1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "connectionstatemanager_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #define private public
22 #define protected public
23 #include "connection_observer_controller.h"
24 #include "connection_record.h"
25 #include "connection_state_item.h"
26 #include "connection_state_manager.h"
27 #undef protected
28 #undef private
29
30 #include "ability_record.h"
31 #include "continuous_task_callback_info.h"
32
33 using namespace OHOS::AAFwk;
34 using namespace OHOS::AppExecFwk;
35 using namespace OHOS::AbilityRuntime;
36
37 namespace OHOS {
38 namespace {
39 constexpr size_t U32_AT_SIZE = 4;
40 constexpr uint8_t ENABLE = 2;
41 class MyAbilityConnection : public IAbilityConnection {
42 public:
43 MyAbilityConnection() = default;
44 virtual ~MyAbilityConnection() = default;
OnAbilityConnectDone(const AppExecFwk::ElementName & element,const sptr<IRemoteObject> & remoteObject,int resultCode)45 void OnAbilityConnectDone(
46 const AppExecFwk::ElementName& element, const sptr<IRemoteObject>& remoteObject, int resultCode) override
47 {}
OnAbilityDisconnectDone(const AppExecFwk::ElementName & element,int resultCode)48 void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override
49 {}
AsObject()50 sptr<IRemoteObject> AsObject() override
51 {
52 return {};
53 }
54 };
55 class MyAbilityConnectionObserver : public IConnectionObserver {
56 public:
57 MyAbilityConnectionObserver() = default;
58 virtual ~MyAbilityConnectionObserver() = default;
OnExtensionConnected(const ConnectionData & data)59 void OnExtensionConnected(const ConnectionData& data) override
60 {}
OnExtensionDisconnected(const ConnectionData & data)61 void OnExtensionDisconnected(const ConnectionData& data) override
62 {}
OnExtensionSuspended(const ConnectionData & data)63 void OnExtensionSuspended(const ConnectionData &data) override
64 {}
OnExtensionResumed(const ConnectionData & data)65 void OnExtensionResumed(const ConnectionData &data) override
66 {}
67 #ifdef WITH_DLP
OnDlpAbilityOpened(const DlpStateData & data)68 void OnDlpAbilityOpened(const DlpStateData& data) override
69 {}
OnDlpAbilityClosed(const DlpStateData & data)70 void OnDlpAbilityClosed(const DlpStateData& data) override
71 {}
72 #endif // WITH_DLP
AsObject()73 sptr<IRemoteObject> AsObject() override
74 {
75 return {};
76 }
77 };
78 }
79
GetU32Data(const char * ptr)80 uint32_t GetU32Data(const char* ptr)
81 {
82 // convert fuzz input data to an integer
83 return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3];
84 }
85
GetFuzzAbilityRecord()86 std::shared_ptr<AbilityRecord> GetFuzzAbilityRecord()
87 {
88 sptr<Token> token = nullptr;
89 AbilityRequest abilityRequest;
90 abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
91 abilityRequest.abilityInfo.name = "MainAbility";
92 abilityRequest.abilityInfo.type = AbilityType::DATA;
93 std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
94 if (!abilityRecord) {
95 return nullptr;
96 }
97 return abilityRecord;
98 }
99
GetFuzzAbilityToken()100 sptr<Token> GetFuzzAbilityToken()
101 {
102 sptr<Token> token = nullptr;
103 std::shared_ptr<AbilityRecord> abilityRecord = GetFuzzAbilityRecord();
104 if (abilityRecord) {
105 token = abilityRecord->GetToken();
106 }
107 return token;
108 }
109
DoSomethingInterestingWithMyAPI(const char * data,size_t size)110 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
111 {
112 bool boolParam = *data % ENABLE;
113 int intParam = static_cast<int>(GetU32Data(data));
114 int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
115 std::string stringParam(data, size);
