diff --git a/test/fuzztest/faultdata_fuzzer/BUILD.gn b/test/fuzztest/faultdata_fuzzer/BUILD.gn new file mode 100755 index 0000000000..be7a79ae88 --- /dev/null +++ b/test/fuzztest/faultdata_fuzzer/BUILD.gn @@ -0,0 +1,96 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("FaultDataFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/faultdata_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ + "${ability_runtime_innerkits_path}/app_manager/src/appmgr/fault_data.cpp", + "faultdata_fuzzer.cpp", + ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:ability_start_options", + "${ability_runtime_innerkits_path}/deps_wrapper:ability_deps_wrapper", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "access_token:libaccesstoken_sdk", + "access_token:libtokenid_sdk", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "hilog:libhilog", + "ipc:ipc_core", + "kv_store:distributeddata_inner", + "napi:ace_napi", + "os_account:os_account_innerkits", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":FaultDataFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/faultdata_fuzzer/corpus/init b/test/fuzztest/faultdata_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/faultdata_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/faultdata_fuzzer/faultdata_fuzzer.cpp b/test/fuzztest/faultdata_fuzzer/faultdata_fuzzer.cpp new file mode 100755 index 0000000000..7dd60609d1 --- /dev/null +++ b/test/fuzztest/faultdata_fuzzer/faultdata_fuzzer.cpp @@ -0,0 +1,184 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "faultdata_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "fault_data.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +Want& SetElement(Want &want) +{ + return want.SetElementName("deviceId", "bundleName", "ability", "moduleName"); +} + +void FaultDataFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + FaultData faultData; + Parcel parcel1; + parcel1.WriteInt32(int32Param); + faultData.ReadFromParcel(parcel1); // branch name failed + Parcel parcel2; + parcel2.WriteString(stringParam); + parcel2.WriteInt32(int32Param); + faultData.ReadFromParcel(parcel2); // branch message failed + Parcel parcel3; + parcel3.WriteString(stringParam); + parcel3.WriteString(stringParam); + faultData.ReadFromParcel(parcel3); // branch stack failed + Parcel parcel4; + parcel4.WriteString(stringParam); + parcel4.WriteString(stringParam); + parcel4.WriteString(stringParam); + faultData.ReadFromParcel(parcel4); // branch FaultType failed + + Parcel parcel5; + parcel5.WriteString(stringParam); + parcel5.WriteString(stringParam); + parcel5.WriteString(stringParam); + parcel5.WriteInt32(int32Param); + faultData.ReadFromParcel(parcel5); // branch FaultType failed + + Parcel parcel6; + parcel6.WriteString(stringParam); + parcel6.WriteString(stringParam); + parcel6.WriteString(stringParam); + parcel6.WriteInt32(int32Param); + parcel6.WriteString(stringParam); + faultData.ReadFromParcel(parcel6); // branch FaultType failed + parcel6.WriteBool(boolParam); + faultData.ReadFromParcel(parcel6); + Parcel parcel7; + faultData.Marshalling(parcel7); +} + +void FaultDataFuzztest2(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + AppFaultDataBySA faultData; + Parcel appParcel1; + appParcel1.WriteInt32(int32Param); + faultData.ReadFromParcel(appParcel1); // branch name failed + Parcel appParcel2; + appParcel2.WriteString(stringParam); + appParcel2.WriteInt32(int32Param); + faultData.ReadFromParcel(appParcel2); // branch message failed + Parcel appParcel3; + appParcel3.WriteString(stringParam); + appParcel3.WriteString(stringParam); + faultData.ReadFromParcel(appParcel3); // branch stack failed + Parcel appParcel4; + appParcel4.WriteString(stringParam); + appParcel4.WriteString(stringParam); + appParcel4.WriteString(stringParam); + faultData.ReadFromParcel(appParcel4); // branch FaultType failed + Parcel appParcel5; + appParcel5.WriteString(stringParam); + appParcel5.WriteString(stringParam); + appParcel5.WriteString(stringParam); + appParcel5.WriteInt32(int32Param); + faultData.ReadFromParcel(appParcel5); // branch FaultType failed + Parcel