1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "backupservicestub_fuzzer.h"
17
18 #include <cstring>
19
20 #include "b_incremental_data.h"
21 #include "b_session_backup.h"
22 #include "b_session_restore.h"
23 #include "message_parcel.h"
24 #include "refbase.h"
25 #include "service.h"
26 #include "service_reverse.h"
27
28 namespace OHOS {
29 using namespace FileManagement::Backup;
30
31 constexpr int32_t SERVICE_ID = 5203;
32
33 template<class T>
TypeCast(const uint8_t * data,int * pos=nullptr)34 T TypeCast(const uint8_t *data, int *pos = nullptr)
35 {
36 if (pos) {
37 *pos += sizeof(T);
38 }
39 return *(reinterpret_cast<const T*>(data));
40 }
41
42 template <typename T>
WriteParcelableVector(const std::vector<T> & parcelableVector,Parcel & data)43 void WriteParcelableVector(const std::vector<T> &parcelableVector, Parcel &data)
44 {
45 if (!data.WriteUint32(parcelableVector.size())) {
46 return;
47 }
48
49 for (const auto &parcelable : parcelableVector) {
50 if (!data.WriteParcelable(&parcelable)) {
51 return;
52 }
53 }
54
55 return;
56 }
57
OnRemoteRequestFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)58 bool OnRemoteRequestFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
59 {
60 if (data == nullptr || size < sizeof(uint32_t)) {
61 return true;
62 }
63
64 MessageParcel msg;
65 MessageParcel reply;
66 MessageOption option;
67
68 int pos = 0;
69 uint32_t code = TypeCast<uint32_t>(data, &pos);
70 msg.WriteInterfaceToken(ServiceStub::GetDescriptor());
71
72 service->OnRemoteRequest(code, msg, reply, option);
73 return true;
74 }
75
CmdInitRestoreSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)76 bool CmdInitRestoreSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
77 {
78 MessageParcel msg;
79 MessageParcel reply;
80 MessageOption option;
81 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_RESTORE_SESSION);
82
83 try {
84 BSessionRestore::Callbacks callbacks;
85 msg.WriteRemoteObject(new ServiceReverse(callbacks));
86 msg.WriteBuffer(data, size);
87 service->OnRemoteRequest(code, msg, reply, option);
88 } catch (OHOS::FileManagement::Backup::BError &err) {
89 // Only filter BError errors, Other results are not expected.
90 }
91 return true;
92 }
93
CmdInitBackupSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)94 bool CmdInitBackupSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
95 {
96 MessageParcel msg;
97 MessageParcel reply;
98 MessageOption option;
99 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_BACKUP_SESSION);
100
101 try {
102 BSessionBackup::Callbacks callbacks;
103 msg.WriteRemoteObject(new ServiceReverse(callbacks));
104 msg.WriteBuffer(data, size);
105 service->OnRemoteRequest(code, msg, reply, option);
106 } catch (OHOS::FileManagement::Backup::BError &err) {
107 // Only filter BError errors, Other results are not expected.
108 }
109 return true;
110 }
111
CmdStartFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)112 bool CmdStartFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
113 {
114 MessageParcel msg;
115 MessageParcel reply;
116 MessageOption option;
117 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_START);
118
119 try {
120 msg.WriteBuffer(data, size);
121 service->OnRemoteRequest(code, msg, reply, option);
122 } catch (OHOS::FileManagement::Backup::BError &err) {
123 // Only filter BError errors, Other results are not expected.
124 }
125 return true;
126 }
127
CmdGetLocalCapabilitiesFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)128 bool CmdGetLocalCapabilitiesFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
129 {
130 MessageParcel msg;
131 MessageParcel reply;
132 MessageOption option;
133 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES);
134
135 try {
136 msg.WriteBuffer(data, size);
137 service->OnRemoteRequest(code, msg, reply, option);
138 } catch (OHOS::FileManagement::Backup::BError &err) {
139 // Only filter BError errors, Other results are not expected.