116 Parcel wantParcel;
117 Want* want = nullptr;
118 if (wantParcel.WriteBuffer(data, size)) {
119 want = Want::Unmarshalling(wantParcel);
120 if (!want) {
121 return false;
122 }
123 }
124 sptr<IRemoteObject> token = GetFuzzAbilityToken();
125 sptr<IAbilityConnection> connect = new MyAbilityConnection();
126 sptr<AbilityRuntime::IConnectionObserver> observer = new MyAbilityConnectionObserver();
127 std::vector<std::string> info;
128 AbilityRuntime::ConnectionData connectionData;
129 ConnectionEvent connectionEvent;
130
131 // fuzz for ConnectionObserverController
132 auto connectionObserverController = std::make_shared<ConnectionObserverController>();
133 connectionObserverController->AddObserver(observer);
134 connectionObserverController->RemoveObserver(observer);
135 connectionObserverController->NotifyExtensionConnected(connectionData);
136 connectionObserverController->NotifyExtensionDisconnected(connectionData);
137 #ifdef WITH_DLP
138 AbilityRuntime::DlpStateData dlpStateData;
139 connectionObserverController->NotifyDlpAbilityOpened(dlpStateData);
140 connectionObserverController->NotifyDlpAbilityClosed(dlpStateData);
141 #endif // WITH_DLP
142 connectionObserverController->GetObservers();
143 wptr<IRemoteObject> remote;
144 connectionObserverController->HandleRemoteDied(remote);
145 ConnectionObserverController::ObserverDeathRecipient::ObserverDeathHandler handler;
146 std::shared_ptr<ConnectionObserverController::ObserverDeathRecipient> observerDeathRecipient =
147 std::make_shared<ConnectionObserverController::ObserverDeathRecipient>(handler);
148 observerDeathRecipient->OnRemoteDied(remote);
149
150 // fuzz for ConnectionRecord
151 std::shared_ptr<AbilityRecord> targetService = GetFuzzAbilityRecord();
152 auto connectionRecord = std::make_shared<ConnectionRecord>(token, targetService, connect, nullptr);
153 connectionRecord->CreateConnectionRecord(token, targetService, connect, nullptr);
154 ConnectionState state = ConnectionState::CONNECTED;
155 connectionRecord->SetConnectState(state);
156 connectionRecord->GetConnectState();
157 connectionRecord->GetToken();
158 connectionRecord->GetAbilityRecord();
159 connectionRecord->GetAbilityConnectCallback();
160 connectionRecord->ClearConnCallBack();
161 connectionRecord->DisconnectAbility();
162 connectionRecord->CompleteConnect();
163 connectionRecord->CompleteDisconnect(intParam, boolParam);
164 connectionRecord->ScheduleDisconnectAbilityDone();
165 connectionRecord->ScheduleConnectAbilityDone();
166 connectionRecord->DisconnectTimeout();
167 connectionRecord->ConvertConnectionState(state);
168 connectionRecord->Dump(info);
169 connectionRecord->AttachCallerInfo();
170 connectionRecord->GetCallerUid();
171 connectionRecord->GetCallerPid();
172 connectionRecord->GetCallerName();
173 connectionRecord->GetTargetToken();
174 connectionRecord->GetConnection();
175
176 // fuzz for ConnectionRecord
177 auto connectionStateItem = std::make_shared<ConnectionStateItem>(int32Param, int32Param, stringParam);
178 std::shared_ptr<ConnectionRecord> record;
179 connectionStateItem->CreateConnectionStateItem(record);
180 DataAbilityCaller dataCaller;
181 connectionStateItem->CreateConnectionStateItem(dataCaller);
182 connectionStateItem->AddConnection(record, connectionData, connectionEvent);
183 connectionStateItem->RemoveConnection(record, connectionData, connectionEvent);
184 std::shared_ptr<DataAbilityRecord> dataAbility;
185 connectionStateItem->AddDataAbilityConnection(dataCaller, dataAbility, connectionData);
186 connectionStateItem->RemoveDataAbilityConnection(dataCaller, dataAbility, connectionData);
