1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "distributedwant_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <fuzzer/FuzzedDataProvider.h>
21 #include <iostream>
22
23 #include "bool_wrapper.h"
24 #include "distributed_want.h"
25 #include "securec.h"
26
27 using namespace OHOS::AAFwk;
28 using namespace OHOS::DistributedSchedule;
29
30 namespace OHOS {
31 namespace {
32 constexpr size_t FOO_MAX_LEN = 1024;
33 constexpr size_t U32_AT_SIZE = 4;
34 constexpr int32_t POS_0 = 0;
35 constexpr int32_t POS_1 = 1;
36 constexpr int32_t POS_2 = 2;
37 constexpr int32_t POS_3 = 3;
38 constexpr int32_t OFFSET_24 = 24;
39 constexpr int32_t OFFSET_16 = 16;
40 constexpr int32_t OFFSET_8 = 8;
41 }
GetU32Data(const char * ptr)42 uint32_t GetU32Data(const char* ptr)
43 {
44 // convert fuzz input data to an integer
45 return (ptr[POS_0] << OFFSET_24) | (ptr[POS_1] << OFFSET_16) | (ptr[POS_2] << OFFSET_8) | ptr[POS_3];
46 }
47
DoSomethingInterestingWithMyApiDistributedWant001(const uint8_t * data,size_t size)48 bool DoSomethingInterestingWithMyApiDistributedWant001(const uint8_t* data, size_t size)
49 {
50 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
51 return false;
52 }
53
54 FuzzedDataProvider fdp(data, size);
55 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
56 unsigned int flags = static_cast<unsigned int>(GetU32Data(reinterpret_cast<const char*>(data)));
57 want->SetFlags(flags);
58 want->RemoveFlags(flags);
59 want->AddFlags(flags);
60 std::string entity = fdp.ConsumeRandomLengthString();
61 want->AddEntity(entity);
62 want->HasEntity(entity);
63 want->RemoveEntity(entity);
64 std::string bundleName = fdp.ConsumeRandomLengthString();
65 want->SetBundle(bundleName);
66 std::string deviceId = fdp.ConsumeRandomLengthString();
67 want->SetDeviceId(deviceId);
68 want->SetElementName(bundleName, entity);
69 want->SetElementName(deviceId, bundleName, entity);
70 return true;
71 }
72
DoSomethingInterestingWithMyApiDistributedWant002(const uint8_t * data,size_t size)73 bool DoSomethingInterestingWithMyApiDistributedWant002(const uint8_t* data, size_t size)
74 {
75 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
76 return false;
77 }
78
79 FuzzedDataProvider fdp(data, size);
80 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
81 std::string type = fdp.ConsumeRandomLengthString();
82 want->SetType(type);
83 Uri uri(type);
84 want->SetUri(uri);
85 want->SetUriAndType(uri, type);
86 want->FormatUri(uri);
87 want->FormatUri(type);
88 want->GetLowerCaseScheme(uri);
89 return true;
90 }
91
DoSomethingInterestingWithMyApiDistributedWant003(const uint8_t * data,size_t size)92 bool DoSomethingInterestingWithMyApiDistributedWant003(const uint8_t* data, size_t size)
93 {
94 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
95 return false;
96 }
97
98 FuzzedDataProvider fdp(data, size);
99 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
100 want->CountEntities();
101 want->GetScheme();
102 DistributedOperation operation;
103 want->SetOperation(operation);
104 std::string key = fdp.ConsumeRandomLengthString();
105 want->HasParameter(key);
106 std::string content = fdp.ConsumeRandomLengthString();
107 std::string prop = fdp.ConsumeRandomLengthString();
108 std::string value = fdp.ConsumeRandomLengthString();
109 std::string str = fdp.ConsumeRandomLengthString();
110 nlohmann::json wantJson;
111 want->ReadFromJson(wantJson);
112 return true;
113 }
114
DoSomethingInterestingWithMyApiDistributedWant004(const uint8_t * data,size_t size)115 bool DoSomethingInterestingWithMyApiDistributedWant004(const uint8_t* data, size_t size)
116 {
117 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
118 return false;
119 }
120
121 FuzzedDataProvider fdp(data, size);
122 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
123 std::string key = fdp.ConsumeRandomLengthString();
124 sptr<IRemoteObject> remoteObject;
125 want->SetParam(key, remoteObject);
126 std::vector<bool> boolValue;
127 want->SetParam(key, boolValue);
128 want->GetBoolArrayParam(key);
129 byte byteValue = '\0';
130 want->SetParam(key, byteValue);
