstdint>
18 #include <string>
19 #include <vector>
20 #include <fuzzer/FuzzedDataProvider.h>
21
22 #include "system_ability_definition.h"
23 #include "iservice_registry.h"
24 #include "userfilemgr_uri.h"
25 #include "payload_data.h"
26 #include "close_session_data.h"
27 #include "media_log.h"
28 #include "media_mtp_utils.h"
29
30 #define private public
31 #include "mtp_data_utils.h"
32 #include "property.h"
33 #undef private
34
35 namespace OHOS {
36 using namespace std;
37 using namespace Media;
38 static const int32_t NUM_BYTES = 1;
39 static const int32_t MAX_DATA_TYPE = 4;
40 static const int32_t MAX_SUB_TYPE = 5;
41 static const string MEDIA_DATA_DB_COMPOSER = "composer";
42 FuzzedDataProvider *provider = nullptr;
43
FuzzVectorUInt16()44 static inline vector<uint16_t> FuzzVectorUInt16()
45 {
46 return {provider->ConsumeIntegral<uint16_t>()};
47 }
48
FuzzVectorUInt32()49 static inline vector<uint32_t> FuzzVectorUInt32()
50 {
51 return {provider->ConsumeIntegral<uint32_t>()};
52 }
53
FuzzPhotoSubType()54 static inline PhotoSubType FuzzPhotoSubType()
55 {
56 int32_t value = provider->ConsumeIntegralInRange<int32_t>(0, MAX_SUB_TYPE);
57 return static_cast<PhotoSubType>(value);
58 }
59
FuzzResultSetDataType()60 static inline Media::ResultSetDataType FuzzResultSetDataType()
61 {
62 int32_t dataType = provider->ConsumeIntegralInRange<int32_t>(0, MAX_DATA_TYPE);
63 return static_cast<Media::ResultSetDataType>(dataType);
64 }
65
FuzzMtpOperationContext()66 static MtpOperationContext FuzzMtpOperationContext()
67 {
68 MtpOperationContext context;
69 context.operationCode = provider->ConsumeIntegral<uint16_t>();
70 context.transactionID = provider->ConsumeIntegral<uint32_t>();
71 context.devicePropertyCode = provider->ConsumeIntegral<uint32_t>();
72 context.storageID = provider->ConsumeIntegral<uint32_t>();
73 context.format = provider->ConsumeIntegral<uint16_t>();
74 context.parent = provider->ConsumeIntegral<uint32_t>();
75 context.handle = provider->ConsumeIntegral<uint32_t>();
76 context.property = provider->ConsumeIntegral<uint32_t>();
77 context.groupCode = provider->ConsumeIntegral<uint32_t>();
78 context.depth = provider->ConsumeIntegral<uint32_t>();
79 context.properStrValue = provider->ConsumeBytesAsString(NUM_BYTES);
80 context.properIntValue = provider->ConsumeIntegral<int64_t>();
81 context.handles = make_shared<UInt32List>(FuzzVectorUInt32());
82 context.name = provider->ConsumeBytesAsString(NUM_BYTES);
83 context.created = provider->ConsumeBytesAsString(NUM_BYTES);
84 context.modified = provider->ConsumeBytesAsString(NUM_BYTES);
85 context.indata = provider->ConsumeBool();
86 context.storageInfoID = provider->ConsumeIntegral<uint32_t>();
87 context.sessionOpen = provider->ConsumeBool();
88 context.sessionID = provider->ConsumeIntegral<uint32_t>();
89 context.mtpDriver = make_shared<MtpDriver>();
90 context.tempSessionID = provider->ConsumeIntegral<uint32_t>();
91 context.eventHandle = provider->ConsumeIntegral<uint32_t>();
92 context.eventProperty = provider->ConsumeIntegral<uint32_t>();
93 return context;
94 }
95
SolveHandlesFormatDataTest()96 static void SolveHandlesFormatDataTest()
97 {
98 uint16_t format = provider->ConsumeIntegral<uint16_t>();
99 MediaType outMediaType = MEDIA_TYPE_FILE;
