From ddd09dfb527356b8a5142d92f1223b82907d4e0c Mon Sep 17 00:00:00 2001 From: xuzheheng Date: Fri, 11 Nov 2022 07:36:28 +0000 Subject: [PATCH] xuzheheng1@huawei.com Signed-off-by: xuzheheng Change-Id: I904bff12f47f0f4f76df2203101163b578601ad3 --- test/fuzztest/BUILD.gn | 4 + .../BUILD.gn | 85 +++++++++++ .../abilitymanagerserviceeighth_fuzzer.cpp | 100 +++++++++++++ .../abilitymanagerserviceeighth_fuzzer.h | 21 +++ .../corpus/init | 16 ++ .../project.xml | 25 ++++ .../BUILD.gn | 84 +++++++++++ .../abilitymanagerserviceseventh_fuzzer.cpp | 140 ++++++++++++++++++ .../abilitymanagerserviceseventh_fuzzer.h | 21 +++ .../corpus/init | 16 ++ .../project.xml | 25 ++++ .../BUILD.gn | 85 +++++++++++ .../abilitymanagerservicesixth_fuzzer.cpp | 123 +++++++++++++++ .../abilitymanagerservicesixth_fuzzer.h | 21 +++ .../corpus/init | 16 ++ .../project.xml | 25 ++++ .../BUILD.gn | 85 +++++++++++ .../abilitymanagerservicethird_fuzzer.cpp | 116 +++++++++++++++ .../abilitymanagerservicethird_fuzzer.h | 21 +++ .../corpus/init | 16 ++ .../project.xml | 25 ++++ 21 files changed, 1070 insertions(+) create mode 100755 test/fuzztest/abilitymanagerserviceeighth_fuzzer/BUILD.gn create mode 100755 test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.cpp create mode 100755 test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.h create mode 100755 test/fuzztest/abilitymanagerserviceeighth_fuzzer/corpus/init create mode 100755 test/fuzztest/abilitymanagerserviceeighth_fuzzer/project.xml create mode 100755 test/fuzztest/abilitymanagerserviceseventh_fuzzer/BUILD.gn create mode 100755 test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.cpp create mode 100755 test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.h create mode 100755 test/fuzztest/abilitymanagerserviceseventh_fuzzer/corpus/init create mode 100755 test/fuzztest/abilitymanagerserviceseventh_fuzzer/project.xml create mode 100755 test/fuzztest/abilitymanagerservicesixth_fuzzer/BUILD.gn create mode 100755 test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.cpp create mode 100755 test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.h create mode 100755 test/fuzztest/abilitymanagerservicesixth_fuzzer/corpus/init create mode 100755 test/fuzztest/abilitymanagerservicesixth_fuzzer/project.xml create mode 100755 test/fuzztest/abilitymanagerservicethird_fuzzer/BUILD.gn create mode 100755 test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.cpp create mode 100755 test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.h create mode 100755 test/fuzztest/abilitymanagerservicethird_fuzzer/corpus/init create mode 100755 test/fuzztest/abilitymanagerservicethird_fuzzer/project.xml diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index e302a0adb5..d8bf2ef044 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -22,8 +22,12 @@ group("fuzztest") { "abilityconnectmanager_fuzzer:fuzztest", "abilitycontext_fuzzer:fuzztest", "abilityeventhandler_fuzzer:fuzztest", + "abilitymanagerserviceeighth_fuzzer:fuzztest", "abilitymanagerservicefirst_fuzzer:fuzztest", "abilitymanagerservicesecond_fuzzer:fuzztest", + "abilitymanagerserviceseventh_fuzzer:fuzztest", + "abilitymanagerservicesixth_fuzzer:fuzztest", + "abilitymanagerservicethird_fuzzer:fuzztest", # "abilitymanager_fuzzer:fuzztest", "abilityrunningrecord_fuzzer:fuzztest", diff --git a/test/fuzztest/abilitymanagerserviceeighth_fuzzer/BUILD.gn b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/BUILD.gn new file mode 100755 index 0000000000..96bbe398d2 --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/BUILD.gn @@ -0,0 +1,85 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("AbilityManagerServiceEighthFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/abilitymanagerserviceeighth_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitymanagerserviceeighth_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityManagerServiceEighthFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.cpp b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.cpp new file mode 100755 index 0000000000..d8bcc12a31 --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.cpp @@ -0,0 +1,100 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitymanagerserviceeighth_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "ability_manager_service.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + int intParam = static_cast(GetU32Data(data)); + int32_t int32Param = static_cast(GetU32Data(data)); + std::string stringParam(data, size); + + // fuzz for AbilityManagerService + auto abilityms = std::make_shared(); + std::shared_ptr callRecord; + abilityms->OnCallConnectDied(callRecord); + abilityms->GetMaxRestartNum(intParam); + abilityms->KillProcess(stringParam); + abilityms->ClearUpApplicationData(stringParam); + abilityms->UninstallApp(stringParam, int32Param); + abilityms->GetBundleManager(); + abilityms->PreLoadAppDataAbilities(stringParam, int32Param); + AbilityInfo abilityInfo; + abilityms->IsSystemUiApp(abilityInfo); + abilityms->IsSystemUI(stringParam); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.h b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.h