1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "mechbodycontrollerservice_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <cstring>
21 #include <fuzzer/FuzzedDataProvider.h>
22 #include <string>
23
24 #define private public
25 #define protected public
26 #include "mechbody_controller_service.h"
27 #undef private
28 #undef protected
29 #include "ipc_skeleton.h"
30 #include "securec.h"
31 #include "accesstoken_kit.h"
32 #include "token_setproc.h"
33 #include "tokenid_kit.h"
34 #include "system_ability.h"
35
36 namespace OHOS {
37 using namespace OHOS::MechBodyController;
IsSystemAppByFullTokenID(uint64_t tokenId)38 bool Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(uint64_t tokenId)
39 {
40 return true;
41 }
42
UnRegisterAttachStateChangeCallbackFuzzTest(const uint8_t * data,size_t size)43 void UnRegisterAttachStateChangeCallbackFuzzTest(const uint8_t *data, size_t size)
44 {
45 if ((data == nullptr) || (size == 0)) {
46 return;
47 }
48
49 FuzzedDataProvider fdp(data, size);
50 uint32_t tokenId = fdp.ConsumeIntegral<uint32_t>();
51 const sptr<OHOS::IRemoteObject> callback;
52
53 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
54 mechBodyControllerService.listener_ = std::shared_ptr<IMechConnectListener>();
55 mechBodyControllerService.deviceAttachCallback_[tokenId] = callback;
56 mechBodyControllerService.UnRegisterAttachStateChangeCallback();
57 }
58
OnAttachStateChangeFuzzTest(const uint8_t * data,size_t size)59 void OnAttachStateChangeFuzzTest(const uint8_t *data, size_t size)
60 {
61 if ((data == nullptr) || (size == 0)) {
62 return;
63 }
64
65 FuzzedDataProvider fdp(data, size);
66 std::string mechName = fdp.ConsumeRandomLengthString();
67 uint32_t tokenId = fdp.ConsumeIntegral<uint32_t>();
68 uint32_t enumIdx = fdp.ConsumeIntegral<uint32_t>() % 2;
69 AttachmentState attachmentState = static_cast<AttachmentState>(enumIdx);
70 AttachmentState state = static_cast<AttachmentState>(enumIdx);
71 const sptr<OHOS::IRemoteObject> callback;
72 MechInfo mechInfo;
73 mechInfo.mechName = mechName;
74 mechInfo.state = state;
75
76 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
77 mechBodyControllerService.deviceAttachCallback_[tokenId] = callback;
78 mechBodyControllerService.OnAttachStateChange(attachmentState, mechInfo);
79 }
80
OnDeviceConnectedFuzzTest(const uint8_t * data,size_t size)81 void OnDeviceConnectedFuzzTest(const uint8_t *data, size_t size)
82 {
83 if ((data == nullptr) || (size == 0)) {
84 return;
85 }
86
87 FuzzedDataProvider fdp(data, size);
88 int32_t mechId = fdp.ConsumeIntegral<int32_t>();
89
90 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
91 mechBodyControllerService.OnDeviceConnected(mechId);
92 }
93
GetAttachedDevicesFuzzTest(const uint8_t * data,size_t size)94 void GetAttachedDevicesFuzzTest(const uint8_t *data, size_t size)
95 {
96 if ((data == nullptr) || (size == 0)) {
97 return;
98 }
99
100 std::set<MechInfo> mechInfos;
101 MechInfo mechInfo;
102 FuzzedDataProvider fdp(data, size);
103 std::string macHash = fdp.ConsumeRandomLengthString();
104 std::string mechName = fdp.ConsumeRandomLengthString();
105 mechInfo.mechName = mechName;
106 mechInfos.insert(mechInfo);
107
108 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
109 mechBodyControllerService.GetAttachedDevices(mechInfos);
110 }
111
