1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "appmgrserviceinnerfirst_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #define private public
22 #include "app_mgr_service_inner.h"
23 #undef private
24
25 #include "parcel.h"
26 #include "securec.h"
27
28 using namespace OHOS::AAFwk;
29 using namespace OHOS::AppExecFwk;
30
31 namespace OHOS {
32 namespace {
33 constexpr size_t FOO_MAX_LEN = 1024;
34 constexpr size_t U32_AT_SIZE = 4;
35 constexpr uint8_t ENABLE = 2;
36 constexpr size_t OFFSET_ZERO = 24;
37 constexpr size_t OFFSET_ONE = 16;
38 constexpr size_t OFFSET_TWO = 8;
39 }
GetU32Data(const char * ptr)40 uint32_t GetU32Data(const char* ptr)
41 {
42 // convert fuzz input data to an integer
43 return (ptr[0] << OFFSET_ZERO) | (ptr[1] << OFFSET_ONE) | (ptr[2] << OFFSET_TWO) | ptr[3];
44 }
DoSomethingInterestingWithMyAPI(const char * data,size_t size)45 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
46 {
47 AppMgrServiceInner* appMgrServiceInner = new AppMgrServiceInner();
48 sptr<IRemoteObject> token = nullptr;
49 sptr<IRemoteObject> preToken = nullptr;
50 std::shared_ptr<AbilityInfo> abilityInfo = std::make_shared<AbilityInfo>();
51 std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
52 std::shared_ptr<Want> want = std::make_shared<Want>();
53 appMgrServiceInner->LoadAbility(token, preToken, abilityInfo, appInfo, want);
54 appMgrServiceInner->CheckLoadAbilityConditions(token, abilityInfo, appInfo);
55 HapModuleInfo hapModuleInfo;
56 int32_t appIndex = static_cast<int32_t>(GetU32Data(data));
57 std::string processName(data, size);
58 appMgrServiceInner->MakeProcessName(abilityInfo, appInfo, hapModuleInfo, appIndex, processName);
59 appMgrServiceInner->MakeProcessName(appInfo, hapModuleInfo, processName);
60 AbilityInfo abilityInfoObj;
61 BundleInfo bundleInfo;
62 appMgrServiceInner->GetBundleAndHapInfo(abilityInfoObj, appInfo, bundleInfo, hapModuleInfo, appIndex);
63 pid_t pid = static_cast<pid_t>(GetU32Data(data));
64 sptr<IAppScheduler> appScheduler = nullptr;
65 appMgrServiceInner->AttachApplication(pid, appScheduler);
66 std::shared_ptr<AppRunningRecord> appRecord;
67 appMgrServiceInner->LaunchApplication(appRecord);
68 int32_t recordId = static_cast<int32_t>(GetU32Data(data));
69 appMgrServiceInner->AddAbilityStageDone(recordId);
70 appMgrServiceInner->ApplicationForegrounded(recordId);
71 appMgrServiceInner->ApplicationBackgrounded(recordId);
72 appMgrServiceInner->ApplicationTerminated(recordId);
73 std::string bundleName(data, size);
74 appMgrServiceInner->KillApplication(bundleName);
75 int uid = static_cast<int>(GetU32Data(data));
76 appMgrServiceInner->KillApplicationByUid(bundleName, uid);
77 int userId = static_cast<int>(GetU32Data(data));
78 appMgrServiceInner->KillApplicationByUserId(bundleName, userId);
79 appMgrServiceInner->KillApplicationByUserIdLocked(bundleName, userId);
80 int32_t callerUid = static_cast<int32_t>(GetU32Data(data));
81 pid_t callerPid = static_cast<pid_t>(GetU32Data(data));
82 appMgrServiceInner->ClearUpApplicationData(bundleName, callerUid, callerPid);
83 std::vector<RunningProcessInfo> info;
84 appMgrServiceInner->GetAllRunningProcesses(info);
85 appMgrServiceInner->GetProcessRunningInfosByUserId(info, userId);
86 int32_t level = static_cast<int32_t>(GetU32Data(data));
87 appMgrServiceInner->NotifyMemoryLevel(level);
88 appMgrServiceInner->StartAbility(token, preToken, abilityInfo, appRecord, hapModuleInfo, want);
89 appMgrServiceInner->GetAppRunningRecordByAbilityToken(token);
