description:元能力fuzz覆盖率整改03

Signed-off-by: 孙旭辉 <sunxuhui7@huawei.com>
This commit is contained in:
孙旭辉
2024-07-15 17:15:12 +08:00
parent 419c77218b
commit 2be620798e
20 changed files with 1485 additions and 0 deletions
+96
View File
@@ -0,0 +1,96 @@
# Copyright (c) 2024 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#####################hydra-fuzz###################
import("//build/config/features.gni")
import("//build/ohos.gni")
import("//build/test.gni")
import("//foundation/ability/ability_runtime/ability_runtime.gni")
module_output_path = "ability_runtime/abilitymgr"
##############################fuzztest##########################################
ohos_fuzztest("FaultDataFuzzTest") {
module_out_path = module_output_path
fuzz_config_file = "${ability_runtime_test_path}/fuzztest/faultdata_fuzzer"
include_dirs = [
"${ability_runtime_innerkits_path}/ability_manager/include",
"${ability_runtime_innerkits_path}/dataobs_manager/include",
"${multimodalinput_path}/interfaces/native/innerkits/event/include",
]
cflags = [
"-g",
"-O0",
"-Wno-unused-variable",
"-fno-omit-frame-pointer",
]
sources = [
"${ability_runtime_innerkits_path}/app_manager/src/appmgr/fault_data.cpp",
"faultdata_fuzzer.cpp",
]
configs = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
"${ability_runtime_services_path}/abilitymgr:abilityms_config",
]
deps = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager",
"${ability_runtime_innerkits_path}/ability_manager:ability_start_options",
"${ability_runtime_innerkits_path}/deps_wrapper:ability_deps_wrapper",
"${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr",
"${ability_runtime_native_path}/ability/native:abilitykit_native",
"${ability_runtime_services_path}/abilitymgr:abilityms",
"//third_party/jsoncpp:jsoncpp",
]
external_deps = [
"ability_base:want",
"ability_base:zuri",
"access_token:libaccesstoken_sdk",
"access_token:libtokenid_sdk",
"bundle_framework:appexecfwk_base",
"c_utils:utils",
"common_event_service:cesfwk_core",
"common_event_service:cesfwk_innerkits",
"ffrt:libffrt",
"hilog:libhilog",
"ipc:ipc_core",
"kv_store:distributeddata_inner",
"napi:ace_napi",
"os_account:os_account_innerkits",
"relational_store:native_dataability",
"relational_store:native_rdb",
"samgr:samgr_proxy",
]
if (ability_runtime_graphics) {
deps += []
external_deps += [
"i18n:intl_util",
"window_manager:libwm",
]
}
}
###############################################################################
group("fuzztest") {
testonly = true
deps = []
deps += [
# deps file
":FaultDataFuzzTest",
]
}
###############################################################################
+16
View File
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
FUZZ
+184
View File
@@ -0,0 +1,184 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "faultdata_fuzzer.h"
#include <cstddef>
#include <cstdint>
#define private public
#define protected public
#include "fault_data.h"
#undef protected
#undef private
#include "ability_record.h"
using namespace OHOS::AAFwk;
using namespace OHOS::AppExecFwk;
using namespace OHOS::AbilityRuntime;
namespace OHOS {
namespace {
constexpr int INPUT_ZERO = 0;
constexpr int INPUT_ONE = 1;
constexpr int INPUT_THREE = 3;
constexpr size_t FOO_MAX_LEN = 1024;
constexpr size_t U32_AT_SIZE = 4;
constexpr uint8_t ENABLE = 2;
constexpr size_t OFFSET_ZERO = 24;
constexpr size_t OFFSET_ONE = 16;
constexpr size_t OFFSET_TWO = 8;
}
uint32_t GetU32Data(const char* ptr)
{
// convert fuzz input data to an integer
return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
ptr[INPUT_THREE];
}
sptr<Token> GetFuzzAbilityToken()
{
sptr<Token> token = nullptr;
AbilityRequest abilityRequest;
abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
abilityRequest.abilityInfo.name = "MainAbility";
abilityRequest.abilityInfo.type = AbilityType::DATA;
std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
if (abilityRecord) {
token = abilityRecord->GetToken();
}
return token;
}
Want& SetElement(Want &want)
{
return want.SetElementName("deviceId", "bundleName", "ability", "moduleName");
}
void FaultDataFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param)
{
FaultData faultData;
Parcel parcel1;
parcel1.WriteInt32(int32Param);
faultData.ReadFromParcel(parcel1); // branch name failed
Parcel parcel2;
parcel2.WriteString(stringParam);
parcel2.WriteInt32(int32Param);
faultData.ReadFromParcel(parcel2); // branch message failed
Parcel parcel3;
parcel3.WriteString(stringParam);
parcel3.WriteString(stringParam);
faultData.ReadFromParcel(parcel3); // branch stack failed
Parcel parcel4;
parcel4.WriteString(stringParam);
parcel4.WriteString(stringParam);
parcel4.WriteString(stringParam);
faultData.ReadFromParcel(parcel4); // branch FaultType failed
Parcel parcel5;
parcel5.WriteString(stringParam);
parcel5.WriteString(stringParam);
parcel5.WriteString(stringParam);
parcel5.WriteInt32(int32Param);
faultData.ReadFromParcel(parcel5); // branch FaultType failed