appParcel6; + faultData.Marshalling(appParcel6); +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + std::string stringParam(data, size); + int32_t int32Param = static_cast(GetU32Data(data)); + FaultDataFuzztest1(boolParam, stringParam, int32Param); + FaultDataFuzztest2(boolParam, stringParam, int32Param); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/faultdata_fuzzer/faultdata_fuzzer.h b/test/fuzztest/faultdata_fuzzer/faultdata_fuzzer.h new file mode 100755 index 0000000000..1180410d1c --- /dev/null +++ b/test/fuzztest/faultdata_fuzzer/faultdata_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYCACHEMANAGERA_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYCACHEMANAGERA_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitycachemanagera_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYCACHEMANAGERA_FUZZER_H diff --git a/test/fuzztest/faultdata_fuzzer/project.xml b/test/fuzztest/faultdata_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/faultdata_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/jsabilityautostartupmanager_fuzzer/BUILD.gn b/test/fuzztest/jsabilityautostartupmanager_fuzzer/BUILD.gn new file mode 100755 index 0000000000..4be56ede4b --- /dev/null +++ b/test/fuzztest/jsabilityautostartupmanager_fuzzer/BUILD.gn @@ -0,0 +1,107 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("JsAbilityAutoStartupManagerFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/jsabilityautostartupmanager_fuzzer" + + include_dirs = [ + "${ability_runtime_path}/interfaces/kits/native/ability/native/ability_business_error", + "${ability_runtime_napi_path}/ability_auto_startup_manager", + "${ability_runtime_napi_path}/ability_auto_startup_callback", + "${ability_runtime_innerkits_path}/ability_manager/include", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ + "${ability_runtime_napi_path}/ability_auto_startup_manager/js_ability_auto_startup_manager.cpp", + "jsabilityautostartupmanager_fuzzer.cpp", + ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/runtime:runtime", + "${ability_runtime_napi_path}/ability_auto_startup_callback:autostartupcallback", + "${ability_runtime_napi_path}/ability_auto_startup_manager:autostartupmanager", + "${ability_runtime_native_path}/ability/native:ability_business_error", + + #"${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_native_path}/ability/native:auto_startup_callback", + "${ability_runtime_native_path}/appkit:appkit_manager_helper", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "access_token:libaccesstoken_sdk", + "access_token:libtokenid_sdk", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "bundle_framework:libappexecfwk_common", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "hilog:libhilog", + "hitrace:hitrace_meter", + "hitrace:libhitracechain", + "ipc:ipc_core", + "kv_store:distributeddata_inner", + "napi:ace_napi", + "os_account:os_account_innerkits", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":JsAbilityAutoStartupManagerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/jsabilityautostartupmanager_fuzzer/corpus/init b/test/fuzztest/jsabilityautostartupmanager_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/jsabilityautostartupmanager_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/jsabilityautostartupmanager_fuzzer/jsabilityautostartupmanager_fuzzer.cpp b/test/fuzztest/jsabilityautostartupmanager_fuzzer/jsabilityautostartupmanager_fuzzer.cpp new file mode 100755 index 0000000000..a5d70456cc --- /dev/null +++ b/test/fuzztest/jsabilityautostartupmanager_fuzzer/jsabilityautostartupmanager_fuzzer.cpp @@ -0,0 +1,122 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "jsabilityautostartupmanager_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "js_ability_auto_startup_manager.