1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "marshalling_helper.h"
17 #include <securec.h>
18 #include <iremote_broker.h>
19 #include <fuzzer/FuzzedDataProvider.h>
20 #include "ability_context.h"
21 #include "ability_context_impl.h"
22 #include "fb_fuzzer.h"
23 #include "floating_ball_controller.h"
24 #include "floating_ball_manager.h"
25 #include "floating_ball_option.h"
26
27 using namespace OHOS::Rosen;
28
29 namespace OHOS {
30 namespace {
31 constexpr size_t DATA_MIN_SIZE = 2;
32 constexpr size_t DATA_MAX_SIZE = 1024;
33 }
34
35 template<class T>
GetObject(T & object,const uint8_t * data,size_t size)36 size_t GetObject(T& object, const uint8_t* data, size_t size)
37 {
38 size_t objectSize = sizeof(object);
39 if (objectSize > size) {
40 return 0;
41 }
42 return memcpy_s(&object, objectSize, data, objectSize) == EOK ? objectSize : 0;
43 }
44
45 class MockFbListener : public IFbLifeCycle,
46 public IFbClickObserver {
47 public:
48 MockFbListener() = default;
49 virtual ~MockFbListener() = default;
50
OnFloatingBallStart()51 void OnFloatingBallStart() override {};
OnFloatingBallStop()52 void OnFloatingBallStop() override {};
53
OnClickEvent()54 void OnClickEvent() override {};
55 };
56
CheckFbControllerFunctionsPart(sptr<FloatingBallController> controller,const uint8_t * data,size_t size)57 void CheckFbControllerFunctionsPart(sptr<FloatingBallController> controller, const uint8_t* data, size_t size)
58 {
59 if (data == nullptr || (size < DATA_MIN_SIZE || size > DATA_MAX_SIZE)) {
60 return;
61 }
62
63 auto fbLifeCycleListener = sptr<MockFbListener>::MakeSptr();
64 controller->RegisterFbLifecycle(fbLifeCycleListener);
65 controller->UnRegisterFbLifecycle(fbLifeCycleListener);
66
67 auto fbClickObserverListener = sptr<MockFbListener>::MakeSptr();
68 controller->RegisterFbClickObserver(fbClickObserverListener);
69 controller->UnRegisterFbClickObserver(fbClickObserverListener);
70
71 std::shared_ptr<AAFwk::Want> want = nullptr;
72 controller->RestoreMainWindow(want);
73
74 want = std::make_shared<AAFwk::Want>();
75 std::stringstream ss;
76 for (size_t i = 0; i < size; ++i) {
77 ss << data[i];
78 }
79 want->SetParam("__startParams", ss.str());
80 controller->RestoreMainWindow(want);
81 }
82
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)83 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
84 {
85 if (data == nullptr || size < DATA_MIN_SIZE) {
86 return false;
87 }
88 size_t startPos = 0;
89
90 uint32_t windowId;
91 startPos += GetObject(windowId, data + startPos, size - startPos);
92 sptr<Window> window = sptr<Window>::MakeSptr();
93 sptr<FloatingBallController> controller = sptr<FloatingBallController>::MakeSptr(window, windowId, nullptr);
94 if (controller == nullptr) {
95 return false;
96 }
97
98 sptr<FbOption> option = sptr<FbOption>::MakeSptr();
99
100 std::string title = "";
101 std::string content = "";
102 option->SetTitle(title);
103 option->SetContent(content);
104 std::shared_ptr<Media::PixelMap> pixelMap = nullptr;
105 option->SetIcon(pixelMap);
106
107 void* contextPtr = nullptr;
108 controller->contextPtr_ = contextPtr;
109 controller->CreateFloatingBallWindow(option);
110
111 controller->StartFloatingBall(option);
112
113 FuzzedDataProvider fdp(data, size);
114 title = fdp.ConsumeRandomLengthString();
115 controller->UpdateFloatingBall(option);
116
117 CheckFbControllerFunctionsPart(controller, data + startPos, size - startPos);
118 controller->DestroyFloatingBallWindow();
119 return true;
120 }
121
FloatingBallManagerFuzzTest(const uint8_t * data,size_t size)122 void FloatingBallManagerFuzzTest(const uint8_t* data, size_t size)
123 {
124 if (data == nullptr || size < DATA_MIN_SIZE) {
125 return;
126 }
127 size_t startPos = 0;
128
129 uint32_t windowId;
130 startPos += GetObject(windowId, data + startPos, size - startPos);
131
132 sptr<Window> window = sptr<Window>::MakeSptr();
133 sptr<FloatingBallController> controller = sptr<FloatingBallController>::MakeSptr(window, windowId, nullptr);
134
135 FloatingBallManager::IsActiveController(controller);
136 FloatingBallManager::SetActiveController(controller);
137 FloatingBallManager::RemoveActiveController(controller);
138 }
139
140 } // namespace OHOS
141
142 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)143 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
144 {
145 /* Run your code on data */
146 OHOS::DoSomethingInterestingWithMyAPI(data, size);
147 OHOS::FloatingBallManagerFuzzTest(data, size);
148 return 0;
149 }