Parcel parcel6;
parcel6.WriteString(stringParam);
parcel6.WriteString(stringParam);
parcel6.WriteString(stringParam);
parcel6.WriteInt32(int32Param);
parcel6.WriteString(stringParam);
faultData.ReadFromParcel(parcel6); // branch FaultType failed
parcel6.WriteBool(boolParam);
faultData.ReadFromParcel(parcel6);
Parcel parcel7;
faultData.Marshalling(parcel7);
}
void FaultDataFuzztest2(bool boolParam, std::string &stringParam, int32_t int32Param)
{
AppFaultDataBySA faultData;
Parcel appParcel1;
appParcel1.WriteInt32(int32Param);
faultData.ReadFromParcel(appParcel1); // branch name failed
Parcel appParcel2;
appParcel2.WriteString(stringParam);
appParcel2.WriteInt32(int32Param);
faultData.ReadFromParcel(appParcel2); // branch message failed
Parcel appParcel3;
appParcel3.WriteString(stringParam);
appParcel3.WriteString(stringParam);
faultData.ReadFromParcel(appParcel3); // branch stack failed
Parcel appParcel4;
appParcel4.WriteString(stringParam);
appParcel4.WriteString(stringParam);
appParcel4.WriteString(stringParam);
faultData.ReadFromParcel(appParcel4); // branch FaultType failed
Parcel appParcel5;
appParcel5.WriteString(stringParam);
appParcel5.WriteString(stringParam);
appParcel5.WriteString(stringParam);
appParcel5.WriteInt32(int32Param);
faultData.ReadFromParcel(appParcel5); // branch FaultType failed
Parcel appParcel6;
faultData.Marshalling(appParcel6);
}
bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
{
bool boolParam = *data % ENABLE;
std::string stringParam(data, size);
int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
FaultDataFuzztest1(boolParam, stringParam, int32Param);
FaultDataFuzztest2(boolParam, stringParam, int32Param);
return true;
}
}
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
/* Run your code on data */
if (data == nullptr) {
return 0;
}
/* Validate the length of size */
if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
return 0;
}
char* ch = (char*)malloc(size + 1);
if (ch == nullptr) {
std::cout << "malloc failed." << std::endl;
return 0;
}
(void)memset_s(ch, size + 1, 0x00, size + 1);
if (memcpy_s(ch, size, data, size) != EOK) {
std::cout << "copy failed." << std::endl;
free(ch);
ch = nullptr;
return 0;
}
OHOS::DoSomethingInterestingWithMyAPI(ch, size);
free(ch);
ch = nullptr;
return 0;
}
+21
View File
@@ -0,0 +1,21 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYCACHEMANAGERA_FUZZER_H
#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYCACHEMANAGERA_FUZZER_H
#define FUZZ_PROJECT_NAME "abilitycachemanagera_fuzzer"
#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYCACHEMANAGERA_FUZZER_H
+25
View File
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<fuzz_config>
<fuzztest>
<!-- maximum length of a test input -->
<max_len>1000</max_len>
<!-- maximum total time in seconds to run the fuzzer -->
<max_total_time>300</max_total_time>
<!-- memory usage limit in Mb -->
<rss_limit_mb>4096</rss_limit_mb>
</fuzztest>
</fuzz_config>
+107
View File
@@ -0,0 +1,107 @@
# Copyright (c) 2024 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#####################hydra-fuzz###################
import("//build/config/features.gni")
import("//build/ohos.gni")
import("//build/test.gni")
import("//foundation/ability/ability_runtime/ability_runtime.gni")
module_output_path = "ability_runtime/abilitymgr"
##############################fuzztest##########################################
ohos_fuzztest("JsAbilityAutoStartupManagerFuzzTest") {
module_out_path = module_output_path
fuzz_config_file =
"${ability_runtime_test_path}/fuzztest/jsabilityautostartupmanager_fuzzer"
include_dirs = [
"${ability_runtime_path}/interfaces/kits/native/ability/native/ability_business_error",
"${ability_runtime_napi_path}/ability_auto_startup_manager",
"${ability_runtime_napi_path}/ability_auto_startup_callback",
"${ability_runtime_innerkits_path}/ability_manager/include",
]
cflags = [
"-g",
"-O0",
"-Wno-unused-variable",
"-fno-omit-frame-pointer",
]
sources = [
"${ability_runtime_napi_path}/ability_auto_startup_manager/js_ability_auto_startup_manager.cpp",
"jsabilityautostartupmanager_fuzzer.cpp",
]
configs = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
"${ability_runtime_services_path}/abilitymgr:abilityms_config",
]
deps = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager",
"${ability_runtime_innerkits_path}/runtime:runtime",
"${ability_runtime_napi_path}/ability_auto_startup_callback:autostartupcallback",
"${ability_runtime_napi_path}/ability_auto_startup_manager:autostartupmanager",
"${ability_runtime_native_path}/ability/native:ability_business_error",
#"${ability_runtime_native_path}/ability/native:abilitykit_native",
"${ability_runtime_native_path}/ability/native:auto_startup_callback",
"${ability_runtime_native_path}/appkit:appkit_manager_helper",
"//third_party/jsoncpp:jsoncpp",
]
external_deps = [
"ability_base:want",
"ability_base:zuri",
"access_token:libaccesstoken_sdk",
"access_token:libtokenid_sdk",
"bundle_framework:appexecfwk_base",
"bundle_framework:appexecfwk_core",
"bundle_framework:libappexecfwk_common",
"c_utils:utils",
"common_event_service:cesfwk_core",
"common_event_service:cesfwk_innerkits",
"ffrt:libffrt",
"hilog:libhilog",
"hitrace:hitrace_meter",
"hitrace:libhitracechain",
"ipc:ipc_core",
"kv_store:distributeddata_inner",
"napi:ace_napi",
"os_account:os_account_innerkits",
"relational_store:native_dataability",
"relational_store:native_rdb",
"samgr:samgr_proxy",
]
if (ability_runtime_graphics) {
deps += []
external_deps += [
"i18n:intl_util",
"window_manager:libwm",
]
}
}
###############################################################################
group("fuzztest") {
testonly = true
deps = []
deps += [
# deps file
":JsAbilityAutoStartupManagerFuzzTest",
]
}
###############################################################################
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
FUZZ
@@ -0,0 +1,122 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "jsabilityautostartupmanager_fuzzer.h"
#include <cstddef>
#include <cstdint>
#define private public
#define protected public
#include "js_ability_auto_startup_manager.h"
#undef protected
#undef private
#include "ability_record.h"
using namespace OHOS::AAFwk;
using namespace OHOS::AppExecFwk;
using namespace OHOS::AbilityRuntime;
namespace OHOS {
namespace {
constexpr int INPUT_ZERO = 0;
constexpr int INPUT_ONE = 1;
constexpr int INPUT_THREE = 3;
constexpr size_t FOO_MAX_LEN = 1024;
constexpr size_t U32_AT_SIZE = 4;
constexpr uint8_t ENABLE = 2;
constexpr size_t OFFSET_ZERO = 24;
constexpr size_t OFFSET_ONE = 16;
constexpr size_t OFFSET_TWO = 8;
}
uint32_t GetU32Data(const char* ptr)
{
// convert fuzz input data to an integer
return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
ptr[INPUT_THREE];
}
sptr<Token> GetFuzzAbilityToken()
{
sptr<Token> token = nullptr;
AbilityRequest abilityRequest;
abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
abilityRequest.abilityInfo.name = "MainAbility";
abilityRequest.abilityInfo.type = AbilityType::DATA;
std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
if (abilityRecord) {
token = abilityRecord->GetToken();
}
return token;
}
void JsAbilityAutostartupManagerFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param)
{
std::shared_ptr<JsAbilityAutoStartupManager> mgr = std::make_shared<JsAbilityAutoStartupManager>();
napi_env env = nullptr;
mgr->Finalizer(env, nullptr, nullptr); // branch
napi_callback_info info = nullptr;
mgr->RegisterAutoStartupCallback(env, info); // branch
mgr->UnregisterAutoStartupCallback(env, info); // branch
mgr->SetApplicationAutoStartup(env, info); // branch
mgr->CancelApplicationAutoStartup(env, info); // branch
mgr->QueryAllAutoStartupApplications(env, info); // branch
}
bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
{
bool boolParam = *data % ENABLE;
std::string stringParam(data, size);
int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
JsAbilityAutostartupManagerFuzztest1(boolParam, stringParam, int32Param);
return true;
}
}
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
/* Run your code on data */
if (data == nullptr) {
return 0;
}
/* Validate the length of size */
if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
return 0;
}
char* ch = (char*)malloc(size + 1);
if (ch == nullptr) {
std::cout << "malloc failed." << std::endl;
return 0;
}
(void)memset_s(ch, size + 1, 0x00, size + 1);
if (memcpy_s(ch, size, data, size) != EOK) {
std::cout << "copy failed." << std::endl;
free(ch);
ch = nullptr;
return 0;
}
OHOS::DoSomethingInterestingWithMyAPI(ch, size);
free(ch);
ch = nullptr;
return 0;
}
@@ -0,0 +1,21 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FUZZTEST_OHOS_ABILITY_JSABILITYAUTOSTARTUPMANAGER_FUZZER_H
#define FUZZTEST_OHOS_ABILITY_JSABILITYAUTOSTARTUPMANAGER_FUZZER_H
#define FUZZ_PROJECT_NAME "jsabilityautostartupmanager_fuzzer"
#endif // FUZZTEST_OHOS_ABILITY_JSABILITYAUTOSTARTUPMANAGER_FUZZER_H
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<fuzz_config>
<fuzztest>
<!-- maximum length of a test input -->
<max_len>1000</max_len>
<!-- maximum total time in seconds to run the fuzzer -->
<max_total_time>300</max_total_time>
<!-- memory usage limit in Mb -->
<rss_limit_mb>4096</rss_limit_mb>
</fuzztest>
</fuzz_config>
+105
View File
@@ -0,0 +1,105 @@
# Copyright (c) 2024 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#####################hydra-fuzz###################
import("//build/config/features.gni")
import("//build/ohos.gni")
import("//build/test.gni")
import("//foundation/ability/ability_runtime/ability_runtime.gni")
module_output_path = "ability_runtime/abilitymgr"
##############################fuzztest##########################################
ohos_fuzztest("NapiCommonWantFuzzTest") {
module_out_path = module_output_path
fuzz_config_file =