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +void JsAbilityAutostartupManagerFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + std::shared_ptr mgr = std::make_shared(); + napi_env env = nullptr; + mgr->Finalizer(env, nullptr, nullptr); // branch + napi_callback_info info = nullptr; + mgr->RegisterAutoStartupCallback(env, info); // branch + mgr->UnregisterAutoStartupCallback(env, info); // branch + mgr->SetApplicationAutoStartup(env, info); // branch + mgr->CancelApplicationAutoStartup(env, info); // branch + mgr->QueryAllAutoStartupApplications(env, info); // branch +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + std::string stringParam(data, size); + int32_t int32Param = static_cast(GetU32Data(data)); + JsAbilityAutostartupManagerFuzztest1(boolParam, stringParam, int32Param); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/jsabilityautostartupmanager_fuzzer/jsabilityautostartupmanager_fuzzer.h b/test/fuzztest/jsabilityautostartupmanager_fuzzer/jsabilityautostartupmanager_fuzzer.h new file mode 100755 index 0000000000..82fc620ea3 --- /dev/null +++ b/test/fuzztest/jsabilityautostartupmanager_fuzzer/jsabilityautostartupmanager_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_JSABILITYAUTOSTARTUPMANAGER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_JSABILITYAUTOSTARTUPMANAGER_FUZZER_H + +#define FUZZ_PROJECT_NAME "jsabilityautostartupmanager_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_JSABILITYAUTOSTARTUPMANAGER_FUZZER_H diff --git a/test/fuzztest/jsabilityautostartupmanager_fuzzer/project.xml b/test/fuzztest/jsabilityautostartupmanager_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/jsabilityautostartupmanager_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/napicommonwant_fuzzer/BUILD.gn b/test/fuzztest/napicommonwant_fuzzer/BUILD.gn new file mode 100755 index 0000000000..b55ff32493 --- /dev/null +++ b/test/fuzztest/napicommonwant_fuzzer/BUILD.gn @@ -0,0 +1,105 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("NapiCommonWantFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/napicommonwant_fuzzer" + + include_dirs = [ + "${ability_runtime_napi_path}/inner/napi_common", + "${ability_runtime_innerkits_path}/ability_manager/include", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "napicommonwant_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_base_path}:base", + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/runtime:runtime", + "${ability_runtime_napi_path}/ability_auto_startup_callback:autostartupcallback", + "${ability_runtime_napi_path}/ability_auto_startup_manager:autostartupmanager", + "${ability_runtime_napi_path}/inner/napi_common:napi_common", + "${ability_runtime_native_path}/ability/native:ability_business_error", + + #"${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_native_path}/ability/native:auto_startup_callback", + "${ability_runtime_native_path}/appkit:appkit_manager_helper", + "${ability_runtime_path}/js_environment/frameworks/js_environment:js_environment", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "access_token:libaccesstoken_sdk", + "access_token:libtokenid_sdk", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "bundle_framework:libappexecfwk_common", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "hilog:libhilog", + "hitrace:hitrace_meter", + "hitrace:libhitracechain", + "ipc:ipc_core", + "kv_store:distributeddata_inner", + "napi:ace_napi", + "os_account:os_account_innerkits", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":NapiCommonWantFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/napicommonwant_fuzzer/corpus/init b/test/fuzztest/napicommonwant_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/napicommonwant_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/napicommonwant_fuzzer/napicommonwant_fuzzer.cpp b/test/fuzztest/napicommonwant_fuzzer/napicommonwant_fuzzer.cpp new file mode 100755 index 0000000000..df478dd4be --- /dev/null +++ b/test/fuzztest/napicommonwant_fuzzer/napicommonwant_fuzzer.cpp @@ -0,0 +1,391 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "napicommonwant_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "napi_common_want.h" +#undef protected +#undef private + +#include "ability_record.h" +#include "array_wrapper.h" +#include "bool_wrapper.h" +#include "byte_wrapper.h" +#include "double_wrapper.h" +#include "float_wrapper.h" +#include "int_wrapper.h" +#include "long_wrapper.h" +#include "short_wrapper.h" +#include "string_wrapper.h" +#include "zchar_wrapper.h" +#include "remote_object_wrapper.h" +#include "native_runtime_impl.h" +#include "js_environment.