1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "security_collector_manager_fuzzer.h"
17
18 #include <string>
19
20 #include "security_collector_manager_callback_service.h"
21 #include "security_collector_manager_service.h"
22 #include "security_guard_log.h"
23
24
25 namespace OHOS::Security::SecurityCollector {
26 SecurityCollectorManagerService g_service(SECURITY_COLLECTOR_MANAGER_SA_ID, true);
27 constexpr int32_t REMAINDER_VALUE = 5;
28 constexpr int32_t CMD_COLLECTOR_SUBCRIBE_VALUE = 0;
29 constexpr int32_t CMD_COLLECTOR_UNSUBCRIBE_VALUE = 1;
30 constexpr int32_t CMD_COLLECTOR_START_VALUE = 2;
31 constexpr int32_t CMD_COLLECTOR_STOP_VALUE = 3;
32 constexpr int32_t CMD_SECURITY_EVENT_QUERY_VALUE = 4;
33 void OnRemoteSubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
34 MessageParcel* reply, MessageOption* option);
35 void OnRemoteUnsubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
36 MessageParcel* reply, MessageOption* option);
37 void OnRemoteStartRequest(const uint8_t* data, size_t size, MessageParcel* datas,
38 MessageParcel* reply, MessageOption* option);
39 void OnRemoteStopRequest(const uint8_t* data, size_t size, MessageParcel* datas,
40 MessageParcel* reply, MessageOption* option);
41 void OnRemoteSecurityEventQuery(const uint8_t* data, size_t size, MessageParcel* datas,
42 MessageParcel* reply, MessageOption* option);
43
OnRemoteRequestFuzzTest(const uint8_t * data,size_t size)44 void OnRemoteRequestFuzzTest(const uint8_t* data, size_t size)
45 {
46 MessageParcel datas;
47 MessageParcel reply;
48 MessageOption option;
49 datas.WriteInterfaceToken(ISecurityCollectorManager::GetDescriptor());
50 if (size % REMAINDER_VALUE == CMD_COLLECTOR_SUBCRIBE_VALUE) {
51 // handle data collect cmd
52 OnRemoteSubscribeRequest(data, size, &datas, &reply, &option);
53 return;
54 } else if (size % REMAINDER_VALUE == CMD_COLLECTOR_UNSUBCRIBE_VALUE) {
55 // handle data request cmd
56 OnRemoteUnsubscribeRequest(data, size, &datas, &reply, &option);
57 return;
58 } else if (size % REMAINDER_VALUE == CMD_COLLECTOR_START_VALUE) {
59 // handle data subscribe cmd
60 OnRemoteStartRequest(data, size, &datas, &reply, &option);
61 return;
62 } else if (size % REMAINDER_VALUE == CMD_COLLECTOR_STOP_VALUE) {
63 // handle data unsubscribe cmd
64 OnRemoteStopRequest(data, size, &datas, &reply, &option);
65 return;
66 } else if (size % REMAINDER_VALUE == CMD_SECURITY_EVENT_QUERY_VALUE) {
67 // handle security event query cmd
68 OnRemoteSecurityEventQuery(data, size, &datas, &reply, &option);
69 return;
70 }
71 }
72
OnRemoteSubscribeRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)73 void OnRemoteSubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
74 MessageParcel* reply, MessageOption* option)
75 {
76 int64_t eventId = static_cast<int64_t>(size);
77 std::string version(reinterpret_cast<const char *>(data), size);
78 std::string content(reinterpret_cast<const char *>(data), size);
79 std::string extra(reinterpret_cast<const char *>(data), size);
80 int64_t duration = static_cast<int64_t>(size);
81 Event event;
82 event.eventId = eventId;
83 event.version = version;
84 event.content = content;
85 event.extra = extra;
86 SecurityCollectorSubscribeInfo subscriberInfo{event, duration, true};
87 datas->WriteParcelable(&subscriberInfo);
88 sptr<SecurityCollectorManagerCallbackService> callback =
89 new (std::nothrow) SecurityCollectorManagerCallbackService(nullptr);
90 datas->WriteRemoteObject(callback);
91 g_service.OnRemoteRequest(SecurityCollectorManagerStub::CMD_COLLECTOR_SUBCRIBE, *datas, *reply, *option);
92 }
93
OnRemoteUnsubscribeRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)94 void OnRemoteUnsubscribeRequest(const uint8_t* data, size_t size, MessageParcel* datas,
95 MessageParcel* reply, MessageOption* option)
96 {
97 int64_t eventId = static_cast<int64_t>(size);
98 std::string version(reinterpret_cast<const char *>(data), size);
99 std::string content(reinterpret_cast<const char *>(data), size);
100 std::string extra(reinterpret_cast<const char *>(data), size);
101 Event event;
102 event.eventId = eventId;
103 event.version = version;
104 event.content = content;
105 event.extra = extra;
106 SecurityCollectorSubscribeInfo subscriberInfo{event, -1, true};
107 datas->WriteParcelable(&subscriberInfo);
108 sptr<SecurityCollectorManagerCallbackService> callback =
109 new (std::nothrow) SecurityCollectorManagerCallbackService(nullptr);
110 datas->WriteRemoteObject(callback);
111 g_service.OnRemoteRequest(SecurityCollectorManagerStub::CMD_COLLECTOR_UNSUBCRIBE, *datas, *reply, *option);
112 }
113
OnRemoteStartRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)114 void OnRemoteStartRequest(const uint8_t* data, size_t size, MessageParcel* datas,
115 MessageParcel* reply, MessageOption* option)
116 {
117 int64_t eventId = static_cast<int64_t>(size);
118 std::string version(reinterpret_cast<const char *>(data), size);
119 std::string content(reinterpret_cast<const char *>(data), size);
120 std::string extra(reinterpret_cast<const char *>(data), size);
121 int64_t duration = static_cast<int64_t>(size);
122 Event event;
123 event.eventId = eventId;
124 event.version = version;
125 event.content = content;
126 event.extra = extra;
127 SecurityCollectorSubscribeInfo subscriberInfo{event, duration, true};
128 datas->WriteParcelable(&subscriberInfo);
129 sptr<SecurityCollectorManagerCallbackService> callback =
130 new (std::nothrow) SecurityCollectorManagerCallbackService(nullptr);
131 datas->WriteRemoteObject(callback);
132 g_service.OnRemoteRequest(SecurityCollectorManagerStub::CMD_COLLECTOR_START, *datas, *reply, *option);
133 }
134
OnRemoteStopRequest(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)135 void OnRemoteStopRequest(const uint8_t* data, size_t size, MessageParcel* datas,
136 MessageParcel* reply, MessageOption* option)
137 {
138 int64_t eventId = static_cast<int64_t>(size);
139 std::string version(reinterpret_cast<const char *>(data), size);
140 std::string content(reinterpret_cast<const char *>(data), size);
141 std::string extra(reinterpret_cast<const char *>(data), size);
142 Event event;
143 event.eventId = eventId;
144 event.version = version;
145 event.content = content;
146 event.extra = extra;
147 SecurityCollectorSubscribeInfo subscriberInfo{event, -1, true};
148 datas->WriteParcelable(&subscriberInfo);
149 sptr<SecurityCollectorManagerCallbackService> callback =
150 new (std::nothrow) SecurityCollectorManagerCallbackService(nullptr);
151 datas->WriteRemoteObject(callback);
152 g_service.OnRemoteRequest(SecurityCollectorManagerStub::CMD_COLLECTOR_STOP, *datas, *reply, *option);
153 }
154
OnRemoteSecurityEventQuery(const uint8_t * data,size_t size,MessageParcel * datas,MessageParcel * reply,MessageOption * option)155 void OnRemoteSecurityEventQuery(const uint8_t* data, size_t size, MessageParcel* datas,
156 MessageParcel* reply, MessageOption* option)
157 {
158 uint32_t rulerSize = size >= MAX_QUERY_EVENT_SIZE ? MAX_QUERY_EVENT_SIZE : static_cast<uint32_t>(size);
159 datas->WriteUint32(rulerSize);
160 for (uint32_t i = 0; i < rulerSize; i++) {
161 int64_t eventId = static_cast<int64_t>(size);
162 std::string beginTime(reinterpret_cast<const char *>(data), size);
163 std::string endTime(reinterpret_cast<const char *>(data), size);
164 std::string param(reinterpret_cast<const char *>(data), size);
165 SecurityEventRuler ruler =
166 SecurityEventRuler(eventId, beginTime, endTime, param);
167 datas->WriteParcelable(&ruler);
168 }
169 sptr<SecurityCollectorManagerCallbackService> callback =
170 new (std::nothrow) SecurityCollectorManagerCallbackService(nullptr);
171 datas->WriteRemoteObject(callback);
172 g_service.OnRemoteRequest(SecurityCollectorManagerStub::CMD_SECURITY_EVENT_QUERY, *datas, *reply, *option);
173 }
174
175 } // namespace OHOS::Security::SecurityCollector
176
177 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)178 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
179 {
180 /* Run your code on date */
181 OHOS::Security::SecurityCollector::OnRemoteRequestFuzzTest(data, size);
182 return 0;
183 }
184