"${ability_runtime_test_path}/fuzztest/napicommonwant_fuzzer"
include_dirs = [
"${ability_runtime_napi_path}/inner/napi_common",
"${ability_runtime_innerkits_path}/ability_manager/include",
]
cflags = [
"-g",
"-O0",
"-Wno-unused-variable",
"-fno-omit-frame-pointer",
]
sources = [ "napicommonwant_fuzzer.cpp" ]
configs = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
"${ability_runtime_services_path}/abilitymgr:abilityms_config",
]
deps = [
"${ability_base_path}:base",
"${ability_runtime_innerkits_path}/ability_manager:ability_manager",
"${ability_runtime_innerkits_path}/runtime:runtime",
"${ability_runtime_napi_path}/ability_auto_startup_callback:autostartupcallback",
"${ability_runtime_napi_path}/ability_auto_startup_manager:autostartupmanager",
"${ability_runtime_napi_path}/inner/napi_common:napi_common",
"${ability_runtime_native_path}/ability/native:ability_business_error",
#"${ability_runtime_native_path}/ability/native:abilitykit_native",
"${ability_runtime_native_path}/ability/native:auto_startup_callback",
"${ability_runtime_native_path}/appkit:appkit_manager_helper",
"${ability_runtime_path}/js_environment/frameworks/js_environment:js_environment",
"//third_party/jsoncpp:jsoncpp",
]
external_deps = [
"ability_base:want",
"ability_base:zuri",
"access_token:libaccesstoken_sdk",
"access_token:libtokenid_sdk",
"bundle_framework:appexecfwk_base",
"bundle_framework:appexecfwk_core",
"bundle_framework:libappexecfwk_common",
"c_utils:utils",
"common_event_service:cesfwk_core",
"common_event_service:cesfwk_innerkits",
"ffrt:libffrt",
"hilog:libhilog",
"hitrace:hitrace_meter",
"hitrace:libhitracechain",
"ipc:ipc_core",
"kv_store:distributeddata_inner",
"napi:ace_napi",
"os_account:os_account_innerkits",
"relational_store:native_dataability",
"relational_store:native_rdb",
"samgr:samgr_proxy",
]
if (ability_runtime_graphics) {
deps += []
external_deps += [
"i18n:intl_util",
"window_manager:libwm",
]
}
}
###############################################################################
group("fuzztest") {
testonly = true
deps = []
deps += [
# deps file
":NapiCommonWantFuzzTest",
]
}
###############################################################################
+16
View File
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
FUZZ
@@ -0,0 +1,391 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "napicommonwant_fuzzer.h"
#include <cstddef>
#include <cstdint>
#define private public
#define protected public
#include "napi_common_want.h"
#undef protected
#undef private
#include "ability_record.h"
#include "array_wrapper.h"
#include "bool_wrapper.h"
#include "byte_wrapper.h"
#include "double_wrapper.h"
#include "float_wrapper.h"
#include "int_wrapper.h"
#include "long_wrapper.h"
#include "short_wrapper.h"
#include "string_wrapper.h"
#include "zchar_wrapper.h"
#include "remote_object_wrapper.h"
#include "native_runtime_impl.h"
#include "js_environment.h"
using namespace OHOS::AAFwk;
using namespace OHOS::AppExecFwk;
using namespace OHOS::AbilityRuntime;
namespace OHOS {
namespace {
constexpr int INPUT_ZERO = 0;
constexpr int INPUT_ONE = 1;
constexpr int INPUT_THREE = 3;
constexpr size_t FOO_MAX_LEN = 1024;
constexpr size_t U32_AT_SIZE = 4;
constexpr uint8_t ENABLE = 2;
constexpr size_t OFFSET_ZERO = 24;
constexpr size_t OFFSET_ONE = 16;
constexpr size_t OFFSET_TWO = 8;
}
uint32_t GetU32Data(const char* ptr)
{
// convert fuzz input data to an integer
return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
ptr[INPUT_THREE];
}
sptr<Token> GetFuzzAbilityToken()
{
sptr<Token> token = nullptr;
AbilityRequest abilityRequest;
abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
abilityRequest.abilityInfo.name = "MainAbility";
abilityRequest.abilityInfo.type = AbilityType::DATA;
std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
if (abilityRecord) {
token = abilityRecord->GetToken();
}
return token;
}
void NapiCommonWantFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param)
{
napi_env env = nullptr;
ElementName elementName;
elementName.SetDeviceID(stringParam);
elementName.SetBundleName(stringParam);
elementName.SetAbilityName(stringParam);
elementName.SetModuleName(stringParam);
WrapElementName(env, elementName); // branch failed
napi_value param = nullptr;
UnwrapElementName(env, param, elementName); // branch failed
AAFwk::WantParams wantParams1;
WrapWantParams(env, wantParams1); // branch failed
wantParams1.SetParam("intf1", String::Box(stringParam));
wantParams1.SetParam("intf2", Long::Box(int32Param));
wantParams1.SetParam("intf3", Boolean::Box(boolParam));
wantParams1.SetParam("intf4", Integer::Box(int32Param));
wantParams1.SetParam("intf5", Float::Box(int32Param));
wantParams1.SetParam("intf5", RemoteObjectWrap::Box(nullptr));
wantParams1.SetParam("intf6", Char::Box(int32Param));
wantParams1.SetParam("intf7", Double::Box(int32Param));
wantParams1.SetParam("intf8", Byte::Box(int32Param));
std::size_t size = 3; // 3 means arraysize.