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +void NapiCommonWantFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + napi_env env = nullptr; + ElementName elementName; + elementName.SetDeviceID(stringParam); + elementName.SetBundleName(stringParam); + elementName.SetAbilityName(stringParam); + elementName.SetModuleName(stringParam); + WrapElementName(env, elementName); // branch failed + napi_value param = nullptr; + UnwrapElementName(env, param, elementName); // branch failed + AAFwk::WantParams wantParams1; + WrapWantParams(env, wantParams1); // branch failed + wantParams1.SetParam("intf1", String::Box(stringParam)); + wantParams1.SetParam("intf2", Long::Box(int32Param)); + wantParams1.SetParam("intf3", Boolean::Box(boolParam)); + wantParams1.SetParam("intf4", Integer::Box(int32Param)); + wantParams1.SetParam("intf5", Float::Box(int32Param)); + wantParams1.SetParam("intf5", RemoteObjectWrap::Box(nullptr)); + wantParams1.SetParam("intf6", Char::Box(int32Param)); + wantParams1.SetParam("intf7", Double::Box(int32Param)); + wantParams1.SetParam("intf8", Byte::Box(int32Param)); + std::size_t size = 3; // 3 means arraysize. + sptr ao = new (std::nothrow) Array(size, g_IID_IBoolean); + if (ao != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao->Set(i, Boolean::Box(boolParam)); + } + wantParams1.SetParam("intf8", ao); + } + WrapWantParams(env, wantParams1); // branch failed + UnwrapWantParams(env, param, wantParams1); // branch failed + BlackListFilter(Want::PARAM_RESV_WINDOW_MODE); // branch + BlackListFilter(Want::PARAM_RESV_DISPLAY_ID); // branch + BlackListFilter(stringParam); // branch + Want want; + WrapWant(env, want); // branch + UnwrapWant(env, param, want); // branch + int resultCode = 0; + WrapAbilityResult(env, resultCode, want); // branch + UnWrapAbilityResult(env, param, resultCode, want); // branch + napi_value jsProValue = nullptr; + HandleNapiObject(env, param, jsProValue, stringParam, wantParams1); // branch + IsSpecialObject(env, param, stringParam, stringParam, static_cast(int32Param)); // branch + HandleFdObject(env, param, stringParam, wantParams1); // branch + HandleRemoteObject(env, param, stringParam, wantParams1); // branch + CreateJsWant(env, want); // branch + CreateJsWantParams(env, wantParams1); // branch +} + +void NapiCommonWantFuzztest2(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + napi_env env = nullptr; + AAFwk::WantParams wantParams1; + napi_value object = nullptr; + InnerWrapJsWantParamsWantParams(env, object, stringParam, wantParams1); // failed + std::size_t size = 3; // 3 means arraysize. + sptr ao = new (std::nothrow) Array(size, g_IID_IBoolean); + if (ao != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao->Set(i, Boolean::Box(boolParam)); + } + } + WrapJsWantParamsArray(env, object, stringParam, ao); // branch +} + +void NapiCommonWantFuzztest3(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + std::shared_ptr jsEnv = nullptr; + AbilityRuntime::JsRuntime::Options options; + auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv); + napi_env env = reinterpret_cast(jsEnv->GetNativeEngine()); + ElementName elementName1; + elementName1.SetDeviceID(stringParam); + elementName1.SetBundleName(stringParam); + elementName1.SetAbilityName(stringParam); + elementName1.SetModuleName(stringParam); + napi_value jsObject = WrapElementName(env, elementName1); // branch + + napi_value param = nullptr; + ElementName elementName2; + UnwrapElementName(env, param, elementName2); // branch null param + ElementName elementName3; + UnwrapElementName(env, jsObject, elementName3); // branch not null param + + AAFwk::WantParams wantParams1; + WrapWantParams(env, wantParams1); + wantParams1.SetParam("intf1", String::Box(stringParam)); + wantParams1.SetParam("intf2", Long::Box(int32Param)); + wantParams1.SetParam("intf3", Boolean::Box(boolParam)); + wantParams1.SetParam("intf4", Integer::Box(int32Param)); + wantParams1.SetParam("intf5", Float::Box(int32Param)); + wantParams1.SetParam("intf5", RemoteObjectWrap::Box(nullptr)); + wantParams1.SetParam("intf6", Char::Box(int32Param)); + wantParams1.SetParam("intf7", Double::Box(int32Param)); + wantParams1.SetParam("intf8", Byte::Box(int32Param)); + std::size_t size = 3; // 3 means arraysize. + sptr ao = new (std::nothrow) Array(size, g_IID_IBoolean); + if (ao != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao->Set(i, Boolean::Box(boolParam)); + } + wantParams1.SetParam("intf8", ao); + } + WrapWantParams(env, wantParams1); // branch null param + UnwrapWantParams(env, param, wantParams1); // branch null param + UnwrapWantParams(env, jsObject, wantParams1); // branch not null param +} + +void NapiCommonWantFuzztest4(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + napi_value param = nullptr; + std::shared_ptr jsEnv = nullptr; + AbilityRuntime::JsRuntime::Options options; + auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv); + napi_env env = reinterpret_cast(jsEnv->GetNativeEngine()); + Want want; + want.SetElementName(stringParam, stringParam, stringParam, stringParam); + WrapWant(env, want); // wrap + + UnwrapWant(env, param, want); // branch null param + ElementName elementName1; + elementName1.SetDeviceID(stringParam); + elementName1.SetBundleName(stringParam); + elementName1.SetAbilityName(stringParam); + elementName1.SetModuleName(stringParam); + napi_value jsObject = WrapElementName(env, elementName1); // branch + UnwrapWant(env, jsObject, want); // branch not null param + + int resultCode = 0; + napi_value jsonObject1 = WrapAbilityResult(env, resultCode, want); // env not null + UnWrapAbilityResult(env, param, resultCode, want); // null param + UnWrapAbilityResult(env, jsonObject1, resultCode, want); // null param + + napi_value jsProValue = nullptr; + AAFwk::WantParams wantParams1; + HandleNapiObject(env, param, jsProValue, stringParam, wantParams1); // param null + HandleNapiObject(env, jsObject, jsProValue, stringParam, wantParams1); // param not null jsProValue null. + + IsSpecialObject(env, param, stringParam, stringParam, static_cast(int32Param)); // param null + IsSpecialObject(env, jsObject, stringParam, stringParam, static_cast(int32Param)); // param not null + + HandleFdObject(env, param, stringParam, wantParams1); // branch null param + HandleRemoteObject(env, param, stringParam, wantParams1); // branch null param + CreateJsWant(env, want); // branch + CreateJsWantParams(env, wantParams1); // branch + napi_value object = nullptr; + InnerWrapJsWantParamsWantParams(env, object, stringParam, wantParams1); // branch null object + napi_value jsObject2 = nullptr; + napi_create_object(env, &jsObject2); + InnerWrapJsWantParamsWantParams(env, jsObject2, stringParam, wantParams1); // branch object, key not exist. + AAFwk::WantParams wantParams2; + wantParams2.SetParam("intf1", String::Box(stringParam)); + InnerWrapJsWantParamsWantParams(env, jsObject2, "intf1", wantParams2); // branch object, key exist. +} + +void NapiCommonWantFuzztest5(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + napi_value param = nullptr; + std::shared_ptr jsEnv = nullptr; + AbilityRuntime::JsRuntime::Options options; + auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv); + napi_env env = reinterpret_cast(jsEnv->GetNativeEngine()); + napi_value nullObject = nullptr; + std::size_t size = 3; // 3 means arraysize. + sptr ao1 = new (std::nothrow) Array(size, g_IID_IBoolean); + if (ao1 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao1->Set(i, Boolean::Box(boolParam)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao1); // null object. + napi_value jsObject1 = nullptr; + napi_create_object(env, &jsObject1); + WrapJsWantParamsArray(env, jsObject1, stringParam, ao1); // not null object. + + sptr ao2 = new (std::nothrow) Array(size, g_IID_IChar); + if (ao2 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao2->Set(i, Char::Box(int32Param)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao2); // null object. + napi_value jsObject2 = nullptr; + napi_create_object(env, &jsObject2); + WrapJsWantParamsArray(env, jsObject2, stringParam, ao2); // not