1 /*
2 * Copyright (c) 2024-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "distributedschedstub_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <fuzzer/FuzzedDataProvider.h>
21 #include <singleton.h>
22
23 #include "distributed_sched_interface.h"
24 #include "distributed_sched_service.h"
25 #include "distributed_sched_stub.h"
26 #include "distributedWant/distributed_want.h"
27 #include "mock_fuzz_util.h"
28 #include "mock_distributed_sched.h"
29 #include "parcel_helper.h"
30 #include "dms_continue_time_dumper.h"
31
32 using namespace OHOS::AAFwk;
33 using namespace OHOS::AppExecFwk;
34
35 namespace OHOS {
36 namespace DistributedSchedule {
37 const std::string TAG = "DistributedSchedFuzzTest";
38 namespace {
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 }
42
GetU32Data(const uint8_t * ptr,size_t size)43 uint32_t GetU32Data(const uint8_t* ptr, size_t size)
44 {
45 if (size > FOO_MAX_LEN || size < U32_AT_SIZE) {
46 return 0;
47 }
48 char *ch = static_cast<char *>(malloc(size + 1));
49 if (ch == nullptr) {
50 std::cout << "malloc failed." << std::endl;
51 return 0;
52 }
53 (void)memset_s(ch, size + 1, 0x00, size + 1);
54 if (memcpy_s(ch, size + 1, ptr, size) != EOK) {
55 std::cout << "copy failed." << std::endl;
56 free(ch);
57 ch = nullptr;
58 return 0;
59 }
60 uint32_t data = (ch[0] << 24) | (ch[1] << 16) | (ch[2] << 8) | ch[3];
61 free(ch);
62 ch = nullptr;
63 return data;
64 }
65
StartRemoteAbilityInnerFuzzTest(const uint8_t * data,size_t size)66 bool StartRemoteAbilityInnerFuzzTest(const uint8_t* data, size_t size)
67 {
68 if ((data == nullptr) || (size < sizeof(int32_t))) {
69 return false;
70 }
71 MessageParcel dataParcel;
72 MessageParcel reply;
73 Want want;
74 FuzzedDataProvider fdp(data, size);
75 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
76 uint32_t uint32Data = fdp.ConsumeIntegral<uint32_t>();
77 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
78 std::string bundleName = fdp.ConsumeRandomLengthString();
79 std::string abilityName = fdp.ConsumeRandomLengthString();
80
81 want.SetDeviceId(dstDeviceId);
82 want.SetElementName(bundleName, abilityName);
83
84 PARCEL_WRITE_HELPER(dataParcel, Parcelable, &want);
85 PARCEL_WRITE_HELPER(dataParcel, Int32, int32Data);
86 PARCEL_WRITE_HELPER(dataParcel, Int32, int32Data);
87 PARCEL_WRITE_HELPER(dataParcel, Uint32, uint32Data);
88 DistributedSchedService::GetInstance().StartRemoteAbilityInner(dataParcel, reply);
89 FuzzUtil::MockPermission();
90 DistributedSchedService::GetInstance().StartRemoteAbilityInner(dataParcel, reply);
91 return true;
92 }
93
ConnectRemoteAbilityInnerFuzzTest(const uint8_t * data,size_t size)94 void ConnectRemoteAbilityInnerFuzzTest(const uint8_t* data, size_t size)
95 {
96 if ((data == nullptr) || (size < sizeof(int32_t))) {
97 return;
98 }
99 FuzzUtil::MockPermission();
100 MessageParcel dataParcel;
101 MessageParcel reply;
102 MessageOption option;
103 Want want;
104 sptr<IRemoteObject> connect(new MockDistributedSched());
105 FuzzedDataProvider fdp(data, size);
106 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
107 uint32_t uint32Data = fdp.ConsumeIntegral<uint32_t>();
108 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
109 std::string bundleName = fdp.ConsumeRandomLengthString();
110 std::string abilityName = fdp.ConsumeRandomLengthString();
111
112 want.SetDeviceId(dstDeviceId);
113 want.SetElementName(bundleName, abilityName);
114
115 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &want);
116 PARCEL_WRITE_HELPER_NORET(dataParcel, RemoteObject, connect);
117 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
118 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
119 PARCEL_WRITE_HELPER_NORET(dataParcel, Uint32, uint32Data);
120 DistributedSchedService::GetInstance().ConnectRemoteAbilityInner(dataParcel, reply);
121 std::string devId = fdp.ConsumeRandomLengthString();