sptr<IArray> ao = new (std::nothrow) Array(size, g_IID_IBoolean);
if (ao != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao->Set(i, Boolean::Box(boolParam));
}
wantParams1.SetParam("intf8", ao);
}
WrapWantParams(env, wantParams1); // branch failed
UnwrapWantParams(env, param, wantParams1); // branch failed
BlackListFilter(Want::PARAM_RESV_WINDOW_MODE); // branch
BlackListFilter(Want::PARAM_RESV_DISPLAY_ID); // branch
BlackListFilter(stringParam); // branch
Want want;
WrapWant(env, want); // branch
UnwrapWant(env, param, want); // branch
int resultCode = 0;
WrapAbilityResult(env, resultCode, want); // branch
UnWrapAbilityResult(env, param, resultCode, want); // branch
napi_value jsProValue = nullptr;
HandleNapiObject(env, param, jsProValue, stringParam, wantParams1); // branch
IsSpecialObject(env, param, stringParam, stringParam, static_cast<napi_valuetype>(int32Param)); // branch
HandleFdObject(env, param, stringParam, wantParams1); // branch
HandleRemoteObject(env, param, stringParam, wantParams1); // branch
CreateJsWant(env, want); // branch
CreateJsWantParams(env, wantParams1); // branch
}
void NapiCommonWantFuzztest2(bool boolParam, std::string &stringParam, int32_t int32Param)
{
napi_env env = nullptr;
AAFwk::WantParams wantParams1;
napi_value object = nullptr;
InnerWrapJsWantParamsWantParams(env, object, stringParam, wantParams1); // failed
std::size_t size = 3; // 3 means arraysize.
sptr<IArray> ao = new (std::nothrow) Array(size, g_IID_IBoolean);
if (ao != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao->Set(i, Boolean::Box(boolParam));
}
}
WrapJsWantParamsArray(env, object, stringParam, ao); // branch
}
void NapiCommonWantFuzztest3(bool boolParam, std::string &stringParam, int32_t int32Param)
{
std::shared_ptr<OHOS::JsEnv::JsEnvironment> jsEnv = nullptr;
AbilityRuntime::JsRuntime::Options options;
auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv);
napi_env env = reinterpret_cast<napi_env>(jsEnv->GetNativeEngine());
ElementName elementName1;
elementName1.SetDeviceID(stringParam);
elementName1.SetBundleName(stringParam);
elementName1.SetAbilityName(stringParam);
elementName1.SetModuleName(stringParam);
napi_value jsObject = WrapElementName(env, elementName1); // branch
napi_value param = nullptr;
ElementName elementName2;
UnwrapElementName(env, param, elementName2); // branch null param
ElementName elementName3;
UnwrapElementName(env, jsObject, elementName3); // branch not null param
AAFwk::WantParams wantParams1;
WrapWantParams(env, wantParams1);
wantParams1.SetParam("intf1", String::Box(stringParam));
wantParams1.SetParam("intf2", Long::Box(int32Param));
wantParams1.SetParam("intf3", Boolean::Box(boolParam));
wantParams1.SetParam("intf4", Integer::Box(int32Param));
wantParams1.SetParam("intf5", Float::Box(int32Param));
wantParams1.SetParam("intf5", RemoteObjectWrap::Box(nullptr));
wantParams1.SetParam("intf6", Char::Box(int32Param));
wantParams1.SetParam("intf7", Double::Box(int32Param));
wantParams1.SetParam("intf8", Byte::Box(int32Param));
std::size_t size = 3; // 3 means arraysize.
