1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fcntl.h>
17 #include <fuzzer/FuzzedDataProvider.h>
18 #include <sys/stat.h>
19 #include <unistd.h>
20
21 #include <cstdint>
22 #include <cstdio>
23 #include <iostream>
24
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "pixel_map.h"
28 #include "token_setproc.h"
29 #include "wallpaper_common.h"
30 #include "wallpaper_manager.h"
31 #include "wallpaper_manager_client.h"
32 #include "wallpaper_manager_common_info.h"
33 #include "wallpaper_picture_info_by_parcel.h"
34 #include "wallpaper_rawdata.h"
35
36 using namespace OHOS::Security::AccessToken;
37 using namespace OHOS::Media;
38
39 namespace OHOS {
40 constexpr const char *WALLPAPER_DEFAULT_FILEFULLPATH = "/system/etc/wallpaperdefault.jpeg";
41 constexpr int32_t PIXELMAP_SIZE = 100;
42 static const char *g_perms[2] = { "ohos.permission.GET_WALLPAPER", "ohos.permission.SET_WALLPAPER" };
GrantNativePermission()43 void GrantNativePermission()
44 {
45 TokenInfoParams infoInstance = {
46 .dcapsNum = 0,
47 .permsNum = 2,
48 .aclsNum = 0,
49 .dcaps = nullptr,
50 .perms = g_perms,
51 .acls = nullptr,
52 .processName = "wallpaper_service",
53 .aplStr = "system_core",
54 };
55 uint64_t tokenId = GetAccessTokenId(&infoInstance);
56 SetSelfTokenID(tokenId);
57 AccessTokenKit::ReloadNativeTokenInfo();
58 }
59
60 class WallpaperEventListenerFuzzTestImpl : public OHOS::WallpaperMgrService::WallpaperEventListener {
61 public:
62 std::vector<uint64_t> color_;
63 int32_t wallpaperType_;
64 WallpaperEventListenerFuzzTestImpl();
~WallpaperEventListenerFuzzTestImpl()65 ~WallpaperEventListenerFuzzTestImpl()
66 {
67 }
68
69 WallpaperEventListenerFuzzTestImpl(const WallpaperEventListenerFuzzTestImpl &) = delete;
70 WallpaperEventListenerFuzzTestImpl &operator=(const WallpaperEventListenerFuzzTestImpl &) = delete;
71 WallpaperEventListenerFuzzTestImpl(WallpaperEventListenerFuzzTestImpl &&) = delete;
72 WallpaperEventListenerFuzzTestImpl &operator=(WallpaperEventListenerFuzzTestImpl &&) = delete;
73
74 // callback function will be called when the db data is changed.
75 void OnColorsChange(const std::vector<uint64_t> &color, int32_t wallpaperType);
76
77 private:
78 unsigned long callCount_;
79 };
80
OnColorsChange(const std::vector<uint64_t> & color,int32_t wallpaperType)81 void WallpaperEventListenerFuzzTestImpl::OnColorsChange(const std::vector<uint64_t> &color, int32_t wallpaperType)
82 {
83 callCount_++;
84 std::copy(color.begin(), color.end(), std::back_inserter(color_));
85 wallpaperType_ = wallpaperType;
86 }
87
WallpaperEventListenerFuzzTestImpl()88 WallpaperEventListenerFuzzTestImpl::WallpaperEventListenerFuzzTestImpl() : wallpaperType_(-1), callCount_(0)
89 {
90 }
91
GetColorsFuzzTest(FuzzedDataProvider & provider)92 void GetColorsFuzzTest(FuzzedDataProvider &provider)
93 {
94 GrantNativePermission();
95 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
96 WallpaperMgrService::ApiInfo apiInfo{ provider.ConsumeBool(), provider.ConsumeBool() };
97 std::vector<uint64_t> colors;
98 WallpaperMgrService::WallpaperManager::GetInstance().GetColors(wallpaperType, apiInfo, colors);
99 }
100
GetWallpaperIdFuzzTest(FuzzedDataProvider & provider)101 void GetWallpaperIdFuzzTest(FuzzedDataProvider &provider)
102 {
103 GrantNativePermission();
104 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
105 WallpaperMgrService::WallpaperManager::GetInstance().GetWallpaperId(wallpaperType);
106 }
107
ResetWallpaperFuzzTest(FuzzedDataProvider & provider)108 void ResetWallpaperFuzzTest(FuzzedDataProvider &provider)
109 {
110 GrantNativePermission();
111 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