140 }
141 return true;
142 }
143
CmdPublishFileFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)144 bool CmdPublishFileFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
145 {
146 if (data == nullptr || size < sizeof(TmpFileSN)) {
147 return true;
148 }
149
150 MessageParcel msg;
151 MessageParcel reply;
152 MessageOption option;
153 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_PUBLISH_FILE);
154
155 try {
156 int pos = 0;
157 BFileInfo info;
158 info.sn = TypeCast<TmpFileSN>(data, &pos);
159 int len = (size - pos) >> 1;
160 info.owner = string(reinterpret_cast<const char*>(data + pos), len);
161 info.fileName = string(reinterpret_cast<const char*>(data + pos + len), len);
162 msg.WriteParcelable(&info);
163 service->OnRemoteRequest(code, msg, reply, option);
164 } catch (OHOS::FileManagement::Backup::BError &err) {
165 // Only filter BError errors, Other results are not expected.
166 }
167 return true;
168 }
169
CmdAppFileReadyFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)170 bool CmdAppFileReadyFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
171 {
172 if (data == nullptr || size < sizeof(int32_t) + sizeof(bool) + sizeof(int)) {
173 return true;
174 }
175
176 MessageParcel msg;
177 MessageParcel reply;
178 MessageOption option;
179 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_FILE_READY);
180
181 try {
182 int pos = 0;
183 int fd = TypeCast<int>(data, &pos);
184 int32_t errCode = TypeCast<int32_t>(data + pos, &pos);
185 bool fdFlag = TypeCast<bool>(data + pos, &pos);
186 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
187 msg.WriteBool(fdFlag);
188 if (fdFlag) {
189 msg.WriteFileDescriptor(fd);
190 }
191 msg.WriteInt32(errCode);
192 service->OnRemoteRequest(code, msg, reply, option);
193 } catch (OHOS::FileManagement::Backup::BError &err) {
194 // Only filter BError errors, Other results are not expected.
195 }
196 return true;
197 }
198
CmdAppDoneFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)199 bool CmdAppDoneFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
200 {
201 if (data == nullptr || size < sizeof(int32_t)) {
202 return true;
203 }
204
205 MessageParcel msg;
206 MessageParcel reply;
207 MessageOption option;
208 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_DONE);
209
210 try {
211 int32_t errCode = TypeCast<int32_t>(data);
212 msg.WriteInt32(errCode);
213 service->OnRemoteRequest(code, msg, reply, option);
214 } catch (OHOS::FileManagement::Backup::BError &err) {
215 // Only filter BError errors, Other results are not expected.
216 }
217 return true;
218 }
219
CmdResultReportFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)220 bool CmdResultReportFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
221 {
222 if (data == nullptr || size < sizeof(int32_t) + sizeof(int32_t)) {
223 return true;
224 }
225
226 MessageParcel msg;
227 MessageParcel reply;
228 MessageOption option;
229 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_SERVICE_RESULT_REPORT);
230
231 try {
232 int pos = 0;
233 int32_t scenario = TypeCast<int32_t>(data, &pos);
234 int32_t errCode = TypeCast<int32_t>(data + pos, &pos);
235 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
236 msg.WriteInt32(scenario);
237 msg.WriteInt32(errCode);
238 service->OnRemoteRequest(code, msg, reply, option);
239 } catch (OHOS::FileManagement::Backup::BError &err) {
240 // Only filter BError errors, Other results are not expected.
241 }
242 return true;
243 }
244
CmdGetFileHandleFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)245 bool CmdGetFileHandleFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
246 {
247 MessageParcel msg;
248 MessageParcel reply;
249 MessageOption option;
250 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_FILE_HANDLE);
251
252 try {
253 int len = size >> 1;
254 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
255 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
256 service->OnRemoteRequest(code, msg, reply, option);
257 } catch (OHOS::FileManagement::Backup::BError &err) {
258 // Only filter BError errors, Other results are not expected.
259 }
260 return true;
261 }
262
CmdAppendBundlesRestoreSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)263 bool CmdAppendBundlesRestoreSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
264 {
265 if (data == nullptr || size < sizeof(int) + sizeof(int32_t) + sizeof(int32_t)) {
266 return true;
267 }
268
269 MessageParcel msg;
270 MessageParcel reply;
271 MessageOption option;
272 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_RESTORE_SESSION_DATA);
273
274 try {
275 int pos = 0;
276 int fd = TypeCast<int>(data, &pos);
277 int32_t type = TypeCast<int32_t>(data + pos, &pos);
278 int32_t userId = TypeCast<int32_t>(data + pos, &pos);
279 vector<string> bundleNames;
280 bundleNames.emplace_back(string(reinterpret_cast<const char*>(data + pos), size - pos));
281 msg.WriteFileDescriptor(fd);
282 msg.WriteStringVector(bundleNames);
283 msg.WriteInt32(type);
284 msg.WriteInt32(userId);
285 service->OnRemoteRequest(code, msg, reply, option);
286 } catch (OHOS::FileManagement::Backup::BError &err) {
287 // Only filter BError errors, Other results are not expected.