SetTrackingEnabledFuzzTest(const uint8_t * data,size_t size)112 void SetTrackingEnabledFuzzTest(const uint8_t *data, size_t size)
113 {
114 if ((data == nullptr) || (size == 0)) {
115 return;
116 }
117
118 FuzzedDataProvider fdp(data, size);
119 bool isEnabled = fdp.ConsumeIntegral<bool>();
120
121 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
122 mechBodyControllerService.SetTrackingEnabled(isEnabled);
123 }
124
GetTrackingEnabledFuzzTest(const uint8_t * data,size_t size)125 void GetTrackingEnabledFuzzTest(const uint8_t *data, size_t size)
126 {
127 if ((data == nullptr) || (size == 0)) {
128 return;
129 }
130
131 FuzzedDataProvider fdp(data, size);
132 bool isEnabled = fdp.ConsumeIntegral<bool>();
133
134 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
135 mechBodyControllerService.GetTrackingEnabled(isEnabled);
136 }
137
SetTrackingLayoutFuzzTest(const uint8_t * data,size_t size)138 void SetTrackingLayoutFuzzTest(const uint8_t *data, size_t size)
139 {
140 if ((data == nullptr) || (size == 0)) {
141 return;
142 }
143
144 FuzzedDataProvider fdp(data, size);
145 uint32_t enumIdx = fdp.ConsumeIntegral<uint32_t>() % 4;
146 CameraTrackingLayout cameraTrackingLayout = static_cast<CameraTrackingLayout>(enumIdx);
147
148 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
149 mechBodyControllerService.SetTrackingLayout(cameraTrackingLayout);
150 }
151
GetTrackingLayoutFuzzTest(const uint8_t * data,size_t size)152 void GetTrackingLayoutFuzzTest(const uint8_t *data, size_t size)
153 {
154 if ((data == nullptr) || (size == 0)) {
155 return;
156 }
157
158 FuzzedDataProvider fdp(data, size);
159 uint32_t enumIdx = fdp.ConsumeIntegral<uint32_t>() % 4;
160 CameraTrackingLayout cameraTrackingLayout = static_cast<CameraTrackingLayout>(enumIdx);
161
162 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
163 mechBodyControllerService.GetTrackingLayout(cameraTrackingLayout);
164 }
165
RotateByDegreeFuzzTest(const uint8_t * data,size_t size)166 void RotateByDegreeFuzzTest(const uint8_t *data, size_t size)
167 {
168 if ((data == nullptr) || (size == 0)) {
169 return;
170 }
171
172 FuzzedDataProvider fdp(data, size);
173 uint32_t duration = fdp.ConsumeIntegral<uint32_t>();
174 float yaw = fdp.ConsumeIntegral<uint32_t>();
175 float roll = fdp.ConsumeIntegral<uint32_t>();
176 float pitch = fdp.ConsumeIntegral<uint32_t>();
177 RotateByDegreeParam rotateParam;
178 rotateParam.duration = static_cast<int32_t>(duration);
179 rotateParam.degree.yaw = yaw;
180 rotateParam.degree.roll = roll;
181 rotateParam.degree.pitch = pitch;
182 auto rotateByDegreeParam = std::make_shared<RotateByDegreeParam>(rotateParam);
183 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
184 std::string cmdId = fdp.ConsumeRandomLengthString();
185
186 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
187 mechBodyControllerService.RotateByDegree(mechId, cmdId, rotateByDegreeParam);
188 }
189
NotifyOperationResultFuzzTest(const uint8_t * data,size_t size)190 void NotifyOperationResultFuzzTest(const uint8_t *data, size_t size)
191 {
192 if ((data == nullptr) || (size == 0)) {
193 return;
194 }
195
196 FuzzedDataProvider fdp(data, size);
197 uint32_t enumIdx = fdp.ConsumeIntegral<uint32_t>() % 4;
198 ExecResult result = static_cast<ExecResult>(enumIdx);
199 uint32_t tokenId = fdp.ConsumeIntegral<uint32_t>();
