1 /*
2 * Copyright (c) 2024-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "servicereverse_fuzzer.h"
17
18 #include <string>
19
20 #include "b_error/b_error.h"
21 #include "b_session_backup.h"
22 #include "b_session_restore.h"
23 #include "b_incremental_backup_session.h"
24 #include "b_incremental_restore_session.h"
25 #include "message_parcel.h"
26 #include "service_reverse_stub.h"
27 #include "service_reverse.h"
28
29 namespace OHOS {
30 using namespace std;
31 using namespace FileManagement::Backup;
32
33 template<class T>
TypeCast(const uint8_t * data,int * pos=nullptr)34 T TypeCast(const uint8_t *data, int *pos = nullptr)
35 {
36 if (pos) {
37 *pos += sizeof(T);
38 }
39 return *(reinterpret_cast<const T*>(data));
40 }
41
BackupOnFileReadyFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)42 bool BackupOnFileReadyFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
43 {
44 if (data == nullptr || size < sizeof(bool) + sizeof(int)) {
45 return true;
46 }
47
48 MessageParcel msg;
49 MessageParcel reply;
50 MessageOption option;
51 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_FILE_READY);
52
53 try {
54 int pos = 0;
55 int fd = TypeCast<int>(data, &pos);
56 bool fdFlag = TypeCast<bool>(data + pos, &pos);
57 int len = ((size - pos) >> 1);
58 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), len));
59 msg.WriteString(string(reinterpret_cast<const char*>(data + pos + len), size - pos - len));
60 msg.WriteBool(fdFlag);
61 if (fdFlag) {
62 msg.WriteFileDescriptor(fd);
63 }
64 service->OnRemoteRequest(code, msg, reply, option);
65 } catch (BError &err) {
66 // Only filter BError errors, Other results are not expected.
67 }
68 return true;
69 }
70
BackupOnBundleStartedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)71 bool BackupOnBundleStartedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
72 {
73 if (data == nullptr || size < sizeof(int32_t)) {
74 return true;
75 }
76
77 MessageParcel msg;
78 MessageParcel reply;
79 MessageOption option;
80 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_BUNDLE_STARTED);
81
82 try {
83 int pos = 0;
84 int32_t errCode = TypeCast<int32_t>(data, &pos);
85 msg.WriteInt32(errCode);
86 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
87 service->OnRemoteRequest(code, msg, reply, option);
88 } catch (BError &err) {
89 // Only filter BError errors, Other results are not expected.
90 }
91 return true;
92 }
93
BackupOnResultReportFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)94 bool BackupOnResultReportFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
95 {
96 if (data == nullptr) {
97 return true;
98 }
99
100 MessageParcel msg;
101 MessageParcel reply;
102 MessageOption option;
103 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_RESULT_REPORT);
104
105 try {
106 int len = (size >> 1);
107 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
108 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
109 service->OnRemoteRequest(code, msg, reply, option);
110 } catch (BError &err) {
111 // Only filter BError errors, Other results are not expected.
112 }
113 return true;
114 }
115
BackupOnBundleFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)116 bool BackupOnBundleFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
117 {
118 if (data == nullptr || size < sizeof(int32_t)) {
119 return true;
120 }
121
122 MessageParcel msg;
123 MessageParcel reply;
124 MessageOption option;
125 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_BUNDLE_FINISHED);
126
127 try {
128 int pos = 0;
129 int32_t errCode = TypeCast<int32_t>(data, &pos);
130 msg.WriteInt32(errCode);
131 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
132 service->OnRemoteRequest(code, msg, reply, option);
133 } catch (BError &err) {
134 // Only filter BError errors, Other results are not expected.
135 }
136 return true;
137 }
138
BackupOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)139 bool BackupOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
140 {
141 if (data == nullptr || size < sizeof(int32_t)) {
142 return true;
143 }
144
145 MessageParcel msg;
146 MessageParcel reply;
147 MessageOption option;
148 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_ALL_BUNDLES_FINISHED);
149
150 try {
151 int32_t errCode = TypeCast<int32_t>(data);
152 msg.WriteInt32(errCode);
153 service->OnRemoteRequest(code, msg, reply, option);
154 } catch (BError &err) {
155 // Only filter BError errors, Other results are not expected.
