From 4b6448b23c2b9872157cbd60a8fa368b9460d488 Mon Sep 17 00:00:00 2001 From: liuzongze Date: Sat, 12 Jul 2025 15:17:47 +0800 Subject: [PATCH] =?UTF-8?q?fuzz=E7=94=A8=E4=BE=8B=E8=A1=A5=E5=85=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: liuzongze Change-Id: Ie2a69423694d0a6127251194d91d041844a46978 --- test/fuzztest/BUILD.gn | 7 ++ .../abilitystubattachappdebug_fuzzer/BUILD.gn | 76 ++++++++++++++++ .../abilitystubattachappdebug_fuzzer.cpp | 88 +++++++++++++++++++ .../abilitystubattachappdebug_fuzzer.h | 21 +++++ .../corpus/init | 16 ++++ .../project.xml | 25 ++++++ .../abilitystubdetachappdebug_fuzzer/BUILD.gn | 76 ++++++++++++++++ .../abilitystubdetachappdebug_fuzzer.cpp | 88 +++++++++++++++++++ .../abilitystubdetachappdebug_fuzzer.h | 21 +++++ .../corpus/init | 16 ++++ .../project.xml | 25 ++++++ .../BUILD.gn | 76 ++++++++++++++++ ...itystubexecuteinsightintentdone_fuzzer.cpp | 88 +++++++++++++++++++ ...ilitystubexecuteinsightintentdone_fuzzer.h | 21 +++++ .../corpus/init | 16 ++++ .../project.xml | 25 ++++++ .../abilitystubexecuteintent_fuzzer/BUILD.gn | 76 ++++++++++++++++ .../abilitystubexecuteintent_fuzzer.cpp | 88 +++++++++++++++++++ .../abilitystubexecuteintent_fuzzer.h | 21 +++++ .../corpus/init | 16 ++++ .../project.xml | 25 ++++++ .../abilitystublogoutuser_fuzzer/BUILD.gn | 76 ++++++++++++++++ .../abilitystublogoutuser_fuzzer.cpp | 88 +++++++++++++++++++ .../abilitystublogoutuser_fuzzer.h | 21 +++++ .../abilitystublogoutuser_fuzzer/corpus/init | 16 ++++ .../abilitystublogoutuser_fuzzer/project.xml | 25 ++++++ .../BUILD.gn | 76 ++++++++++++++++ ...itystubregisterappdebuglistener_fuzzer.cpp | 88 +++++++++++++++++++ ...ilitystubregisterappdebuglistener_fuzzer.h | 21 +++++ .../corpus/init | 16 ++++ .../project.xml | 25 ++++++ .../BUILD.gn | 76 ++++++++++++++++ ...ystubunregisterappdebuglistener_fuzzer.cpp | 88 +++++++++++++++++++ ...itystubunregisterappdebuglistener_fuzzer.h | 21 +++++ .../corpus/init | 16 ++++ .../project.xml | 25 ++++++ 36 files changed, 1589 insertions(+) create mode 100644 test/fuzztest/abilitystubattachappdebug_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.cpp create mode 100644 test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.h create mode 100644 test/fuzztest/abilitystubattachappdebug_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystubattachappdebug_fuzzer/project.xml create mode 100644 test/fuzztest/abilitystubdetachappdebug_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.cpp create mode 100644 test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.h create mode 100644 test/fuzztest/abilitystubdetachappdebug_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystubdetachappdebug_fuzzer/project.xml create mode 100644 test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.cpp create mode 100644 test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.h create mode 100644 test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/project.xml create mode 100644 test/fuzztest/abilitystubexecuteintent_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.cpp create mode 100644 test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.h create mode 100644 test/fuzztest/abilitystubexecuteintent_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystubexecuteintent_fuzzer/project.xml create mode 100644 test/fuzztest/abilitystublogoutuser_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.cpp create mode 100644 test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.h create mode 100644 test/fuzztest/abilitystublogoutuser_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystublogoutuser_fuzzer/project.xml create mode 100644 test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.cpp create mode 100644 test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.h create mode 100644 test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/project.xml create mode 100644 test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/BUILD.gn create mode 100644 test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.cpp create mode 100644 test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.h create mode 100644 test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/corpus/init create mode 100644 test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/project.xml diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index 3f0fc5cb8e..38a806e504 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -138,6 +138,7 @@ group("fuzztest") { "abilitystubaddfreeinstallobserver_fuzzer:fuzztest", "abilitystubaddwindowinfodone_fuzzer:fuzztest", "abilitystubattachabilitythread_fuzzer:fuzztest", + "abilitystubattachappdebug_fuzzer:fuzztest", "abilitystubcallrequestdone_fuzzer:fuzztest", "abilitystubcalluiabilitybyscb_fuzzer:fuzztest", "abilitystubcancelwantsender_fuzzer:fuzztest", @@ -160,6 +161,7 @@ group("fuzztest") { "abilitystubcontinuemissionofbundlename_fuzzer:fuzztest", "abilitystubdelegatordoabilitybackground_fuzzer:fuzztest", "abilitystubdelegatordoabilityforeground_fuzzer:fuzztest", + "abilitystubdetachappdebug_fuzzer:fuzztest", "abilitystubdisconnectability_fuzzer:fuzztest", "abilitystubdisconnectabilitydone_fuzzer:fuzztest", "abilitystubdoabilitybackground_fuzzer:fuzztest", @@ -167,6 +169,8 @@ group("fuzztest") { "abilitystubdumpabilityinfodone_fuzzer:fuzztest", "abilitystubdumpstate_fuzzer:fuzztest", "abilitystubdumpsysstate_fuzzer:fuzztest", + "abilitystubexecuteinsightintentdone_fuzzer:fuzztest", + "abilitystubexecuteintent_fuzzer:fuzztest", "abilitystubfinishusertest_fuzzer:fuzztest", "abilitystubforceexitapp_fuzzer:fuzztest", "abilitystubfreeinstallabilityfromremote_fuzzer:fuzztest", @@ -200,6 +204,7 @@ group("fuzztest") { "abilitystubisrunninginstabilitytest_fuzzer:fuzztest", "abilitystubkillprocess_fuzzer:fuzztest", "abilitystubliststackinfodone_fuzzer:fuzztest", + "abilitystublogoutuser_fuzzer:fuzztest", "abilitystublockmissionforcleanup_fuzzer:fuzztest", "abilitystubluckmissiondone_fuzzer:fuzztest", "abilitystubmaximizemultiwindowdone_fuzzer:fuzztest", @@ -224,6 +229,7 @@ group("fuzztest") { "abilitystubprepareterminateability_fuzzer:fuzztest", "abilitystubquerymissionvaild_fuzzer:fuzztest", "abilitystubrecordappexitreason_fuzzer:fuzztest", + "abilitystubregisterappdebuglistener_fuzzer:fuzztest", "abilitystubregistercancellistener_fuzzer:fuzztest", "abilitystubregistercollaborator_fuzzer:fuzztest", "abilitystubregisterconnectionobserver_fuzzer:fuzztest", @@ -274,6 +280,7 @@ group("fuzztest") { "abilitystubuninstallapp_fuzzer:fuzztest", "abilitystubunlockmissionforcleanup_fuzzer:fuzztest", "abilitystubunluckmissiondone_fuzzer:fuzztest", + "abilitystubunregisterappdebuglistener_fuzzer:fuzztest", "abilitystubunregistercancellistener_fuzzer:fuzztest", "abilitystubunregistercollaborator_fuzzer:fuzztest", "abilitystubunregisterconnectionobserver_fuzzer:fuzztest", diff --git a/test/fuzztest/abilitystubattachappdebug_fuzzer/BUILD.gn b/test/fuzztest/abilitystubattachappdebug_fuzzer/BUILD.gn new file mode 100644 index 0000000000..2f5e5f2dfb --- /dev/null +++ b/test/fuzztest/abilitystubattachappdebug_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubAttachAppDebugFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystubattachappdebug_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystubattachappdebug_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubAttachAppDebugFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.cpp b/test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.cpp new file mode 100644 index 0000000000..35e252135a --- /dev/null +++ b/test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystubattachappdebug_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::ATTACH_APP_DEBUG); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.h b/test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.h new file mode 100644 index 0000000000..d28cb072a5 --- /dev/null +++ b/test/fuzztest/abilitystubattachappdebug_fuzzer/abilitystubattachappdebug_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBATTACHAPPDEBUG_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBATTACHAPPDEBUG_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystubattachappdebug_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBATTACHAPPDEBUG_FUZZER_H diff --git a/test/fuzztest/abilitystubattachappdebug_fuzzer/corpus/init b/test/fuzztest/abilitystubattachappdebug_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystubattachappdebug_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystubattachappdebug_fuzzer/project.xml b/test/fuzztest/abilitystubattachappdebug_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystubattachappdebug_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitystubdetachappdebug_fuzzer/BUILD.gn b/test/fuzztest/abilitystubdetachappdebug_fuzzer/BUILD.gn new file mode 100644 index 0000000000..8085a8ad32 --- /dev/null +++ b/test/fuzztest/abilitystubdetachappdebug_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubDetachAppDebugFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystubdetachappdebug_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystubdetachappdebug_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubDetachAppDebugFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.cpp b/test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.cpp new file mode 100644 index 0000000000..3dde764113 --- /dev/null +++ b/test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystubdetachappdebug_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::DETACH_APP_DEBUG); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.h b/test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.h new file mode 100644 index 0000000000..7868958331 --- /dev/null +++ b/test/fuzztest/abilitystubdetachappdebug_fuzzer/abilitystubdetachappdebug_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBDETACHAPPDEBUG_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBDETACHAPPDEBUG_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystubdetachappdebug_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBDETACHAPPDEBUG_FUZZER_H diff --git a/test/fuzztest/abilitystubdetachappdebug_fuzzer/corpus/init b/test/fuzztest/abilitystubdetachappdebug_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystubdetachappdebug_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystubdetachappdebug_fuzzer/project.xml