187 connectionStateItem->HandleDataAbilityDied(token, connectionData);
188 connectionStateItem->IsEmpty();
189 std::vector<AbilityRuntime::ConnectionData> datas;
190 connectionStateItem->GenerateAllConnectionData(datas);
191 std::shared_ptr<ConnectedExtension> connectedExtension;
192 connectionStateItem->GenerateConnectionData(connectedExtension, connectionData);
193 std::shared_ptr<ConnectedDataAbility> connectedDataAbility;
194 connectionStateItem->GenerateConnectionData(connectedDataAbility, connectionData);
195
196 // fuzz for ConnectionStateManager
197 auto connectionStateManager = std::make_shared<ConnectionStateManager>();
198 connectionStateManager->GetProcessNameByPid(int32Param);
199 connectionStateManager->Init();
200 connectionStateManager->RegisterObserver(observer);
201 connectionStateManager->UnregisterObserver(observer);
202 connectionStateManager->AddConnection(record);
203 connectionStateManager->RemoveConnection(record, boolParam);
204 connectionStateManager->AddDataAbilityConnection(dataCaller, dataAbility);
205 connectionStateManager->RemoveDataAbilityConnection(dataCaller, dataAbility);
206 connectionStateManager->CheckDataAbilityConnectionParams(dataCaller, dataAbility);
207 connectionStateManager->HandleDataAbilityDied(dataAbility);
208 connectionStateManager->HandleDataAbilityCallerDied(int32Param);
209 #ifdef WITH_DLP
210 std::shared_ptr<AbilityRecord> dlpManger = GetFuzzAbilityRecord();
211 connectionStateManager->AddDlpManager(dlpManger);
212 connectionStateManager->RemoveDlpManager(dlpManger);
213 connectionStateManager->AddDlpAbility(dlpManger);
214 connectionStateManager->RemoveDlpAbility(dlpManger);
215 #endif // WITH_DLP
216 connectionStateManager->HandleAppDied(int32Param);
217 #ifdef WITH_DLP
218 std::vector<AbilityRuntime::DlpConnectionInfo> infos;
219 connectionStateManager->GetDlpConnectionInfos(infos);
220 #endif // WITH_DLP
221 connectionStateManager->AddConnectionInner(connectionRecord, connectionData, connectionEvent);
222 connectionStateManager->RemoveConnectionInner(connectionRecord, connectionData, connectionEvent);
223 connectionStateManager->HandleCallerDied(int32Param);
224 connectionStateManager->RemoveDiedCaller(int32Param);
225 connectionStateManager->AddDataAbilityConnectionInner(dataCaller, dataAbility, connectionData);
226 connectionStateManager->RemoveDataAbilityConnectionInner(dataCaller, dataAbility, connectionData);
227 connectionStateManager->HandleDataAbilityDiedInner(token, datas);
228 #ifdef WITH_DLP
229 AbilityRuntime::DlpStateData dlpData;
230 connectionStateManager->HandleDlpAbilityInner(dlpManger, boolParam, dlpData);
231 #endif // WITH_DLP
232 connectionStateManager->InitAppStateObserver();
233 if (want) {
234 delete want;
235 want = nullptr;
236 }
237 return true;
238 }
239 }
240
241 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)242 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
243 {
244 /* Run your code on data */
245 if (data == nullptr) {
246 return 0;
247 }
248
249 /* Validate the length of size */
250 if (size < OHOS::U32_AT_SIZE) {
251 return 0;
252 }
253
254 char* ch = static_cast<char*>(malloc(size + 1));
255 if (ch == nullptr) {
256 std::cout << "malloc failed." << std::endl;
257 return 0;
258 }
259
260 (void)memset_s(ch, size + 1, 0x00, size + 1);
261 if (memcpy_s(ch, size, data, size) != EOK) {
262 std::cout << "copy failed." << std::endl;
263 free(ch);
264 ch = nullptr;
265 return 0;
266 }
267
268 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
269 free(ch);
270 ch = nullptr;
271 return 0;
272 }
273
274