156 }
157 return true;
158 }
159
BackupOnProcessInfoFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)160 bool BackupOnProcessInfoFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
161 {
162 if (data == nullptr) {
163 return true;
164 }
165
166 MessageParcel msg;
167 MessageParcel reply;
168 MessageOption option;
169 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_PROCESS_INFO);
170
171 try {
172 int len = (size >> 1);
173 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
174 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
175 service->OnRemoteRequest(code, msg, reply, option);
176 } catch (BError &err) {
177 // Only filter BError errors, Other results are not expected.
178 }
179 return true;
180 }
181
BackupOnScanningInfoFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)182 bool BackupOnScanningInfoFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
183 {
184 if (data == nullptr) {
185 return true;
186 }
187
188 MessageParcel msg;
189 MessageParcel reply;
190 MessageOption option;
191 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_SCANNING_INFO);
192
193 try {
194 msg.WriteString(string(reinterpret_cast<const char*>(data), size));
195 service->OnRemoteRequest(code, msg, reply, option);
196 } catch (BError &err) {
197 // Only filter BError errors, Other results are not expected.
198 }
199 return true;
200 }
201
RestoreOnBundleStartedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)202 bool RestoreOnBundleStartedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
203 {
204 if (data == nullptr || size < sizeof(int32_t)) {
205 return true;
206 }
207
208 MessageParcel msg;
209 MessageParcel reply;
210 MessageOption option;
211 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_RESTORE_ON_BUNDLE_STARTED);
212
213 try {
214 int pos = 0;
215 int32_t errCode = TypeCast<int32_t>(data, &pos);
216 msg.WriteInt32(errCode);
217 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
218 service->OnRemoteRequest(code, msg, reply, option);
219 } catch (BError &err) {
220 // Only filter BError errors, Other results are not expected.
221 }
222 return true;
223 }
224
RestoreOnBundleFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)225 bool RestoreOnBundleFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
226 {
227 if (data == nullptr || size < sizeof(int32_t)) {
228 return true;
229 }
230
231 MessageParcel msg;
232 MessageParcel reply;
233 MessageOption option;
234 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_RESTORE_ON_BUNDLE_FINISHED);
235
236 try {
237 int pos = 0;
238 int32_t errCode = TypeCast<int32_t>(data, &pos);
239 msg.WriteInt32(errCode);
240 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
241 service->OnRemoteRequest(code, msg, reply, option);
242 } catch (BError &err) {
243 // Only filter BError errors, Other results are not expected.
244 }
245 return true;
246 }
247
RestoreOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)248 bool RestoreOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
249 {
250 if (data == nullptr || size < sizeof(int32_t)) {
251 return true;
252 }
253
254 MessageParcel msg;
255 MessageParcel reply;
256 MessageOption option;
257 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_RESTORE_ON_ALL_BUNDLES_FINISHED);
258
259 try {
260 int32_t errCode = TypeCast<int32_t>(data);
261 msg.WriteInt32(errCode);
262 service->OnRemoteRequest(code, msg, reply, option);
263 } catch (BError &err) {
264 // Only filter BError errors, Other results are not expected.
265 }
266 return true;
267 }
268
RestoreOnFileReadyFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)269 bool RestoreOnFileReadyFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
270 {
271 if (data == nullptr || size < sizeof(bool) + sizeof(int) + sizeof(int32_t)) {
272 return true;
273 }
274
275 MessageParcel msg;
276 MessageParcel reply;
277 MessageOption option;
278 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_RESTORE_ON_FILE_READY);
279
280 try {
281 int pos = 0;
282 int fd = TypeCast<int>(data, &pos);
283 bool fdFlag = TypeCast<bool>(data + pos, &pos);
284 int32_t errCode = TypeCast<int32_t>(data + pos, &pos);
285 int len = ((size - pos) >> 1);
286 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), len));
287 msg.WriteString(string(reinterpret_cast<const char*>(data + pos + len), size - pos - len));
288 msg.WriteBool(fdFlag);
289 if (fdFlag) {
290 msg.WriteFileDescriptor(fd);
291 }
292 msg.WriteInt32(errCode);
293 service->OnRemoteRequest(code, msg, reply, option);
294 } catch (BError &err) {
295 // Only filter BError errors, Other results are not expected.
296 }
297 return true;
298 }
299
RestoreOnResultReportFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)300 bool RestoreOnResultReportFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
301 {
302 if (data == nullptr || size < sizeof(int32_t)) {
303 return true;
304 }
305
306 MessageParcel msg;
307 MessageParcel reply;
308 MessageOption option;
309 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_RESTORE_ON_RESULT_REPORT);
310
311 try {
312 int pos = 0;
313 int32_t errCode = TypeCast<int32_t>(data, &pos);
314 int len = ((size - pos) >> 1);
315 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), len));
316 msg.WriteString(string(reinterpret_cast<const char*>(data + pos + len), size - pos - len));
317 msg.WriteInt32(errCode);
318 service->OnRemoteRequest(code, msg, reply, option);
319 } catch (BError &err) {
320 // Only filter BError errors, Other results are not expected.
321 }
322 return true;
323 }
324
RestoreOnProcessInfoFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)325 bool RestoreOnProcessInfoFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
326 {
327 if (data == nullptr) {
328 return true;
329 }
330
331 MessageParcel msg;
332 MessageParcel reply;
333 MessageOption option;
334 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_RESTORE_ON_PROCESS_INFO);
335
336 try {
337 int len = (size >> 1);
338 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
339 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
340 service->OnRemoteRequest(code, msg, reply, option);
341 } catch (BError &err) {
342 // Only filter BError errors, Other results are not expected.
343 }
344 return true;
345 }
346
IncrementalBackupOnFileReadyFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)347 bool IncrementalBackupOnFileReadyFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
348 {
349 if (data == nullptr || size < sizeof(bool) + sizeof(int) + sizeof(int) + sizeof(int32_t)) {
350 return true;
351 }
352
353 MessageParcel msg;
354 MessageParcel reply;
355 MessageOption option;
356 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_FILE_READY);
357
358 try {
359 int pos = 0;
360 int fd = TypeCast<int>(data, &pos);
361 int manifestFd = TypeCast<int>(data + pos, &pos);
362 bool fdFlag = TypeCast<bool>(data + pos, &pos);
363 int32_t errCode = TypeCast<int32_t>(data + pos, &pos);
364 int len = ((size - pos) >> 1);
365 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), len));
366 msg.WriteString(string(reinterpret_cast<const char*>(data + pos + len), size - pos - len));
367 msg.WriteBool(fdFlag);
368 if (fdFlag) {
369 msg.WriteFileDescriptor(fd);
370 msg.WriteFileDescriptor(manifestFd);
371 }
372 msg.WriteInt32(errCode);
373 service->OnRemoteRequest(code, msg, reply, option);
374 } catch (BError &err) {
375 // Only filter BError errors, Other results are not expected.
376 }
377 return true;
378 }
379
IncrementalBackupOnBundleStartedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)380 bool IncrementalBackupOnBundleStartedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
381 {
382 if (data == nullptr || size < sizeof(int32_t)) {
383 return true;
384 }
385
386 MessageParcel msg;
387 MessageParcel reply;
388 MessageOption option;
389 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_BUNDLE_STARTED);
390
391 try {
392 int pos = 0;
393 int32_t errCode = TypeCast<int32_t>(data, &pos);
394 msg.WriteInt32(errCode);
395 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
396 service->OnRemoteRequest(code, msg, reply, option);
397 } catch (BError &err) {
398 // Only filter BError errors, Other results are not expected.
399 }
400 return true;
401 }
402
IncrementalBackupOnResultReportFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)403 bool IncrementalBackupOnResultReportFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
404 {
405 if (data == nullptr) {
406 return true;
407 }
408
409 MessageParcel msg;
410 MessageParcel reply;
411 MessageOption option;
412 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_RESULT_REPORT);
413
414 try {
415 int len = (size >> 1);
416 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
417 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
418 service->OnRemoteRequest(code, msg, reply, option);
419 } catch (BError &err) {
420 // Only filter BError errors, Other results are not expected.
421 }
422 return true;
423 }
424
IncrementalBackupOnBundleFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)425 bool IncrementalBackupOnBundleFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
426 {
427 if (data == nullptr || size < sizeof(int32_t)) {
428 return true;
429 }
430
431 MessageParcel msg;
432 MessageParcel reply;
433 MessageOption option;
434 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_BUNDLE_FINISHED);
435
436 try {
437 int pos = 0;
438 int32_t errCode = TypeCast<int32_t>(data, &pos);
439 msg.WriteInt32(errCode);
440 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
441 service->OnRemoteRequest(code, msg, reply, option);
442 } catch (BError &err) {
443 // Only filter BError errors, Other results are not expected.
444 }
445 return true;
446 }
447
IncrementalBackupOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)448 bool IncrementalBackupOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
449 {
450 if (data == nullptr || size < sizeof(int32_t)) {
451 return true;
452 }
453
454 MessageParcel msg;
455 MessageParcel reply;
456 MessageOption option;
457 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_ALL_BUNDLES_FINISHED);
458
459 try {
460 int32_t errCode = TypeCast<int32_t>(data);
461 msg.WriteInt32(errCode);
462 service->OnRemoteRequest(code, msg, reply, option);
463 } catch (BError &err) {
464 // Only filter BError errors, Other results are not expected.
465 }
466 return true;
467 }
468
IncrementalBackupOnProcessInfoFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)469 bool IncrementalBackupOnProcessInfoFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
470 {
471 if (data == nullptr) {
472 return true;
473 }
474
475 MessageParcel msg;
476 MessageParcel reply;
477 MessageOption option;
478 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_PROCESS_INFO);
479
480 try {
481 int len = (size >> 1);
482 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
483 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
484 service->OnRemoteRequest(code, msg, reply, option);
485 } catch (BError &err) {
486 // Only filter BError errors, Other results are not expected.
487 }
488 return true;
489 }
490
IncrementalBackupOnScanningInfoFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)491 bool IncrementalBackupOnScanningInfoFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
492 {
493 if (data == nullptr) {
494 return true;
495 }
496
497 MessageParcel msg;
498 MessageParcel reply;
499 MessageOption option;
500 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_BACKUP_ON_SCANNING_INFO);
501
502 try {
503 msg.WriteString(string(reinterpret_cast<const char*>(data), size));
504 service->OnRemoteRequest(code, msg, reply, option);
505 } catch (BError &err) {
506 // Only filter BError errors, Other results are not expected.
507 }
508 return true;
509 }
510
IncrementalRestoreOnBundleStartedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)511 bool IncrementalRestoreOnBundleStartedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
512 {
513 if (data == nullptr || size < sizeof(int32_t)) {
514 return true;
515 }
516
517 MessageParcel msg;
518 MessageParcel reply;
519 MessageOption option;
520 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_RESTORE_ON_BUNDLE_STARTED);
521
522 try {
523 int pos = 0;
524 int32_t errCode = TypeCast<int32_t>(data, &pos);
525 msg.WriteInt32(errCode);
526 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
527 service->OnRemoteRequest(code, msg, reply, option);
528 } catch (BError &err) {
529 // Only filter BError errors, Other results are not expected.
530 }
531 return true;
532 }
533
IncrementalRestoreOnBundleFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)534 bool IncrementalRestoreOnBundleFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
535 {
536 if (data == nullptr || size < sizeof(int32_t)) {
537 return true;
538 }
539
540 MessageParcel msg;
541 MessageParcel reply;
542 MessageOption option;
543 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_RESTORE_ON_BUNDLE_FINISHED);
544
545 try {
546 int pos = 0;
547 int32_t errCode = TypeCast<int32_t>(data, &pos);
548 msg.WriteInt32(errCode);
549 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), size - pos));
550 service->OnRemoteRequest(code, msg, reply, option);
551 } catch (BError &err) {
552 // Only filter BError errors, Other results are not expected.
553 }
554 return true;
555 }
556
IncrementalRestoreOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)557 bool IncrementalRestoreOnAllBundlesFinishedFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
558 {
559 if (data == nullptr || size < sizeof(int32_t)) {
560 return true;
561 }
562
563 MessageParcel msg;
564 MessageParcel reply;
565 MessageOption option;
566 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_RESTORE_ON_ALL_BUNDLES_FINISHED);
567
568 try {
569 int32_t errCode = TypeCast<int32_t>(data);
570 msg.WriteInt32(errCode);
571 service->OnRemoteRequest(code, msg, reply, option);
572 } catch (BError &err) {
573 // Only filter BError errors, Other results are not expected.
574 }
575 return true;
576 }
577
IncrementalRestoreOnFileReadyFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)578 bool IncrementalRestoreOnFileReadyFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
579 {
580 if (data == nullptr || size < sizeof(bool) + sizeof(int) + sizeof(int) + sizeof(int32_t)) {
581 return true;
582 }
583
584 MessageParcel msg;
585 MessageParcel reply;
586 MessageOption option;
587 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_RESTORE_ON_FILE_READY);
588
589 try {
590 int pos = 0;
591 int fd = TypeCast<int>(data, &pos);
592 int manifestFd = TypeCast<int>(data + pos, &pos);
593 bool fdFlag = TypeCast<bool>(data + pos, &pos);
594 int32_t errCode = TypeCast<int32_t>(data + pos, &pos);
595 int len = ((size - pos) >> 1);
596 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), len));
597 msg.WriteString(string(reinterpret_cast<const char*>(data + pos + len), size - pos - len));
598 msg.WriteBool(fdFlag);
599 if (fdFlag) {
600 msg.WriteFileDescriptor(fd);
601 msg.WriteFileDescriptor(manifestFd);
602 }
603 msg.WriteInt32(errCode);
604 service->OnRemoteRequest(code, msg, reply, option);
605 } catch (BError &err) {
606 // Only filter BError errors, Other results are not expected.
607 }
608 return true;
609 }
610
IncrementalRestoreOnResultReportFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)611 bool IncrementalRestoreOnResultReportFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
612 {
613 if (data == nullptr || size < sizeof(int32_t)) {
614 return true;
615 }
616
617 MessageParcel msg;
618 MessageParcel reply;
619 MessageOption option;
620 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_RESTORE_ON_RESULT_REPORT);
621
622 try {
623 int pos = 0;
624 int32_t errCode = TypeCast<int32_t>(data, &pos);
625 int len = ((size - pos) >> 1);
626 msg.WriteString(string(reinterpret_cast<const char*>(data + pos), len));
627 msg.WriteString(string(reinterpret_cast<const char*>(data + pos + len), size - pos - len));
628 msg.WriteInt32(errCode);
629 service->OnRemoteRequest(code, msg, reply, option);
630 } catch (BError &err) {
631 // Only filter BError errors, Other results are not expected.
632 }
633 return true;
634 }
635
IncrementalRestoreOnProcessInfoFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)636 bool IncrementalRestoreOnProcessInfoFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
637 {
638 if (data == nullptr) {
639 return true;
640 }
641
642 MessageParcel msg;
643 MessageParcel reply;
644 MessageOption option;
645 uint32_t code = static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_INCREMENTAL_RESTORE_ON_PROCESS_INFO);
646
647 try {
648 int len = (size >> 1);
649 msg.WriteString(string(reinterpret_cast<const char*>(data), len));
650 msg.WriteString(string(reinterpret_cast<const char*>(data + len), size - len));
651 service->OnRemoteRequest(code, msg, reply, option);
652 } catch (BError &err) {
653 // Only filter BError errors, Other results are not expected.
654 }
655 return true;
656 }
657
OnRemoteRequestFuzzTest(sptr<ServiceReverse> service,const uint8_t * data,size_t size)658 bool OnRemoteRequestFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
659 {
660 uint32_t codeMax = 31;
661 for (uint32_t code = 1; code < codeMax; code++) {
662 MessageParcel datas;
663 MessageParcel reply;
664 MessageOption option;
665 datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
666 datas.WriteBuffer(reinterpret_cast<const char*>(data), size);
667 datas.RewindRead(0);
668 try {
669 service->OnRemoteRequest(code, datas, reply, option);
670 } catch (BError &err) {
671 // Only filter BError errors, Other results are not expected.
672 }
673 }
674 {
675 MessageParcel datas;
676 MessageParcel reply;
677 MessageOption option;
678 datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
679 datas.WriteBuffer(reinterpret_cast<const char*>(data), size);
680 datas.RewindRead(0);
681 service->OnRemoteRequest(static_cast<uint32_t>(IServiceReverseIpcCode::COMMAND_BACKUP_ON_BUNDLE_STARTED),
682 datas, reply, option);
683 }
684 return true;
685 }
686 } // namespace OHOS
687
688 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)689 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
690 {
691 OHOS::FileManagement::Backup::BSessionBackup::Callbacks backupCallbacks;
692 OHOS::sptr backupService(new OHOS::FileManagement::Backup::ServiceReverse(backupCallbacks));
693 OHOS::FileManagement::Backup::BSessionRestore::Callbacks restoreCallbacks;
694 OHOS::sptr restoreService(new OHOS::FileManagement::Backup::ServiceReverse(restoreCallbacks));
695 OHOS::FileManagement::Backup::BIncrementalBackupSession::Callbacks incrementalBackupCallbacks;
696 OHOS::sptr incrementalBackupService(new OHOS::FileManagement::Backup::ServiceReverse(incrementalBackupCallbacks));
697 OHOS::FileManagement::Backup::BIncrementalRestoreSession::Callbacks incrementalRestoreCallbacks;
698 OHOS::sptr incrementalRestoreService(new OHOS::FileManagement::Backup::ServiceReverse(incrementalRestoreCallbacks));
699 if (!backupService || !restoreService || !incrementalBackupService || !incrementalRestoreService) {
700 printf("service handler is nullptr");
701 return 0;
702 }
703 OHOS::OnRemoteRequestFuzzTest(incrementalRestoreService, data, size);
704 OHOS::BackupOnFileReadyFuzzTest(backupService, data, size);
705 OHOS::BackupOnBundleStartedFuzzTest(backupService, data, size);
706 OHOS::BackupOnResultReportFuzzTest(backupService, data, size);
707 OHOS::BackupOnBundleFinishedFuzzTest(backupService, data, size);
708 OHOS::BackupOnAllBundlesFinishedFuzzTest(backupService, data, size);
709 OHOS::BackupOnProcessInfoFuzzTest(backupService, data, size);
710 OHOS::BackupOnScanningInfoFuzzTest(backupService, data, size);
711 OHOS::OnRemoteRequestFuzzTest(backupService, data, size);
712
713 OHOS::RestoreOnBundleStartedFuzzTest(restoreService, data, size);
714 OHOS::RestoreOnBundleFinishedFuzzTest(restoreService, data, size);
715 OHOS::RestoreOnAllBundlesFinishedFuzzTest(restoreService, data, size);
716 OHOS::RestoreOnFileReadyFuzzTest(restoreService, data, size);
717 OHOS::RestoreOnResultReportFuzzTest(restoreService, data, size);
718 OHOS::RestoreOnProcessInfoFuzzTest(restoreService, data, size);
719 OHOS::OnRemoteRequestFuzzTest(restoreService, data, size);
720
721 OHOS::IncrementalBackupOnFileReadyFuzzTest(incrementalBackupService, data, size);
722 OHOS::IncrementalBackupOnBundleStartedFuzzTest(incrementalBackupService, data, size);
723 OHOS::IncrementalBackupOnResultReportFuzzTest(incrementalBackupService, data, size);
724 OHOS::IncrementalBackupOnBundleFinishedFuzzTest(incrementalBackupService, data, size);
725 OHOS::IncrementalBackupOnAllBundlesFinishedFuzzTest(incrementalBackupService, data, size);
726 OHOS::IncrementalBackupOnProcessInfoFuzzTest(incrementalBackupService, data, size);
727 OHOS::IncrementalBackupOnScanningInfoFuzzTest(incrementalBackupService, data, size);
728 OHOS::OnRemoteRequestFuzzTest(incrementalBackupService, data, size);
729
730 OHOS::IncrementalRestoreOnBundleStartedFuzzTest(incrementalRestoreService, data, size);
731 OHOS::IncrementalRestoreOnBundleFinishedFuzzTest(incrementalRestoreService, data, size);
732 OHOS::IncrementalRestoreOnAllBundlesFinishedFuzzTest(incrementalRestoreService, data, size);
733 OHOS::IncrementalRestoreOnFileReadyFuzzTest(incrementalRestoreService, data, size);
734 OHOS::IncrementalRestoreOnResultReportFuzzTest(incrementalRestoreService, data, size);
735 OHOS::IncrementalRestoreOnProcessInfoFuzzTest(incrementalRestoreService, data, size);
736 return 0;
737 }