288 }
289 return true;
290 }
291
CmdAppendBundlesDetailsRestoreSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)292 bool CmdAppendBundlesDetailsRestoreSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
293 {
294 if (data == nullptr || size < sizeof(int) + sizeof(int32_t) + sizeof(int32_t)) {
295 return true;
296 }
297
298 MessageParcel msg;
299 MessageParcel reply;
300 MessageOption option;
301 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_RESTORE_SESSION_DATA_BY_DETAIL);
302
303 try {
304 int pos = 0;
305 int fd = TypeCast<int>(data, &pos);
306 int32_t type = TypeCast<int32_t>(data + pos, &pos);
307 int32_t userId = TypeCast<int32_t>(data + pos, &pos);
308 int len = (size - pos) >> 1;
309 vector<string> bundleNames;
310 bundleNames.emplace_back(string(reinterpret_cast<const char*>(data + pos), len));
311 vector<string> detailInfos;
312 detailInfos.emplace_back(string(reinterpret_cast<const char*>(data + pos + len), len));
313 msg.WriteFileDescriptor(fd);
314 msg.WriteStringVector(bundleNames);
315 msg.WriteStringVector(detailInfos);
316 msg.WriteInt32(type);
317 msg.WriteInt32(userId);
318 service->OnRemoteRequest(code, msg, reply, option);
319 } catch (OHOS::FileManagement::Backup::BError &err) {
320 // Only filter BError errors, Other results are not expected.
321 }
322 return true;
323 }
324
CmdAppendBundlesBackupSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)325 bool CmdAppendBundlesBackupSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
326 {
327 MessageParcel msg;
328 MessageParcel reply;
329 MessageOption option;
330 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_BACKUP_SESSION);
331
332 try {
333 vector<string> bundleNames;
334 bundleNames.emplace_back(string(reinterpret_cast<const char*>(data), size));
335 msg.WriteStringVector(bundleNames);
336 service->OnRemoteRequest(code, msg, reply, option);
337 } catch (OHOS::FileManagement::Backup::BError &err) {
338 // Only filter BError errors, Other results are not expected.
339 }
340 return true;
341 }
342
CmdAppendBundlesDetailsBackupSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)343 bool CmdAppendBundlesDetailsBackupSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
344 {
345 MessageParcel msg;
346 MessageParcel reply;
347 MessageOption option;
348 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_DETAILS_BACKUP_SESSION);
349
350 try {
351 int len = size >> 1;
352 vector<string> bundleNames;
353 bundleNames.emplace_back(string(reinterpret_cast<const char*>(data), len));
354 vector<string> detailInfos;
355 detailInfos.emplace_back(string(reinterpret_cast<const char*>(data + len), len));
356 msg.WriteStringVector(bundleNames);
357 msg.WriteStringVector(detailInfos);
358 service->OnRemoteRequest(code, msg, reply, option);
359 } catch (OHOS::FileManagement::Backup::BError &err) {
360 // Only filter BError errors, Other results are not expected.
361 }
362 return true;
363 }
364
CmdFinishFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)365 bool CmdFinishFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
366 {
367 MessageParcel msg;
368 MessageParcel reply;
369 MessageOption option;
370 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_FINISH);
371 try {
372 msg.WriteBuffer(data, size);
373 service->OnRemoteRequest(code, msg, reply, option);
374 } catch (OHOS::FileManagement::Backup::BError &err) {
375 // Only filter BError errors, Other results are not expected.
376 }
377 return true;
378 }
379
CmdReleaseFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)380 [[maybe_unused]] bool CmdReleaseFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
381 {
382 MessageParcel msg;
383 MessageParcel reply;
384 MessageOption option;
385 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_RELEASE);
386 try {
387 msg.WriteBuffer(data, size);
388 service->OnRemoteRequest(code, msg, reply, option);
389 } catch (OHOS::FileManagement::Backup::BError &err) {
390 // Only filter BError errors, Other results are not expected.
391 }
392 return true;
393 }
394
CmdGetLocalCapabilitiesIncrementalFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)395 bool CmdGetLocalCapabilitiesIncrementalFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
396 {
397 MessageParcel msg;
398 MessageParcel reply;
399 MessageOption option;
400 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES_INCREMENTAL);
401
402 try {
403 vector<BIncrementalData> bundleNames;
404 bundleNames.emplace_back(string(reinterpret_cast<const char*>(data), size), 0);
405 WriteParcelableVector(bundleNames, msg);
406 service->OnRemoteRequest(code, msg, reply, option);
407 } catch (OHOS::FileManagement::Backup::BError &err) {
408 // Only filter BError errors, Other results are not expected.
409 }
410 return true;
411 }
412
CmdGetAppLocalListAndDoIncrementalBackupFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)413 bool CmdGetAppLocalListAndDoIncrementalBackupFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
414 {
415 MessageParcel msg;
416 MessageParcel reply;
417 MessageOption option;
418 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_APP_LOCAL_LIST_AND_DO_INCREMENTAL_BACKUP);
419 try {
420 msg.WriteBuffer(data, size);
421 service->OnRemoteRequest(code, msg, reply, option);
422 } catch (OHOS::FileManagement::Backup::BError &err) {
423 // Only filter BError errors, Other results are not expected.
424 }
425 return true;
426 }
427
CmdInitIncrementalBackupSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)428 bool CmdInitIncrementalBackupSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
429 {
430 MessageParcel msg;
431 MessageParcel reply;
432 MessageOption option;
433 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_INCREMENTAL_BACKUP_SESSION);
434
435 try {
436 BIncrementalBackupSession::Callbacks callbacks;
437 msg.WriteRemoteObject(new ServiceReverse(callbacks));
438 msg.WriteBuffer(data, size);
439 service->OnRemoteRequest(code, msg, reply, option);
440 } catch (OHOS::FileManagement::Backup::BError &err) {
441 // Only filter BError errors, Other results are not expected.
442 }
443 return true;
444 }
445
CmdAppendBundlesIncrementalBackupSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)446 bool CmdAppendBundlesIncrementalBackupSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
447 {
448 MessageParcel msg;
449 MessageParcel reply;
450 MessageOption option;
451 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_INCREMENTAL_BACKUP_SESSION);
452
453 try {
454 vector<BIncrementalData> bundlesToBackup;
455 bundlesToBackup.emplace_back(string(reinterpret_cast<const char*>(data), size), 0);
456 WriteParcelableVector(bundlesToBackup, msg);
457 service->OnRemoteRequest(code, msg, reply, option);
458 } catch (OHOS::FileManagement::Backup::BError &err) {
459 // Only filter BError errors, Other results are not expected.
460 }
461 return true;
462 }
463
CmdAppendBundlesDetailsIncrementalBackupSessionFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)464 bool CmdAppendBundlesDetailsIncrementalBackupSessionFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
465 {
466 MessageParcel msg;
467 MessageParcel reply;
468 MessageOption option;
469 uint32_t code = static_cast<uint32_t>(
470 IServiceIpcCode::COMMAND_APPEND_BUNDLES_INCREMENTAL_BACKUP_SESSION_WITH_BUNDLE_INFOS);
471
472 try {
473 int len = size >> 2;
474 vector<BIncrementalData> bundlesToBackup;
475 bundlesToBackup.emplace_back(string(reinterpret_cast<const char*>(data), len), 0);
476 std::vector<std::string> infos;
477 infos.emplace_back(string(reinterpret_cast<const char*>(data + len), len));
478 infos.emplace_back(string(reinterpret_cast<const char*>(data + len + len), len));
479 WriteParcelableVector(bundlesToBackup, msg);
480 msg.WriteStringVector(infos);
481 service->OnRemoteRequest(code, msg, reply, option);
482 } catch (OHOS::FileManagement::Backup::BError &err) {
483 // Only filter BError errors, Other results are not expected.
484 }
485 return true;
486 }
487
CmdPublishIncrementalFileFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)488 bool CmdPublishIncrementalFileFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
489 {
490 if (data == nullptr || size < sizeof(TmpFileSN)) {
491 return true;
492 }
493
494 MessageParcel msg;
495 MessageParcel reply;
496 MessageOption option;
497 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_PUBLISH_INCREMENTAL_FILE);
498
499 try {
500 int pos = 0;
501 BFileInfo info;
502 info.sn = TypeCast<TmpFileSN>(data, &pos);
503 int len = (size - pos) >> 1;
504 info.owner = string(reinterpret_cast<const char*>(data + pos), len);
505 info.fileName = string(reinterpret_cast<const char*>(data + pos + len), len);
506 msg.WriteParcelable(&info);
507 service->OnRemoteRequest(code, msg, reply, option);
508 } catch (OHOS::FileManagement::Backup::BError &err) {
509 // Only filter BError errors, Other results are not expected.
510 }
511 return true;
512 }
513
CmdPublishSAIncrementalFileFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)514 [[maybe_unused]] bool CmdPublishSAIncrementalFileFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
515 {
516 if (data == nullptr || size < sizeof(int) + sizeof(TmpFileSN)) {
517 return true;
518 }
519
520 MessageParcel msg;
521 MessageParcel reply;
522 MessageOption option;
523 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_PUBLISH_S_A_INCREMENTAL_FILE);
524
525 try {
526 int pos = 0;
527 BFileInfo info;
528 int fd = TypeCast<int>(data, &pos);
529 info.sn = TypeCast<TmpFileSN>(data + pos, &pos);
530 int len = (size - pos) >> 1;
531 info.owner = string(reinterpret_cast<const char*>(data + pos), len);
532 info.fileName = string(reinterpret_cast<const char*>(data + pos + len), len);
533 msg.WriteParcelable(&info);
534 msg.WriteFileDescriptor(fd);
535 service->OnRemoteRequest(code, msg, reply, option);
536 } catch (OHOS::FileManagement::Backup::BError &err) {
537 // Only filter BError errors, Other results are not expected.
538 }
539 return true;
540 }
541
CmdAppIncrementalFileReadyFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)542 bool CmdAppIncrementalFileReadyFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
543 {
544 if (data == nullptr || size < sizeof(int32_t) + sizeof(bool) + sizeof(int) + sizeof(int)) {
545 return true;
546 }
547
548 MessageParcel msg;
549 MessageParcel reply;
550 MessageOption option;
551 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_INCREMENTAL_FILE_READY);
552
553 try {
554 int pos = 0;
555 int fd1 = TypeCast<int>(data, &pos);
556 int fd2 = TypeCast<int>(data + pos, &pos);
557 int32_t errCode = TypeCast<int32_t>(data + pos, &pos);
558 bool fdFlag = TypeCast<bool>(data + pos, &pos);
559 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
560 msg.WriteBool(fdFlag);
561 if (fdFlag) {
562 msg.WriteFileDescriptor(fd1);
563 msg.WriteFileDescriptor(fd2);
564 }
565 msg.WriteInt32(errCode);
566 service->OnRemoteRequest(code, msg, reply, option);
567 } catch (OHOS::FileManagement::Backup::BError &err) {
568 // Only filter BError errors, Other results are not expected.
569 }
570 return true;
571 }
572
CmdAppIncrementalDoneFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)573 bool CmdAppIncrementalDoneFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
574 {
575 if (data == nullptr || size < sizeof(int32_t)) {
576 return true;
577 }
578
579 MessageParcel msg;
580 MessageParcel reply;
581 MessageOption option;
582 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_INCREMENTAL_DONE);
583
584 try {
585 int32_t errCode = TypeCast<int32_t>(data);
586 msg.WriteInt32(errCode);
587 service->OnRemoteRequest(code, msg, reply, option);
588 } catch (OHOS::FileManagement::Backup::BError &err) {
589 // Only filter BError errors, Other results are not expected.
590 }
591 return true;
592 }
593
CmdGetIncrementalFileHandleFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)594 bool CmdGetIncrementalFileHandleFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
595 {
596 MessageParcel msg;
597 MessageParcel reply;
598 MessageOption option;
599 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_INCREMENTAL_FILE_HANDLE);
600
601 try {
602 int len = size >> 1;
603 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
604 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
605 service->OnRemoteRequest(code, msg, reply, option);
606 } catch (OHOS::FileManagement::Backup::BError &err) {
607 // Only filter BError errors, Other results are not expected.
608 }
609 return true;
610 }
611
CmdGetBackupInfoFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)612 bool CmdGetBackupInfoFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
613 {
614 MessageParcel msg;
615 MessageParcel reply;
616 MessageOption option;
617 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_BACKUP_INFO);
618
619 try {
620 msg.WriteString(string(reinterpret_cast<const char*>(data), size));
621 service->OnRemoteRequest(code, msg, reply, option);
622 } catch (OHOS::FileManagement::Backup::BError &err) {
623 // Only filter BError errors, Other results are not expected.
624 }
625 return true;
626 }
627
CmdUpdateTimerFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)628 bool CmdUpdateTimerFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
629 {
630 if (data == nullptr || size < sizeof(int32_t)) {
631 return true;
632 }
633
634 MessageParcel msg;
635 MessageParcel reply;
636 MessageOption option;
637 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_UPDATE_TIMER);
638
639 try {
640 int pos = 0;
641 int32_t timeout = TypeCast<int32_t>(data, &pos);
642 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
643 msg.WriteInt32(timeout);
644 service->OnRemoteRequest(code, msg, reply, option);
645 } catch (OHOS::FileManagement::Backup::BError &err) {
646 // Only filter BError errors, Other results are not expected.
647 }
648 return true;
649 }
650
CmdUpdateSendRateFuzzTest(sptr<Service> service,const uint8_t * data,size_t size)651 bool CmdUpdateSendRateFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
652 {
653 if (data == nullptr || size < sizeof(int32_t)) {
654 return true;
655 }
656
657 MessageParcel msg;
658 MessageParcel reply;
659 MessageOption option;
660 uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_UPDATE_SEND_RATE);
661
662 try {
663 int pos = 0;
664 int32_t sendRate = TypeCast<int32_t>(data, &pos);
665 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
666 msg.WriteInt32(sendRate);
667 service->OnRemoteRequest(code, msg, reply, option);
668 } catch (OHOS::FileManagement::Backup::BError &err) {
669 // Only filter BError errors, Other results are not expected.
670 }
671 return true;
672 }
673 } // namespace OHOS
674
675 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)676 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
677 {
678 OHOS::sptr service(new OHOS::FileManagement::Backup::Service(OHOS::SERVICE_ID));
679 if (service == nullptr) {
680 return 0;
681 }
682
683 try {
684 OHOS::OnRemoteRequestFuzzTest(service, data, size);
685 CmdInitRestoreSessionFuzzTest(service, data, size);
686 CmdInitBackupSessionFuzzTest(service, data, size);
687 CmdStartFuzzTest(service, data, size);
688 CmdGetLocalCapabilitiesFuzzTest(service, data, size);
689 CmdPublishFileFuzzTest(service, data, size);
690 CmdAppFileReadyFuzzTest(service, data, size);
691 CmdAppDoneFuzzTest(service, data, size);
692 CmdResultReportFuzzTest(service, data, size);
693 CmdGetFileHandleFuzzTest(service, data, size);
694 CmdAppendBundlesRestoreSessionFuzzTest(service, data, size);
695 CmdAppendBundlesDetailsRestoreSessionFuzzTest(service, data, size);
696 CmdAppendBundlesBackupSessionFuzzTest(service, data, size);
697 CmdAppendBundlesDetailsBackupSessionFuzzTest(service, data, size);
698 CmdFinishFuzzTest(service, data, size);
699 CmdGetLocalCapabilitiesIncrementalFuzzTest(service, data, size);
700 CmdGetAppLocalListAndDoIncrementalBackupFuzzTest(service, data, size);
701 CmdInitIncrementalBackupSessionFuzzTest(service, data, size);
702 CmdAppendBundlesIncrementalBackupSessionFuzzTest(service, data, size);
703 CmdAppendBundlesDetailsIncrementalBackupSessionFuzzTest(service, data, size);
704 CmdPublishIncrementalFileFuzzTest(service, data, size);
705 CmdAppIncrementalFileReadyFuzzTest(service, data, size);
706 CmdAppIncrementalDoneFuzzTest(service, data, size);
707 CmdGetIncrementalFileHandleFuzzTest(service, data, size);
708 CmdGetBackupInfoFuzzTest(service, data, size);
709 CmdUpdateTimerFuzzTest(service, data, size);
710 CmdUpdateSendRateFuzzTest(service, data, size);
711 } catch (OHOS::FileManagement::Backup::BError &err) {
712 // Only filter BError errors, Other results are not expected.
713 }
714 return 0;
715 }