sptr<IArray> ao = new (std::nothrow) Array(size, g_IID_IBoolean);
if (ao != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao->Set(i, Boolean::Box(boolParam));
}
wantParams1.SetParam("intf8", ao);
}
WrapWantParams(env, wantParams1); // branch null param
UnwrapWantParams(env, param, wantParams1); // branch null param
UnwrapWantParams(env, jsObject, wantParams1); // branch not null param
}
void NapiCommonWantFuzztest4(bool boolParam, std::string &stringParam, int32_t int32Param)
{
napi_value param = nullptr;
std::shared_ptr<OHOS::JsEnv::JsEnvironment> jsEnv = nullptr;
AbilityRuntime::JsRuntime::Options options;
auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv);
napi_env env = reinterpret_cast<napi_env>(jsEnv->GetNativeEngine());
Want want;
want.SetElementName(stringParam, stringParam, stringParam, stringParam);
WrapWant(env, want); // wrap
UnwrapWant(env, param, want); // branch null param
ElementName elementName1;
elementName1.SetDeviceID(stringParam);
elementName1.SetBundleName(stringParam);
elementName1.SetAbilityName(stringParam);
elementName1.SetModuleName(stringParam);
napi_value jsObject = WrapElementName(env, elementName1); // branch
UnwrapWant(env, jsObject, want); // branch not null param
int resultCode = 0;
napi_value jsonObject1 = WrapAbilityResult(env, resultCode, want); // env not null
UnWrapAbilityResult(env, param, resultCode, want); // null param
UnWrapAbilityResult(env, jsonObject1, resultCode, want); // null param
napi_value jsProValue = nullptr;
AAFwk::WantParams wantParams1;
HandleNapiObject(env, param, jsProValue, stringParam, wantParams1); // param null
HandleNapiObject(env, jsObject, jsProValue, stringParam, wantParams1); // param not null jsProValue null.
IsSpecialObject(env, param, stringParam, stringParam, static_cast<napi_valuetype>(int32Param)); // param null
IsSpecialObject(env, jsObject, stringParam, stringParam, static_cast<napi_valuetype>(int32Param)); // param not null
HandleFdObject(env, param, stringParam, wantParams1); // branch null param
HandleRemoteObject(env, param, stringParam, wantParams1); // branch null param
CreateJsWant(env, want); // branch
CreateJsWantParams(env, wantParams1); // branch
napi_value object = nullptr;
InnerWrapJsWantParamsWantParams(env, object, stringParam, wantParams1); // branch null object
napi_value jsObject2 = nullptr;
napi_create_object(env, &jsObject2);
InnerWrapJsWantParamsWantParams(env, jsObject2, stringParam, wantParams1); // branch object, key not exist.
AAFwk::WantParams wantParams2;
wantParams2.SetParam("intf1", String::Box(stringParam));
InnerWrapJsWantParamsWantParams(env, jsObject2, "intf1", wantParams2); // branch object, key exist.
}
void NapiCommonWantFuzztest5(bool boolParam, std::string &stringParam, int32_t int32Param)
{
napi_value param = nullptr;
std::shared_ptr<OHOS::JsEnv::JsEnvironment> jsEnv = nullptr;
AbilityRuntime::JsRuntime::Options options;
auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv);
napi_env env = reinterpret_cast<napi_env>(jsEnv->GetNativeEngine());
napi_value nullObject = nullptr;
std::size_t size = 3; // 3 means arraysize.
sptr<IArray> ao1 = new (std::nothrow) Array(size, g_IID_IBoolean);
if (ao1 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao1->Set(i, Boolean::Box(boolParam));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao1); // null object.
napi_value jsObject1 = nullptr;
napi_create_object(env, &jsObject1);
WrapJsWantParamsArray(env, jsObject1, stringParam, ao1); // not null object.
sptr<IArray> ao2 = new (std::nothrow) Array(size, g_IID_IChar);
if (ao2 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao2->Set(i, Char::Box(int32Param));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao2); // null object.
napi_value jsObject2 = nullptr;
napi_create_object(env, &jsObject2);
WrapJsWantParamsArray(env, jsObject2, stringParam, ao2); // not null object.
sptr<IArray> ao3 = new (std::nothrow) Array(size, g_IID_IByte);
if (ao3 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao3->Set(i, Byte::Box(int32Param));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao3); // null object.
napi_value jsObject3 = nullptr;
napi_create_object(env, &jsObject3);
WrapJsWantParamsArray(env, jsObject3, stringParam, ao3); // not null object.
sptr<IArray> ao4 = new (std::nothrow) Array(size, g_IID_IShort);
if (ao4 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao4->Set(i, Short::Box(int32Param));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao4); // null object.
napi_value jsObject4 = nullptr;
napi_create_object(env, &jsObject4);
WrapJsWantParamsArray(env, jsObject4, stringParam, ao4); // not null object.
}
void NapiCommonWantFuzztest6(bool boolParam, std::string &stringParam, int32_t int32Param)
{
napi_value param = nullptr;
std::shared_ptr<OHOS::JsEnv::JsEnvironment> jsEnv = nullptr;
AbilityRuntime::JsRuntime::Options options;
auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv);
napi_env env = reinterpret_cast<napi_env>(jsEnv->GetNativeEngine());
napi_value nullObject = nullptr;
std::size_t size = 3; // 3 means arraysize.
sptr<IArray> ao1 = new (std::nothrow) Array(size, g_IID_ILong);
if (ao1 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao1->Set(i, Long::Box(int32Param));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao1); // null object.
napi_value jsObject1 = nullptr;
napi_create_object(env, &jsObject1);
WrapJsWantParamsArray(env, jsObject1, stringParam, ao1); // not null object.
sptr<IArray> ao2 = new (std::nothrow) Array(size, g_IID_IFloat);
if (ao2 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao2->Set(i, Float::Box(int32Param));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao2); // null object.
