1 /*
2 * Copyright (c) 2023-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "startusingpermissionstub_fuzzer.h"
17
18 #include "constant.h"
19 #include "fuzzer/FuzzedDataProvider.h"
20 #include "iprivacy_manager.h"
21 #include "permission_used_type.h"
22 #include "privacy_manager_service.h"
23 #include "proxy_death_callback_stub.h"
24
25 using namespace std;
26 using namespace OHOS::Security::AccessToken;
27 static int32_t g_permSize = static_cast<int32_t>(Constant::PERMISSION_OPCODE_MAP.size());
28
29 namespace OHOS {
StartUsingPermissionStub(AccessTokenID tokenID,int32_t pid,const std::string & permissionName)30 void StartUsingPermissionStub(AccessTokenID tokenID, int32_t pid, const std::string& permissionName)
31 {
32 MessageParcel data;
33 if (!data.WriteInterfaceToken(IPrivacyManager::GetDescriptor())) {
34 return;
35 }
36
37 PermissionUsedTypeInfoParcel infoParcel;
38 infoParcel.info.tokenId = tokenID;
39 infoParcel.info.pid = pid;
40 infoParcel.info.permissionName = permissionName;
41 infoParcel.info.type = NORMAL_TYPE;
42
43 auto anonyStub = sptr<ProxyDeathCallBackStub>::MakeSptr();
44 if (!data.WriteParcelable(&infoParcel)) {
45 return;
46 }
47 if (!data.WriteRemoteObject(anonyStub)) {
48 return;
49 }
50
51 MessageParcel reply;
52 MessageOption option(MessageOption::TF_SYNC);
53 DelayedSingleton<PrivacyManagerService>::GetInstance()->OnRemoteRequest(
54 static_cast<uint32_t>(IPrivacyManagerIpcCode::COMMAND_START_USING_PERMISSION), data, reply, option);
55 }
56
StopUsingPermissionStub(AccessTokenID tokenID,int32_t pid,const std::string & permissionName)57 void StopUsingPermissionStub(AccessTokenID tokenID, int32_t pid, const std::string& permissionName)
58 {
59 MessageParcel datas;
60 if (!datas.WriteInterfaceToken(IPrivacyManager::GetDescriptor())) {
61 return;
62 }
63 if (!datas.WriteUint32(tokenID)) {
64 return;
65 }
66 if (!datas.WriteInt32(pid)) {
67 return;
68 }
69 if (!datas.WriteString(permissionName)) {
70 return;
71 }
72
73 MessageParcel reply;
74 MessageOption option(MessageOption::TF_SYNC);
75 DelayedSingleton<PrivacyManagerService>::GetInstance()->OnRemoteRequest(
76 static_cast<uint32_t>(IPrivacyManagerIpcCode::COMMAND_STOP_USING_PERMISSION), datas, reply, option);
77 }
78
StartUsingPermissionStubFuzzTest(const uint8_t * data,size_t size)79 bool StartUsingPermissionStubFuzzTest(const uint8_t* data, size_t size)
80 {
81 if ((data == nullptr) || (size == 0)) {
82 return false;
83 }
84
85 FuzzedDataProvider provider(data, size);
86 AccessTokenID tokenID = provider.ConsumeIntegral<AccessTokenID>();
87 int32_t pid = provider.ConsumeIntegral<int32_t>();
88 std::string permissionName;
89 int32_t opCode = provider.ConsumeIntegral<int32_t>() % g_permSize;
90 Constant::TransferOpcodeToPermission(opCode, permissionName);
91
92 StartUsingPermissionStub(tokenID, pid, permissionName);
93 StopUsingPermissionStub(tokenID, pid, permissionName);
94 return true;
95 }
96 } // namespace OHOS
97
98 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)99 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
100 {
101 /* Run your code on data */
102 OHOS::StartUsingPermissionStubFuzzTest(data, size);
103 return 0;
104 }
105