null object. + + sptr ao3 = new (std::nothrow) Array(size, g_IID_IByte); + if (ao3 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao3->Set(i, Byte::Box(int32Param)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao3); // null object. + napi_value jsObject3 = nullptr; + napi_create_object(env, &jsObject3); + WrapJsWantParamsArray(env, jsObject3, stringParam, ao3); // not null object. + + sptr ao4 = new (std::nothrow) Array(size, g_IID_IShort); + if (ao4 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao4->Set(i, Short::Box(int32Param)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao4); // null object. + napi_value jsObject4 = nullptr; + napi_create_object(env, &jsObject4); + WrapJsWantParamsArray(env, jsObject4, stringParam, ao4); // not null object. +} + +void NapiCommonWantFuzztest6(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + napi_value param = nullptr; + std::shared_ptr jsEnv = nullptr; + AbilityRuntime::JsRuntime::Options options; + auto err = NativeRuntimeImpl::GetNativeRuntimeImpl().CreateJsEnv(options, jsEnv); + napi_env env = reinterpret_cast(jsEnv->GetNativeEngine()); + napi_value nullObject = nullptr; + std::size_t size = 3; // 3 means arraysize. + sptr ao1 = new (std::nothrow) Array(size, g_IID_ILong); + if (ao1 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao1->Set(i, Long::Box(int32Param)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao1); // null object. + napi_value jsObject1 = nullptr; + napi_create_object(env, &jsObject1); + WrapJsWantParamsArray(env, jsObject1, stringParam, ao1); // not null object. + + sptr ao2 = new (std::nothrow) Array(size, g_IID_IFloat); + if (ao2 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao2->Set(i, Float::Box(int32Param)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao2); // null object. + napi_value jsObject2 = nullptr; + napi_create_object(env, &jsObject2); + WrapJsWantParamsArray(env, jsObject2, stringParam, ao2); // not null object. + + sptr ao3 = new (std::nothrow) Array(size, g_IID_IDouble); + if (ao3 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao3->Set(i, Double::Box(int32Param)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao3); // null object. + napi_value jsObject3 = nullptr; + napi_create_object(env, &jsObject3); + WrapJsWantParamsArray(env, jsObject3, stringParam, ao3); // not null object. + + sptr ao4 = new (std::nothrow) Array(size, g_IID_IString); + if (ao4 != nullptr) { + for (std::size_t i = 0; i < size; i++) { + ao4->Set(i, String::Box(stringParam)); + } + } + WrapJsWantParamsArray(env, nullObject, stringParam, ao4); // null object. + napi_value jsObject4 = nullptr; + napi_create_object(env, &jsObject4); + WrapJsWantParamsArray(env, jsObject4, stringParam, ao4); // not null object. +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + std::string stringParam(data, size); + int32_t int32Param = static_cast(GetU32Data(data)); + NapiCommonWantFuzztest1(boolParam, stringParam, int32Param); + NapiCommonWantFuzztest2(boolParam, stringParam, int32Param); + NapiCommonWantFuzztest3(boolParam, stringParam, int32Param); + NapiCommonWantFuzztest4(boolParam, stringParam, int32Param); + NapiCommonWantFuzztest5(boolParam, stringParam, int32Param); + NapiCommonWantFuzztest6(boolParam, stringParam, int32Param); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/napicommonwant_fuzzer/napicommonwant_fuzzer.h b/test/fuzztest/napicommonwant_fuzzer/napicommonwant_fuzzer.h new file mode 100755 index 0000000000..cca3406c9b --- /dev/null +++ b/test/fuzztest/napicommonwant_fuzzer/napicommonwant_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_NAPICOMMONWANT_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_NAPICOMMONWANT_FUZZER_H + +#define FUZZ_PROJECT_NAME "napicommonwant_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_NAPICOMMONWANT_FUZZER_H diff --git a/test/fuzztest/napicommonwant_fuzzer/project.xml b/test/fuzztest/napicommonwant_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/napicommonwant_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startabilityutils_fuzzer/BUILD.gn