131 want->GetByteParam(key, byteValue);
132 std::vector<byte> byteVector;
133 want->SetParam(key, byteVector);
134 want->GetByteArrayParam(key);
135 zchar charValue = U'\0';
136 want->SetParam(key, charValue);
137 want->GetCharParam(key, charValue);
138 want->GetParams();
139 return true;
140 }
141
DoSomethingInterestingWithMyApiDistributedWant005(const uint8_t * data,size_t size)142 bool DoSomethingInterestingWithMyApiDistributedWant005(const uint8_t* data, size_t size)
143 {
144 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
145 return false;
146 }
147
148 FuzzedDataProvider fdp(data, size);
149 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
150 std::string key = fdp.ConsumeRandomLengthString();
151 std::vector<zchar> charVector;
152 want->SetParam(key, charVector);
153 want->GetCharArrayParam(key);
154 std::vector<int> intVector;
155 want->SetParam(key, intVector);
156 want->GetIntArrayParam(key);
157 double doubleValue = 0.0;
158 want->SetParam(key, doubleValue);
159 want->GetDoubleParam(key, doubleValue);
160 std::vector<double> doubleVector;
161 want->SetParam(key, doubleVector);
162 want->GetDoubleArrayParam(key);
163 float floatValue = 0.0;
164 want->SetParam(key, floatValue);
165 want->GetFloatParam(key, floatValue);
166 bool boolValue = true;
167 want->SetParam(key, boolValue);
168 want->GetBoolParam(key, boolValue);
169 return true;
170 }
171
DoSomethingInterestingWithMyApiDistributedWant006(const uint8_t * data,size_t size)172 bool DoSomethingInterestingWithMyApiDistributedWant006(const uint8_t* data, size_t size)
173 {
174 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
175 return false;
176 }
177
178 FuzzedDataProvider fdp(data, size);
179 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
180 std::string key = fdp.ConsumeRandomLengthString();
181 std::vector<float> floatVector;
182 want->SetParam(key, floatVector);
183 want->GetFloatArrayParam(key);
184 long longValue = 0;
185 want->SetParam(key, longValue);
186 want->GetShortParam(key, longValue);
187 std::vector<long> longVector;
188 want->SetParam(key, longVector);
189 want->GetLongArrayParam(key);
190 short shortValue = 0;
191 want->SetParam(key, shortValue);
192 want->GetShortParam(key, shortValue);
193 std::vector<short> shortVector;
194 want->SetParam(key, shortVector);
195 want->GetShortArrayParam(key);
196 std::string stringValue = fdp.ConsumeRandomLengthString();
197 want->SetParam(key, stringValue);
198 want->GetStringParam(key);
199 std::vector<std::string> stringVector;
200 want->SetParam(key, stringVector);
201 want->GetStringArrayParam(key);
202 want->RemoveParam(key);
203
204 bool boolValue = true;
205 DistributedWantParams dWantParams;
206 dWantParams.SetParam(key, Boolean::Box(boolValue));
207 want->SetParams(dWantParams);
208 want->ReplaceParams(dWantParams);
209 DistributedWant dWant;
210 want->ReplaceParams(dWant);
211 want->ClearWant(&dWant);
212 return true;
213 }
214
FuzzDistributedWantGetIntParam(const uint8_t * data,size_t size)215 void FuzzDistributedWantGetIntParam(const uint8_t* data, size_t size)
216 {
217 if (data == nullptr || size == 0) {
218 return;
219 }
220 FuzzedDataProvider fdp(data, size);
221
222 DistributedWant want;
223
224 std::string key = fdp.ConsumeRandomLengthString();
225 int defaultValue = fdp.ConsumeIntegral<int>();
226
227 if (fdp.ConsumeBool()) {
228 int value = fdp.ConsumeIntegral<int>();
229 want.SetParam(key, value);
230 } else {
231 std::string value = fdp.ConsumeRandomLengthString();
232 want.SetParam(key, value);
233 }
234 want.GetIntParam(key, defaultValue);
235 }
236
FuzzDistributedWantSetParamInt(const uint8_t * data,size_t size)237 void FuzzDistributedWantSetParamInt(const uint8_t* data, size_t size)
238 {
239 if (data == nullptr || size == 0) {
240 return;
241 }
242 FuzzedDataProvider fdp(data, size);
243
244 DistributedWant want;
245
246 std::string key = fdp.ConsumeRandomLengthString();
247 int value = fdp.ConsumeIntegral<int>();
248 want.SetParam(key, value);
249 int defaultValue = 0;
250 want.GetIntParam(key, defaultValue);
251 }
252
FuzzDistributedWantGetLongParam(const uint8_t * data,size_t size)253 void FuzzDistributedWantGetLongParam(const uint8_t* data, size_t size)
254 {
255 if (data == nullptr || size == 0) {
256 return;
257 }
258 FuzzedDataProvider fdp(data, size);
259
260 DistributedWant want;
261
262 std::string key = fdp.ConsumeRandomLengthString();
263 long defaultValue = fdp.ConsumeIntegral<long>();
264
265 if (fdp.ConsumeBool()) {
266 long value = fdp.ConsumeIntegral<long>();
267 want.SetParam(key, value);
268 } else {
269 std::string value = fdp.ConsumeRandomLengthString();
270 want.SetParam(key, value);
271 }
272 want.GetLongParam(key, defaultValue);
273 }
274
FuzzDistributedWantSetParamLongLong(const uint8_t * data,size_t size)275 void FuzzDistributedWantSetParamLongLong(const uint8_t* data, size_t size)
276 {
277 if (data == nullptr || size == 0) {
278 return;
279 }
280 FuzzedDataProvider fdp(data, size);
281
282 DistributedWant want;
283
284 std::string key = fdp.ConsumeRandomLengthString();
285 long long value = fdp.ConsumeIntegral<long long>();
286 want.SetParam(key, value);
287
288 long long defaultValue = 0;
289 want.GetLongParam(key, defaultValue);
290 }
291
FuzzDistributedWantGetOperation(const uint8_t * data,size_t size)292 void FuzzDistributedWantGetOperation(const uint8_t* data, size_t size)
293 {
294 if (data == nullptr || size == 0) {
295 return;
296 }
297 FuzzedDataProvider fdp(data, size);
298
299 DistributedWant want;
300
301 std::string deviceId = fdp.ConsumeRandomLengthString();
302 std::string bundleName = fdp.ConsumeRandomLengthString();
303 std::string abilityName = fdp.ConsumeRandomLengthString();
304 want.SetElementName(deviceId, bundleName, abilityName);
305
306 std::string action = fdp.ConsumeRandomLengthString();
307 want.SetAction(action);
308
309 unsigned int flags = fdp.ConsumeIntegral<unsigned int>();
310 want.SetFlags(flags);
311 want.GetOperation();
312 }
313
FuzzDistributedWantOperationEquals(const uint8_t * data,size_t size)314 void FuzzDistributedWantOperationEquals(const uint8_t* data, size_t size)
315 {
316 if (data == nullptr || size == 0) {
317 return;
318 }
319 FuzzedDataProvider fdp(data, size);
320
321 DistributedWant want1;
322 DistributedWant want2;
323
324 std::string deviceId1 = fdp.ConsumeRandomLengthString();
325 std::string bundleName1 = fdp.ConsumeRandomLengthString();
326 std::string abilityName1 = fdp.ConsumeRandomLengthString();
327 want1.SetElementName(deviceId1, bundleName1, abilityName1);
328
329 std::string deviceId2 = fdp.ConsumeRandomLengthString();
330 std::string bundleName2 = fdp.ConsumeRandomLengthString();
331 std::string abilityName2 = fdp.ConsumeRandomLengthString();
332 want2.SetElementName(deviceId2, bundleName2, abilityName2);
333
334 unsigned int flags1 = fdp.ConsumeIntegral<unsigned int>();
335 unsigned int flags2 = fdp.ConsumeIntegral<unsigned int>();
336 want1.SetFlags(flags1);
337 want2.SetFlags(flags2);
338
339 std::string action1 = fdp.ConsumeRandomLengthString();
340 std::string action2 = fdp.ConsumeRandomLengthString();
341 want1.SetAction(action1);
342 want2.SetAction(action2);
343 want1.OperationEquals(want2);
344 }
345
FuzzDistributedWantSetUri(const uint8_t * data,size_t size)346 void FuzzDistributedWantSetUri(const uint8_t* data, size_t size)
347 {
348 if (data == nullptr || size == 0) {
349 return;
350 }
351 FuzzedDataProvider fdp(data, size);
352
353 DistributedWant want;
354
355 std::string uri = fdp.ConsumeRandomLengthString();
356 want.SetUri(uri);
357 }
358
FuzzDistributedWantToJson(const uint8_t * data,size_t size)359 bool FuzzDistributedWantToJson(const uint8_t* data, size_t size)
360 {
361 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
362 return false;
363 }
364
365 std::shared_ptr<DistributedWant> want = std::make_shared<DistributedWant>();
366 FuzzedDataProvider fdp(data, size);
367
368 std::string deviceId = fdp.ConsumeRandomLengthString();
369 std::string bundleName = fdp.ConsumeRandomLengthString();
370 std::string abilityName = fdp.ConsumeRandomLengthString();
371 want->SetElementName(deviceId, bundleName, abilityName);
372
