1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "pictureinpicture_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <parcel.h>
21 #include <securec.h>
22
23 #include <iremote_stub.h>
24 #include "message_option.h"
25 #include "message_parcel.h"
26 #include "marshalling_helper.h"
27 #include "window_scene_session_impl.h"
28 #include "scene_session_manager_lite.h"
29 #include "scene_session_manager_lite_stub.h"
30 #include "scene_session_manager_lite_interface.h"
31 #include "scene_session_manager_interface.h"
32 #include "session_ipc_interface_code.h"
33 #include "session_stub.h"
34 #include "session.h"
35 #include "session_manager.h"
36 #include "session_stage_ipc_interface_code.h"
37 #include "session_stage_stub.h"
38 #include "window_option.h"
39 #include "session_proxy.h"
40
41 using namespace OHOS::Rosen;
42
43 namespace OHOS {
44 namespace {
45 constexpr size_t DATA_MIN_SIZE = 2;
46 }
47
PIPSceneSessionMgrStubTest(MessageParcel & parcel,MessageParcel & reply,MessageOption & option)48 void PIPSceneSessionMgrStubTest(MessageParcel& parcel, MessageParcel& reply, MessageOption& option)
49 {
50 parcel.RewindRead(0);
51 SceneSessionManagerLite::GetInstance().OnRemoteRequest(
52 static_cast<uint32_t>(ISceneSessionManager::SceneSessionManagerMessage::TRANS_ID_GET_PIP_SWITCH_STATUS), parcel,
53 reply, option);
54 return;
55 }
56
DoSomethingInterestingWithMyAPI1(const uint8_t * data,size_t size)57 bool DoSomethingInterestingWithMyAPI1(const uint8_t *data, size_t size)
58 {
59 if (data == nullptr || size < DATA_MIN_SIZE) {
60 return false;
61 }
62
63 MessageParcel parcel;
64 MessageParcel reply;
65 MessageOption option;
66
67 parcel.WriteInterfaceToken(SceneSessionManagerLiteStub::GetDescriptor());
68 parcel.WriteBuffer(data, size);
69
70 PIPSceneSessionMgrStubTest(parcel, reply, option);
71 return true;
72 }
73
PIPSessionTest(sptr<Session> sessionStub,MessageParcel & parcel,MessageParcel & reply,MessageOption & option)74 void PIPSessionTest(sptr<Session> sessionStub, MessageParcel& parcel, MessageParcel& reply, MessageOption& option)
75 {
76 parcel.RewindRead(0);
77 sessionStub->OnRemoteRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_FRAME_LAYOUT_FINISH), parcel,
78 reply, option);
79
80 parcel.RewindRead(0);
81 sessionStub->OnRemoteRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_PIP_CONTROL_STATUS),
82 parcel, reply, option);
83
84 parcel.RewindRead(0);
85 sessionStub->OnRemoteRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_PIP_TEMPLATE_INFO), parcel,
86 reply, option);
87
88 parcel.RewindRead(0);
89 sessionStub->OnRemoteRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_AUTOSTART_PIP), parcel, reply,
90 option);
91 return;
92 }
93
DoSomethingInterestingWithMyAPI2(const uint8_t * data,size_t size)94 bool DoSomethingInterestingWithMyAPI2(const uint8_t *data, size_t size)
95 {
96 if (data == nullptr || size < DATA_MIN_SIZE) {
97 return false;
98 }
99
100 MessageParcel parcel;
101 MessageParcel reply;
102 MessageOption option;
103
104 parcel.WriteInterfaceToken(SessionStub::GetDescriptor());
105 parcel.WriteBuffer(data, size);
106
107 SessionInfo info;
108 info.abilityName_ = "pictureInPictureTestFuzzTest";
109 info.bundleName_ = "pictureInPictureTestFuzzTest";
110 sptr<Session> sessionStub = new (std::nothrow) Session(info);
111 if (sessionStub == nullptr) {
112 return false;
113 }
114
115 PIPSessionTest(sessionStub, parcel, reply, option);
116 return true;
117 }
118
PIPSessionStageTest(sptr<WindowSessionImpl> stageStub,MessageParcel & parcel,MessageParcel & reply,MessageOption & option)119 void PIPSessionStageTest(sptr<WindowSessionImpl> stageStub, MessageParcel& parcel, MessageParcel& reply,
120 MessageOption& option)
121 {
122 parcel.RewindRead(0);
123 stageStub->OnRemoteRequest(static_cast<uint32_t>(SessionStageInterfaceCode::TRANS_ID_NOTIFY_PIPSIZE_CHANGE), parcel,
124 reply, option);
125
126 parcel.RewindRead(0);
127 stageStub->OnRemoteRequest(static_cast<uint32_t>(SessionStageInterfaceCode::TRANS_ID_SET_PIP_CONTROL_EVENT), parcel,
128 reply, option);
129 return;
130 }
131
DoSomethingInterestingWithMyAPI3(const uint8_t * data,size_t size)132 bool DoSomethingInterestingWithMyAPI3(const uint8_t *data, size_t size)
133 {
134 if (data == nullptr || size < DATA_MIN_SIZE) {
135 return false;
136 }
137
138 MessageParcel parcel;
139 MessageParcel reply;
140 MessageOption option;
141
142 parcel.WriteInterfaceToken(SessionStageStub::GetDescriptor());
143 parcel.WriteBuffer(data, size);
144
145 sptr<WindowOption> windowOption = new (std::nothrow) WindowOption();
146 if (windowOption == nullptr) {
147 return false;
148 }
149 sptr<WindowSessionImpl> stageStub = new (std::nothrow) WindowSessionImpl(windowOption);
150 if (stageStub == nullptr) {
151 return false;
152 }
153
154 PIPSessionStageTest(stageStub, parcel, reply, option);
155 return true;
156 }
157 } // namespace OHOS
158
159 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)160 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
161 {
162 /* Run your code on data */
163 OHOS::DoSomethingInterestingWithMyAPI1(data, size);
164 OHOS::DoSomethingInterestingWithMyAPI2(data, size);
165 OHOS::DoSomethingInterestingWithMyAPI3(data, size);
166 return 0;
167 }