1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "sessioninterface_fuzzer.h"
17
18 #include <iremote_broker.h>
19
20 #include "ability_context_impl.h"
21 #include "session_manager.h"
22 #include "window_manager_hilog.h"
23 #include "window_scene_session_impl.h"
24 #include "zidl/session_ipc_interface_code.h"
25 #include "zidl/session_proxy.h"
26 #include "data_source.h"
27
28 namespace OHOS::Rosen {
29 namespace {
30 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "SessionInterfaceFuzzTest"};
31 }
32
33 static std::shared_ptr<AbilityRuntime::AbilityContext> abilityContext =
34 std::make_shared<AbilityRuntime::AbilityContextImpl>();
35 static sptr<WindowSessionImpl> savedWindow;
36
GetProxy()37 std::pair<sptr<ISession>, sptr<IRemoteObject>> GetProxy()
38 {
39 if (savedWindow) {
40 savedWindow->Destroy();
41 savedWindow = nullptr;
42 }
43
44 sptr<WindowOption> option = new WindowOption();
45 option->SetWindowName("SessionInterfaceFuzzTest");
46 option->SetWindowType(WindowType::WINDOW_TYPE_WALLPAPER);
47
48 sptr<WindowSessionImpl> window = new WindowSceneSessionImpl(option);
49 WMError err = window->Create(abilityContext, nullptr);
50 if (err != WMError::WM_OK) {
51 WLOGFE("Failed to create window: %{public}d", static_cast<int>(err));
52 return {nullptr, nullptr};
53 }
54
55 auto session = window->GetHostSession();
56 if (!session) {
57 WLOGFE("Session is nullptr");
58 return {nullptr, nullptr};
59 }
60
61 sptr<SessionProxy> proxy = new SessionProxy(session->AsObject());
62 savedWindow = window;
63
64 WLOGFD("GetProxy success");
65
66 return {proxy, session->AsObject()};
67 }
68
69 template<class T>
UnmarshallingDataTo(const uint8_t * data,size_t size)70 T* UnmarshallingDataTo(const uint8_t* data, size_t size)
71 {
72 MessageParcel parcel;
73 if (data) {
74 parcel.WriteBuffer(data, size);
75 }
76 return T::Unmarshalling(parcel);
77 }
78
IPCFuzzTest(const uint8_t * data,size_t size)79 void IPCFuzzTest(const uint8_t* data, size_t size)
80 {
81 auto [proxy, remoteObject] = GetProxy();
82 if (!proxy || !remoteObject) {
83 return;
84 }
85
86 DataSource source(data, size);
87 uint32_t code = source.GetObject<uint32_t>();
88 int flags = source.GetObject<int>();
89 int waitTime = source.GetObject<int>();
90
91 MessageParcel sendData;
92 MessageParcel reply;
93 MessageOption option(flags, waitTime);
94 auto rawSize = source.size_ - source.pos_;
95 auto buf = source.GetRaw(rawSize);
96 if (buf) {
97 sendData.WriteBuffer(buf, rawSize);
98 }
99 remoteObject->SendRequest(code, sendData, reply, option);
100 }
101
IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)102 void IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
103 MessageOption& option)
104 {
105 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_CONNECT),
106 sendData, reply, option);
107 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_FOREGROUND),
108 sendData, reply, option);
109 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_BACKGROUND),
110 sendData, reply, option);
111 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_DISCONNECT),
112 sendData, reply, option);
113 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SESSION_EVENT),
114 sendData, reply, option);
115 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_SESSION_RECT),
116 sendData, reply, option);
117 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_RAISE_TO_APP_TOP),
118 sendData, reply, option);
119 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_BACKPRESSED),
120 sendData, reply, option);
121 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_MARK_PROCESSED),
122 sendData, reply, option);
123 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_MAXIMIZE_MODE),
124 sendData, reply, option);
125 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_GET_MAXIMIZE_MODE),
126 sendData, reply, option);
127 }
128
IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)129 void IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
130 MessageOption& option)
131 {
132 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_NEED_AVOID),
133 sendData, reply, option);
134 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_GET_AVOID_AREA),
135 sendData, reply, option);
136 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_ASPECT_RATIO),
137 sendData, reply, option);
138 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_WINDOW_ANIMATION_FLAG),
139 sendData, reply, option);
140 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_CUSTOM_ANIMATION),
141 sendData, reply, option);
142 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_RAISE_ABOVE_TARGET),
143 sendData, reply, option);
144 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_ACTIVE_PENDING_SESSION),
145 sendData, reply, option);
146 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TERMINATE),
147 sendData, reply, option);
148 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_EXCEPTION),
149 sendData, reply, option);
150 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TRANSFER_ABILITY_RESULT),
151 sendData, reply, option);
152 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TRANSFER_EXTENSION_DATA),
153 sendData, reply, option);
154 proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_NOTIFY_EXTENSION_DIED),
155 sendData, reply, option);
156 }
157
IPCInterfaceFuzzTest(const uint8_t * data,size_t size)158 void IPCInterfaceFuzzTest(const uint8_t* data, size_t size)
159 {
160 auto [proxy, remoteObject] = GetProxy();
161 if (!proxy || !remoteObject) {
162 return;
163 }
164
165 DataSource source(data, size);
166 int flags = source.GetObject<int>();
167 int waitTime = source.GetObject<int>();
168
169 MessageParcel sendData;
170 MessageParcel reply;
171 MessageOption option(flags, waitTime);
172 sendData.WriteInterfaceToken(proxy->GetDescriptor());
173 auto rawSize = source.size_ - source.pos_;
174 auto buf = source.GetRaw(rawSize);
175 if (buf) {
176 sendData.WriteBuffer(buf, rawSize);
177 }
178 IPCSpecificInterfaceFuzzTest1(remoteObject, sendData, reply, option);
179 IPCSpecificInterfaceFuzzTest2(remoteObject, sendData, reply, option);
180 }
181
ProxyInterfaceFuzzTestPart1(const uint8_t * data,size_t size)182 void ProxyInterfaceFuzzTestPart1(const uint8_t* data, size_t size)
183 {
184 auto [proxy, remoteObject] = GetProxy();
185 if (!proxy || !remoteObject) {
186 return;
187 }
188
189 DataSource source(data, size);
190
191 sptr<WindowSessionProperty> property = UnmarshallingDataTo<WindowSessionProperty>(data, size);
192 proxy->Foreground(property);
193 proxy->Background();
194 proxy->RaiseToAppTop();
195
196 SessionEvent event = source.GetObject<SessionEvent>();
197 proxy->OnSessionEvent(event);
198
199 WSRect rect = source.GetObject<WSRect>();
200 SizeChangeReason reason = source.GetObject<SizeChangeReason>();
201 proxy->UpdateSessionRect(rect, reason);
202
203 bool needMoveToBackground = source.GetObject<bool>();
204 proxy->RequestSessionBack(needMoveToBackground);
205 }
206
ProxyInterfaceFuzzTestPart2(const uint8_t * data,size_t size)207 void ProxyInterfaceFuzzTestPart2(const uint8_t* data, size_t size)
208 {
209 auto [proxy, remoteObject] = GetProxy();
210 if (!proxy || !remoteObject) {
211 return;
212 }
213
214 DataSource source(data, size);
215
216 int32_t eventId = source.GetObject<int32_t>();
217 proxy->MarkProcessed(eventId);
218
219 MaximizeMode mode = source.GetObject<MaximizeMode>();
220 proxy->SetGlobalMaximizeMode(mode);
221 proxy->GetGlobalMaximizeMode(mode);
222
223 bool status = source.GetObject<bool>();
224 proxy->OnNeedAvoid(status);
225
226 AvoidAreaType type = source.GetObject<AvoidAreaType>();
227 proxy->GetAvoidAreaByType(type);
228
229 float ratio = source.GetObject<float>();
230 proxy->SetAspectRatio(ratio);
231
232 bool needDefaultAnimationFlag = source.GetObject<bool>();
233 proxy->UpdateWindowAnimationFlag(needDefaultAnimationFlag);
234
235 bool isAdd = source.GetObject<bool>();
236 proxy->UpdateWindowSceneAfterCustomAnimation(isAdd);
237 }
238
ProxyInterfaceFuzzTestPart3(const uint8_t * data,size_t size)239 void ProxyInterfaceFuzzTestPart3(const uint8_t* data, size_t size)
240 {
241 auto [proxy, remoteObject] = GetProxy();
242 if (!proxy || !remoteObject) {
243 return;
244 }
245
246 DataSource source(data, size);
247
248 int32_t subWindowId = source.GetObject<int32_t>();
249 proxy->RaiseAboveTarget(subWindowId);
250
251 sptr<AAFwk::SessionInfo> sessionInfo = UnmarshallingDataTo<AAFwk::SessionInfo>(data, size);
252 proxy->PendingSessionActivation(sessionInfo);
253 proxy->TerminateSession(sessionInfo);
254 proxy->NotifySessionException(sessionInfo);
255
256 uint32_t resultCode = source.GetObject<uint32_t>();
257 sptr<AAFwk::Want> want = UnmarshallingDataTo<AAFwk::Want>(data, size);
258 proxy->TransferAbilityResult(resultCode, *want);
259
260 sptr<AAFwk::WantParams> wantParams = UnmarshallingDataTo<AAFwk::WantParams>(data, size);
261 proxy->TransferExtensionData(*wantParams);
262 proxy->NotifyExtensionDied();
263 int32_t errorCode = 1;
264 proxy->NotifyExtensionTimeout(errorCode);
265 }
266
ProxyInterfaceFuzzTest(const uint8_t * data,size_t size)267 void ProxyInterfaceFuzzTest(const uint8_t* data, size_t size)
268 {
269 ProxyInterfaceFuzzTestPart1(data, size);
270 ProxyInterfaceFuzzTestPart2(data, size);
271 ProxyInterfaceFuzzTestPart3(data, size);
272 }
273 }
274
275 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)276 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
277 {
278 /* Run your code on data */
279 OHOS::Rosen::IPCFuzzTest(data, size);
280 OHOS::Rosen::IPCInterfaceFuzzTest(data, size);
281 OHOS::Rosen::ProxyInterfaceFuzzTest(data, size);
282 return 0;
283 }
284