1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "intention_client_fuzzer.h"
17
18 #include "boomerang_callback_stub.h"
19 #include "devicestatus_callback_stub.h"
20
21 #include <cstddef>
22 #include <cstdint>
23 #include <map>
24
25 #include <nocopyable.h>
26
27 #include "intention_client.h"
28
29 #undef LOG_TAG
30 #define LOG_TAG "MsdpIntentionClientFuzzTest"
31
32 namespace {
33 constexpr size_t THRESHOLD = 5;
34 }
35 using namespace OHOS::Media;
36 using namespace OHOS::Msdp;
37
ConvertToUint32(const uint8_t * ptr)38 uint32_t ConvertToUint32(const uint8_t *ptr)
39 {
40 if (ptr == nullptr) {
41 return 0;
42 }
43 uint32_t bigVar = (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
44 return bigVar;
45 }
46
47 class BoomerangClientTestCallback : public OHOS::Msdp::DeviceStatus::BoomerangCallbackStub {
48 public:
49
50 private:
51 OHOS::Msdp::DeviceStatus::BoomerangData data_;
52 };
53
54 namespace OHOS {
55
FuzzIntentionClientSocket(const uint8_t * rawData,size_t size)56 void FuzzIntentionClientSocket(const uint8_t *rawData, size_t size)
57 {
58 uint32_t integer = ConvertToUint32(rawData);
59 int32_t integer32 = static_cast<int32_t>(integer);
60 std::string str(reinterpret_cast<const char *>(rawData), size);
61 INTENTION_CLIENT->Socket(str, integer, integer32, integer32);
62 }
63
FuzzIntentionClientCooperate(const uint8_t * rawData,size_t size)64 void FuzzIntentionClientCooperate(const uint8_t *rawData, size_t size)
65 {
66 uint32_t integer = ConvertToUint32(rawData);
67 std::string str(reinterpret_cast<const char *>(rawData), size);
68 bool boolean = static_cast<bool>(*rawData);
69 double doubleNum = static_cast<double>(*rawData);
70 CooperateOptions options {
71 .displayX = 500,
72 .displayY = 500,
73 .displayId = 1
74 };
75 INTENTION_CLIENT->EnableCooperate(integer);
76 INTENTION_CLIENT->DisableCooperate(integer);
77 INTENTION_CLIENT->StartCooperate(str, integer, integer, boolean);
78 INTENTION_CLIENT->StartCooperateWithOptions(str, integer, integer, boolean, options);
79 INTENTION_CLIENT->StopCooperate(integer, boolean, boolean);
80 INTENTION_CLIENT->RegisterCooperateListener();
81 INTENTION_CLIENT->UnregisterCooperateListener();
82 INTENTION_CLIENT->RegisterHotAreaListener(integer, boolean);
83 INTENTION_CLIENT->UnregisterHotAreaListener(integer, boolean);
84 INTENTION_CLIENT->RegisterMouseEventListener(str);
85 INTENTION_CLIENT->UnregisterMouseEventListener(str);
86 bool state { false };
87 INTENTION_CLIENT->GetCooperateStateSync(str, state);
88 INTENTION_CLIENT->GetCooperateStateAsync(str, integer, boolean);
89 INTENTION_CLIENT->SetDamplingCoefficient(integer, doubleNum);
90 }
91
FuzzIntentionClientDrag(const uint8_t * rawData,size_t size)92 void FuzzIntentionClientDrag(const uint8_t *rawData, size_t size)
93 {
94 uint32_t integer = ConvertToUint32(rawData);
95 int32_t integer32 = static_cast<int32_t>(integer);
96 uint64_t integerU64 = static_cast<uint64_t>(integer);
97 std::string str(reinterpret_cast<const char *>(rawData), size);
98 bool boolean = static_cast<bool>(*rawData);
99 float floatNum = static_cast<float>(*rawData);
100
101 uint32_t color[100] = { integer };
102 InitializationOptions opts = { { 5, 7}, PixelFormat::ARGB_8888 };
103 std::unique_ptr<PixelMap> pixelMap = PixelMap::Create(color, sizeof(color)/sizeof(color[0]), opts);
104 std::shared_ptr<PixelMap> pixelMapIn = move(pixelMap);
105
106 Msdp::DeviceStatus::ShadowInfo shadowInfo {
107 .pixelMap = pixelMapIn,
108 .x = integer32,
109 .y = integer32
110 };
111
112 Msdp::DeviceStatus::DragData dragData {
113 .shadowInfos = { shadowInfo },
114 .buffer = {rawData, rawData + size},
115 .udKey = str,
116 .extraInfo = str,
117 .filterInfo = str,
118 .sourceType = integer32,
119 .dragNum = integer32,
120 .pointerId = integer32,
121 .displayId = integer32,
122 .mainWindow = integer32,
123 .hasCanceledAnimation = boolean,
124 .hasCoordinateCorrected = boolean,
125 .isDragDelay = boolean,
126 .appCallee = str,
127 .appCaller = str
128 };
129 Msdp::DeviceStatus::DragDropResult dragDropResult {
130 .hasCustomAnimation = boolean,
131 .mainWindow = integer32
132 };
133
134 Msdp::DeviceStatus::PreviewStyle previewStyle {
135 .foregroundColor = integer,
136 .opacity = integer32,
137 .radius = floatNum,
138 .scale = floatNum
139 };
140
141 Msdp::DeviceStatus::PreviewAnimation previewAnimation {
142 .duration = integer32,
143 .curveName = str,
144 .curve = { floatNum, floatNum }
145 };
146
147 const std::shared_ptr<Rosen::RSTransaction>& rsTransaction { nullptr };
148
149 INTENTION_CLIENT->StopDrag(dragDropResult);
150 INTENTION_CLIENT->StartDrag(dragData);
151 INTENTION_CLIENT->EnableInternalDropAnimation(str);
152 INTENTION_CLIENT->AddDraglistener(boolean);
153 INTENTION_CLIENT->RemoveDraglistener(boolean);
154 INTENTION_CLIENT->AddSubscriptListener();
155 INTENTION_CLIENT->RemoveSubscriptListener();
156 INTENTION_CLIENT->SetDragWindowVisible(boolean, boolean, rsTransaction);
157 Msdp::DeviceStatus::DragCursorStyle dragCursorStyle { Msdp::DeviceStatus::DragCursorStyle::DEFAULT };
158 INTENTION_CLIENT->UpdateDragStyle(dragCursorStyle, integer32);
159 INTENTION_CLIENT->UpdateShadowPic(shadowInfo);
160 INTENTION_CLIENT->GetDragTargetPid(integer32);
161 INTENTION_CLIENT->GetUdKey(str);
162 Msdp::DeviceStatus::ShadowOffset shadowOffset;
163 INTENTION_CLIENT->GetShadowOffset(shadowOffset);
164 Msdp::DeviceStatus::DragData dragDataGet;
165 INTENTION_CLIENT->GetDragData(dragDataGet);
166
167 INTENTION_CLIENT->UpdatePreviewStyle(previewStyle);
168 INTENTION_CLIENT->UpdatePreviewStyleWithAnimation(previewStyle, previewAnimation);
169 INTENTION_CLIENT->RotateDragWindowSync(rsTransaction);
170 INTENTION_CLIENT->SetDragWindowScreenId(integerU64, integerU64);
171 std::map<std::string, int64_t> summarys;
172 INTENTION_CLIENT->GetDragSummary(summarys, boolean);
173 INTENTION_CLIENT->SetDragSwitchState(boolean, boolean);
174 INTENTION_CLIENT->SetAppDragSwitchState(boolean, str, boolean);
175 Msdp::DeviceStatus::DragState dragState;
176 INTENTION_CLIENT->GetDragState(dragState);
177 INTENTION_CLIENT->EnableUpperCenterMode(boolean);
178 Msdp::DeviceStatus::DragAction dragAction;
179 INTENTION_CLIENT->GetDragAction(dragAction);
180 INTENTION_CLIENT->GetExtraInfo(str);
181 INTENTION_CLIENT->AddPrivilege();
182 INTENTION_CLIENT->EraseMouseIcon();
183 INTENTION_CLIENT->SetMouseDragMonitorState(boolean);
184 INTENTION_CLIENT->SetDraggableState(boolean);
185 INTENTION_CLIENT->GetAppDragSwitchState(boolean);
186 INTENTION_CLIENT->SetDraggableStateAsync(boolean, integer32);
187 Msdp::DeviceStatus::DragBundleInfo dragBundleInfo;
188 INTENTION_CLIENT->GetDragBundleInfo(dragBundleInfo);
189 bool isStart = false;
190 INTENTION_CLIENT->IsDragStart(isStart);
191 }
192
FuzzIntentionClientBoomerang(const uint8_t * rawData,size_t size)193 void FuzzIntentionClientBoomerang(const uint8_t *rawData, size_t size)
194 {
195 uint32_t integer = ConvertToUint32(rawData);
196 int32_t integer32 = static_cast<int32_t>(integer);
197 std::string str(reinterpret_cast<const char *>(rawData), size);
198
199 uint32_t color[100] = { integer };
200 InitializationOptions opts = { { 5, 7}, PixelFormat::ARGB_8888 };
201 std::unique_ptr<PixelMap> pixelMap = PixelMap::Create(color, sizeof(color)/sizeof(color[0]), opts);
202 std::shared_ptr<PixelMap> pixelMapIn = move(pixelMap);
203
204 sptr<Msdp::DeviceStatus::IRemoteBoomerangCallback> callback =
205 sptr<BoomerangClientTestCallback>::MakeSptr();
206 INTENTION_CLIENT->SubscribeCallback(integer32, str, callback);
207 INTENTION_CLIENT->UnsubscribeCallback(integer32, str, callback);
208 INTENTION_CLIENT->NotifyMetadataBindingEvent(str, callback);
209 INTENTION_CLIENT->SubmitMetadata(str);
210 INTENTION_CLIENT->BoomerangEncodeImage(pixelMapIn, str, callback);
211 INTENTION_CLIENT->BoomerangDecodeImage(pixelMapIn, callback);
212 }
213
FuzzIntentionClientStationary(const uint8_t * rawData,size_t size)214 void FuzzIntentionClientStationary(const uint8_t *rawData, size_t size)
215 {
216 uint32_t integer = ConvertToUint32(rawData);
217 int32_t integer32 = static_cast<int32_t>(integer);
218
219 sptr<Msdp::DeviceStatus::IRemoteDevStaCallback> callback =
220 sptr<Msdp::DeviceStatus::DeviceStatusCallbackStub>::MakeSptr();
221
222 INTENTION_CLIENT->SubscribeStationaryCallback(integer32, integer32, integer32, callback);
223 INTENTION_CLIENT->UnsubscribeStationaryCallback(integer32, integer32, callback);
224 INTENTION_CLIENT->GetDeviceStatusData(integer32, integer32, integer32);
225 }
226
227 } // namespace OHOS
228
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)229 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
230 {
231 if (size < THRESHOLD) {
232 return 0;
233 }
234 /* Run your code on data */
235 OHOS::FuzzIntentionClientSocket(data, size);
236 OHOS::FuzzIntentionClientCooperate(data, size);
237 OHOS::FuzzIntentionClientDrag(data, size);
238 OHOS::FuzzIntentionClientBoomerang(data, size);
239 OHOS::FuzzIntentionClientStationary(data, size);
240 return 0;
241 }
242