100 string outExtension = provider->ConsumeBytesAsString(NUM_BYTES);
101 MtpDataUtils::SolveHandlesFormatData(format, outExtension, outMediaType);
102
103 format = provider->ConsumeBool() ? MTP_FORMAT_UNDEFINED_CODE : provider->ConsumeIntegral<uint16_t>();
104 MtpDataUtils::SolveHandlesFormatData(format, outExtension, outMediaType);
105 }
106
SolveSendObjectFormatDataTest()107 static void SolveSendObjectFormatDataTest()
108 {
109 uint16_t format = provider->ConsumeIntegral<uint16_t>();
110 MediaType outMediaType = MEDIA_TYPE_FILE;
111 MtpDataUtils::SolveSendObjectFormatData(format, outMediaType);
112 }
113
SolveSetObjectPropValueDataTest()114 static void SolveSetObjectPropValueDataTest()
115 {
116 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
117 FuzzMtpOperationContext());
118 if (context == nullptr) {
119 MEDIA_ERR_LOG("context is nullptr");
120 return;
121 }
122 context->property = provider->ConsumeBool() ? MTP_PROPERTY_OBJECT_FILE_NAME_CODE :
123 provider->ConsumeIntegral<uint32_t>();
124 string outColName = provider->ConsumeBytesAsString(NUM_BYTES);
125 variant<int64_t, string> outColVal;
126 MtpDataUtils::SolveSetObjectPropValueData(context, outColName, outColVal);
127 }
128
GetMediaTypeByformatTest()129 static void GetMediaTypeByformatTest()
130 {
131 uint16_t format = provider->ConsumeIntegral<uint16_t>();
132 MediaType outMediaType = MEDIA_TYPE_FILE;
133 MtpDataUtils::GetMediaTypeByformat(format, outMediaType);
134 }
135
GetPropListBySetTest()136 static void GetPropListBySetTest()
137 {
138 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
139 FuzzMtpOperationContext());
140 if (context == nullptr) {
141 MEDIA_ERR_LOG("context is nullptr");
142 return;
143 }
144 const shared_ptr<DataShare::DataShareResultSet> resultSet = make_shared<DataShare::DataShareResultSet>();
145 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
146 MtpDataUtils::GetPropListBySet(context, resultSet, outProps);
147
148 context->property = provider->ConsumeBool() ? MTP_PROPERTY_ALL_CODE : provider->ConsumeIntegral<int32_t>();
149 MtpDataUtils::GetPropListBySet(context, resultSet, outProps);
150 }
151
GetPropValueBySetTest()152 static void GetPropValueBySetTest()
153 {
154 uint32_t property = provider->ConsumeIntegral<uint32_t>();
155 PropertyValue outPropValue;
156 const shared_ptr<DataShare::DataShareResultSet> resultSet = make_shared<DataShare::DataShareResultSet>();
157 MtpDataUtils::GetPropValueBySet(property, resultSet, outPropValue, false);
158 }
159
GetMediaTypeByNameTest()160 static void GetMediaTypeByNameTest()
161 {
162 string displayName = provider->ConsumeBytesAsString(NUM_BYTES);
163 MediaType outMediaType = MEDIA_TYPE_FILE;
164 MtpDataUtils::GetMediaTypeByName(displayName, outMediaType);
165 }
166
GetPropListTest()167 static void GetPropListTest()
168 {
169 const shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
170 FuzzMtpOperationContext());
171 if (context == nullptr) {
172 MEDIA_ERR_LOG("context is nullptr");
173 return;
174 }
175 shared_ptr<DataShare::DataShareResultSet> resultSet = make_shared<DataShare::DataShareResultSet>();
176 shared_ptr<UInt16List> properties = make_shared<UInt16List>(FuzzVectorUInt16());
177 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