new file mode 100755 index 0000000000..00581f33d4 --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/abilitymanagerserviceeighth_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICEEIGHTH_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICEEIGHTH_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitymanagerserviceeighth_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICEEIGHTH_FUZZER_H diff --git a/test/fuzztest/abilitymanagerserviceeighth_fuzzer/corpus/init b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/corpus/init new file mode 100755 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitymanagerserviceeighth_fuzzer/project.xml b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/project.xml new file mode 100755 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceeighth_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitymanagerserviceseventh_fuzzer/BUILD.gn b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/BUILD.gn new file mode 100755 index 0000000000..8aa05f53cb --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/BUILD.gn @@ -0,0 +1,84 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("AbilityManagerServiceSeventhFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitymanagerserviceseventh_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitymanagerserviceseventh_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityManagerServiceSeventhFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.cpp b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.cpp new file mode 100755 index 0000000000..3079832653 --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.cpp @@ -0,0 +1,140 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitymanagerserviceseventh_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "ability_manager_service.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +class MyAbilityConnection : public IAbilityConnection { +public: + MyAbilityConnection() = default; + virtual ~MyAbilityConnection() = default; + void OnAbilityConnectDone( + const AppExecFwk::ElementName &element, const sptr &remoteObject, int resultCode) override + {} + void OnAbilityDisconnectDone(const AppExecFwk::ElementName &element, int resultCode) override + {} + sptr AsObject() override + { + return {}; + } +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + int32_t int32Param = static_cast(GetU32Data(data)); + Parcel wantParcel; + Want *want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (!want) { + return false; + } + } + sptr token = GetFuzzAbilityToken(); + sptr connect = new MyAbilityConnection(); + + // fuzz for AbilityManagerService + auto abilityms = std::make_shared(); + abilityms->GetDataAbilityManagerByToken(token); + abilityms->ConnectBmsService(); + sptr target; + std::shared_ptr wantSenderInfo; + abilityms->GetWantSenderInfo(target, wantSenderInfo); + abilityms->GetAppMemorySize(); + abilityms->IsRamConstrainedDevice(); + abilityms->GetMissionSaveTime(); + abilityms->GetMissionIdByAbilityToken(token); + abilityms->GetAbilityTokenByMissionId(int32Param); + abilityms->StartRemoteAbilityByCall(*want, token, token); + AppExecFwk::ElementName element; + abilityms->ReleaseRemoteAbility(token, element); + abilityms->StartAbilityByCall(*want, connect, token); + abilityms->ReleaseCall(connect, element); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.h b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.h new file mode 100755 index 0000000000..c2ad01ee1e --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/abilitymanagerserviceseventh_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICESEVENTH_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICESEVENTH_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitymanagerserviceseventh_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICESEVENTH_FUZZER_H diff --git a/test/fuzztest/abilitymanagerserviceseventh_fuzzer/corpus/init b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/corpus/init new file mode 100755 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitymanagerserviceseventh_fuzzer/project.xml b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/project.xml new file mode 100755 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/abilitymanagerserviceseventh_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitymanagerservicesixth_fuzzer/BUILD.gn b/test/fuzztest/abilitymanagerservicesixth_fuzzer/BUILD.gn new file mode 100755 index 0000000000..3f27ed7698 --- /dev/null +++ b/test/fuzztest/abilitymanagerservicesixth_fuzzer/BUILD.gn @@ -0,0 +1,85 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("AbilityManagerServiceSixthFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/abilitymanagerservicesixth_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitymanagerservicesixth_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityManagerServiceSixthFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.cpp b/test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.cpp new file mode 100755 index 0000000000..0e028ec40f --- /dev/null +++ b/test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.cpp @@ -0,0 +1,123 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitymanagerservicesixth_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "ability_manager_service.