1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "distributedschedstubtwo_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <fuzzer/FuzzedDataProvider.h>
21 #include <singleton.h>
22
23 #include "distributed_sched_interface.h"
24 #include "distributed_sched_service.h"
25 #include "distributed_sched_stub.h"
26 #include "distributedWant/distributed_want.h"
27 #include "mock_fuzz_util.h"
28 #include "mock_distributed_sched.h"
29 #include "parcel_helper.h"
30 #include "dms_continue_time_dumper.h"
31
32 using namespace OHOS::AAFwk;
33 using namespace OHOS::AppExecFwk;
34
35 namespace OHOS {
36 namespace DistributedSchedule {
37 const std::string TAG = "DistributedSchedFuzzTest";
38 namespace {
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 }
42
GetU32Data(const uint8_t * ptr,size_t size)43 uint32_t GetU32Data(const uint8_t* ptr, size_t size)
44 {
45 if (size > FOO_MAX_LEN || size < U32_AT_SIZE) {
46 return 0;
47 }
48 char *ch = static_cast<char *>(malloc(size + 1));
49 if (ch == nullptr) {
50 std::cout << "malloc failed." << std::endl;
51 return 0;
52 }
53 (void)memset_s(ch, size + 1, 0x00, size + 1);
54 if (memcpy_s(ch, size + 1, ptr, size) != EOK) {
55 std::cout << "copy failed." << std::endl;
56 free(ch);
57 ch = nullptr;
58 return 0;
59 }
60 uint32_t data = (ch[0] << 24) | (ch[1] << 16) | (ch[2] << 8) | ch[3];
61 free(ch);
62 ch = nullptr;
63 return data;
64 }
65
RegisterMissionListenerInnerFuzzTest(const uint8_t * data,size_t size)66 void RegisterMissionListenerInnerFuzzTest(const uint8_t* data, size_t size)
67 {
68 if ((data == nullptr) || (size < sizeof(int32_t))) {
69 return;
70 }
71 FuzzUtil::MockPermission();
72 MessageParcel dataParcel;
73 MessageParcel reply;
74 MessageOption option;
75 Want want;
76 FuzzedDataProvider fdp(data, size);
77 int32_t missionId = fdp.ConsumeIntegral<int32_t>();
78 uint32_t uint32Data = fdp.ConsumeIntegral<uint32_t>();
79 std::string str = fdp.ConsumeRandomLengthString();
80 sptr<IRemoteObject> obj(new MockDistributedSched());
81 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
82
83 want.SetDeviceId(dstDeviceId);
84
85 PARCEL_WRITE_HELPER_NORET(dataParcel, String16, Str8ToStr16(str));
86 PARCEL_WRITE_HELPER_NORET(dataParcel, RemoteObject, obj);
87 DistributedSchedService::GetInstance().RegisterMissionListenerInner(dataParcel, reply);
88 DistributedSchedService::GetInstance().ContinueLocalMissionDealFreeInstall(want, missionId, str, obj);
89 DistributedSchedService::GetInstance().ContinueAbilityWithTimeout(str, missionId, obj, uint32Data);
90 }
91
UnRegisterMissionListenerInnerFuzzTest(const uint8_t * data,size_t size)92 void UnRegisterMissionListenerInnerFuzzTest(const uint8_t* data, size_t size)
93 {
94 if ((data == nullptr) || (size < sizeof(int32_t))) {
95 return;
96 }
97 FuzzUtil::MockPermission();
98 MessageParcel dataParcel;
99 MessageParcel reply;
100 MessageOption option;
101 FuzzedDataProvider fdp(data, size);
102 std::string str = fdp.ConsumeRandomLengthString();
103 sptr<IRemoteObject> obj(new MockDistributedSched());
104
105 PARCEL_WRITE_HELPER_NORET(dataParcel, String16, Str8ToStr16(str));
106 PARCEL_WRITE_HELPER_NORET(dataParcel, RemoteObject, obj);
107 DistributedSchedService::GetInstance().UnRegisterMissionListenerInner(dataParcel, reply);
108 }
109
StartSyncRemoteMissionsInnerFuzzTest(const uint8_t * data,size_t size)110 void StartSyncRemoteMissionsInnerFuzzTest(const uint8_t* data, size_t size)
111 {
112 if ((data == nullptr) || (size < sizeof(int32_t))) {
113 return;
114 }
115 FuzzUtil::MockPermission();
116 MessageParcel dataParcel;
117 MessageParcel reply;
118 MessageOption option;
119 FuzzedDataProvider fdp(data, size);
120 bool boolData = fdp.ConsumeBool();
121 std::string str = fdp.ConsumeRandomLengthString();
122 int64_t int64Data = static_cast<int64_t>(GetU32Data(data, size));
123
124 PARCEL_WRITE_HELPER_NORET(dataParcel, String16, Str8ToStr16(str));
125 PARCEL_WRITE_HELPER_NORET(dataParcel, Bool, boolData);
126 PARCEL_WRITE_HELPER_NORET(dataParcel, Int64, int64Data);
127 DistributedSchedService::GetInstance().StartSyncRemoteMissionsInner(dataParcel, reply);
128 }
129
StopSyncRemoteMissionsInnerFuzzTest(const uint8_t * data,size_t size)130 void StopSyncRemoteMissionsInnerFuzzTest(const uint8_t* data, size_t size)
131 {
132 if ((data == nullptr) || (size < sizeof(int32_t))) {
133 return;
134 }
135 FuzzUtil::MockPermission();
136 FuzzedDataProvider fdp(data, size);
137 MessageParcel dataParcel;
138 MessageParcel reply;
139 MessageOption option;
140 std::string str = fdp.ConsumeRandomLengthString();
141
142 PARCEL_WRITE_HELPER_NORET(dataParcel, String16, Str8ToStr16(str));
143 DistributedSchedService::GetInstance().StopSyncRemoteMissionsInner(dataParcel, reply);
144
145 Want want;
146 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
147
148 want.SetDeviceId(dstDeviceId);
149 CallerInfo callerInfo;
150 IDistributedSched::AccountInfo accountInfo;
151 int32_t flag = *(reinterpret_cast<const int32_t*>(data));
152 DistributedSchedService::GetInstance().CheckTargetPermission(want, callerInfo, accountInfo, flag, true);
153 }
154
StartAbilityByCallFromRemoteInnerFuzzTest(const uint8_t * data,size_t size)155 void StartAbilityByCallFromRemoteInnerFuzzTest(const uint8_t* data, size_t size)
156 {
157 if ((data == nullptr) || (size < sizeof(int32_t))) {
158 return;
159 }
160 FuzzUtil::MockPermission();
161 MessageParcel dataParcel;
162 MessageParcel reply;
163 MessageOption option;
164 FuzzedDataProvider fdp(data, size);
165 int32_t int32Data = fdp.ConsumeIntegral<int32_t>();
166 std::string str = fdp.ConsumeRandomLengthString();
167 std::vector<std::string> strVector = {str};
168 DistributedWant dstbWant;
169 std::string dstDeviceId = fdp.ConsumeRandomLengthString();
170 std::string bundleName = fdp.ConsumeRandomLengthString();
171 std::string abilityName = fdp.ConsumeRandomLengthString();
172
173 dstbWant.SetDeviceId(dstDeviceId);
174 dstbWant.SetElementName(bundleName, abilityName);
175 sptr<IRemoteObject> connect(new MockDistributedSched());
176
177 PARCEL_WRITE_HELPER_NORET(dataParcel, RemoteObject, connect);
178 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
179 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
180 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
181 PARCEL_WRITE_HELPER_NORET(dataParcel, Int32, int32Data);
182 PARCEL_WRITE_HELPER_NORET(dataParcel, StringVector, strVector);
183 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
184 PARCEL_WRITE_HELPER_NORET(dataParcel, String, str);
185 PARCEL_WRITE_HELPER_NORET(dataParcel, Parcelable, &dstbWant);
186 DistributedSchedService::GetInstance().StartAbilityByCallFromRemoteInner(dataParcel, reply);
187 DistributedSchedService::GetInstance().ProcessConnectDied(connect);
188 DistributedSchedService::GetInstance().DisconnectEachRemoteAbilityLocked(str, str, connect);
189 }
190 }
191 }
192
193 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)194 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
195 {
196 OHOS::DistributedSchedule::RegisterMissionListenerInnerFuzzTest(data, size);
197 OHOS::DistributedSchedule::UnRegisterMissionListenerInnerFuzzTest(data, size);
198 OHOS::DistributedSchedule::StartSyncRemoteMissionsInnerFuzzTest(data, size);
199 OHOS::DistributedSchedule::StopSyncRemoteMissionsInnerFuzzTest(data, size);
200 OHOS::DistributedSchedule::StartAbilityByCallFromRemoteInnerFuzzTest(data, size);
201 return 0;
202 }
203