1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "medialibrarycloudmediacontroller_fuzzer.h"
17
18 #include <cstdint>
19 #include <string>
20 #include <fstream>
21 #include <fuzzer/FuzzedDataProvider.h>
22 #define private public
23 #include "cloud_media_album_controller_service.h"
24 #include "cloud_media_data_controller_service.h"
25 #include "cloud_media_download_controller_service.h"
26 #include "cloud_media_photo_controller_service.h"
27 #include "cloud_media_album_controller_processor.h"
28 #include "cloud_media_data_controller_processor.h"
29 #include "cloud_media_download_controller_processor.h"
30 #include "cloud_media_photo_controller_processor.h"
31 #undef private
32 #include "ability_context_impl.h"
33 #include "media_log.h"
34 #include "medialibrary_command.h"
35 #include "medialibrary_data_manager.h"
36 #include "medialibrary_rdbstore.h"
37 #include "medialibrary_type_const.h"
38 #include "medialibrary_unistore_manager.h"
39
40 namespace OHOS {
41 using namespace std;
42 using namespace OHOS::Media;
43 using namespace OHOS::Media::CloudSync;
44 static constexpr const auto DESCRIPTOR = u"ohos.nfc.INfcControllerService";
45 const int32_t NUM_BYTES = 1;
46 const int32_t MAX_BYTE_VALUE = 256;
47 const int32_t SEED_SIZE = 1024;
48 FuzzedDataProvider* provider = nullptr;
49
50 shared_ptr<CloudMediaAlbumControllerService> cloudMediaAlbumControllerService = nullptr;
51 shared_ptr<CloudMediaDataControllerService> cloudMediaDataControllerService = nullptr;
52 shared_ptr<CloudMediaDownloadControllerService> cloudMediaDownloadControllerService = nullptr;
53 shared_ptr<CloudMediaPhotoControllerService> cloudMediaPhotoControllerService = nullptr;
54 shared_ptr<CloudMediaAlbumControllerProcessor> cloudMediaAlbumControllerProcessor = nullptr;
55 shared_ptr<CloudMediaDataControllerProcessor> cloudMediaDataControllerProcessor = nullptr;
56 shared_ptr<CloudMediaDownloadControllerProcessor> cloudMediaDownloadControllerProcessor = nullptr;
57 shared_ptr<CloudMediaPhotoControllerProcessor> cloudMediaPhotoControllerProcessor = nullptr;
58
FuzzPhotosVo(string & cloudId)59 static PhotosVo FuzzPhotosVo(string &cloudId)
60 {
61 PhotosVo photosVo;
62 photosVo.cloudId = cloudId;
63 photosVo.size = provider->ConsumeIntegral<int64_t>();
64 photosVo.path = provider->ConsumeBytesAsString(NUM_BYTES);
65 photosVo.fileName = provider->ConsumeBytesAsString(NUM_BYTES);
66 photosVo.type = provider->ConsumeBool() ? MediaType::MEDIA_TYPE_IMAGE : MediaType::MEDIA_TYPE_VIDEO;
67 CloudFileDataVo cloudFileDataVo;
68 cloudFileDataVo.fileName = provider->ConsumeBytesAsString(NUM_BYTES);
69 cloudFileDataVo.filePath = provider->ConsumeBytesAsString(NUM_BYTES);
70 cloudFileDataVo.size = provider->ConsumeIntegral<int64_t>();
71 photosVo.attachment.insert({"attachment", cloudFileDataVo});
72 return photosVo;
73 }
74
FuzzCloudErrorDetail()75 static CloudErrorDetail FuzzCloudErrorDetail()
76 {
77 CloudErrorDetail errorDetail;
78 errorDetail.domain = provider->ConsumeBytesAsString(NUM_BYTES);
79 errorDetail.reason = provider->ConsumeBytesAsString(NUM_BYTES);
80 errorDetail.errorCode = provider->ConsumeBytesAsString(NUM_BYTES);
81 errorDetail.description = provider->ConsumeBytesAsString(NUM_BYTES);
82 errorDetail.errorPos = provider->ConsumeBytesAsString(NUM_BYTES);
83 errorDetail.errorParam = provider->ConsumeBytesAsString(NUM_BYTES);
84 errorDetail.detailCode = provider->ConsumeIntegral<int32_t>();
85 return errorDetail;
86 }
87
FuzzErrorType()88 static inline Media::CloudSync::ErrorType FuzzErrorType()
89 {
90 int32_t value = provider->ConsumeIntegral<int32_t>() % 3;
91 if (value >= static_cast<int32_t>(Media::CloudSync::ErrorType::TYPE_UNKNOWN) &&
92 value <= static_cast<int32_t>(Media::CloudSync::ErrorType::TYPE_MAX)) {
93 return static_cast<Media::CloudSync::ErrorType>(value);
94 }
95 return Media::CloudSync::ErrorType::TYPE_NEED_UPLOAD;
96 }
97
FuzzPhotosDto(string & cloudId)98 static PhotosDto FuzzPhotosDto(string &cloudId)
99 {
100 PhotosDto photosDto;
101 photosDto.fileId = provider->ConsumeIntegral<int32_t>();
102 photosDto.cloudId = cloudId;
103 photosDto.displayName = provider->ConsumeBytesAsString(NUM_BYTES);
104 photosDto.size = provider->ConsumeIntegral<int64_t>();
105 photosDto.path = provider->ConsumeBytesAsString(NUM_BYTES);
106 photosDto.fileName = provider->ConsumeBytesAsString(NUM_BYTES);
107 photosDto.mediaType = provider->ConsumeBool() ? MediaType::MEDIA_TYPE_IMAGE : MediaType::MEDIA_TYPE_VIDEO;
108 photosDto.originalCloudId = cloudId;
109 photosDto.modifiedTime = provider->ConsumeIntegral<int64_t>();
110 photosDto.rotation = provider->ConsumeIntegral<int32_t>();
111 photosDto.fileType = provider->ConsumeIntegral<int32_t>();
112 photosDto.createTime = provider->ConsumeIntegral<int64_t>();
113 photosDto.modifiedTime = provider->ConsumeIntegral<int64_t>();
114 photosDto.version = provider->ConsumeIntegral<int64_t>();
115 photosDto.sourcePath = provider->ConsumeBytesAsString(NUM_BYTES);
116 photosDto.metaDateModified = provider->ConsumeIntegral<int64_t>();
117 photosDto.errorDetails = { FuzzCloudErrorDetail() };
118 photosDto.serverErrorCode = provider->ConsumeIntegral<int32_t>();
119 photosDto.errorType = FuzzErrorType();
120 photosDto.isSuccess = provider->ConsumeBool();
121 CloudFileDataDto cloudFileDataDto;
122 cloudFileDataDto.fileName = provider->ConsumeBytesAsString(NUM_BYTES);
123 cloudFileDataDto.path = provider->ConsumeBytesAsString(NUM_BYTES);
124 cloudFileDataDto.size = provider->ConsumeIntegral<int64_t>();
125 photosDto.attachment.insert({"attachment", cloudFileDataDto});
126 return photosDto;
127 }
128
FuzzMediaOperateResultDto(string & cloudId)129 static MediaOperateResultDto FuzzMediaOperateResultDto(string &cloudId)
130 {
131 MediaOperateResultDto operateResultDtoDto;
132 operateResultDtoDto.cloudId = cloudId;
133 operateResultDtoDto.errorCode = provider->ConsumeIntegral<int32_t>();
134 operateResultDtoDto.errorMsg = provider->ConsumeBytesAsString(NUM_BYTES);
135 return operateResultDtoDto;
136 }
137
FuzzPhotoAlbumPo()138 static PhotoAlbumPo FuzzPhotoAlbumPo()
139 {
140 PhotoAlbumPo photoAlbumPo;
141 photoAlbumPo.albumId = provider->ConsumeIntegral<int32_t>();
142 photoAlbumPo.albumType = provider->ConsumeIntegral<int32_t>();
143 photoAlbumPo.albumName = provider->ConsumeBytesAsString(NUM_BYTES);
144 photoAlbumPo.lpath = provider->ConsumeBytesAsString(NUM_BYTES);
145 photoAlbumPo.cloudId = provider->ConsumeBytesAsString(NUM_BYTES);
146 photoAlbumPo.albumSubtype = provider->ConsumeIntegral<int32_t>();
147 photoAlbumPo.dateAdded = provider->ConsumeIntegral<int64_t>();
148 photoAlbumPo.dateModified = provider->ConsumeIntegral<int64_t>();
149 photoAlbumPo.bundleName = provider->ConsumeBytesAsString(NUM_BYTES);
150 photoAlbumPo.localLanguage = provider->ConsumeBytesAsString(NUM_BYTES);
151 photoAlbumPo.albumOrder = provider->ConsumeIntegral<int32_t>();
152 photoAlbumPo.dirty = provider->ConsumeIntegral<int32_t>();
153 photoAlbumPo.albumPluginCloudId = provider->ConsumeBytesAsString(NUM_BYTES);
154 photoAlbumPo.albumNameEn = provider->ConsumeBytesAsString(NUM_BYTES);
155 photoAlbumPo.dualAlbumName = provider->ConsumeBytesAsString(NUM_BYTES);
156 photoAlbumPo.priority = provider->ConsumeIntegral<int32_t>();
157 photoAlbumPo.isInWhiteList = provider->ConsumeBool();
158 return photoAlbumPo;
159 }
160
FuzzGetAgingFileReqBody()161 static GetAgingFileReqBody FuzzGetAgingFileReqBody()
162 {
163 GetAgingFileReqBody agingFileReqBody;
164 agingFileReqBody.time = provider->ConsumeIntegral<int64_t>();
165 agingFileReqBody.mediaType = provider->ConsumeIntegral<int32_t>();
166 agingFileReqBody.sizeLimit = provider->ConsumeIntegral<int32_t>();
167 agingFileReqBody.offset = provider->ConsumeIntegral<int32_t>();
168 return agingFileReqBody;
169 }
170
FuzzGetDownloadThmReqBody()171 static GetDownloadThmReqBody FuzzGetDownloadThmReqBody()
172 {
173 GetDownloadThmReqBody downloadThmReqBody;
174 downloadThmReqBody.size = provider->ConsumeIntegral<int32_t>();
175 downloadThmReqBody.type = provider->ConsumeIntegral<int32_t>();
176 downloadThmReqBody.offset = provider->ConsumeIntegral<int32_t>();
177 downloadThmReqBody.isDownloadDisplayFirst = provider->ConsumeBool();
178 return downloadThmReqBody;
179 }
180
CloudMediaAlbumControllerServiceFuzzer()181 static void CloudMediaAlbumControllerServiceFuzzer()
182 {
183 MessageParcel dataParcel;
184 MessageParcel reply;
185 if (cloudMediaAlbumControllerService == nullptr) {
186 MEDIA_ERR_LOG("cloudMediaAlbumControllerService is nullptr");
187 return;
188 }
189 cloudMediaAlbumControllerService->OnFetchRecords(dataParcel, reply);
190 bool errConn = !dataParcel.WriteInterfaceToken(DESCRIPTOR);
191 CHECK_AND_RETURN_LOG(!errConn, "WriteInterfaceToken failed");
192 cloudMediaAlbumControllerService->OnFetchRecords(dataParcel, reply);
193 cloudMediaAlbumControllerService->OnDentryFileInsert(dataParcel, reply);
194 cloudMediaAlbumControllerService->GetCheckRecords(dataParcel, reply);
195 cloudMediaAlbumControllerService->GetCreatedRecords(dataParcel, reply);
196 cloudMediaAlbumControllerService->GetMetaModifiedRecords(dataParcel, reply);
197 cloudMediaAlbumControllerService->GetDeletedRecords(dataParcel, reply);
198 cloudMediaAlbumControllerService->OnCreateRecords(dataParcel, reply);
199 cloudMediaAlbumControllerService->OnMdirtyRecords(dataParcel, reply);
200 cloudMediaAlbumControllerService->OnFdirtyRecords(dataParcel, reply);
201 cloudMediaAlbumControllerService->OnDeleteRecords(dataParcel, reply);
202 cloudMediaAlbumControllerService->OnCopyRecords(dataParcel, reply);
203 }
204
CloudMediaDataControllerServiceFuzzer()205 static void CloudMediaDataControllerServiceFuzzer()
206 {
207 MessageParcel dataParcel;
208 MessageParcel reply;
209 if (cloudMediaDataControllerService == nullptr) {
210 MEDIA_ERR_LOG("cloudMediaDataControllerService is nullptr");
211 return;
212 }
213 cloudMediaDataControllerService->UpdateDirty(dataParcel, reply);
214 cloudMediaDataControllerService->UpdatePosition(dataParcel, reply);
215 cloudMediaDataControllerService->UpdateThmStatus(dataParcel, reply);
216 cloudMediaDataControllerService->GetAgingFile(dataParcel, reply);
217 cloudMediaDataControllerService->GetActiveAgingFile(dataParcel, reply);
218 cloudMediaDataControllerService->GetVideoToCache(dataParcel, reply);
219 cloudMediaDataControllerService->GetFilePosStat(dataParcel, reply);
220 cloudMediaDataControllerService->GetCloudThmStat(dataParcel, reply);
221 cloudMediaDataControllerService->GetDirtyTypeStat(dataParcel, reply);
222 cloudMediaDataControllerService->UpdateLocalFileDirty(dataParcel, reply);
223 cloudMediaDataControllerService->UpdateSyncStatus(dataParcel, reply);
224 }
225
CloudMediaDownloadControllerServiceFuzzer()226 static void CloudMediaDownloadControllerServiceFuzzer()
227 {
228 MessageParcel dataParcel;
229 MessageParcel reply;
230 if (cloudMediaDownloadControllerService == nullptr) {
231 MEDIA_ERR_LOG("cloudMediaDownloadControllerService is nullptr");
232 return;
233 }
234 cloudMediaDownloadControllerService->GetDownloadThms(dataParcel, reply);
235 cloudMediaDownloadControllerService->GetDownloadThmNum(dataParcel, reply);
236 cloudMediaDownloadControllerService->GetDownloadThmsByUri(dataParcel, reply);
237 cloudMediaDownloadControllerService->OnDownloadThms(dataParcel, reply);
238 cloudMediaDownloadControllerService->GetDownloadAsset(dataParcel, reply);
239 cloudMediaDownloadControllerService->OnDownloadAsset(dataParcel, reply);
240 }
241
CloudMediaPhotoControllerServiceFuzzer()242 static void CloudMediaPhotoControllerServiceFuzzer()
243 {
244 MessageParcel dataParcel;
245 MessageParcel reply;
246 if (cloudMediaPhotoControllerService == nullptr) {
247 MEDIA_ERR_LOG("cloudMediaPhotoControllerService is nullptr");
248 return;
249 }
250 cloudMediaPhotoControllerService->OnFetchRecords(dataParcel, reply);
251 cloudMediaPhotoControllerService->OnDentryFileInsert(dataParcel, reply);
252 cloudMediaPhotoControllerService->GetCreatedRecords(dataParcel, reply);
253 cloudMediaPhotoControllerService->GetMetaModifiedRecords(dataParcel, reply);
254 cloudMediaPhotoControllerService->GetFileModifiedRecords(dataParcel, reply);
255 cloudMediaPhotoControllerService->GetDeletedRecords(dataParcel, reply);
256 cloudMediaPhotoControllerService->GetCopyRecords(dataParcel, reply);
257 cloudMediaPhotoControllerService->GetCheckRecords(dataParcel, reply);
258 cloudMediaPhotoControllerService->OnCreateRecords(dataParcel, reply);
259 cloudMediaPhotoControllerService->OnMdirtyRecords(dataParcel, reply);
260 cloudMediaPhotoControllerService->OnFdirtyRecords(dataParcel, reply);
261 cloudMediaPhotoControllerService->OnDeleteRecords(dataParcel, reply);
262 cloudMediaPhotoControllerService->OnCopyRecords(dataParcel, reply);
263 cloudMediaPhotoControllerService->GetRetryRecords(dataParcel, reply);
264 }
265
CloudMediaAlbumControllerProcessorFuzzer()266 static void CloudMediaAlbumControllerProcessorFuzzer()
267 {
268 PhotoAlbumPo record = FuzzPhotoAlbumPo();
269 if (cloudMediaAlbumControllerProcessor == nullptr) {
270 MEDIA_ERR_LOG("cloudMediaAlbumControllerProcessor is nullptr");
271 return;
272 }
273 cloudMediaAlbumControllerProcessor->ConvertRecordPoToVo(record);
274 }
275
CloudMediaDataControllerProcessorFuzzer()276 static void CloudMediaDataControllerProcessorFuzzer()
277 {
278 std::string cloudId = provider->ConsumeBytesAsString(NUM_BYTES);
279 PhotosVo photosVo = FuzzPhotosVo(cloudId);
280 PhotosDto photosDto = FuzzPhotosDto(cloudId);
281 vector<MediaOperateResultDto> mediaOperateResultDto = { FuzzMediaOperateResultDto(cloudId) };
282 GetAgingFileReqBody reqBody = FuzzGetAgingFileReqBody();
283 AgingFileQueryDto queryDto;
284 if (cloudMediaDataControllerProcessor == nullptr) {
285 MEDIA_ERR_LOG("cloudMediaDataControllerProcessor is nullptr");
286 return;
287 }
288 cloudMediaDataControllerProcessor->ConvertPhotosVoToPhotosDto(photosVo);
289 cloudMediaDataControllerProcessor->ConvertPhotosDtoToPhotosVo(photosDto);
290 cloudMediaDataControllerProcessor->GetMediaOperateResult(mediaOperateResultDto);
291 cloudMediaDataControllerProcessor->GetAgingFileQueryDto(reqBody, queryDto);
292 }
293
CloudMediaDownloadControllerProcessorFuzzer()294 static void CloudMediaDownloadControllerProcessorFuzzer()
295 {
296 std::string cloudId = provider->ConsumeBytesAsString(NUM_BYTES);
297 PhotosDto photosDto = FuzzPhotosDto(cloudId);
298 GetDownloadThmReqBody reqBody = FuzzGetDownloadThmReqBody();
299 vector<MediaOperateResultDto> mediaOperateResultDto = { FuzzMediaOperateResultDto(cloudId) };
300 if (cloudMediaDownloadControllerProcessor == nullptr) {
301 MEDIA_ERR_LOG("cloudMediaDownloadControllerProcessor is nullptr");
302 return;
303 }
304 cloudMediaDownloadControllerProcessor->ConvertPhotosDtoToPhotosVo(photosDto);
305 cloudMediaDownloadControllerProcessor->GetDownloadThumbnailQueryDto(reqBody);
306 cloudMediaDownloadControllerProcessor->GetMediaOperateResult(mediaOperateResultDto);
307 }
308
CloudMediaPhotoControllerProcessorFuzzer()309 static void CloudMediaPhotoControllerProcessorFuzzer()
310 {
311 std::string cloudId = provider->ConsumeBytesAsString(NUM_BYTES);
312 vector<PhotosDto> photosDto = { FuzzPhotosDto(cloudId) };
313 PhotosDto dto = FuzzPhotosDto(cloudId);
314 PhotosPo record;
315 OnFetchPhotosVo photosVo;
316 OnCreateRecord createRecordrecordVo;
317 OnFileDirtyRecord fileDirtyRecordVo;
318 OnModifyRecord modifyRecordVo;
319
320 if (cloudMediaPhotoControllerProcessor == nullptr) {