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + int intParam = static_cast(GetU32Data(data)); + int32_t int32Param = static_cast(GetU32Data(data)); + Parcel wantParcel; + Want *want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (!want) { + return false; + } + } + sptr token = GetFuzzAbilityToken(); + + // fuzz for AbilityManagerService + auto abilityms = std::make_shared(); + abilityms->GetEventHandler(); + abilityms->InitMissionListManager(intParam, boolParam); + abilityms->GetUserId(); + AbilityRequest request; + abilityms->GenerateAbilityRequest(*want, intParam, request, token, int32Param); + abilityms->GenerateExtensionAbilityRequest(*want, request, token, int32Param); + abilityms->TerminateAbilityResult(token, intParam); + abilityms->StopServiceAbility(*want, int32Param); + std::shared_ptr abilityRecord; + abilityms->OnAbilityDied(abilityRecord); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.h b/test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.h new file mode 100755 index 0000000000..5cbb6ad039 --- /dev/null +++ b/test/fuzztest/abilitymanagerservicesixth_fuzzer/abilitymanagerservicesixth_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICESIXTH_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICESIXTH_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitymanagerservicesixth_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICESIXTH_FUZZER_H diff --git a/test/fuzztest/abilitymanagerservicesixth_fuzzer/corpus/init b/test/fuzztest/abilitymanagerservicesixth_fuzzer/corpus/init new file mode 100755 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/abilitymanagerservicesixth_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitymanagerservicesixth_fuzzer/project.xml b/test/fuzztest/abilitymanagerservicesixth_fuzzer/project.xml new file mode 100755 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/abilitymanagerservicesixth_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitymanagerservicethird_fuzzer/BUILD.gn b/test/fuzztest/abilitymanagerservicethird_fuzzer/BUILD.gn new file mode 100755 index 0000000000..efb38217eb --- /dev/null +++ b/test/fuzztest/abilitymanagerservicethird_fuzzer/BUILD.gn @@ -0,0 +1,85 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("AbilityManagerServiceThirdFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/abilitymanagerservicethird_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitymanagerservicethird_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityManagerServiceThirdFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.cpp b/test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.cpp new file mode 100755 index 0000000000..e1d0123052 --- /dev/null +++ b/test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.cpp @@ -0,0 +1,116 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitymanagerservicethird_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "ability_manager_service.h" +#undef protected +#undef private + +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + int32_t int32Param = static_cast(GetU32Data(data)); + int64_t int64Param = static_cast(GetU32Data(data)); + sptr token = GetFuzzAbilityToken(); + + // fuzz for AbilityManagerService + auto abilityms = std::make_shared(); + abilityms->HandleLoadTimeOut(int64Param); + abilityms->HandleActiveTimeOut(int64Param); + abilityms->HandleInactiveTimeOut(int64Param); + abilityms->HandleForegroundTimeOut(int64Param); + abilityms->HandleBackgroundTimeOut(int64Param); + abilityms->VerificationToken(token); + abilityms->VerificationAllToken(token); + sptr scheduler; + abilityms->GetDataAbilityManager(scheduler); + abilityms->GetListManagerByUserId(int32Param); + abilityms->GetConnectManagerByUserId(int32Param); + abilityms->GetDataAbilityManagerByUserId(int32Param); + abilityms->GetConnectManagerByToken(token); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.h b/test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.h new file mode 100755 index 0000000000..9e37562d7c --- /dev/null +++ b/test/fuzztest/abilitymanagerservicethird_fuzzer/abilitymanagerservicethird_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICETHIRD_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICETHIRD_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitymanagerservicethird_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYMANAGERSERVICETHIRD_FUZZER_H diff --git a/test/fuzztest/abilitymanagerservicethird_fuzzer/corpus/init b/test/fuzztest/abilitymanagerservicethird_fuzzer/corpus/init new file mode 100755 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/abilitymanagerservicethird_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitymanagerservicethird_fuzzer/project.xml b/test/fuzztest/abilitymanagerservicethird_fuzzer/project.xml new file mode 100755 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/abilitymanagerservicethird_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + +