1 /*
2 * Copyright (c) 2023-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "startusingpermissioncallbackstub_fuzzer.h"
17
18 #include "constant.h"
19 #include "fuzzer/FuzzedDataProvider.h"
20 #include "iprivacy_manager.h"
21 #include "permission_used_type.h"
22 #include "proxy_death_callback_stub.h"
23 #include "state_change_callback.h"
24 #include "state_customized_cbk.h"
25 #include "privacy_manager_service.h"
26
27 using namespace std;
28 using namespace OHOS::Security::AccessToken;
29 static int32_t g_permSize = static_cast<int32_t>(Constant::PERMISSION_OPCODE_MAP.size());
30
31 class CbCustomizeTest : public StateCustomizedCbk {
32 public:
CbCustomizeTest()33 explicit CbCustomizeTest() : StateCustomizedCbk()
34 {
35 }
36
~CbCustomizeTest()37 ~CbCustomizeTest()
38 {}
39
StateChangeNotify(AccessTokenID tokenId,bool isShowing)40 virtual void StateChangeNotify(AccessTokenID tokenId, bool isShowing)
41 {
42 isShowing_ = true;
43 }
44
45 bool isShowing_ = false;
46 };
47
48 namespace OHOS {
StartUsingPermissionCallbackStub(AccessTokenID tokenID,int32_t pid,const std::string & permissionName)49 void StartUsingPermissionCallbackStub(AccessTokenID tokenID, int32_t pid, const std::string& permissionName)
50 {
51 MessageParcel data;
52 if (!data.WriteInterfaceToken(IPrivacyManager::GetDescriptor())) {
53 return;
54 }
55
56 PermissionUsedTypeInfoParcel infoParcel;
57 infoParcel.info.tokenId = tokenID;
58 infoParcel.info.pid = pid;
59 infoParcel.info.permissionName = permissionName;
60 infoParcel.info.type = NORMAL_TYPE;
61
62 auto anonyStub = sptr<ProxyDeathCallBackStub>::MakeSptr();
63 if (!data.WriteParcelable(&infoParcel)) {
64 return;
65 }
66
67 sptr<StateChangeCallback> callbackWrap = nullptr;
68 auto callback = std::make_shared<CbCustomizeTest>();
69 callbackWrap = new (std::nothrow) StateChangeCallback(callback);
70 if (callbackWrap == nullptr) {
71 return;
72 }
73 if (!data.WriteRemoteObject(callbackWrap->AsObject())) {
74 return;
75 }
76
77 if (!data.WriteRemoteObject(anonyStub)) {
78 return;
79 }
80
81 MessageParcel reply;
82 MessageOption option(MessageOption::TF_SYNC);
83 DelayedSingleton<PrivacyManagerService>::GetInstance()->OnRemoteRequest(
84 static_cast<uint32_t>(IPrivacyManagerIpcCode::COMMAND_START_USING_PERMISSION_CALLBACK), data, reply, option);
85 }
86
StopUsingPermissionStub(AccessTokenID tokenID,int32_t pid,const std::string & permissionName)87 void StopUsingPermissionStub(AccessTokenID tokenID, int32_t pid, const std::string& permissionName)
88 {
89 MessageParcel datas;
90 if (!datas.WriteInterfaceToken(IPrivacyManager::GetDescriptor())) {
91 return;
92 }
93 if (!datas.WriteUint32(tokenID)) {
94 return;
95 }
96 if (!datas.WriteInt32(pid)) {
97 return;
98 }
99 if (!datas.WriteString(permissionName)) {
100 return;
101 }
102
103 MessageParcel reply;
104 MessageOption option(MessageOption::TF_SYNC);
105 DelayedSingleton<PrivacyManagerService>::GetInstance()->OnRemoteRequest(
106 static_cast<uint32_t>(IPrivacyManagerIpcCode::COMMAND_STOP_USING_PERMISSION), datas, reply, option);
107 }
108
StartUsingPermissionCallbackStubFuzzTest(const uint8_t * data,size_t size)109 bool StartUsingPermissionCallbackStubFuzzTest(const uint8_t* data, size_t size)
110 {
111 if ((data == nullptr) || (size == 0)) {
112 return false;
113 }
114
115 FuzzedDataProvider provider(data, size);
116 AccessTokenID tokenID = provider.ConsumeIntegral<AccessTokenID>();
117 int32_t pid = provider.ConsumeIntegral<int32_t>();
118 std::string permissionName;
119 int32_t opCode = provider.ConsumeIntegral<int32_t>() % g_permSize;
120 Constant::TransferOpcodeToPermission(opCode, permissionName);
121
122 StartUsingPermissionCallbackStub(tokenID, pid, permissionName);
123 StopUsingPermissionStub(tokenID, pid, permissionName);
124
125 return true;
126 }
127 } // namespace OHOS
128
129 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)130 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
131 {
132 /* Run your code on data */
133 OHOS::StartUsingPermissionCallbackStubFuzzTest(data, size);
134 return 0;
135 }
136