112 WallpaperMgrService::ApiInfo apiInfo{ provider.ConsumeBool(), provider.ConsumeBool() };
113 WallpaperMgrService::WallpaperManager::GetInstance().ResetWallpaper(wallpaperType, apiInfo);
114 }
115
SetWallpaperByUriFuzzTest(FuzzedDataProvider & provider)116 void SetWallpaperByUriFuzzTest(FuzzedDataProvider &provider)
117 {
118 GrantNativePermission();
119 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
120 std::string uri = provider.ConsumeRandomLengthString();
121 WallpaperMgrService::ApiInfo apiInfo{ provider.ConsumeBool(), provider.ConsumeBool() };
122 auto listener = std::make_shared<WallpaperEventListenerFuzzTestImpl>();
123 WallpaperMgrService::WallpaperManager::GetInstance().On("colorChange", listener);
124 WallpaperMgrService::WallpaperManager::GetInstance().SetWallpaper(uri, wallpaperType, apiInfo);
125 WallpaperMgrService::WallpaperManager::GetInstance().Off("colorChange", listener);
126 WallpaperMgrService::WallpaperManager::GetInstance().SetWallpaper(
127 std::string(WALLPAPER_DEFAULT_FILEFULLPATH), wallpaperType, apiInfo);
128 }
129
SetWallpaperByMapFuzzTest(FuzzedDataProvider & provider)130 void SetWallpaperByMapFuzzTest(FuzzedDataProvider &provider)
131 {
132 GrantNativePermission();
133 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
134 uint32_t color[100] = { 3, 7, 9, 9, 7, 6 };
135 InitializationOptions opts = { { 5, 7 }, OHOS::Media::PixelFormat::ARGB_8888 };
136 std::unique_ptr<PixelMap> uniquePixelMap = PixelMap::Create(color, sizeof(color) / sizeof(color[0]), opts);
137 std::shared_ptr<PixelMap> pixelMap = std::move(uniquePixelMap);
138 auto listener = std::make_shared<WallpaperEventListenerFuzzTestImpl>();
139 WallpaperMgrService::ApiInfo apiInfo{ provider.ConsumeBool(), provider.ConsumeBool() };
140 WallpaperMgrService::WallpaperManager::GetInstance().On("colorChange", listener);
141 WallpaperMgrService::WallpaperManager::GetInstance().SetWallpaper(pixelMap, wallpaperType, apiInfo);
142 WallpaperMgrService::WallpaperManager::GetInstance().Off("colorChange", listener);
143 }
144
GetFileFuzzTest(FuzzedDataProvider & provider)145 void GetFileFuzzTest(FuzzedDataProvider &provider)
146 {
147 GrantNativePermission();
148 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
149 int32_t wallpaperFd = -1;
150 WallpaperMgrService::WallpaperManager::GetInstance().GetFile(wallpaperType, wallpaperFd);
151 }
152
WallpaperManagerFuzzTest(FuzzedDataProvider & provider)153 void WallpaperManagerFuzzTest(FuzzedDataProvider &provider)
154 {
155 GrantNativePermission();
156 auto minHeight = provider.ConsumeIntegral<int32_t>();
157 auto minWidth = provider.ConsumeIntegral<int32_t>();
158 WallpaperMgrService::ApiInfo apiInfo{ provider.ConsumeBool(), provider.ConsumeBool() };
159 WallpaperMgrService::WallpaperManager::GetInstance().GetWallpaperMinHeight(apiInfo, minHeight);
160 WallpaperMgrService::WallpaperManager::GetInstance().GetWallpaperMinWidth(apiInfo, minWidth);
161 WallpaperMgrService::WallpaperManager::GetInstance().IsChangePermitted();
162 WallpaperMgrService::WallpaperManager::GetInstance().IsOperationAllowed();
163 uint32_t color[100] = { 3, 7, 9, 9, 7, 6 };
164 InitializationOptions opts = { { 5, 7 }, OHOS::Media::PixelFormat::ARGB_8888 };
165 std::unique_ptr<PixelMap> uniquePixelMap = PixelMap::Create(color, sizeof(color) / sizeof(color[0]), opts);
166 std::shared_ptr<PixelMap> pixelMap = std::move(uniquePixelMap);
167 int32_t size = provider.ConsumeIntegral<int32_t>();
168 int32_t fd = provider.ConsumeIntegral<int32_t>();
169 WallpaperMgrService::WallpaperManager::GetInstance().CreatePixelMapByFd(fd, size, pixelMap);
170 WallpaperMgrService::WallpaperManager::GetInstance().GetCallback();
171 FaultType faultType = FaultType::SERVICE_FAULT;
172 FaultCode FaultCode = FaultCode::SF_SERVICE_UNAVAILABLE;
173 WallpaperMgrService::WallpaperManager::GetInstance().ReporterFault(faultType, FaultCode);
174 int32_t wallpaperType = provider.ConsumeIntegral<int32_t>();
175 WallpaperMgrService::WallpaperManager::GetInstance().CloseWallpaperFd(wallpaperType);
176 WallpaperMgrService::WallpaperManager::GetInstance().RegisterWallpaperListener();
177 std::string fileName = provider.ConsumeRandomLengthString();
178 WallpaperMgrService::WallpaperManager::GetInstance().CheckVideoFormat(fileName);
179 int64_t fileSize;
180 int32_t fdVedio;
181 WallpaperMgrService::WallpaperManager::GetInstance().OpenFile(fileName, fdVedio, fileSize);
182 long fdLength;
183 bool idLive = provider.ConsumeBool();
184 WallpaperMgrService::WallpaperManager::GetInstance().CheckWallpaperFormat(fileName, idLive, fdLength);
185 WallpaperInfo wallpaperInfo;
186 wallpaperInfo.foldState = FoldState::NORMAL;
187 wallpaperInfo.rotateState = RotateState::PORT;
188 wallpaperInfo.source = provider.ConsumeRandomLengthString();
189 WallpaperMgrService::WallpaperPictureInfo wallpaperPictureInfo;
190 wallpaperPictureInfo.foldState = FoldState::NORMAL;
191 wallpaperPictureInfo.rotateState = RotateState::PORT;
192 wallpaperPictureInfo.fd = fd;
193 wallpaperPictureInfo.length = provider.ConsumeIntegral<long>();
194 WallpaperMgrService::WallpaperManager::GetInstance().GetFdByPath(wallpaperInfo, wallpaperPictureInfo, fileName);
195 WallpaperMgrService::WallpaperManager::GetInstance().ConverString2Int(fileName);
196 }
197
GetPixelMapFuzzTest(FuzzedDataProvider & provider)198 void GetPixelMapFuzzTest(FuzzedDataProvider &provider)
199 {
200 GrantNativePermission();
201 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
202 std::shared_ptr<OHOS::Media::PixelMap> pixelMap;
203 WallpaperMgrService::ApiInfo apiInfo{ provider.ConsumeBool(), provider.ConsumeBool() };
204 WallpaperMgrService::WallpaperManager::GetInstance().GetPixelMap(wallpaperType, apiInfo, pixelMap);
205 }
206
SetVideoFuzzTest(FuzzedDataProvider & provider)207 void SetVideoFuzzTest(FuzzedDataProvider &provider)
208 {
209 GrantNativePermission();
210 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
211 std::string uri = provider.ConsumeRandomLengthString();
212 WallpaperMgrService::WallpaperManager::GetInstance().SetVideo(uri, wallpaperType);
213 WallpaperMgrService::WallpaperManager::GetInstance().SetVideo(
214 std::string(WALLPAPER_DEFAULT_FILEFULLPATH), wallpaperType);
215 }
216
SendEventFuzzTest(FuzzedDataProvider & provider)217 void SendEventFuzzTest(FuzzedDataProvider &provider)
218 {
219 GrantNativePermission();
220 std::string eventType = provider.ConsumeRandomLengthString();
221 WallpaperMgrService::WallpaperManager::GetInstance().SendEvent(eventType);
222 }
223
SetCustomWallpaperFuzzTest(FuzzedDataProvider & provider)224 void SetCustomWallpaperFuzzTest(FuzzedDataProvider &provider)
225 {
226 GrantNativePermission();
227 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
228 std::string uri = provider.ConsumeRandomLengthString();
229 WallpaperMgrService::WallpaperManager::GetInstance().SetCustomWallpaper(uri, wallpaperType);
230 WallpaperMgrService::WallpaperManager::GetInstance().SetCustomWallpaper(
231 std::string(WALLPAPER_DEFAULT_FILEFULLPATH), wallpaperType);
232 }
233
SetAllWallpapersFuzzTest(FuzzedDataProvider & provider)234 void SetAllWallpapersFuzzTest(FuzzedDataProvider &provider)
235 {
236 GrantNativePermission();
237 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
238 std::vector<WallpaperInfo> allWallpaperInfos;
239 WallpaperInfo wallpaperInfo;
240 wallpaperInfo.foldState = FoldState::NORMAL;
241 wallpaperInfo.rotateState = RotateState::PORT;
242 wallpaperInfo.source = provider.ConsumeRandomLengthString();
243 allWallpaperInfos.push_back(wallpaperInfo);
244 WallpaperMgrService::WallpaperManager::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
245 allWallpaperInfos.clear();
246 wallpaperInfo.source = std::string(WALLPAPER_DEFAULT_FILEFULLPATH);
247 allWallpaperInfos.push_back(wallpaperInfo);
248 WallpaperMgrService::WallpaperManager::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
249 }
250
GetCorrespondWallpaperFuzzTest(FuzzedDataProvider & provider)251 void GetCorrespondWallpaperFuzzTest(FuzzedDataProvider &provider)
252 {
253 GrantNativePermission();
254 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
255 std::shared_ptr<OHOS::Media::PixelMap> pixelMap;
256 WallpaperMgrService::WallpaperManager::GetInstance().GetCorrespondWallpaper(
257 wallpaperType, FoldState::NORMAL, RotateState::PORT, pixelMap);
258 }
259
IsDefaultWallpaperResourceFuzzTest(FuzzedDataProvider & provider)260 void IsDefaultWallpaperResourceFuzzTest(FuzzedDataProvider &provider)
261 {
262 GrantNativePermission();
263 uint32_t userId = provider.ConsumeIntegral<uint32_t>();
264 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
265 WallpaperMgrService::WallpaperManagerClient::GetInstance().IsDefaultWallpaperResource(userId, wallpaperType);
266 WallpaperMgrService::WallpaperManager::GetInstance().IsDefaultWallpaperResource(userId, wallpaperType);
267 }
268
SetAllWallpapersClientFuzzTest(FuzzedDataProvider & provider)269 void SetAllWallpapersClientFuzzTest(FuzzedDataProvider &provider)
270 {
271 GrantNativePermission();
272 uint32_t wallpaperType = provider.ConsumeIntegral<uint32_t>();
273 std::vector<WallpaperInfo> allWallpaperInfos;
274 WallpaperInfo wallpaperInfo;
275 wallpaperInfo.foldState = FoldState::NORMAL;
276 wallpaperInfo.rotateState = RotateState::PORT;
277 wallpaperInfo.source = provider.ConsumeRandomLengthString();
278 allWallpaperInfos.push_back(wallpaperInfo);
279 WallpaperMgrService::WallpaperManagerClient::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
280 wallpaperType = 0;
281 WallpaperMgrService::WallpaperManagerClient::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
282 WallpaperMgrService::WallpaperManager::GetInstance().SetAllWallpapers(allWallpaperInfos, wallpaperType);
283 }
284
WallpaperManagerProxyFuzzTest(FuzzedDataProvider & provider)285 void WallpaperManagerProxyFuzzTest(FuzzedDataProvider &provider)
286 {
287 auto wallpaperProxy = WallpaperMgrService::WallpaperManager::GetInstance().GetService();
288 int32_t fd = provider.ConsumeIntegral<int32_t>();
289 int32_t wallpaperType = provider.ConsumeIntegral<int32_t>();
290 long length = provider.ConsumeIntegral<long>();
291 wallpaperProxy->SetWallpaperV9(fd, wallpaperType, length);
292 wallpaperProxy->SetWallpaper(fd, wallpaperType, length);
293 wallpaperProxy->SetVideo(fd, wallpaperType, length);
294 wallpaperProxy->SetCustomWallpaper(fd, wallpaperType, length);
295
296 std::vector<int8_t> value = provider.ConsumeBytes<int8_t>(PIXELMAP_SIZE);
297 WallpaperMgrService::WallpaperRawData wallpaperRawData;
298 wallpaperRawData.size = value.size();
299 wallpaperRawData.data = value.data();
300 wallpaperProxy->SetWallpaperByPixelMap(wallpaperRawData, wallpaperType);
301 wallpaperProxy->SetWallpaperV9ByPixelMap(wallpaperRawData, wallpaperType);
302
303 int32_t pixelmapSize;
304 int32_t pixelmapFd;
305 wallpaperProxy->GetPixelMapV9(wallpaperType, pixelmapSize, pixelmapFd);
306 wallpaperProxy->GetPixelMap(wallpaperType, pixelmapSize, pixelmapFd);
307 WallpaperMgrService::WallpaperPictureInfoByParcel wallpaperPictureInfoByParcel;
308
309 WallpaperMgrService::WallpaperPictureInfo wallpaperPictureInfo;
310 wallpaperPictureInfo.foldState = FoldState::NORMAL;
311 wallpaperPictureInfo.rotateState = RotateState::PORT;
312 wallpaperPictureInfo.fd = fd;
313 wallpaperPictureInfo.length = length;
314 wallpaperPictureInfoByParcel.wallpaperPictureInfo_.push_back(wallpaperPictureInfo);
315 std::vector<int32_t> fdVector;
316 fdVector.push_back(fd);
317 wallpaperProxy->SetAllWallpapers(wallpaperPictureInfoByParcel, wallpaperType, fdVector);
318
319 int32_t foldState = 0;
320 int32_t rotateState = 0;
321 wallpaperProxy->GetCorrespondWallpaper(wallpaperType, foldState, rotateState, pixelmapSize, pixelmapFd);
322 }
323
WallpaperManagerCallbackFuzzTest(FuzzedDataProvider & provider)324 void WallpaperManagerCallbackFuzzTest(FuzzedDataProvider &provider)
325 {
326 GrantNativePermission();
327 uint32_t color[100] = { 3, 7, 9, 9, 7, 6 };
328 InitializationOptions opts = { { 5, 7 }, OHOS::Media::PixelFormat::ARGB_8888 };
329 std::unique_ptr<PixelMap> uniquePixelMap = PixelMap::Create(color, sizeof(color) / sizeof(color[0]), opts);
330 std::shared_ptr<PixelMap> pixelMap = std::move(uniquePixelMap);
331 int32_t size = provider.ConsumeIntegral<int32_t>();
332 int32_t fd = provider.ConsumeIntegral<int32_t>();
333 WallpaperMgrService::WallpaperManager::GetInstance().CreatePixelMapByFd(fd, size, pixelMap);
334 std::string wallpaperPath = "/data/service/el1/public/wallpaper/100/system/wallpaper_home";
335 int32_t wallpaperFd = open(wallpaperPath.c_str(), O_RDONLY, S_IREAD);
336 FILE *file = fopen(wallpaperPath.c_str(), "rb");
337 if (file == nullptr) {
338 close(wallpaperFd);
339 return;
340 }
341 int32_t fend = fseek(file, 0, SEEK_END);
342 size = ftell(file);
343 int32_t fset = fseek(file, 0, SEEK_SET);
344 if (size <= 0 || fend != 0 || fset != 0) {
345 fclose(file);
346 close(wallpaperFd);
347 return;
348 }
349 if (fclose(file) < 0) {
350 close(wallpaperFd);
351 return;
352 }
353 WallpaperMgrService::WallpaperManager::GetInstance().CreatePixelMapByFd(wallpaperFd, size, pixelMap);
354 close(wallpaperFd);
355
356 auto wallpaperProxy = WallpaperMgrService::WallpaperManager::GetInstance().GetService();
357 JScallback callback = nullptr;
358 WallpaperMgrService::WallpaperManager::GetInstance().RegisterWallpaperCallback(callback);
359 bool registerWallpaperCallback;
360 sptr<IWallpaperCallback> wallpaperCallback;
361 wallpaperProxy->RegisterWallpaperCallback(wallpaperCallback, registerWallpaperCallback);
362 }
363
364 } // namespace OHOS
365
366 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)367 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
368 {
369 FuzzedDataProvider provider(data, size);
370 /* Run your code on data */
371 OHOS::GetColorsFuzzTest(provider);
372 OHOS::GetWallpaperIdFuzzTest(provider);
373 OHOS::ResetWallpaperFuzzTest(provider);
374 OHOS::SetWallpaperByUriFuzzTest(provider);
375 OHOS::SetWallpaperByMapFuzzTest(provider);
376 OHOS::GetFileFuzzTest(provider);
377 OHOS::WallpaperManagerFuzzTest(provider);
378 OHOS::GetPixelMapFuzzTest(provider);
379 OHOS::SendEventFuzzTest(provider);
380 OHOS::SetVideoFuzzTest(provider);
381 OHOS::SetCustomWallpaperFuzzTest(provider);
382 OHOS::SetAllWallpapersFuzzTest(provider);
383 OHOS::GetCorrespondWallpaperFuzzTest(provider);
384 OHOS::IsDefaultWallpaperResourceFuzzTest(provider);
385 OHOS::WallpaperManagerProxyFuzzTest(provider);
386 OHOS::WallpaperManagerCallbackFuzzTest(provider);
387 return 0;
388 }