178 MtpDataUtils::GetPropList(context, resultSet, properties, outProps);
179 }
180
ReturnErrorTest()181 static void ReturnErrorTest()
182 {
183 string errMsg = "";
184 ResultSetDataType type = FuzzResultSetDataType();
185 MtpDataUtils::ReturnError(errMsg, type);
186 }
187
GetMovingOrEnditOneRowPropListTest()188 static void GetMovingOrEnditOneRowPropListTest()
189 {
190 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
191 FuzzMtpOperationContext());
192 if (context == nullptr) {
193 MEDIA_ERR_LOG("context is nullptr");
194 return;
195 }
196 shared_ptr<vector<uint16_t>> properties = make_shared<vector<uint16_t>>(FuzzVectorUInt16());
197 properties->push_back(MTP_PROPERTY_STORAGE_ID_CODE);
198 properties->push_back(MTP_PROPERTY_OBJECT_FORMAT_CODE);
199 string path = provider->ConsumeBytesAsString(NUM_BYTES);
200 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
201 MovingType movingType;
202 MtpDataUtils::GetMovingOrEnditOneRowPropList(properties, path, context, outProps, movingType);
203 }
204
GetFormatTest()205 static void GetFormatTest()
206 {
207 shared_ptr<DataShare::DataShareResultSet> resultSet = make_shared<DataShare::DataShareResultSet>();
208 uint16_t outFormat = provider->ConsumeIntegral<uint16_t>();
209 MtpDataUtils::GetFormat(resultSet, outFormat);
210
211 uint32_t handle = provider->ConsumeIntegral<uint32_t>();
212 shared_ptr<vector<uint16_t>> properties = make_shared<vector<uint16_t>>(FuzzVectorUInt16());
213 properties->push_back(MTP_PROPERTY_STORAGE_ID_CODE);
214 properties->push_back(MTP_PROPERTY_OBJECT_FORMAT_CODE);
215 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
216
217 MtpDataUtils::GetOneRowPropList(handle, resultSet, properties, outProps);
218 }
219
SetOneDefaultlPropListTest()220 static void SetOneDefaultlPropListTest()
221 {
222 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
223 MtpDataUtils::SetOneDefaultlPropList(0, MTP_PROPERTY_PROTECTION_STATUS_CODE, outProps);
224 MtpDataUtils::SetOneDefaultlPropList(0, MTP_PROPERTY_PERSISTENT_UID_CODE, outProps);
225 MtpDataUtils::SetOneDefaultlPropList(0, MTP_PROPERTY_ALBUM_NAME_CODE, outProps);
226 MtpDataUtils::SetOneDefaultlPropList(0, MTP_PROPERTY_STORAGE_ID_CODE, outProps);
227 string column = provider->ConsumeBytesAsString(NUM_BYTES);
228 shared_ptr<DataShare::DataShareResultSet> resultSet = make_shared<DataShare::DataShareResultSet>();
229 Property prop;
230 ResultSetDataType type = TYPE_NULL;
231 MtpDataUtils::SetProperty(column, resultSet, type, prop);
232 ResultSetDataType typeOne = TYPE_STRING;
233 MtpDataUtils::SetProperty(column, resultSet, typeOne, prop);
234 ResultSetDataType typeTwo = TYPE_INT32;
235 MtpDataUtils::SetProperty(column, resultSet, typeTwo, prop);
236 ResultSetDataType typeThree = TYPE_INT64;
237 column = provider->ConsumeBool() ? MEDIA_DATA_DB_DATE_MODIFIED : provider->ConsumeBytesAsString(NUM_BYTES);
238 MtpDataUtils::SetProperty(column, resultSet, typeThree, prop);
239 ResultSetDataType typeFour = TYPE_DOUBLE;
240 MtpDataUtils::SetProperty(column, resultSet, typeFour, prop);
241 uint16_t outFormat = 0;
242 MtpDataUtils::GetFormatByPath("", outFormat);
243 string path = provider->ConsumeBytesAsString(NUM_BYTES);
244 MtpDataUtils::GetFormatByPath(path, outFormat);
245 }
246
GetMtpPropListTest()247 static void GetMtpPropListTest()
