1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "commonevent_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #include "input_method_agent_service_impl.h"
22 #include "string_utils.h"
23 #include "message_parcel.h"
24 #define private public
25 #define protected public
26 #include "on_demand_start_stop_sa.h"
27 #include "input_method_system_ability.h"
28 #undef private
29 #include "fuzzer/FuzzedDataProvider.h"
30 #include "input_method_controller.h"
31 #include "input_method_core_service_impl.h"
32 #include "inputmethod_message_handler.h"
33 #include "iremote_object.h"
34 #include "system_cmd_channel_service_impl.h"
35 using namespace OHOS::MiscServices;
36 using namespace MessageID;
37 namespace OHOS {
ConvertToUint32(const uint8_t * ptr)38 uint32_t ConvertToUint32(const uint8_t *ptr)
39 {
40 if (ptr == nullptr) {
41 return 0;
42 }
43 uint32_t bigVar = (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
44 return bigVar;
45 }
46
FuzzStringUtils(const uint8_t * data,size_t size)47 void FuzzStringUtils(const uint8_t *data, size_t size)
48 {
49 std::string fuzzedString(reinterpret_cast<const char *>(data), size);
50 auto fuzzedInt32 = static_cast<int32_t>(size);
51 std::u16string txt = u"insert text";
52 StringUtils::ToHex(fuzzedString);
53 StringUtils::ToHex(txt);
54 StringUtils::CountUtf16Chars(txt);
55 StringUtils::TruncateUtf16String(txt, fuzzedInt32);
56 }
57
FuzzOnDemandStartStopSa(const uint8_t * data,size_t size)58 void FuzzOnDemandStartStopSa(const uint8_t *data, size_t size)
59 {
60 auto onDemandStartStopSa = std::make_shared<OnDemandStartStopSa>();
61 sptr<OnDemandStartStopSa::SaLoadCallback> callback =
62 new (std::nothrow) OnDemandStartStopSa::SaLoadCallback(onDemandStartStopSa);
63 sptr<IRemoteObject> object {nullptr};
64 FuzzedDataProvider provider(data, size);
65 int32_t fuzzedInt32 = provider.ConsumeIntegral<int32_t>();
66 callback->OnLoadSystemAbilitySuccess(fuzzedInt32, object);
67 callback->OnLoadSystemAbilityFail(fuzzedInt32);
68 OnDemandStartStopSa::IncreaseProcessingIpcCnt();
69 OnDemandStartStopSa::DecreaseProcessingIpcCnt();
70 OnDemandStartStopSa::IsSaBusy();
71 }
72
FuzzSwitchOperation(const uint8_t * data,size_t size)73 void FuzzSwitchOperation(const uint8_t *data, size_t size)
74 {
75 FuzzedDataProvider provider(data, size);
76 auto fuzzedUint64 = provider.ConsumeIntegral<uint64_t>();
77 auto fuzzedUint32 = provider.ConsumeIntegral<uint32_t>();
78 auto fuzzedInt32 = provider.ConsumeIntegral<int32_t>();
79 sptr<IInputMethodCore> core = new InputMethodCoreServiceImpl();
80 sptr<SystemCmdChannelStub> stub = new SystemCmdChannelServiceImpl();
81 auto info = std::make_shared<ImeInfo>();
82
83 MessageParcel messData;
84 messData.WriteRemoteObject(stub->AsObject());
85 sptr<IRemoteObject> remoteObject = messData.ReadRemoteObject();
86 auto fuzzedBool = static_cast<bool>(data[0] % 2);
87 std::string fuzzedString(reinterpret_cast<const char *>(data), size);
88
89 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->InitMemMgrMonitor();
90 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleUserSwitched(fuzzedInt32);
91 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->InitFocusChangedMonitor();
92 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->InitWmsConnectionMonitor();
93 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->IsValidBundleName(fuzzedString);
94 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->UpdateUserInfo(fuzzedInt32);
95
96 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->RegisterProxyIme(fuzzedUint64, core, remoteObject);
97 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->Switch(fuzzedInt32, fuzzedString, info);
98 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->SwitchExtension(fuzzedInt32, info);
99 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->SwitchSubType(fuzzedInt32, info);
100 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->SwitchByCombinationKey(fuzzedUint32);
101 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleFocusChanged(fuzzedBool,
102 fuzzedUint64, fuzzedInt32, fuzzedInt32);
103 }
104
FuzzHandleOperation(const uint8_t * data,size_t size)105 void FuzzHandleOperation(const uint8_t *data, size_t size)
106 {
107 FuzzedDataProvider provider(data, size);
108 auto fuzzedInt32 = provider.ConsumeIntegral<int32_t>();
109 InputType inputType = static_cast<InputType>(size);
110 InputClientInfo clientInfo {};
111
112 auto fuzzedBool = static_cast<bool>(data[0] % 2);
113 std::string fuzzedString(reinterpret_cast<const char *>(data), size);
114
115 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleUserSwitched(fuzzedInt32);
116 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->StopImeInBackground();
117 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleOsAccountStarted();
118 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleMemStarted();
119 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleWmsStarted();
120
121 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleWmsConnected(fuzzedInt32, fuzzedInt32);
122 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleScbStarted(fuzzedInt32, fuzzedInt32);
123 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->HandleWmsDisconnected(fuzzedInt32, fuzzedInt32);
124 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->NeedHideWhenSwitchInputType(fuzzedInt32, inputType,
125 fuzzedBool);
126 DelayedSingleton<InputMethodSystemAbility>::GetInstance()->GetAlternativeIme(fuzzedInt32, fuzzedString);
127 }
128 } // namespace OHOS
129 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)130 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
131 {
132 if (data == nullptr || size == 0) {
133 return 0;
134 }
135 /* Run your code on data */
136 OHOS::FuzzStringUtils(data, size);
137 OHOS::FuzzOnDemandStartStopSa(data, size);
138 OHOS::FuzzSwitchOperation(data, size);
139 OHOS::FuzzHandleOperation(data, size);
140 return 0;
141 }