373 std::string action = fdp.ConsumeRandomLengthString();
374 want->SetAction(action);
375
376 unsigned int flags = static_cast<unsigned int>(data[0]);
377 want->SetFlags(flags);
378
379 std::string type = fdp.ConsumeRandomLengthString();
380 want->SetType(type);
381
382 std::string uri = fdp.ConsumeRandomLengthString();
383 want->SetUri(uri);
384
385 std::vector<std::string> entities = { "entity1", "entity2", "entity3" };
386 for (const auto& entity : entities) {
387 want->AddEntity(entity);
388 }
389
390 want->ToJson();
391 return true;
392 }
393
FuzzDistributedWantFromString(const uint8_t * data,size_t size)394 bool FuzzDistributedWantFromString(const uint8_t* data, size_t size)
395 {
396 if (data == nullptr || size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
397 return false;
398 }
399 FuzzedDataProvider fdp(data, size);
400 std::string inputString = fdp.ConsumeRandomLengthString();
401 std::shared_ptr<DistributedWant> want(DistributedWant::FromString(inputString));
402 return true;
403 }
404
DistributedWantCopyCtorFuzzTest(const uint8_t * data,size_t size)405 void DistributedWantCopyCtorFuzzTest(const uint8_t* data, size_t size)
406 {
407 if (data == nullptr || size == 0) {
408 return;
409 }
410 FuzzedDataProvider fdp(data, size);
411
412 Want want;
413 want.SetAction(fdp.ConsumeRandomLengthString());
414 want.SetBundle(fdp.ConsumeRandomLengthString());
415 want.SetElement(AppExecFwk::ElementName(
416 fdp.ConsumeRandomLengthString(),
417 fdp.ConsumeRandomLengthString(),
418 fdp.ConsumeRandomLengthString()
419 ));
420
421 DistributedWant original(want);
422
423 DistributedWant copy(original);
424 }
425
DistributedWantAssignOperatorFuzzTest(const uint8_t * data,size_t size)426 void DistributedWantAssignOperatorFuzzTest(const uint8_t* data, size_t size)
427 {
428 if (data == nullptr || size == 0) {
429 return;
430 }
431 FuzzedDataProvider fdp(data, size);
432
433 Want want;
434 want.SetAction(fdp.ConsumeRandomLengthString());
435 want.SetBundle(fdp.ConsumeRandomLengthString());
436 want.SetElement(AppExecFwk::ElementName(
437 fdp.ConsumeRandomLengthString(),
438 fdp.ConsumeRandomLengthString(),
439 fdp.ConsumeRandomLengthString()
440 ));
441
442 DistributedWant lhs(want);
443 DistributedWant rhs(want);
444
445 lhs = rhs;
446 }
447
DistributedWantFromWantFuzzTest(const uint8_t * data,size_t size)448 void DistributedWantFromWantFuzzTest(const uint8_t* data, size_t size)
449 {
450 if (data == nullptr || size == 0) {
451 return;
452 }
453 FuzzedDataProvider fdp(data, size);
454
455 Want want;
456 want.SetAction(fdp.ConsumeRandomLengthString());
457 want.SetBundle(fdp.ConsumeRandomLengthString());
458 want.SetElement(AppExecFwk::ElementName(
459 fdp.ConsumeRandomLengthString(),
460 fdp.ConsumeRandomLengthString(),
461 fdp.ConsumeRandomLengthString()
462 ));
463
464 DistributedWant distributedWant(want);
465 }
466 }
467
468 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)469 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
470 {
471 OHOS::DoSomethingInterestingWithMyApiDistributedWant001(data, size);
472 OHOS::DoSomethingInterestingWithMyApiDistributedWant002(data, size);
473 OHOS::DoSomethingInterestingWithMyApiDistributedWant003(data, size);
474 OHOS::DoSomethingInterestingWithMyApiDistributedWant004(data, size);
475 OHOS::DoSomethingInterestingWithMyApiDistributedWant005(data, size);
476 OHOS::DoSomethingInterestingWithMyApiDistributedWant006(data, size);
477 OHOS::FuzzDistributedWantGetIntParam(data, size);
478 OHOS::FuzzDistributedWantSetParamInt(data, size);
479 OHOS::FuzzDistributedWantGetLongParam(data, size);
480 OHOS::FuzzDistributedWantSetParamLongLong(data, size);
481 OHOS::FuzzDistributedWantGetOperation(data, size);
482 OHOS::FuzzDistributedWantOperationEquals(data, size);
483 OHOS::FuzzDistributedWantSetUri(data, size);
484 OHOS::FuzzDistributedWantToJson(data, size);
485 OHOS::FuzzDistributedWantFromString(data, size);
486 OHOS::DistributedWantCopyCtorFuzzTest(data, size);
487 OHOS::DistributedWantAssignOperatorFuzzTest(data, size);
488 OHOS::DistributedWantFromWantFuzzTest(data, size);
489 return 0;
490 }
491