321 MEDIA_ERR_LOG("cloudMediaPhotoControllerProcessor is nullptr");
322 return;
323 }
324 cloudMediaPhotoControllerProcessor->SetFdirtyDataVoFromDto(photosDto);
325 cloudMediaPhotoControllerProcessor->SetNewDataVoFromDto(photosDto);
326 cloudMediaPhotoControllerProcessor->GetCheckRecordsRespBody(photosDto);
327 cloudMediaPhotoControllerProcessor->ConvertRecordPoToVo(record);
328 cloudMediaPhotoControllerProcessor->ConvertToCloudMediaPullData(photosVo);
329 cloudMediaPhotoControllerProcessor->ConvertToPhotoDto(createRecordrecordVo);
330 cloudMediaPhotoControllerProcessor->ConvertToPhotosDto(fileDirtyRecordVo, dto);
331 cloudMediaPhotoControllerProcessor->ConvertToPhotosDto(modifyRecordVo, dto);
332 }
333
Init()334 static void Init()
335 {
336 cloudMediaAlbumControllerService = make_shared<CloudMediaAlbumControllerService>();
337 cloudMediaDataControllerService = make_shared<CloudMediaDataControllerService>();
338 cloudMediaDownloadControllerService = make_shared<CloudMediaDownloadControllerService>();
339 cloudMediaPhotoControllerService = make_shared<CloudMediaPhotoControllerService>();
340 cloudMediaAlbumControllerProcessor = make_shared<CloudMediaAlbumControllerProcessor>();
341 cloudMediaDataControllerProcessor = make_shared<CloudMediaDataControllerProcessor>();
342 cloudMediaDownloadControllerProcessor = make_shared<CloudMediaDownloadControllerProcessor>();
343 cloudMediaPhotoControllerProcessor = make_shared<CloudMediaPhotoControllerProcessor>();
344 }
345
AddSeed()346 static int32_t AddSeed()
347 {
348 char *seedData = new char[OHOS::SEED_SIZE];
349 for (int i = 0; i < OHOS::SEED_SIZE; i++) {
350 seedData[i] = static_cast<char>(i % MAX_BYTE_VALUE);
351 }
352
353 const char* filename = "corpus/seed.txt";
354 std::ofstream file(filename, std::ios::binary | std::ios::trunc);
355 if (!file) {
356 MEDIA_ERR_LOG("Cannot open file filename:%{public}s", filename);
357 delete[] seedData;
358 return Media::E_ERR;
359 }
360 file.write(seedData, OHOS::SEED_SIZE);
361 file.close();
362 delete[] seedData;
363 MEDIA_INFO_LOG("seedData has been successfully written to file filename:%{public}s", filename);
364 return Media::E_OK;
365 }
366 } // namespace OHOS
367
LLVMFuzzerInitialize(int * argc,char *** argv)368 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
369 {
370 OHOS::AddSeed();
371 OHOS::Init();
372 return 0;
373 }
374
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)375 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
376 {
377 /* Run your code on data */
378 FuzzedDataProvider fdp(data, size);
379 OHOS::provider = &fdp;
380 if (data == nullptr) {
381 return 0;
382 }
383 OHOS::CloudMediaAlbumControllerServiceFuzzer();
384 OHOS::CloudMediaDataControllerServiceFuzzer();
385 OHOS::CloudMediaDownloadControllerServiceFuzzer();
386 OHOS::CloudMediaPhotoControllerServiceFuzzer();
387 OHOS::CloudMediaAlbumControllerProcessorFuzzer();
388 OHOS::CloudMediaDataControllerProcessorFuzzer();
389 OHOS::CloudMediaDownloadControllerProcessorFuzzer();
390 OHOS::CloudMediaPhotoControllerProcessorFuzzer();
391 return 0;
392 }