1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "abilityeventhandler_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #define private public
22 #include "ability_event_handler.h"
23 #include "interceptor/ability_interceptor_executer.h"
24 #include "ability_running_info.h"
25 #include "ability_scheduler_proxy.h"
26 #include "ams_configuration_parameter.h"
27 #undef private
28
29 #include "ability_record.h"
30 #include "data_ability_observer_interface.h"
31 #include "data_ability_predicates.h"
32
33 using namespace OHOS::AAFwk;
34 using namespace OHOS::AppExecFwk;
35
36 namespace OHOS {
37 namespace {
38 constexpr int INPUT_ZERO = 0;
39 constexpr int INPUT_ONE = 1;
40 constexpr int INPUT_THREE = 3;
41 constexpr size_t U32_AT_SIZE = 4;
42 constexpr uint8_t ENABLE = 2;
43 constexpr int OFFSET_ZERO = 24;
44 constexpr int OFFSET_ONE = 16;
45 constexpr int OFFSET_TWO = 8;
46 class DataAbilityObserver : public IDataAbilityObserver {
47 public:
48 DataAbilityObserver() = default;
49 virtual ~DataAbilityObserver() = default;
OnChange()50 void OnChange() override
51 {}
AsObject()52 sptr<IRemoteObject> AsObject() override
53 {
54 return {};
55 }
56 };
57 }
58
GetU32Data(const char * ptr)59 uint32_t GetU32Data(const char* ptr)
60 {
61 // convert fuzz input data to an integer
62 return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
63 ptr[INPUT_THREE];
64 }
65
GetFuzzAbilityToken()66 sptr<Token> GetFuzzAbilityToken()
67 {
68 sptr<Token> token = nullptr;
69 AbilityRequest abilityRequest;
70 abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
71 abilityRequest.abilityInfo.name = "MainAbility";
72 abilityRequest.abilityInfo.type = AbilityType::DATA;
73 std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
74 if (abilityRecord) {
75 token = abilityRecord->GetToken();
76 }
77 return token;
78 }
79
DoSomethingInterestingWithMyAPI(const char * data,size_t size)80 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
81 {
82 bool boolParam = *data % ENABLE;
83 int intParam = static_cast<int>(GetU32Data(data));
84 int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
85 int64_t int64Param = static_cast<int64_t>(GetU32Data(data));
86 uint32_t uint32Param = GetU32Data(data);
87 std::string stringParam(data, size);
88
89 // fuzz for AbilityEventHandler
90 std::shared_ptr<TaskHandlerWrap> runner;
91 std::weak_ptr<AbilityManagerService> server;
92 auto abilityEventHandler = std::make_shared<AbilityEventHandler>(runner, server);
93 abilityEventHandler->ProcessLoadTimeOut(int64Param);
94 abilityEventHandler->ProcessActiveTimeOut(int64Param);
95 abilityEventHandler->ProcessInactiveTimeOut(int64Param);
96 abilityEventHandler->ProcessForegroundTimeOut(int64Param);
97
98 // fuzz for AbilityInterceptorExecuter
99 auto abilityInterceptorExecuter = std::make_shared<AbilityInterceptorExecuter>();
100 std::shared_ptr<AbilityInterceptor> interceptor;
101 abilityInterceptorExecuter->AddInterceptor(interceptor);
102 Parcel wantParcel;
103 Want* want = nullptr;
104 if (wantParcel.WriteBuffer(data, size)) {
105 want = Want::Unmarshalling(wantParcel);
106 if (!want) {
107 return false;
108 }
109 }
110
111 AbilityInterceptorParam interceptorParam = AbilityInterceptorParam(
112 *want, intParam, int32Param, boolParam, nullptr, nullptr);
113 abilityInterceptorExecuter->DoProcess(interceptorParam);
114
115 // fuzz for AbilityRunningInfo
116 auto abilityRunningInfo = std::make_shared<AbilityRunningInfo>();
117 Parcel parcel;
118 abilityRunningInfo->ReadFromParcel(parcel);
119 abilityRunningInfo->Unmarshalling(parcel);
120 abilityRunningInfo->Marshalling(parcel);
121
122 // fuzz for AbilitySchedulerProxy
123 sptr<IRemoteObject> impl = GetFuzzAbilityToken();
124 auto abilitySchedulerProxy = std::make_shared<AbilitySchedulerProxy>(impl);