200 std::string cmdId = fdp.ConsumeRandomLengthString();
201
202 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
203 mechBodyControllerService.NotifyOperationResult(tokenId, cmdId, result);
204 }
205
RotateToEulerAnglesFuzzTest(const uint8_t * data,size_t size)206 void RotateToEulerAnglesFuzzTest(const uint8_t *data, size_t size)
207 {
208 if ((data == nullptr) || (size == 0)) {
209 return;
210 }
211
212 FuzzedDataProvider fdp(data, size);
213 uint32_t duration = fdp.ConsumeIntegral<uint32_t>();
214 float yaw = fdp.ConsumeIntegral<uint32_t>();
215 float roll = fdp.ConsumeIntegral<uint32_t>();
216 float pitch = fdp.ConsumeIntegral<uint32_t>();
217 RotateToEulerAnglesParam rotateParam;
218 rotateParam.duration = static_cast<int32_t>(duration);
219 rotateParam.angles.yaw = yaw;
220 rotateParam.angles.roll = roll;
221 rotateParam.angles.pitch = pitch;
222 auto rotateToEulerAnglesParam = std::make_shared<RotateToEulerAnglesParam>(rotateParam);
223 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
224 std::string cmdId = fdp.ConsumeRandomLengthString();
225
226 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
227 mechBodyControllerService.RotateToEulerAngles(mechId, cmdId, rotateToEulerAnglesParam);
228 }
229
GetMaxRotationTimeFuzzTest(const uint8_t * data,size_t size)230 void GetMaxRotationTimeFuzzTest(const uint8_t *data, size_t size)
231 {
232 if ((data == nullptr) || (size == 0)) {
233 return;
234 }
235
236 FuzzedDataProvider fdp(data, size);
237 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
238 auto timeLimit = std::shared_ptr<TimeLimit>();
239
240 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
241 mechBodyControllerService.GetMaxRotationTime(mechId, timeLimit);
242 }
243
GetMaxRotationSpeedFuzzTest(const uint8_t * data,size_t size)244 void GetMaxRotationSpeedFuzzTest(const uint8_t *data, size_t size)
245 {
246 if ((data == nullptr) || (size == 0)) {
247 return;
248 }
249
250 FuzzedDataProvider fdp(data, size);
251 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
252 float yawMin = fdp.ConsumeIntegral<uint32_t>();
253 float rollMin = fdp.ConsumeIntegral<uint32_t>();
254 float pitchMin = fdp.ConsumeIntegral<uint32_t>();
255 float yawMax = fdp.ConsumeIntegral<uint32_t>();
256 float rollMax = fdp.ConsumeIntegral<uint32_t>();
257 float pitchMax = fdp.ConsumeIntegral<uint32_t>();
258 RotateSpeedLimit rotateSpeedLimit;
259 rotateSpeedLimit.speedMax.yawSpeed = yawMax;
260 rotateSpeedLimit.speedMax.rollSpeed = rollMax;
261 rotateSpeedLimit.speedMax.pitchSpeed = pitchMax;
262 rotateSpeedLimit.speedMin.yawSpeed = yawMin;
263 rotateSpeedLimit.speedMin.rollSpeed = rollMin;
264 rotateSpeedLimit.speedMin.pitchSpeed = pitchMin;
265
266 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
267 mechBodyControllerService.GetMaxRotationSpeed(mechId, rotateSpeedLimit);
268 }
269
RotateBySpeedFuzzTest(const uint8_t * data,size_t size)270 void RotateBySpeedFuzzTest(const uint8_t *data, size_t size)
271 {
272 if ((data == nullptr) || (size == 0)) {
273 return;
274 }
275
276 FuzzedDataProvider fdp(data, size);
277 uint32_t duration = fdp.ConsumeIntegral<uint32_t>();
278 float yaw = fdp.ConsumeIntegral<uint32_t>();
279 float roll = fdp.ConsumeIntegral<uint32_t>();
280 float pitch = fdp.ConsumeIntegral<uint32_t>();
281 RotateBySpeedParam rotateParam;
282 rotateParam.duration = static_cast<float>(duration);
283 rotateParam.speed.yawSpeed = yaw;
284 rotateParam.speed.rollSpeed = roll;
285 rotateParam.speed.pitchSpeed = pitch;
286 auto rotateBySpeedParam = std::make_shared<RotateBySpeedParam>(rotateParam);
287 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
288 std::string cmdId = fdp.ConsumeRandomLengthString();
289
290 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
291 mechBodyControllerService.RotateBySpeed(mechId, cmdId, rotateBySpeedParam);
292 }
293
StopMovingFuzzTest(const uint8_t * data,size_t size)294 void StopMovingFuzzTest(const uint8_t *data, size_t size)
295 {
296 if ((data == nullptr) || (size == 0)) {
297 return;
298 }
299
300 FuzzedDataProvider fdp(data, size);
301 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
302 std::string cmdId = fdp.ConsumeRandomLengthString();
303
304 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
305 mechBodyControllerService.StopMoving(mechId, cmdId);
306 }
307
GetRotationAnglesFuzzTest(const uint8_t * data,size_t size)308 void GetRotationAnglesFuzzTest(const uint8_t *data, size_t size)
309 {
310 if ((data == nullptr) || (size == 0)) {
311 return;
312 }
313
314 FuzzedDataProvider fdp(data, size);
315 float yaw = fdp.ConsumeIntegral<uint32_t>();
316 float roll = fdp.ConsumeIntegral<uint32_t>();
317 float pitch = fdp.ConsumeIntegral<uint32_t>();
318 EulerAngles eulerAngles;
319 eulerAngles.yaw = yaw;
320 eulerAngles.roll = roll;
321 eulerAngles.pitch = pitch;
322 auto eulerAnglesPtr = std::make_shared<EulerAngles>(eulerAngles);
323 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
324
325 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
326 mechBodyControllerService.GetRotationAngles(mechId, eulerAnglesPtr);
327 }
328
GetRotationDegreeLimitsFuzzTest(const uint8_t * data,size_t size)329 void GetRotationDegreeLimitsFuzzTest(const uint8_t *data, size_t size)
330 {
331 if ((data == nullptr) || (size == 0)) {
332 return;
333 }
334
335 FuzzedDataProvider fdp(data, size);
336 float yawNeg = fdp.ConsumeIntegral<uint32_t>();
337 float rollNeg = fdp.ConsumeIntegral<uint32_t>();
338 float pitchNeg = fdp.ConsumeIntegral<uint32_t>();
339 float yawPos = fdp.ConsumeIntegral<uint32_t>();
340 float rollPos = fdp.ConsumeIntegral<uint32_t>();
341 float pitchPos = fdp.ConsumeIntegral<uint32_t>();
342 RotateDegreeLimit rotationLimit;
343 rotationLimit.negMax.yaw = yawNeg;
344 rotationLimit.negMax.roll = rollNeg;
345 rotationLimit.negMax.pitch = pitchNeg;
346 rotationLimit.posMax.yaw = yawPos;
347 rotationLimit.posMax.roll = rollPos;
348 rotationLimit.posMax.pitch = pitchPos;
349 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
350
351 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
352 mechBodyControllerService.GetRotationDegreeLimits(mechId, rotationLimit);
353 }
354
GetRotationAxesStatusFuzzTest(const uint8_t * data,size_t size)355 void GetRotationAxesStatusFuzzTest(const uint8_t *data, size_t size)
356 {
357 if ((data == nullptr) || (size == 0)) {
358 return;
359 }
360
361 FuzzedDataProvider fdp(data, size);
362 bool boolIdx = fdp.ConsumeIntegral<uint32_t>() % 2;
363 uint32_t enumIdx = fdp.ConsumeIntegral<uint32_t>() % 3;
364 RotationAxisLimited limited = static_cast<RotationAxisLimited>(enumIdx);
365 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
366 RotationAxesStatus axesStatus;
367 axesStatus.pitchEnabled = boolIdx;
368 axesStatus.rollEnabled = boolIdx;
369 axesStatus.yawEnabled = boolIdx;
370 axesStatus.pitchLimited = limited;
371 axesStatus.rollLimited = limited;
372 axesStatus.yawLimited = limited;
373
374 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
375 mechBodyControllerService.GetRotationAxesStatus(mechId, axesStatus);
376 }
377
OnRotationAxesStatusChangeFuzzTest(const uint8_t * data,size_t size)378 void OnRotationAxesStatusChangeFuzzTest(const uint8_t *data, size_t size)
379 {
380 if ((data == nullptr) || (size == 0)) {
381 return;
382 }
383
384 FuzzedDataProvider fdp(data, size);
385 bool boolIdx = fdp.ConsumeIntegral<uint32_t>() % 2;
386 uint32_t enumIdx = fdp.ConsumeIntegral<uint32_t>() % 3;
387 RotationAxisLimited limited = static_cast<RotationAxisLimited>(enumIdx);
388 uint32_t mechId = fdp.ConsumeIntegral<uint32_t>();
389 RotationAxesStatus axesStatus;
390 axesStatus.pitchEnabled = boolIdx;
391 axesStatus.rollEnabled = boolIdx;
392 axesStatus.yawEnabled = boolIdx;
393 axesStatus.pitchLimited = limited;
394 axesStatus.rollLimited = limited;
395 axesStatus.yawLimited = limited;
396
397 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
398 mechBodyControllerService.OnRotationAxesStatusChange(mechId, axesStatus);
399 }
400
SetUserOperationFuzzTest(const uint8_t * data,size_t size)401 void SetUserOperationFuzzTest(const uint8_t *data, size_t size)
402 {
403 if ((data == nullptr) || (size == 0)) {
404 return;
405 }
406 FuzzedDataProvider fdp(data, size);
407 int32_t num = fdp.ConsumeIntegral<int32_t>();
408 std::shared_ptr<Operation> operation = std::make_shared<Operation>(
409 static_cast<Operation>(num));
410 std::string mac = fdp.ConsumeRandomLengthString();
411 std::string param = fdp.ConsumeRandomLengthString();
412 MechBodyControllerService& mechBodyControllerService = MechBodyControllerService::GetInstance();
413 mechBodyControllerService.SetUserOperation(operation, mac, param);
414
415 int32_t mechId = fdp.ConsumeIntegral<int32_t>();
416 mechBodyControllerService.OnDeviceDisconnected(mechId);
417 }
418 }
419
420 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)421 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
422 {
423 /* Run your code on data */
424 OHOS::UnRegisterAttachStateChangeCallbackFuzzTest(data, size);
425 OHOS::OnAttachStateChangeFuzzTest(data, size);
426 OHOS::OnDeviceConnectedFuzzTest(data, size);
427 OHOS::GetAttachedDevicesFuzzTest(data, size);
428 OHOS::SetTrackingEnabledFuzzTest(data, size);
429 OHOS::GetTrackingEnabledFuzzTest(data, size);
430 OHOS::SetTrackingLayoutFuzzTest(data, size);
431 OHOS::GetTrackingLayoutFuzzTest(data, size);
432 OHOS::RotateByDegreeFuzzTest(data, size);
433 OHOS::NotifyOperationResultFuzzTest(data, size);
434 OHOS::RotateToEulerAnglesFuzzTest(data, size);
435 OHOS::GetMaxRotationTimeFuzzTest(data, size);
436 OHOS::GetMaxRotationSpeedFuzzTest(data, size);
437 OHOS::RotateBySpeedFuzzTest(data, size);
438 OHOS::StopMovingFuzzTest(data, size);
439 OHOS::GetRotationAnglesFuzzTest(data, size);
440 OHOS::GetRotationDegreeLimitsFuzzTest(data, size);
441 OHOS::GetRotationAxesStatusFuzzTest(data, size);
442 OHOS::OnRotationAxesStatusChangeFuzzTest(data, size);
443 OHOS::SetUserOperationFuzzTest(data, size);
444 return 0;
445 }