248 {
249 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
250 FuzzMtpOperationContext());
251 if (context == nullptr) {
252 MEDIA_ERR_LOG("context is nullptr");
253 return;
254 }
255 context->property = MTP_PROPERTY_ALL_CODE;
256 shared_ptr<unordered_map<uint32_t, string>> handles = make_shared<unordered_map<uint32_t, string>>();
257 unordered_map<std::string, uint32_t> pathHandles;
258 shared_ptr<vector<Property>> outPropValue = make_shared<vector<Property>>();
259 MtpDataUtils::GetMtpPropList(handles, pathHandles, context, outPropValue);
260 }
261
GetMtpOneRowPropTest()262 static void GetMtpOneRowPropTest()
263 {
264 shared_ptr<vector<uint16_t>> properties = make_shared<vector<uint16_t>>(FuzzVectorUInt16());
265 uint32_t parentId = provider->ConsumeIntegral<uint32_t>();
266 std::unordered_map<uint32_t, std::string> umap{
267 {provider->ConsumeIntegral<uint32_t>(), provider->ConsumeBytesAsString(NUM_BYTES)}
268 };
269 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
270 int32_t storageId = provider->ConsumeIntegral<int32_t>();
271 MtpDataUtils::GetMtpOneRowProp(properties, parentId, umap.begin(), outProps, storageId);
272 }
273
SetMtpPropertyTest()274 static void SetMtpPropertyTest()
275 {
276 string column = MEDIA_DATA_DB_NAME;
277 string path = provider->ConsumeBytesAsString(NUM_BYTES);
278 ResultSetDataType type;
279 Property prop;
280 MtpDataUtils::SetMtpProperty(column, path, type, prop);
281
282 column = MEDIA_DATA_DB_SIZE;
283 MtpDataUtils::SetMtpProperty(column, path, type, prop);
284
285 column = MEDIA_DATA_DB_DATE_MODIFIED;
286 MtpDataUtils::SetMtpProperty(column, path, type, prop);
287
288 column = MEDIA_DATA_DB_DATE_ADDED;
289 MtpDataUtils::SetMtpProperty(column, path, type, prop);
290
291 column = MEDIA_DATA_DB_DESCRIPTION;
292 MtpDataUtils::SetMtpProperty(column, path, type, prop);
293
294 column = MEDIA_DATA_DB_DURATION;
295 MtpDataUtils::SetMtpProperty(column, path, type, prop);
296
297 column = MEDIA_DATA_DB_ARTIST;
298 MtpDataUtils::SetMtpProperty(column, path, type, prop);
299
300 column = MEDIA_DATA_DB_ALBUM_NAME;
301 MtpDataUtils::SetMtpProperty(column, path, type, prop);
302
303 column = MEDIA_DATA_DB_COMPOSER;
304 MtpDataUtils::SetMtpProperty(column, path, type, prop);
305 }
306
SetPtpPropertyTest()307 static void SetPtpPropertyTest()
308 {
309 string column = MEDIA_DATA_DB_NAME;
310 string path = provider->ConsumeBytesAsString(NUM_BYTES);
311 MovingType movingType;
312 movingType.displayName = provider->ConsumeBytesAsString(NUM_BYTES);
313 Property prop;
314 prop.currentValue = make_shared<Property::Value>();
315 MtpDataUtils::SetPtpProperty(column, path, movingType, prop);
316
317 column = MEDIA_DATA_DB_PARENT_ID;
318 MtpDataUtils::SetPtpProperty(column, path, movingType, prop);
319
320 column = MEDIA_DATA_DB_SIZE;
321 MtpDataUtils::SetPtpProperty(column, path, movingType, prop);
322
323 column = MEDIA_DATA_DB_DATE_MODIFIED;
324 MtpDataUtils::SetPtpProperty(column, path, movingType, prop);
325
326 column = MEDIA_DATA_DB_DATE_ADDED;
327 MtpDataUtils::SetPtpProperty(column, path, movingType, prop);
328 }
329
GetMovingOrEnditSourcePathTest()330 static void GetMovingOrEnditSourcePathTest()
331 {
332 shared_ptr<MtpOperationContext> context = make_shared<MtpOperationContext>(