napi_value jsObject2 = nullptr;
napi_create_object(env, &jsObject2);
WrapJsWantParamsArray(env, jsObject2, stringParam, ao2); // not null object.
sptr<IArray> ao3 = new (std::nothrow) Array(size, g_IID_IDouble);
if (ao3 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao3->Set(i, Double::Box(int32Param));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao3); // null object.
napi_value jsObject3 = nullptr;
napi_create_object(env, &jsObject3);
WrapJsWantParamsArray(env, jsObject3, stringParam, ao3); // not null object.
sptr<IArray> ao4 = new (std::nothrow) Array(size, g_IID_IString);
if (ao4 != nullptr) {
for (std::size_t i = 0; i < size; i++) {
ao4->Set(i, String::Box(stringParam));
}
}
WrapJsWantParamsArray(env, nullObject, stringParam, ao4); // null object.
napi_value jsObject4 = nullptr;
napi_create_object(env, &jsObject4);
WrapJsWantParamsArray(env, jsObject4, stringParam, ao4); // not null object.
}
bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
{
bool boolParam = *data % ENABLE;
std::string stringParam(data, size);
int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
NapiCommonWantFuzztest1(boolParam, stringParam, int32Param);
NapiCommonWantFuzztest2(boolParam, stringParam, int32Param);
NapiCommonWantFuzztest3(boolParam, stringParam, int32Param);
NapiCommonWantFuzztest4(boolParam, stringParam, int32Param);
NapiCommonWantFuzztest5(boolParam, stringParam, int32Param);
NapiCommonWantFuzztest6(boolParam, stringParam, int32Param);
return true;
}
}
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
/* Run your code on data */
if (data == nullptr) {
return 0;
}
/* Validate the length of size */
if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
return 0;
}
char* ch = (char*)malloc(size + 1);
if (ch == nullptr) {
std::cout << "malloc failed." << std::endl;
return 0;
}
(void)memset_s(ch, size + 1, 0x00, size + 1);
if (memcpy_s(ch, size, data, size) != EOK) {
std::cout << "copy failed." << std::endl;
free(ch);
ch = nullptr;
return 0;
}
OHOS::DoSomethingInterestingWithMyAPI(ch, size);
free(ch);
ch = nullptr;
return 0;
}
@@ -0,0 +1,21 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FUZZTEST_OHOS_ABILITY_NAPICOMMONWANT_FUZZER_H
#define FUZZTEST_OHOS_ABILITY_NAPICOMMONWANT_FUZZER_H
#define FUZZ_PROJECT_NAME "napicommonwant_fuzzer"
#endif // FUZZTEST_OHOS_ABILITY_NAPICOMMONWANT_FUZZER_H
+25
View File
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<fuzz_config>
<fuzztest>
<!-- maximum length of a test input -->
<max_len>1000</max_len>
<!-- maximum total time in seconds to run the fuzzer -->
<max_total_time>300</max_total_time>
<!-- memory usage limit in Mb -->
<rss_limit_mb>4096</rss_limit_mb>
</fuzztest>
</fuzz_config>
+105
View File
@@ -0,0 +1,105 @@
# Copyright (c) 2024 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#####################hydra-fuzz###################
import("//build/config/features.gni")
import("//build/ohos.gni")
import("//build/test.gni")
import("//foundation/ability/ability_runtime/ability_runtime.gni")
module_output_path = "ability_runtime/abilitymgr"
##############################fuzztest##########################################
ohos_fuzztest("StartAbilityUtilsFuzzTest") {
module_out_path = module_output_path
fuzz_config_file =
"${ability_runtime_test_path}/fuzztest/startabilityutils_fuzzer"
include_dirs = [
"${ability_runtime_innerkits_path}/ability_manager/include",
"${ability_runtime_innerkits_path}/dataobs_manager/include",
"${multimodalinput_path}/interfaces/native/innerkits/event/include",
]
cflags = [
"-g",
"-O0",
"-Wno-unused-variable",
"-fno-omit-frame-pointer",
]
sources = [
"${ability_runtime_services_path}/abilitymgr/src/start_ability_utils.cpp",
"startabilityutils_fuzzer.cpp",
]
configs = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
"${ability_runtime_services_path}/abilitymgr:abilityms_config",
]
deps = [
"${ability_runtime_innerkits_path}/ability_manager:ability_manager",
"${ability_runtime_innerkits_path}/ability_manager:ability_start_options",
"${ability_runtime_innerkits_path}/deps_wrapper:ability_deps_wrapper",
"${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr",
"${ability_runtime_native_path}/ability/native:abilitykit_native",
"${ability_runtime_native_path}/ability/native:auto_startup_callback",
"${ability_runtime_native_path}/appkit:appkit_manager_helper",
"${ability_runtime_path}/utils/server/startup:startup_util",
"${ability_runtime_services_path}/abilitymgr:abilityms",
"${ability_runtime_services_path}/common:perm_verification",
"//third_party/jsoncpp:jsoncpp",
]
external_deps = [
"ability_base:want",
"ability_base:zuri",
"access_token:libaccesstoken_sdk",
"access_token:libtokenid_sdk",
"bundle_framework:appexecfwk_base",
"bundle_framework:appexecfwk_core",
"bundle_framework:libappexecfwk_common",
"c_utils:utils",
"common_event_service:cesfwk_core",
"common_event_service:cesfwk_innerkits",
"ffrt:libffrt",
"hilog:libhilog",
"hitrace:hitrace_meter",
"hitrace:libhitracechain",
"ipc:ipc_core",
"kv_store:distributeddata_inner",
"napi:ace_napi",
"os_account:os_account_innerkits",
"relational_store:native_dataability",
"relational_store:native_rdb",
"samgr:samgr_proxy",
]
if (ability_runtime_graphics) {
deps += []
external_deps += [
"i18n:intl_util",
"window_manager:libwm",
]
}
}
###############################################################################
group("fuzztest") {
testonly = true
deps = []
deps += [
# deps file
":StartAbilityUtilsFuzzTest",
]
}
###############################################################################
+16
View File
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
FUZZ
+25
View File
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<fuzz_config>
<fuzztest>
<!-- maximum length of a test input -->
<max_len>1000</max_len>
<!-- maximum total time in seconds to run the fuzzer -->
<max_total_time>300</max_total_time>
<!-- memory usage limit in Mb -->
<rss_limit_mb>4096</rss_limit_mb>
</fuzztest>
</fuzz_config>
@@ -0,0 +1,127 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "startabilityutils_fuzzer.h"
#include <cstddef>
#include <cstdint>
#define private public
#define protected public
#include "start_ability_utils.h"
#undef protected
#undef private
#include "ability_record.h"
using namespace OHOS::AAFwk;
using namespace OHOS::AppExecFwk;
using namespace OHOS::AbilityRuntime;
namespace OHOS {
namespace {
constexpr int INPUT_ZERO = 0;
constexpr int INPUT_ONE = 1;
constexpr int INPUT_THREE = 3;
constexpr size_t FOO_MAX_LEN = 1024;
constexpr size_t U32_AT_SIZE = 4;
constexpr uint8_t ENABLE = 2;
constexpr size_t OFFSET_ZERO = 24;
constexpr size_t OFFSET_ONE = 16;
constexpr size_t OFFSET_TWO = 8;
}
uint32_t GetU32Data(const char* ptr)
{
// convert fuzz input data to an integer
return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
ptr[INPUT_THREE];
}
sptr<Token> GetFuzzAbilityToken()
{
sptr<Token> token = nullptr;
AbilityRequest abilityRequest;
abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
abilityRequest.abilityInfo.name = "MainAbility";
abilityRequest.abilityInfo.type = AbilityType::DATA;
std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
if (abilityRecord) {
token = abilityRecord->GetToken();
}
return token;
}
void StartAbilityUtilsFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param)
{
Want want;
sptr<Token> callerToken = GetFuzzAbilityToken();
StartAbilityUtils::GetAppIndex(want, callerToken, int32Param);
AppExecFwk::ApplicationInfo appInfo;
StartAbilityUtils::GetApplicationInfo(stringParam, int32Param, appInfo);
AppExecFwk::AbilityInfo abilityInfo;
StartAbilityUtils::GetCallerAbilityInfo(nullptr, abilityInfo);
StartAbilityUtils::GetCallerAbilityInfo(callerToken, abilityInfo);
StartAbilityUtils::CheckAppProvisionMode(want, int32Param);
std::shared_ptr<StartAbilityInfoWrap> startAbilityInfoWrap =
std::make_shared<StartAbilityInfoWrap>(want, int32Param, int32Param, callerToken, boolParam);
StartAbilityInfo::CreateStartAbilityInfo(want, int32Param, int32Param);
StartAbilityInfo::CreateCallerAbilityInfo(nullptr);
StartAbilityInfo::CreateCallerAbilityInfo(callerToken);
}
bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
{
bool boolParam = *data % ENABLE;
std::string stringParam(data, size);
int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
StartAbilityUtilsFuzztest1(boolParam, stringParam, int32Param);
return true;
}
}
/* Fuzzer entry point */
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
/* Run your code on data */
if (data == nullptr) {
return 0;
}
/* Validate the length of size */
if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
return 0;
}
char* ch = (char*)malloc(size + 1);
if (ch == nullptr) {
std::cout << "malloc failed." << std::endl;
return 0;
}
(void)memset_s(ch, size + 1, 0x00, size + 1);
if (memcpy_s(ch, size, data, size) != EOK) {
std::cout << "copy failed." << std::endl;
free(ch);
ch = nullptr;
return 0;
}
OHOS::DoSomethingInterestingWithMyAPI(ch, size);
free(ch);
ch = nullptr;
return 0;
}
@@ -0,0 +1,21 @@
/*
* Copyright (c) 2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYAUTOSTARTUPSERVICEA_FUZZER_H
#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYAUTOSTARTUPSERVICEA_FUZZER_H
#define FUZZ_PROJECT_NAME "abilityautostartupservicea_fuzzer"
#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYAUTOSTARTUPSERVICEA_FUZZER_H