1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "injectpointerevent_fuzzer.h"
17
18 #include "multimodal_input_connect_stub.h"
19 #include "mmi_service.h"
20 #include "mmi_log.h"
21 #include "pointer_event.h"
22 #include <fuzzer/FuzzedDataProvider.h>
23
24 #undef LOG_TAG
25 #define LOG_TAG "InjectPointerEventFuzzTest"
26
27 namespace OHOS {
28 namespace MMI {
29
30 namespace {
31 const std::u16string kInterfaceToken { u"ohos.multimodalinput.IConnectManager" };
32 constexpr int32_t kMinCoord = -100000;
33 constexpr int32_t kMaxCoord = 100000;
34 constexpr int32_t kMinId = -1;
35 constexpr int32_t kMaxId = 65535;
36 constexpr int32_t kMinAction = 0;
37 constexpr int32_t kMaxAction = 10;
38 constexpr int32_t kMinUseCoord = 0;
39 constexpr int32_t kMaxUseCoord = 2;
40 }
41
InjectPointerEventFuzzTest(FuzzedDataProvider & provider)42 bool InjectPointerEventFuzzTest(FuzzedDataProvider &provider)
43 {
44 std::shared_ptr<PointerEvent> pe = PointerEvent::Create();
45 if (!pe) {
46 return false;
47 }
48
49 const int32_t pointerId = provider.ConsumeIntegralInRange<int32_t>(kMinId, kMaxId);
50 const int32_t action = provider.ConsumeIntegralInRange<int32_t>(kMinAction, kMaxAction);
51 const int32_t gx = provider.ConsumeIntegralInRange<int32_t>(kMinCoord, kMaxCoord);
52 const int32_t gy = provider.ConsumeIntegralInRange<int32_t>(kMinCoord, kMaxCoord);
53 const int32_t wx = provider.ConsumeIntegralInRange<int32_t>(kMinCoord, kMaxCoord);
54 const int32_t wy = provider.ConsumeIntegralInRange<int32_t>(kMinCoord, kMaxCoord);
55 const int32_t deviceId = provider.ConsumeIntegral<int32_t>();
56 const bool isNativeInject = provider.ConsumeBool();
57 const int32_t useCoordinate = provider.ConsumeIntegralInRange<int32_t>(kMinUseCoord, kMaxUseCoord);
58
59 pe->SetPointerAction(action);
60 pe->SetPointerId(pointerId);
61 pe->SetDeviceId(deviceId);
62
63 PointerEvent::PointerItem item;
64 item.SetPointerId(pointerId);
65 item.SetGlobalX(gx);
66 item.SetGlobalY(gy);
67 item.SetWindowX(wx);
68 item.SetWindowY(wy);
69 pe->AddPointerItem(item);
70
71 MessageParcel datas;
72 if (!datas.WriteInterfaceToken(kInterfaceToken)) {
73 return false;
74 }
75 if (!datas.WriteParcelable(pe.get())) {
76 return false;
77 }
78 if (!datas.WriteBool(isNativeInject)) {
79 return false;
80 }
81 if (!datas.WriteInt32(useCoordinate)) {
82 return false;
83 }
84 if (!datas.RewindRead(0)) {
85 return false;
86 }
87 (void)provider.ConsumeRemainingBytes<uint8_t>();
88
89 MessageParcel reply;
90 MessageOption option;
91 MMIService::GetInstance()->state_ = ServiceRunningState::STATE_RUNNING;
92 (void)MMIService::GetInstance()->OnRemoteRequest(
93 static_cast<uint32_t>(IMultimodalInputConnectIpcCode::COMMAND_INJECT_POINTER_EVENT),
94 datas, reply, option);
95
96 return true;
97 }
98
99 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)100 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
101 {
102 if (!data || size == 0) {
103 return 0;
104 }
105 FuzzedDataProvider provider(data, size);
106 (void)OHOS::MMI::InjectPointerEventFuzzTest(provider);
107 return 0;
108 }
109
110 } // namespace MMI
111 } // namespace OHOS