333 FuzzMtpOperationContext());
334 if (context == nullptr) {
335 MEDIA_ERR_LOG("context is nullptr");
336 return;
337 }
338 string path = provider->ConsumeBytesAsString(NUM_BYTES);
339 int32_t subtype = static_cast<int32_t>(FuzzPhotoSubType());
340 MtpDataUtils::GetMovingOrEnditSourcePath(path, subtype, context);
341
342 context->handle = EDITED_PHOTOS_OFFSET;
343 MtpDataUtils::GetMovingOrEnditSourcePath(path, subtype, context);
344
345 context->handle = COMMON_MOVING_OFFSET;
346 MtpDataUtils::GetMovingOrEnditSourcePath(path, subtype, context);
347
348 context->handle = EDITED_MOVING_OFFSET;
349 MtpDataUtils::GetMovingOrEnditSourcePath(path, subtype, context);
350 }
351
GetMtpPropValueTest()352 static void GetMtpPropValueTest()
353 {
354 string path = provider->ConsumeBytesAsString(NUM_BYTES);
355 uint32_t property = MTP_PROPERTY_OBJECT_FILE_NAME_CODE;
356 uint16_t format = provider->ConsumeIntegral<uint16_t>();
357 PropertyValue outPropValue;
358 MtpDataUtils::GetMtpPropValue(path, property, format, outPropValue);
359
360 property = MTP_PROPERTY_OBJECT_SIZE_CODE;
361 MtpDataUtils::GetMtpPropValue(path, property, format, outPropValue);
362
363 property = MTP_PROPERTY_DATE_MODIFIED_CODE;
364 MtpDataUtils::GetMtpPropValue(path, property, format, outPropValue);
365
366 property = MTP_PROPERTY_DATE_ADDED_CODE;
367 MtpDataUtils::GetMtpPropValue(path, property, format, outPropValue);
368 }
369
SetMtpOneDefaultlPropListTest()370 static void SetMtpOneDefaultlPropListTest()
371 {
372 uint32_t handle = provider->ConsumeIntegral<uint32_t>();
373 uint16_t property = MTP_PROPERTY_PROTECTION_STATUS_CODE;
374 shared_ptr<vector<Property>> outProps = make_shared<vector<Property>>();
375 int32_t storageId = provider->ConsumeIntegral<int32_t>();
376 MtpDataUtils::SetMtpOneDefaultlPropList(handle, property, outProps, storageId);
377
378 property = MTP_PROPERTY_PERSISTENT_UID_CODE;
379 MtpDataUtils::SetMtpOneDefaultlPropList(handle, property, outProps, storageId);
380
381 property = MTP_PROPERTY_ALBUM_NAME_CODE;
382 MtpDataUtils::SetMtpOneDefaultlPropList(handle, property, outProps, storageId);
383
384 property = MTP_PROPERTY_STORAGE_ID_CODE;
385 MtpDataUtils::SetMtpOneDefaultlPropList(handle, property, outProps, storageId);
386 }
387
MtpDataUtilsTest()388 static void MtpDataUtilsTest()
389 {
390 SolveHandlesFormatDataTest();
391 SolveSendObjectFormatDataTest();
392 SolveSetObjectPropValueDataTest();
393 GetMediaTypeByformatTest();
394 GetPropListBySetTest();
395 GetPropValueBySetTest();
396 GetMediaTypeByNameTest();
397 GetPropListTest();
398 ReturnErrorTest();
399 GetMovingOrEnditOneRowPropListTest();
400 GetFormatTest();
401 SetOneDefaultlPropListTest();
402 GetMtpPropListTest();
403 GetMtpOneRowPropTest();
404 SetMtpPropertyTest();
405 SetPtpPropertyTest();
406 GetMovingOrEnditSourcePathTest();
407 GetMtpPropValueTest();
408 SetMtpOneDefaultlPropListTest();
409 }
410 } // namespace OHOS
411
412 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)413 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
414 {
415 /* Run your code on data */
416 FuzzedDataProvider fdp(data, size);
417 OHOS::provider = &fdp;
418 if (data == nullptr) {
419 return 0;
420 }
421 OHOS::MtpDataUtilsTest();
422 return 0;
423 }