b/test/fuzztest/abilitystubdetachappdebug_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystubdetachappdebug_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/BUILD.gn b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/BUILD.gn new file mode 100644 index 0000000000..bd4a3bc132 --- /dev/null +++ b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubExecuteInsightIntentDoneFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystubexecuteinsightintentdone_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystubexecuteinsightintentdone_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubExecuteInsightIntentDoneFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.cpp b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.cpp new file mode 100644 index 0000000000..10577d3a5f --- /dev/null +++ b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystubexecuteinsightintentdone_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::EXECUTE_INSIGHT_INTENT_DONE); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.h b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.h new file mode 100644 index 0000000000..af240e3473 --- /dev/null +++ b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/abilitystubexecuteinsightintentdone_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBEXECUTEINSIGHTINTENTDONE_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBEXECUTEINSIGHTINTENTDONE_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystubexecuteinsightintentdone_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBEXECUTEINSIGHTINTENTDONE_FUZZER_H diff --git a/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/corpus/init b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/project.xml b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystubexecuteinsightintentdone_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitystubexecuteintent_fuzzer/BUILD.gn b/test/fuzztest/abilitystubexecuteintent_fuzzer/BUILD.gn new file mode 100644 index 0000000000..ac50b49c42 --- /dev/null +++ b/test/fuzztest/abilitystubexecuteintent_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubExecuteIntentFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystubexecuteintent_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystubexecuteintent_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubExecuteIntentFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.cpp b/test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.cpp new file mode 100644 index 0000000000..7b31c03633 --- /dev/null +++ b/test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystubexecuteintent_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::EXECUTE_INTENT); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.h b/test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.h new file mode 100644 index 0000000000..50bcd5964e --- /dev/null +++ b/test/fuzztest/abilitystubexecuteintent_fuzzer/abilitystubexecuteintent_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBEXECUTEINTENT_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBEXECUTEINTENT_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystubexecuteintent_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBEXECUTEINTENT_FUZZER_H diff --git a/test/fuzztest/abilitystubexecuteintent_fuzzer/corpus/init b/test/fuzztest/abilitystubexecuteintent_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystubexecuteintent_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystubexecuteintent_fuzzer/project.xml b/test/fuzztest/abilitystubexecuteintent_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystubexecuteintent_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitystublogoutuser_fuzzer/BUILD.gn b/test/fuzztest/abilitystublogoutuser_fuzzer/BUILD.gn new file mode 100644 index 0000000000..85a48185f5 --- /dev/null +++ b/test/fuzztest/abilitystublogoutuser_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubLogoutUserFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystublogoutuser_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystublogoutuser_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubLogoutUserFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.cpp b/test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.cpp new file mode 100644 index 0000000000..b110676dd4 --- /dev/null +++ b/test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystublogoutuser_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::LOGOUT_USER); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.h b/test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.h new file mode 100644 index 0000000000..bdd3424169 --- /dev/null +++ b/test/fuzztest/abilitystublogoutuser_fuzzer/abilitystublogoutuser_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBLOGOUTUSER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBLOGOUTUSER_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystublogoutuser_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBLOGOUTUSER_FUZZER_H diff --git a/test/fuzztest/abilitystublogoutuser_fuzzer/corpus/init b/test/fuzztest/abilitystublogoutuser_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystublogoutuser_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystublogoutuser_fuzzer/project.xml