diff --git a/test/fuzztest/cleanmission_fuzzer/BUILD.gn b/test/fuzztest/cleanmission_fuzzer/BUILD.gn new file mode 100755 index 0000000000..2f848a28e9 --- /dev/null +++ b/test/fuzztest/cleanmission_fuzzer/BUILD.gn @@ -0,0 +1,75 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("CleanMissionFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/cleanmission_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "cleanmission_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:app_manager", + "c_utils:utils", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":CleanMissionFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/cleanmission_fuzzer/cleanmission_fuzzer.cpp b/test/fuzztest/cleanmission_fuzzer/cleanmission_fuzzer.cpp new file mode 100755 index 0000000000..31ed743a8d --- /dev/null +++ b/test/fuzztest/cleanmission_fuzzer/cleanmission_fuzzer.cpp @@ -0,0 +1,86 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "cleanmission_fuzzer.h" + +#include +#include + +#include "ability_manager_client.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + auto abilitymgr = AbilityManagerClient::GetInstance(); + if (!abilitymgr) { + return false; + } + + int32_t missionId = static_cast(GetU32Data(data)); + if (abilitymgr->CleanMission(missionId) != 0) { + return false; + } + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/cleanmission_fuzzer/cleanmission_fuzzer.h b/test/fuzztest/cleanmission_fuzzer/cleanmission_fuzzer.h new file mode 100755 index 0000000000..b9326b0775 --- /dev/null +++ b/test/fuzztest/cleanmission_fuzzer/cleanmission_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_CLEANMISSION_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_CLEANMISSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "cleanmission_fuzzer" + +#endif diff --git a/test/fuzztest/cleanmission_fuzzer/corpus/init b/test/fuzztest/cleanmission_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/cleanmission_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/cleanmission_fuzzer/project.xml b/test/fuzztest/cleanmission_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/cleanmission_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startabilitybycall_fuzzer/BUILD.gn b/test/fuzztest/startabilitybycall_fuzzer/BUILD.gn new file mode 100755 index 0000000000..01bfa29404 --- /dev/null +++ b/test/fuzztest/startabilitybycall_fuzzer/BUILD.gn @@ -0,0 +1,78 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("StartAbilityByCallFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startabilitybycall_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "startabilitybycall_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:app_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartAbilityByCallFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startabilitybycall_fuzzer/corpus/init b/test/fuzztest/startabilitybycall_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startabilitybycall_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startabilitybycall_fuzzer/project.xml b/test/fuzztest/startabilitybycall_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startabilitybycall_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startabilitybycall_fuzzer/startabilitybycall_fuzzer.cpp b/test/fuzztest/startabilitybycall_fuzzer/startabilitybycall_fuzzer.cpp new file mode 100755 index 0000000000..113ee0cd3e --- /dev/null +++ b/test/fuzztest/startabilitybycall_fuzzer/startabilitybycall_fuzzer.cpp @@ -0,0 +1,120 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startabilitybycall_fuzzer.h" + +#include +#include + +#include "ability_manager_client.h" +#include "ability_connect_callback_interface.h" +#include "ability_record.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} +class AbilityConnectionFuzz : public IAbilityConnection { +public: + explicit AbilityConnectionFuzz() {}; + virtual ~AbilityConnectionFuzz() {}; + void OnAbilityConnectDone( + const AppExecFwk::ElementName& element, const sptr& remoteObject, int resultCode) override {}; + void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override {}; +}; +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::SERVICE; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + + return token; +} +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + auto abilitymgr = AbilityManagerClient::GetInstance(); + if (!abilitymgr) { + return false; + } + + // fuzz for want + Parcel wantParcel; + sptr connect; + Want* want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (want && connect) { + abilitymgr->StartAbilityByCall(*want, connect); + } + } + if (want) { + delete want; + want = nullptr; + } + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startabilitybycall_fuzzer/startabilitybycall_fuzzer.h b/test/fuzztest/startabilitybycall_fuzzer/startabilitybycall_fuzzer.h new file mode 100755 index 0000000000..10d1c24895 --- /dev/null +++ b/test/fuzztest/startabilitybycall_fuzzer/startabilitybycall_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTABILITYBYCALL_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTABILITYBYCALL_FUZZER_H + +#define FUZZ_PROJECT_NAME "startabilitybycall_fuzzer" + +#endif diff --git a/test/fuzztest/startcontinuation_fuzzer/BUILD.gn b/test/fuzztest/startcontinuation_fuzzer/BUILD.gn new file mode 100755 index 0000000000..bbe9663959 --- /dev/null +++ b/test/fuzztest/startcontinuation_fuzzer/BUILD.gn @@ -0,0 +1,69 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("StartContinuationFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startcontinuation_fuzzer" + + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_path}/interfaces/kits/native/ability/native/", + ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "startcontinuation_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "ffrt:libffrt", + "napi:ace_napi", + ] +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartContinuationFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startcontinuation_fuzzer/corpus/init b/test/fuzztest/startcontinuation_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startcontinuation_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startcontinuation_fuzzer/project.xml b/test/fuzztest/startcontinuation_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startcontinuation_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startcontinuation_fuzzer/startcontinuation_fuzzer.cpp b/test/fuzztest/startcontinuation_fuzzer/startcontinuation_fuzzer.cpp new file mode 100755 index 0000000000..f9f5112cda --- /dev/null +++ b/test/fuzztest/startcontinuation_fuzzer/startcontinuation_fuzzer.cpp @@ -0,0 +1,118 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startcontinuation_fuzzer.h" + +#include +#include + +#include "ability_manager_client.h" +#include "ability_record.h" +#include "parcel.h" +#include "securec.h" +#include "want.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + auto abilityMgr = AbilityManagerClient::GetInstance(); + if (!abilityMgr) { + return false; + } + + // get token + sptr token = GetFuzzAbilityToken(); + if (!token) { + std::cout << "Get ability token failed." << std::endl; + return false; + } + + // fuzz for want + Parcel wantParcel; + Want* want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (want) { + abilityMgr->StartContinuation(*want, token, 0); + abilityMgr->StartContinuation(*want, token, 1); + } + } + + if (want) { + delete want; + want = nullptr; + } + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startcontinuation_fuzzer/startcontinuation_fuzzer.h b/test/fuzztest/startcontinuation_fuzzer/startcontinuation_fuzzer.h new file mode 100755 index 0000000000..b0530f3072 --- /dev/null +++ b/test/fuzztest/startcontinuation_fuzzer/startcontinuation_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTCONTINUATION_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTCONTINUATION_FUZZER_H + +#define FUZZ_PROJECT_NAME "startcontinuation_fuzzer" + +#endif diff --git a/test/fuzztest/startrenderprocess_fuzzer/BUILD.gn b/test/fuzztest/startrenderprocess_fuzzer/BUILD.gn new file mode 100755 index 0000000000..33e1d653b0 --- /dev/null +++ b/test/fuzztest/startrenderprocess_fuzzer/BUILD.gn @@ -0,0 +1,74 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/app_manager" + +##############################fuzztest########################################## +ohos_fuzztest("StartRenderProcessFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startrenderprocess_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "startrenderprocess_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/app_manager:app_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:configuration", + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ "input:libmmi-client" ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartRenderProcessFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startrenderprocess_fuzzer/corpus/init b/test/fuzztest/startrenderprocess_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startrenderprocess_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startrenderprocess_fuzzer/project.xml b/test/fuzztest/startrenderprocess_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startrenderprocess_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startrenderprocess_fuzzer/startrenderprocess_fuzzer.cpp b/test/fuzztest/startrenderprocess_fuzzer/startrenderprocess_fuzzer.cpp new file mode 100755 index 0000000000..2189a0bf5d --- /dev/null +++ b/test/fuzztest/startrenderprocess_fuzzer/startrenderprocess_fuzzer.cpp @@ -0,0 +1,91 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startrenderprocess_fuzzer.h" + +#include +#include + +#include "ability_record.h" +#include "app_mgr_client.h" +#include "configuration.h" +#include "parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr appMgrClient = std::make_shared(); + if (!appMgrClient) { + return false; + } + + std::string renderParam(data, size); + int32_t ipcFd = 100; + int32_t sharedFd = 100; + pid_t renderPid = 100; + int32_t crashFd = 100; + + if (appMgrClient->StartRenderProcess(renderParam, ipcFd, sharedFd, crashFd, + renderPid) != 0) { + return false; + } + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startrenderprocess_fuzzer/startrenderprocess_fuzzer.h b/test/fuzztest/startrenderprocess_fuzzer/startrenderprocess_fuzzer.h new file mode 100755 index 0000000000..8444c85c73 --- /dev/null +++ b/test/fuzztest/startrenderprocess_fuzzer/startrenderprocess_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTRENDERPROCESS_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTRENDERPROCESS_FUZZER_H + +#define FUZZ_PROJECT_NAME "startrenderprocess_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_STARTRENDERPROCESS_FUZZER_H diff --git a/test/fuzztest/startserviceextensionability_fuzzer/BUILD.gn b/test/fuzztest/startserviceextensionability_fuzzer/BUILD.gn new file mode 100755 index 0000000000..27b76a3373 --- /dev/null +++ b/test/fuzztest/startserviceextensionability_fuzzer/BUILD.gn @@ -0,0 +1,70 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/ability_context_native" + +##############################fuzztest########################################## +ohos_fuzztest("StartServiceExtensionAbilityFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/startserviceextensionability_fuzzer" + + include_dirs = [] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + sources = [ "startserviceextensionability_fuzzer.cpp" ] + + configs = [] + + deps = [ + "${ability_runtime_innerkits_path}/dataobs_manager:dataobs_manager", + "${ability_runtime_native_path}/ability:ability_context_native", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_native_path}/appkit:app_context", + "${ability_runtime_native_path}/appkit:app_context_utils", + "${ability_runtime_native_path}/appkit:appkit_delegator", + ] + + external_deps = [ + "ability_base:want", + "ability_runtime:ability_manager", + "appspawn:appspawn_socket_client", + "bundle_framework:appexecfwk_base", + "common_event_service:cesfwk_innerkits", + "ipc:ipc_core", + "napi:ace_napi", + "samgr:samgr_proxy", + ] +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartServiceExtensionAbilityFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startserviceextensionability_fuzzer/corpus/init b/test/fuzztest/startserviceextensionability_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startserviceextensionability_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startserviceextensionability_fuzzer/project.xml b/test/fuzztest/startserviceextensionability_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startserviceextensionability_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startserviceextensionability_fuzzer/startserviceextensionability_fuzzer.cpp b/test/fuzztest/startserviceextensionability_fuzzer/startserviceextensionability_fuzzer.cpp new file mode 100755 index 0000000000..794e036ca8 --- /dev/null +++ b/test/fuzztest/startserviceextensionability_fuzzer/startserviceextensionability_fuzzer.cpp @@ -0,0 +1,97 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startserviceextensionability_fuzzer.h" + +#include +#include + +#include "ability_context_impl.h" +#include "parcel.h" +#include "want.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr context = + std::make_shared(); + + int32_t accountId = 100; + if (!context) { + return false; + } + + // fuzz for want + Parcel wantParcel; + Want* want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (want) { + context->StartServiceExtensionAbility(*want); + context->StartServiceExtensionAbility(*want, accountId); + } + } + + if (want) { + delete want; + want = nullptr; + } + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startserviceextensionability_fuzzer/startserviceextensionability_fuzzer.h b/test/fuzztest/startserviceextensionability_fuzzer/startserviceextensionability_fuzzer.h new file mode 100755 index 0000000000..04b5fae2b0 --- /dev/null +++ b/test/fuzztest/startserviceextensionability_fuzzer/startserviceextensionability_fuzzer.h @@ -0,0 +1,20 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSERVICEEXTENSIONABILITY_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSERVICEEXTENSIONABILITY_FUZZER_H + +#define FUZZ_PROJECT_NAME "startserviceextensionability_fuzzer" + +#endif diff --git a/test/fuzztest/startspecifiedability_fuzzer/BUILD.gn b/test/fuzztest/startspecifiedability_fuzzer/BUILD.gn new file mode 100755 index 0000000000..c5a47e0c32 --- /dev/null +++ b/test/fuzztest/startspecifiedability_fuzzer/BUILD.gn @@ -0,0 +1,74 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/app_manager" + +##############################fuzztest########################################## +ohos_fuzztest("StartSpecifiedAbilityFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startspecifiedability_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "startspecifiedability_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/app_manager:app_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:configuration", + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ "input:libmmi-client" ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartSpecifiedAbilityFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startspecifiedability_fuzzer/corpus/init b/test/fuzztest/startspecifiedability_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startspecifiedability_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startspecifiedability_fuzzer/project.xml b/test/fuzztest/startspecifiedability_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startspecifiedability_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startspecifiedability_fuzzer/startspecifiedability_fuzzer.cpp b/test/fuzztest/startspecifiedability_fuzzer/startspecifiedability_fuzzer.cpp new file mode 100755 index 0000000000..e0f3977821 --- /dev/null +++ b/test/fuzztest/startspecifiedability_fuzzer/startspecifiedability_fuzzer.cpp @@ -0,0 +1,98 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startspecifiedability_fuzzer.h" + +#include +#include + +#include "ability_record.h" +#include "app_mgr_client.h" +#include "configuration.h" +#include "parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr appMgrClient = std::make_shared(); + if (!appMgrClient) { + return false; + } + + // fuzz for want + Parcel wantParcel; + Want* want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (want) { + return false; + } + } + AbilityInfo abilityInfo; + + appMgrClient->StartSpecifiedAbility(*want, abilityInfo); + + if (want) { + delete want; + want = nullptr; + } + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startspecifiedability_fuzzer/startspecifiedability_fuzzer.h b/test/fuzztest/startspecifiedability_fuzzer/startspecifiedability_fuzzer.h new file mode 100755 index 0000000000..51d41e65d3 --- /dev/null +++ b/test/fuzztest/startspecifiedability_fuzzer/startspecifiedability_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSPECIFIEDABILITY_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSPECIFIEDABILITY_FUZZER_H + +#define FUZZ_PROJECT_NAME "startspecifiedability_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSPECIFIEDABILITY_FUZZER_H diff --git a/test/fuzztest/startsyncremotemissions_fuzzer/BUILD.gn b/test/fuzztest/startsyncremotemissions_fuzzer/BUILD.gn new file mode 100755 index 0000000000..a7081b3c51 --- /dev/null +++ b/test/fuzztest/startsyncremotemissions_fuzzer/BUILD.gn @@ -0,0 +1,77 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("StartSyncRemoteMissionsFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startsyncremotemissions_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "startsyncremotemissions_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:app_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartSyncRemoteMissionsFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startsyncremotemissions_fuzzer/corpus/init b/test/fuzztest/startsyncremotemissions_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startsyncremotemissions_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startsyncremotemissions_fuzzer/project.xml b/test/fuzztest/startsyncremotemissions_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startsyncremotemissions_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startsyncremotemissions_fuzzer/startsyncremotemissions_fuzzer.cpp b/test/fuzztest/startsyncremotemissions_fuzzer/startsyncremotemissions_fuzzer.cpp new file mode 100755 index 0000000000..f609d80ab4 --- /dev/null +++ b/test/fuzztest/startsyncremotemissions_fuzzer/startsyncremotemissions_fuzzer.cpp @@ -0,0 +1,82 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startsyncremotemissions_fuzzer.h" + +#include +#include + +#include "ability_manager_client.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +} +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + auto abilitymgr = AbilityManagerClient::GetInstance(); + if (!abilitymgr) { + return false; + } + + std::string devId(data, size); + bool fixConflict = *data % ENABLE; + int64_t tag = 1; + abilitymgr->StartSyncRemoteMissions(devId, fixConflict, tag); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startsyncremotemissions_fuzzer/startsyncremotemissions_fuzzer.h b/test/fuzztest/startsyncremotemissions_fuzzer/startsyncremotemissions_fuzzer.h new file mode 100755 index 0000000000..b4c05b52b5 --- /dev/null +++ b/test/fuzztest/startsyncremotemissions_fuzzer/startsyncremotemissions_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSYNCREMOTEMISSIONS_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTSYNCREMOTEMISSIONS_FUZZER_H + +#define FUZZ_PROJECT_NAME "startsyncremotemissions_fuzzer" + +#endif diff --git a/test/fuzztest/startupresidentprocess_fuzzer/BUILD.gn b/test/fuzztest/startupresidentprocess_fuzzer/BUILD.gn new file mode 100755 index 0000000000..3d84c43134 --- /dev/null +++ b/test/fuzztest/startupresidentprocess_fuzzer/BUILD.gn @@ -0,0 +1,74 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/app_manager" + +##############################fuzztest########################################## +ohos_fuzztest("StartupResidentProcessFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/startupresidentprocess_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "startupresidentprocess_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/app_manager:app_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:configuration", + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ "input:libmmi-client" ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":StartupResidentProcessFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/startupresidentprocess_fuzzer/corpus/init b/test/fuzztest/startupresidentprocess_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/startupresidentprocess_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/startupresidentprocess_fuzzer/project.xml b/test/fuzztest/startupresidentprocess_fuzzer/project.xml new file mode 100755 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/startupresidentprocess_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/startupresidentprocess_fuzzer/startupresidentprocess_fuzzer.cpp b/test/fuzztest/startupresidentprocess_fuzzer/startupresidentprocess_fuzzer.cpp new file mode 100755 index 0000000000..e796024321 --- /dev/null +++ b/test/fuzztest/startupresidentprocess_fuzzer/startupresidentprocess_fuzzer.cpp @@ -0,0 +1,83 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "startupresidentprocess_fuzzer.h" + +#include +#include + +#include "ability_record.h" +#include "app_mgr_client.h" +#include "configuration.h" +#include "parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr appMgrClient = std::make_shared(); + if (!appMgrClient) { + return false; + } + + std::vector bundleInfos; + appMgrClient->StartupResidentProcess(bundleInfos); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/startupresidentprocess_fuzzer/startupresidentprocess_fuzzer.h b/test/fuzztest/startupresidentprocess_fuzzer/startupresidentprocess_fuzzer.h new file mode 100755 index 0000000000..7ef1334261 --- /dev/null +++ b/test/fuzztest/startupresidentprocess_fuzzer/startupresidentprocess_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_STARTUPRESIDENTPROCESS_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_STARTUPRESIDENTPROCESS_FUZZER_H + +#define FUZZ_PROJECT_NAME "startupresidentprocess_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_STARTUPRESIDENTPROCESS_FUZZER_H