122 DistributedSchedService::GetInstance().ProcessFreeInstallOffline(devId);
123 DistributedSchedService::GetInstance().ProcessCalleeOffline(devId);
124 }
125
DisconnectRemoteAbilityInnerFuzzTest(const uint8_t * data,size_t size)126 void DisconnectRemoteAbilityInnerFuzzTest(const uint8_t* data, size_t size)
127 {
128 if ((data == nullptr) || (size < sizeof(int32_t))) {
129 return;
130 }
131 FuzzUtil::MockPermission();
132 MessageParcel dataParcel;
133 MessageParcel reply;
134 MessageOption option;
135 sptr<IRemoteObject> connect(new MockDistributedSched());
136 FuzzedDataProvider fdp(data, size);
137 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
138 uint32_t uint32Data = fdp.ConsumeIntegral<uint32_t>();
139
140 PARCEL_WRITE_HELPER_NORET(dataParcel, RemoteObject, connect);
141 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
142 PARCEL_WRITE_HELPER_NORET(dataParcel, Uint32, uint32Data);
143 DistributedSchedService::GetInstance().DisconnectRemoteAbilityInner(dataParcel, reply);
144
145 std::string networkId = fdp.ConsumeRandomLengthString();
146 std::string bundleName = fdp.ConsumeRandomLengthString();
147 DistributedSchedService::GetInstance().IsRemoteInstall(networkId, bundleName);
148 DistributedSchedService::GetInstance().GetContinueInfo(networkId, networkId);
149 }
150
StartContinuationInnerFuzzTest(const uint8_t * data,size_t size)151 void StartContinuationInnerFuzzTest(const uint8_t* data, size_t size)
152 {
153 if ((data == nullptr) || (size < sizeof(int32_t))) {
154 return;
155 }
156 FuzzUtil::MockPermission();
157 MessageParcel dataParcel;
158 MessageParcel reply;
159 MessageOption option;
160 Want want;
161 FuzzedDataProvider fdp(data, size);
162 int32_t missionId = fdp.ConsumeIntegral<int32_t>();
163 int32_t callerUid = fdp.ConsumeIntegral<int32_t>();
164 int32_t status = fdp.ConsumeIntegral<int32_t>();
165 uint32_t accessToken = fdp.ConsumeIntegral<uint32_t>();
166 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
167 std::string bundleName = fdp.ConsumeRandomLengthString();
168 std::string abilityName = fdp.ConsumeRandomLengthString();
169
170 want.SetDeviceId(dstDeviceId);
171 want.SetElementName(bundleName, abilityName);
172
173 dataParcel.WriteParcelable(&want);
174 dataParcel.WriteInt32(missionId);
175 dataParcel.WriteInt32(callerUid);
176 dataParcel.WriteInt32(status);
177 dataParcel.WriteUint32(accessToken);
178 DistributedSchedService::GetInstance().StartContinuationInner(dataParcel, reply);
179 DistributedSchedService::GetInstance().StartAbility(want, callerUid);
180 }
181
NotifyCompleteFreeInstallFromRemoteInnerFuzzTest(const uint8_t * data,size_t size)182 void NotifyCompleteFreeInstallFromRemoteInnerFuzzTest(const uint8_t* data, size_t size)
183 {
184 if ((data == nullptr) || (size < sizeof(int32_t))) {
185 return;
186 }
187 FuzzUtil::MockPermission();
188 MessageParcel dataParcel;
189 MessageParcel reply;
190 MessageOption option;
191 FuzzedDataProvider fdp(data, size);
192 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
193 int64_t int64Data = static_cast<int64_t>(GetU32Data(data, size));
194
195 PARCEL_WRITE_HELPER_NORET(dataParcel, Int64, int64Data);
196 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
197 DistributedSchedService::GetInstance().NotifyCompleteFreeInstallFromRemoteInner(dataParcel, reply);
198 }
199 }
200 }
201
202 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)203 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
204 {
205 OHOS::DistributedSchedule::StartRemoteAbilityInnerFuzzTest(data, size);
206 OHOS::DistributedSchedule::ConnectRemoteAbilityInnerFuzzTest(data, size);
207 OHOS::DistributedSchedule::DisconnectRemoteAbilityInnerFuzzTest(data, size);
208 OHOS::DistributedSchedule::StartContinuationInnerFuzzTest(data, size);
209 OHOS::DistributedSchedule::NotifyCompleteFreeInstallFromRemoteInnerFuzzTest(data, size);
210 return 0;
211 }
212