b/test/fuzztest/abilitystublogoutuser_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystublogoutuser_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/BUILD.gn b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/BUILD.gn new file mode 100644 index 0000000000..cc4a10a2e7 --- /dev/null +++ b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubRegisterAppDebugListenerFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystubregisterappdebuglistener_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystubregisterappdebuglistener_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubRegisterAppDebugListenerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.cpp b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.cpp new file mode 100644 index 0000000000..2316ad5fad --- /dev/null +++ b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystubregisterappdebuglistener_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::REGISTER_APP_DEBUG_LISTENER); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.h b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.h new file mode 100644 index 0000000000..3d8991b11b --- /dev/null +++ b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/abilitystubregisterappdebuglistener_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBREGISTERAPPDEBUGLISTENER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBREGISTERAPPDEBUGLISTENER_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystubregisterappdebuglistener_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBREGISTERAPPDEBUGLISTENER_FUZZER_H diff --git a/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/corpus/init b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/project.xml b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystubregisterappdebuglistener_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/BUILD.gn b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/BUILD.gn new file mode 100644 index 0000000000..f1464ea9b8 --- /dev/null +++ b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/BUILD.gn @@ -0,0 +1,76 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") + +##############################fuzztest########################################## +ohos_fuzztest("AbilityStubUnRegisterAppDebugListenerFuzzTest") { + module_out_path = fuzz_test_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/abilitystubunregisterappdebuglistener_fuzzer" + include_dirs = [ "${ability_runtime_innerkits_path}/ability_manager/include" ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "abilitystubunregisterappdebuglistener_fuzzer.cpp" ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ffrt:libffrt", + "hilog:libhilog", + "hisysevent:libhisysevent", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + external_deps += [ + "input:libmmi-client", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":AbilityStubUnRegisterAppDebugListenerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.cpp b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.cpp new file mode 100644 index 0000000000..969a3fc039 --- /dev/null +++ b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "abilitystubunregisterappdebuglistener_fuzzer.h" + +#include +#include + +#define private public +#include "ability_manager_service.h" +#undef private +#include "message_parcel.h" +#include "securec.h" + +using namespace OHOS::AAFwk; + +namespace OHOS { +namespace { +constexpr size_t U32_AT_SIZE = 4; +} +const std::u16string ABILITYMGR_INTERFACE_TOKEN = u"ohos.aafwk.AbilityManager"; + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + uint32_t code = static_cast(AbilityManagerInterfaceCode::UNREGISTER_APP_DEBUG_LISTENER); + + MessageParcel parcel; + parcel.WriteInterfaceToken(ABILITYMGR_INTERFACE_TOKEN); + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->subManagersHelper_ = + std::make_shared(nullptr, nullptr); + DelayedSingleton::GetInstance()->subManagersHelper_->currentUIAbilityManager_ = + std::make_shared(); + DelayedSingleton::GetInstance()->OnRemoteRequest(code, parcel, reply, option); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = static_cast(malloc(size + 1)); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.h b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.h new file mode 100644 index 0000000000..2ce8701d92 --- /dev/null +++ b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/abilitystubunregisterappdebuglistener_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBUNREGISTERAPPDEBUGLISTENER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBUNREGISTERAPPDEBUGLISTENER_FUZZER_H + +#define FUZZ_PROJECT_NAME "abilitystubunregisterappdebuglistener_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_ABILITYSTUBUNREGISTERAPPDEBUGLISTENER_FUZZER_H diff --git a/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/corpus/init b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/corpus/init new file mode 100644 index 0000000000..7ade8a0faa --- /dev/null +++ b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/project.xml b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/project.xml new file mode 100644 index 0000000000..66e1dcac47 --- /dev/null +++ b/test/fuzztest/abilitystubunregisterappdebuglistener_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + +