1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "medialibrarynotification_fuzzer.h"
17
18 #include <cstdint>
19 #include <string>
20 #include <fstream>
21 #include <pixel_map.h>
22 #include "media_observer_manager.h"
23 #include <fuzzer/FuzzedDataProvider.h>
24 #include "medialibrary_restore.h"
25 #include "medialibrary_rdbstore.h"
26 #include "medialibrary_db_const.h"
27 #include "medialibrary_errno.h"
28 #include "media_file_utils.h"
29 #include "medialibrary_data_manager.h"
30 #include "medialibrary_unistore_manager.h"
31 #include "medialibrary_unittest_utils.h"
32 #include "medialibrary_notify_new.h"
33 #include "notification_classification.h"
34 #include "notify_info_inner.h"
35 #include "media_change_info.h"
36 #include "notification_merging.h"
37 #include "notification_distribution.h"
38 #include "notify_info.h"
39 #include "media_datashare_stub_impl.h"
40 #include "data_ability_observer_interface.h"
41 #include "observer_info.h"
42 #include "data_ability_observer_stub.h"
43 #include "media_log.h"
44 #include "get_self_permissions.h"
45 #include "access_token.h"
46 #include "accesstoken_kit.h"
47 #include "token_setproc.h"
48 #include <iostream>
49 #include <vector>
50 #include <algorithm>
51 #include <random>
52
53 namespace OHOS {
54 using namespace Media;
55 using namespace std;
56 const uint32_t NOTIFY_URI_TYPE_MAX = 7;
57 const uint32_t NOTIFY_TYPE_MAX = 5;
58 const uint32_t NOTIFY_TABLE_TYPE_MAX = 2;
59 const uint32_t ALBUM_REFRESH_OPERATION_MAX = 6;
60 static const int32_t MAX_BYTE_VALUE = 256;
61 static const int32_t SEED_SIZE = 1024;
62
__anond9f12be50102() 63 const Media::AccurateRefresh::PhotoAssetChangeData changePhotoData = []() {
64 Media::AccurateRefresh::PhotoAssetChangeData photoData;
65 Media::AccurateRefresh::PhotoAssetChangeInfo assetChangeInfo;
66 assetChangeInfo.fileId_ = 10;
67 photoData.infoBeforeChange_ = assetChangeInfo;
68 return photoData;
69 }();
70
__anond9f12be50202() 71 const Media::AccurateRefresh::AlbumChangeData albumChangeData = []() {
72 Media::AccurateRefresh::AlbumChangeData albumData;
73 Media::AccurateRefresh::AlbumChangeInfo albumInfo;
74 albumInfo.albumId_ = 7;
75 albumInfo.albumName_ = "相机相册";
76 albumInfo.albumUri_ = "//storge//cloud//100//1";
77 albumData.infoBeforeChange_ = albumInfo;
78 return albumData;
79 }();
80
81 FuzzedDataProvider *provider = nullptr;
82
FuzzNotifyType()83 static inline Notification::NotifyType FuzzNotifyType()
84 {
85 int32_t value = provider->ConsumeIntegralInRange<int32_t>(0, NOTIFY_TYPE_MAX);
86 return static_cast<Notification::NotifyType>(value);
87 }
88
FuzzNotifyUriType()89 static inline Notification::NotifyUriType FuzzNotifyUriType()
90 {
91 int32_t value = provider->ConsumeIntegralInRange<int32_t>(0, NOTIFY_URI_TYPE_MAX);
92 return static_cast<Notification::NotifyUriType>(value);
93 }
94
FuzzNotifyTableType()95 static inline Notification::NotifyTableType FuzzNotifyTableType()
96 {
97 int32_t value = provider->ConsumeIntegralInRange<int32_t>(0, NOTIFY_TABLE_TYPE_MAX);
98 return static_cast<Notification::NotifyTableType>(value);
99 }
100
FuzzAlbumRefreshOperation()101 static inline Notification::AlbumRefreshOperation FuzzAlbumRefreshOperation()
102 {
103 int32_t value = provider->ConsumeIntegralInRange<int32_t>(0, ALBUM_REFRESH_OPERATION_MAX);
104 return static_cast<Notification::AlbumRefreshOperation>(value);
105 }
106
getTwoDifferentRandoms()107 std::pair<Media::Notification::NotifyUriType, Media::Notification::NotifyUriType> getTwoDifferentRandoms()
108 {
109 int32_t firstUriType = provider->ConsumeIntegralInRange<int32_t>(0, NOTIFY_URI_TYPE_MAX);
110 int32_t secondUriType = provider->ConsumeIntegralInRange<int32_t>(0, NOTIFY_URI_TYPE_MAX);
111 return {
112 static_cast<Media::Notification::NotifyUriType>(firstUriType),
113 static_cast<Media::Notification::NotifyUriType>(secondUriType)
114 };
115 }
116
Init()117 static void Init()
118 {
119 MEDIA_INFO_LOG("start init");
120 auto observerManager = Notification::MediaObserverManager::GetObserverManager();
121 sptr<OHOS::AAFwk::IDataAbilityObserver> dataObserver = new (std::nothrow) IDataAbilityObserverTest();
122 Notification::NotifyUriType PHOTO_URI = Notification::NotifyUriType::PHOTO_URI;
123 Notification::NotifyUriType HIDDEN_PHOTO_URI = Notification::NotifyUriType::HIDDEN_PHOTO_URI;
124 Notification::NotifyUriType TRASH_PHOTO_URI = Notification::NotifyUriType::TRASH_PHOTO_URI;
125 Notification::NotifyUriType PHOTO_ALBUM_URI = Notification::NotifyUriType::PHOTO_ALBUM_URI;
126 Notification::NotifyUriType HIDDEN_ALBUM_URI = Notification::NotifyUriType::HIDDEN_ALBUM_URI;
127 Notification::NotifyUriType TRASH_ALBUM_URI = Notification::NotifyUriType::TRASH_ALBUM_URI;
128 Notification::NotifyUriType ANALYSIS_ALBUM_URI = Notification::NotifyUriType::ANALYSIS_ALBUM_URI;
129 Notification::NotifyUriType INVALID = Notification::NotifyUriType::INVALID;
130 sptr<OHOS::AAFwk::IDataAbilityObserver> consumeEnumDataObserver = new (std::nothrow) IDataAbilityObserverTest();
131 Notification::NotifyUriType consumeEnum = FuzzNotifyUriType();
132 observerManager->AddObserver(PHOTO_URI, dataObserver);
133 observerManager->AddObserver(HIDDEN_PHOTO_URI, dataObserver);
134 observerManager->AddObserver(TRASH_PHOTO_URI, dataObserver);
135 observerManager->AddObserver(PHOTO_ALBUM_URI, dataObserver);
136 observerManager->AddObserver(HIDDEN_ALBUM_URI, dataObserver);
137 observerManager->AddObserver(TRASH_ALBUM_URI, dataObserver);
138 observerManager->AddObserver(ANALYSIS_ALBUM_URI, dataObserver);
139 observerManager->AddObserver(INVALID, dataObserver);
140 observerManager->AddObserver(consumeEnum, consumeEnumDataObserver);
141 MEDIA_INFO_LOG("end init");
142 }
143
SetNotifyInfoInners(std::vector<Notification::NotifyInfoInner> & notifyInfoInners)144 static void SetNotifyInfoInners(std::vector<Notification::NotifyInfoInner> ¬ifyInfoInners)
145 {
146 MEDIA_INFO_LOG("start SetNotifyInfoInners");
147 Notification::NotifyInfoInner firstNotifyInfoInner;
148 firstNotifyInfoInner.tableType = FuzzNotifyTableType();
149 int32_t instIndex = provider->ConsumeIntegralInRange<int32_t>(0, ASSET_REFRESH_OPERATION.size()-1);
150 firstNotifyInfoInner.operationType = ASSET_REFRESH_OPERATION[instIndex];
151 notifyInfoInners.push_back(firstNotifyInfoInner);
152 Notification::MediaLibraryNotifyNew::NotifyInner(firstNotifyInfoInner);
153 Notification::NotifyInfoInner secondNotifyInfoInner;
154 secondNotifyInfoInner.tableType = FuzzNotifyTableType();
155 secondNotifyInfoInner.operationType = FuzzAlbumRefreshOperation();
156 notifyInfoInners.push_back(secondNotifyInfoInner);
157 Notification::MediaLibraryNotifyNew::UpdateItem(secondNotifyInfoInner);
158 Notification::MediaLibraryNotifyNew::DeleteItem(firstNotifyInfoInner);
159 MEDIA_INFO_LOG("end SetNotifyInfoInners");
160 }
161
SetMediaChangeInfos(std::vector<Notification::MediaChangeInfo> & mediaChangeInfos)162 static void SetMediaChangeInfos(std::vector<Notification::MediaChangeInfo> &mediaChangeInfos)
163 {
164 MEDIA_INFO_LOG("start SetMediaChangeInfos");
165 Notification::MediaChangeInfo firstMediaChangeInfo;
166 firstMediaChangeInfo.isForRecheck = provider->ConsumeBool();
167 firstMediaChangeInfo.notifyUri = FuzzNotifyUriType();
168 firstMediaChangeInfo.notifyType = FuzzNotifyType();
169 firstMediaChangeInfo.isSystem = provider->ConsumeBool();
170 firstMediaChangeInfo.changeInfos = {changePhotoData};
171 mediaChangeInfos.push_back(firstMediaChangeInfo);
172
173 Notification::MediaChangeInfo secondMediaChangeInfo;
174 secondMediaChangeInfo.isForRecheck = provider->ConsumeBool();
175 secondMediaChangeInfo.notifyUri = FuzzNotifyUriType();
176 secondMediaChangeInfo.notifyType = FuzzNotifyType();
177 secondMediaChangeInfo.isSystem = provider->ConsumeBool();
178 secondMediaChangeInfo.changeInfos = {changePhotoData};
179 mediaChangeInfos.push_back(secondMediaChangeInfo);
180
181 Notification::MediaChangeInfo thirdMediaChangeInfo;
182 thirdMediaChangeInfo.isForRecheck = provider->ConsumeBool();
183 thirdMediaChangeInfo.notifyUri = FuzzNotifyUriType();
184 thirdMediaChangeInfo.notifyType = FuzzNotifyType();
185 thirdMediaChangeInfo.isSystem = provider->ConsumeBool();
186 thirdMediaChangeInfo.changeInfos = {albumChangeData};
187 mediaChangeInfos.push_back(thirdMediaChangeInfo);
188 MEDIA_INFO_LOG("end SetMediaChangeInfos");
189 }
190
SetNotifyInfos(std::vector<Notification::NotifyInfo> & notifyInfos)191 static void SetNotifyInfos(std::vector<Notification::NotifyInfo>& notifyInfos)
192 {
193 MEDIA_INFO_LOG("start SetNotifyInfos");
194 Notification::NotifyInfo firstNotifyInfo;
195 auto [firstNotifyUriType, secondNotifyUriType] = getTwoDifferentRandoms();
196 auto firstObserverManager = Notification::MediaObserverManager::GetObserverManager();
197 sptr<OHOS::AAFwk::IDataAbilityObserver> dataObserver = new (std::nothrow) IDataAbilityObserverTest();
198 firstObserverManager->AddObserver(firstNotifyUriType, dataObserver);
199 std::vector<Notification::ObserverInfo> firstObserverInfos = firstObserverManager->FindObserver(firstNotifyUriType);
200 firstNotifyInfo.observerInfos.insert(
201 firstNotifyInfo.observerInfos.end(),
202 firstObserverInfos.begin(), firstObserverInfos.end());
203 std::vector<Notification::MediaChangeInfo> firstMediaChangeInfos;
204 SetMediaChangeInfos(firstMediaChangeInfos);
205 firstNotifyInfo.changeInfosMap[firstNotifyUriType] = firstMediaChangeInfos;
206
207 Notification::NotifyInfo secondtNotifyInfo;
208 auto secondObserverManager = Notification::MediaObserverManager::GetObserverManager();
209 sptr<OHOS::AAFwk::IDataAbilityObserver> secondDataObserver = new (std::nothrow) IDataAbilityObserverTest();
210 secondObserverManager->AddObserver(secondNotifyUriType, secondDataObserver);
211 std::vector<Notification::ObserverInfo> secondObserverInfos =
212 secondObserverManager->FindObserver(secondNotifyUriType);
213 secondtNotifyInfo.observerInfos.insert(
214 secondtNotifyInfo.observerInfos.end(),
215 secondObserverInfos.begin(), secondObserverInfos.end());
216 std::vector<Notification::MediaChangeInfo> secondMediaChangeInfos;
217 SetMediaChangeInfos(secondMediaChangeInfos);
218 secondtNotifyInfo.changeInfosMap[secondNotifyUriType] = secondMediaChangeInfos;
219 notifyInfos.push_back(firstNotifyInfo);
220 notifyInfos.push_back(secondtNotifyInfo);
221 MEDIA_INFO_LOG("end SetNotifyInfos");
222 }
223
ConvertNotificationFuzzerTest()224 static void ConvertNotificationFuzzerTest()
225 {
226 MEDIA_INFO_LOG("start ConvertNotificationFuzzerTest");
227 std::vector<Notification::NotifyInfoInner> notifyInfoInners;
228 SetNotifyInfoInners(notifyInfoInners);
229 std::vector<Notification::MediaChangeInfo> mediaChangeInfos;
230 SetMediaChangeInfos(mediaChangeInfos);
231 Notification::NotificationClassification::ConvertNotification(notifyInfoInners, mediaChangeInfos);
232 MEDIA_INFO_LOG("end ConvertNotificationFuzzerTest");
233 }
234
MergeNotifyInfoFuzzerTest()235 static void MergeNotifyInfoFuzzerTest()
236 {
237 MEDIA_INFO_LOG("start MergeNotifyInfoFuzzerTest");
238 std::vector<Notification::MediaChangeInfo> mediaChangeInfos;
239 SetMediaChangeInfos(mediaChangeInfos);
240 Notification::NotificationMerging::MergeNotifyInfo(mediaChangeInfos);
241 MEDIA_INFO_LOG("end MergeNotifyInfoFuzzerTest");
242 }
243
DistributeNotifyInfoFuzzerTest()244 static void DistributeNotifyInfoFuzzerTest()
245 {
246 MEDIA_INFO_LOG("start DistributeNotifyInfoFuzzerTest");
247 std::vector<Notification::NotifyInfo> notifyInfos;
248 SetNotifyInfos(notifyInfos);
249 Notification::NotificationDistribution::DistributeNotifyInfo(notifyInfos);
250 MEDIA_INFO_LOG("end DistributeNotifyInfoFuzzerTest");
251 }
252
NotificationRegisterManagerFuzzerTest()253 static void NotificationRegisterManagerFuzzerTest()
254 {
255 MEDIA_INFO_LOG("start NotificationRegisterManagerFuzzerTest");
256 Notification::NotifyUriType uri = FuzzNotifyUriType();
257 Notification::NotifyUriType secondUri = FuzzNotifyUriType();
258 auto observerManager = Notification::MediaObserverManager::GetObserverManager();
259 sptr<OHOS::AAFwk::IDataAbilityObserver> dataObserver = new (std::nothrow) IDataAbilityObserverTest();
260 sptr<OHOS::AAFwk::IDataAbilityObserver> secondDataObserver = new (std::nothrow) IDataAbilityObserverTest();
261 observerManager->AddObserver(uri, dataObserver);
262 observerManager->AddObserver(secondUri, secondDataObserver);
263 observerManager->FindObserver(uri);
264 observerManager->FindObserver(secondUri);
265 observerManager->GetObservers();
266 observerManager->RemoveObserver(dataObserver->AsObject());
267 observerManager->RemoveObserverWithUri(secondUri, secondDataObserver);
268 observerManager->RemoveObserver(secondDataObserver->AsObject());
269 observerManager->RemoveObserverWithUri(uri, dataObserver);
270 MEDIA_INFO_LOG("start NotificationRegisterManagerFuzzerTest");
271 }
272
SetHapPermission()273 static void SetHapPermission()
274 {
275 MEDIA_INFO_LOG("enter SetHapPermission");
276 OHOS::Security::AccessToken::HapInfoParams info = {
277 .userID = 100, // 100 UserID
278 .bundleName = "com.ohos.test.screencapturetdd",
279 .instIndex = 0, // 0 index
280 .appIDDesc = "com.ohos.test.screencapturetdd",
281 .isSystemApp = true
282 };
283
284 OHOS::Security::AccessToken::HapPolicyParams policy = {
285 .apl = Security::AccessToken::APL_SYSTEM_BASIC,
286 .domain = "test.domain.screencapturetdd",
287 .permList = { },
288 .permStateList = {
289 {
290 .permissionName = "ohos.permission.MANAGE_PRIVATE_PHOTOS",
291 .isGeneral = true,
292 .resDeviceID = { "local" },
293 .grantStatus = { OHOS::Security::AccessToken::PermissionState::PERMISSION_GRANTED },
294 .grantFlags = { 1 }
295 },
296 {
297 .permissionName = "ohos.permission.READ_IMAGEVIDEO",
298 .isGeneral = true,
299 .resDeviceID = { "local" },
300 .grantStatus = { OHOS::Security::AccessToken::PermissionState::PERMISSION_GRANTED },
301 .grantFlags = { 1 }
302 },
303 {
304 .permissionName = "ohos.permission.WRITE_IMAGEVIDEO",
305 .isGeneral = true,
306 .resDeviceID = { "local" },
307 .grantStatus = { OHOS::Security::AccessToken::PermissionState::PERMISSION_GRANTED },
308 .grantFlags = { 1 }
309 }
310 }
311 };
312 OHOS::Security::AccessToken::AccessTokenIDEx tokenIdEx = { 0 };
313 tokenIdEx = OHOS::Security::AccessToken::AccessTokenKit::AllocHapToken(info, policy);
314 int ret = SetSelfTokenID(tokenIdEx.tokenIDEx);
315 if (ret != 0) {
316 MEDIA_INFO_LOG("Set hap token failed, err: %{public}d", ret);
317 }
318 }
319
AddSeed()320 static int32_t AddSeed()
321 {
322 char *seedData = new char[OHOS::SEED_SIZE];
323 for (int i = 0; i < OHOS::SEED_SIZE; i++) {
324 seedData[i] = static_cast<char>(i % MAX_BYTE_VALUE);
325 }
326
327 const char* filename = "corpus/seed.txt";
328 std::ofstream file(filename, std::ios::binary | std::ios::trunc);
329 if (!file) {
330 MEDIA_ERR_LOG("Cannot open file filename:%{public}s", filename);
331 delete[] seedData;
332 return E_ERR;
333 }
334 file.write(seedData, OHOS::SEED_SIZE);
335 file.close();
336 delete[] seedData;
337 MEDIA_INFO_LOG("seedData has been successfully written to file filename:%{public}s", filename);
338 return E_OK;
339 }
340 } // namespace OHOS
341
LLVMFuzzerInitialize(int * argc,char *** argv)342 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
343 {
344 OHOS::SetHapPermission();
345 OHOS::AddSeed();
346 return 0;
347 }
348
349 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)350 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
351 {
352 FuzzedDataProvider provider(data, size);
353 OHOS::provider = &provider;
354 if (data == nullptr) {
355 return 0;
356 }
357 OHOS::Init();
358 OHOS::ConvertNotificationFuzzerTest();
359 OHOS::MergeNotifyInfoFuzzerTest();
360 OHOS::DistributeNotifyInfoFuzzerTest();
361 OHOS::NotificationRegisterManagerFuzzerTest();
362 return 0;
363 }