125 MessageParcel messageParcel;
126 abilitySchedulerProxy->WriteInterfaceToken(messageParcel);
127 LifeCycleStateInfo stateInfo;
128 abilitySchedulerProxy->ScheduleAbilityTransaction(*want, stateInfo);
129 abilitySchedulerProxy->SendResult(intParam, intParam, *want);
130 abilitySchedulerProxy->ScheduleConnectAbility(*want);
131 abilitySchedulerProxy->ScheduleDisconnectAbility(*want);
132 abilitySchedulerProxy->ScheduleCommandAbility(*want, boolParam, intParam);
133 abilitySchedulerProxy->ScheduleSaveAbilityState();
134 PacMap inState;
135 abilitySchedulerProxy->ScheduleRestoreAbilityState(inState);
136 Uri uri(stringParam);
137 abilitySchedulerProxy->GetFileTypes(uri, stringParam);
138 abilitySchedulerProxy->OpenFile(uri, stringParam);
139 abilitySchedulerProxy->OpenRawFile(uri, stringParam);
140 PacMap pacMap;
141 abilitySchedulerProxy->Call(uri, stringParam, stringParam, pacMap);
142 NativeRdb::DataAbilityPredicates predicates;
143 abilitySchedulerProxy->Delete(uri, predicates);
144 std::vector<std::string> columns;
145 abilitySchedulerProxy->Query(uri, columns, predicates);
146 abilitySchedulerProxy->GetType(uri);
147 PacMap extras;
148 abilitySchedulerProxy->Reload(uri, extras);
149 sptr<IDataAbilityObserver> dataObserver(new DataAbilityObserver());
150 abilitySchedulerProxy->ScheduleRegisterObserver(uri, dataObserver);
151 abilitySchedulerProxy->ScheduleUnregisterObserver(uri, dataObserver);
152 abilitySchedulerProxy->ScheduleNotifyChange(uri);
153 abilitySchedulerProxy->NormalizeUri(uri);
154 abilitySchedulerProxy->DenormalizeUri(uri);
155 std::vector<std::shared_ptr<AppExecFwk::DataAbilityOperation>> operations;
156 abilitySchedulerProxy->ExecuteBatch(operations);
157 abilitySchedulerProxy->ContinueAbility(stringParam, uint32Param);
158 abilitySchedulerProxy->NotifyContinuationResult(int32Param);
159 std::vector<std::string> stringVector;
160 abilitySchedulerProxy->DumpAbilityInfo(stringVector, stringVector);
161 abilitySchedulerProxy->CallRequest();
162 // fuzz for AmsConfigurationParameter
163 AmsConfigurationParameter::GetInstance().NonConfigFile();
164 AmsConfigurationParameter::GetInstance().GetMissionSaveTime();
165 AmsConfigurationParameter::GetInstance().GetOrientation();
166 AmsConfigurationParameter::GetInstance().GetANRTimeOutTime();
167 AmsConfigurationParameter::GetInstance().GetAMSTimeOutTime();
168 AmsConfigurationParameter::GetInstance().GetMaxRestartNum(true);
169 AmsConfigurationParameter::GetInstance().GetDeviceType();
170 AmsConfigurationParameter::GetInstance().GetBootAnimationTimeoutTime();
171 nlohmann::json Object;
172 AmsConfigurationParameter::GetInstance().LoadAppConfigurationForStartUpService(Object);
173 AmsConfigurationParameter::GetInstance().LoadAppConfigurationForMemoryThreshold(Object);
174 AmsConfigurationParameter::GetInstance().LoadSystemConfiguration(Object);
175
176 return true;
177 }
178 }
179
180 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)181 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
182 {
183 /* Run your code on data */
184 if (data == nullptr) {
185 std::cout << "invalid data" << std::endl;
186 return 0;
187 }
188
189 /* Validate the length of size */
190 if (size < OHOS::U32_AT_SIZE) {
191 return 0;
192 }
193
194 char* ch = static_cast<char*>(malloc(size + 1));
195 if (ch == nullptr) {
196 std::cout << "malloc failed." << std::endl;
197 return 0;
198 }
199
200 (void)memset_s(ch, size + 1, 0x00, size + 1);
201 if (memcpy_s(ch, size, data, size) != EOK) {
202 std::cout << "copy failed." << std::endl;
203 free(ch);
204 ch = nullptr;
205 return 0;
206 }
207
208 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
209 free(ch);
210 ch = nullptr;
211 return 0;
212 }
213
214