90 appMgrServiceInner->AbilityTerminated(token);
91 appMgrServiceInner->GetAppRunningRecordByAppRecordId(recordId);
92 ApplicationState state = ApplicationState::APP_STATE_CREATE;
93 bool needNotifyApp = *data % ENABLE;
94 appMgrServiceInner->OnAppStateChanged(appRecord, state, needNotifyApp);
95 std::shared_ptr<AbilityRunningRecord> ability;
96 AppExecFwk::AbilityState abilityState = AppExecFwk::AbilityState::ABILITY_STATE_CREATE;
97 appMgrServiceInner->OnAbilityStateChanged(ability, abilityState);
98 std::string appName(data, size);
99 uint32_t startFlags = GetU32Data(data);
100 int32_t bundleIndex = static_cast<int32_t>(GetU32Data(data));
101 appMgrServiceInner->StartProcess(appName, processName, startFlags, appRecord, uid, bundleName, bundleIndex);
102 appMgrServiceInner->RemoveAppFromRecentList(appName, processName);
103 wptr<IRemoteObject> remote = nullptr;
104 bool isRenderProcess = *data % ENABLE;
105 appMgrServiceInner->OnRemoteDied(remote, isRenderProcess);
106 bool containsApp = *data % ENABLE;
107 appMgrServiceInner->ClearAppRunningData(appRecord, containsApp);
108 appMgrServiceInner->PushAppFront(recordId);
109 appMgrServiceInner->RemoveAppFromRecentListById(recordId);
110 appMgrServiceInner->AddAppToRecentList(appName, processName, pid, recordId);
111 appMgrServiceInner->GetAppTaskInfoById(recordId);
112 sptr<AppDeathRecipient> appDeathRecipient = nullptr;
113 appMgrServiceInner->AddAppDeathRecipient(pid, appDeathRecipient);
114 std::shared_ptr<AMSEventHandler> handler;
115 appMgrServiceInner->SetEventHandler(handler);
116 appMgrServiceInner->HandleAbilityAttachTimeOut(token);
117 appMgrServiceInner->PrepareTerminate(token);
118 int64_t eventId = static_cast<int64_t>(GetU32Data(data));
119 appMgrServiceInner->HandleTerminateApplicationTimeOut(eventId);
120 appMgrServiceInner->HandleAddAbilityStageTimeOut(eventId);
121 RunningProcessInfo runningProcessInfo;
122 appMgrServiceInner->GetRunningProcessInfoByToken(token, runningProcessInfo);
123 std::vector<AppExecFwk::BundleInfo> bundleInfos;
124 appMgrServiceInner->LoadResidentProcess(bundleInfos);
125 int restartCount = static_cast<int>(GetU32Data(data));
126 bool isEmptyKeepAliveApp = *data % ENABLE;
127 appMgrServiceInner->StartResidentProcess(bundleInfos, restartCount, isEmptyKeepAliveApp);
128 appMgrServiceInner->StartEmptyResidentProcess(bundleInfo, processName, restartCount, isEmptyKeepAliveApp);
129 appMgrServiceInner->RestartResidentProcess(appRecord);
130 const std::string eventData(data, size);
131 appMgrServiceInner->NotifyAppStatus(bundleName, eventData);
132 appMgrServiceInner->NotifyAppStatusByCallerUid(bundleName, static_cast<int32_t>(userId), callerUid, eventData);
133 return true;
134 }
135 }
136
137 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)138 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
139 {
140 /* Run your code on data */
141 if (data == nullptr) {
142 std::cout << "invalid data" << std::endl;
143 return 0;
144 }
145
146 /* Validate the length of size */
147 if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
148 return 0;
149 }
150
151 char* ch = (char*)malloc(size + 1);
152 if (ch == nullptr) {
153 std::cout << "malloc failed." << std::endl;
154 return 0;
155 }
156
157 (void)memset_s(ch, size + 1, 0x00, size + 1);
158 if (memcpy_s(ch, size, data, size) != EOK) {
159 std::cout << "copy failed." << std::endl;
160 free(ch);
161 ch = nullptr;
162 return 0;
163 }
164
165 OHOS::DoSomethingInterestingWithMyAPI(ch, size);
166 free(ch);
167 ch = nullptr;
168 return 0;
169 }
170