b/test/fuzztest/startabilityutils_fuzzer/BUILD.gn new file mode 100755 index 0000000000..ebfc3cb0c5 --- /dev/null +++ b/test/fuzztest/startabilityutils_fuzzer/BUILD.gn @@ -0,0 +1,105 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("StartAbilityUtilsFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startabilityutils_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ + "${ability_runtime_services_path}/abilitymgr/src/start_ability_utils.cpp", + "startabilityutils_fuzzer.cpp", + ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:ability_start_options", + "${ability_runtime_innerkits_path}/deps_wrapper:ability_deps_wrapper", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_native_path}/ability/native:auto_startup_callback", + "${ability_runtime_native_path}/appkit:appkit_manager_helper", + "${ability_runtime_path}/utils/server/startup:startup_util", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "${ability_runtime_services_path}/common:perm_verification", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "access_token:libaccesstoken_sdk", + "access_token:libtokenid_sdk", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "bundle_framework:libappexecfwk_common", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "hilog:libhilog", + "hitrace:hitrace_meter", + "hitrace:libhitracechain", + "ipc:ipc_core", + "kv_store:distributeddata_inner", + "napi:ace_napi", + "os_account:os_account_innerkits", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartAbilityUtilsFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startabilityutils_fuzzer/corpus/init b/test/fuzztest/startabilityutils_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startabilityutils_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startabilityutils_fuzzer/project.xml b/test/fuzztest/startabilityutils_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startabilityutils_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startabilityutils_fuzzer/startabilityutils_fuzzer.cpp b/test/fuzztest/startabilityutils_fuzzer/startabilityutils_fuzzer.cpp new file mode 100755 index 0000000000..0be939fea5 --- /dev/null +++ b/test/fuzztest/startabilityutils_fuzzer/startabilityutils_fuzzer.cpp @@ -0,0 +1,127 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startabilityutils_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "start_ability_utils.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +void StartAbilityUtilsFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param) +{ + Want want; + sptr callerToken = GetFuzzAbilityToken(); + StartAbilityUtils::GetAppIndex(want, callerToken, int32Param); + AppExecFwk::ApplicationInfo appInfo; + StartAbilityUtils::GetApplicationInfo(stringParam, int32Param, appInfo); + AppExecFwk::AbilityInfo abilityInfo; + StartAbilityUtils::GetCallerAbilityInfo(nullptr, abilityInfo); + StartAbilityUtils::GetCallerAbilityInfo(callerToken, abilityInfo); + StartAbilityUtils::CheckAppProvisionMode(want, int32Param); + std::shared_ptr startAbilityInfoWrap = + std::make_shared(want, int32Param, int32Param, callerToken, boolParam); + StartAbilityInfo::CreateStartAbilityInfo(want, int32Param, int32Param); + StartAbilityInfo::CreateCallerAbilityInfo(nullptr); + StartAbilityInfo::CreateCallerAbilityInfo(callerToken); +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + std::string stringParam(data, size); + int32_t int32Param = static_cast(GetU32Data(data)); + StartAbilityUtilsFuzztest1(boolParam, stringParam, int32Param); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startabilityutils_fuzzer/startabilityutils_fuzzer.h b/test/fuzztest/startabilityutils_fuzzer/startabilityutils_fuzzer.h new file mode 100755 index 0000000000..57edc0fab1 --- /dev/null +++ b/test/fuzztest/startabilityutils_fuzzer/startabilityutils_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYAUTOSTARTUPSERVICEA_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYAUTOSTARTUPSERVICEA_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilityautostartupservicea_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYAUTOSTARTUPSERVICEA_FUZZER_H