From aa18e4e062c9c70bce86b839d531981bb5cb254e Mon Sep 17 00:00:00 2001 From: wujiqin Date: Wed, 16 Nov 2022 17:04:06 +0800 Subject: [PATCH] =?UTF-8?q?IssueNo:https://gitee.com/openharmony/ability?= =?UTF-8?q?=5Fability=5Fruntime/issues/I61HNZ=3Ffrom=3Dproject-issue=20Des?= =?UTF-8?q?cription:=E5=85=83=E8=83=BD=E5=8A=9Bfuzz=E8=A1=A5=E9=BD=9001=20?= =?UTF-8?q?Sig:SIG=5FApplicationFramework=20Feature=20or=20Bugfix:Bugfix?= =?UTF-8?q?=20Binary=20Source:=20No?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: wujiqin Change-Id: Ie880d8b054cd5a23f3a9d8a6a03ea36ec017da73 --- test/fuzztest/BUILD.gn | 2 + .../connectionobserverclient_fuzzer/BUILD.gn | 88 ++++++++++++ .../connectionobserverclient_fuzzer.cpp | 128 ++++++++++++++++++ .../connectionobserverclient_fuzzer.h | 21 +++ .../corpus/init | 16 +++ .../project.xml | 25 ++++ .../BUILD.gn | 87 ++++++++++++ .../connectionobserverclientimpl_fuzzer.cpp | 122 +++++++++++++++++ .../connectionobserverclientimpl_fuzzer.h | 21 +++ .../corpus/init | 16 +++ .../project.xml | 25 ++++ 11 files changed, 551 insertions(+) create mode 100644 test/fuzztest/connectionobserverclient_fuzzer/BUILD.gn create mode 100644 test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.cpp create mode 100644 test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.h create mode 100644 test/fuzztest/connectionobserverclient_fuzzer/corpus/init create mode 100644 test/fuzztest/connectionobserverclient_fuzzer/project.xml create mode 100644 test/fuzztest/connectionobserverclientimpl_fuzzer/BUILD.gn create mode 100644 test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.cpp create mode 100644 test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.h create mode 100644 test/fuzztest/connectionobserverclientimpl_fuzzer/corpus/init create mode 100644 test/fuzztest/connectionobserverclientimpl_fuzzer/project.xml diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index fc50c936fd..13738214d8 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -79,6 +79,8 @@ group("fuzztest") { "closeability_fuzzer:fuzztest", "completefirstframedrawing_fuzzer:fuzztest", "connectability_fuzzer:fuzztest", + "connectionobserverclient_fuzzer:fuzztest", + "connectionobserverclientimpl_fuzzer:fuzztest", "connectionstatemanager_fuzzer:fuzztest", "continueability_fuzzer:fuzztest", diff --git a/test/fuzztest/connectionobserverclient_fuzzer/BUILD.gn b/test/fuzztest/connectionobserverclient_fuzzer/BUILD.gn new file mode 100644 index 0000000000..2f5a36ddac --- /dev/null +++ b/test/fuzztest/connectionobserverclient_fuzzer/BUILD.gn @@ -0,0 +1,88 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +import("//foundation/resourceschedule/background_task_mgr/bgtaskmgr.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("ConnectionObserverClientFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/connectionobserverclient_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${bgtaskmgr_interfaces_path}/innerkits/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "connectionobserverclient_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:connection_obs_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":ConnectionObserverClientFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.cpp b/test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.cpp new file mode 100644 index 0000000000..c9c4d2a3b0 --- /dev/null +++ b/test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.cpp @@ -0,0 +1,128 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "connectionobserverclient_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "connection_observer_client.h" +#include "service_proxy_adapter.h" +#undef protected +#undef private + +#include "ability_record.h" +#include "continuous_task_callback_info.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; + +class MyConnectionObserver : public ConnectionObserver { +public: + MyConnectionObserver() = default; + virtual ~MyConnectionObserver() = default; + void OnExtensionConnected(const ConnectionData &data) override + {} + void OnExtensionDisconnected(const ConnectionData &data) override + {} + void OnDlpAbilityOpened(const DlpStateData &data) override + {} + void OnDlpAbilityClosed(const DlpStateData &data) override + {} + void OnServiceDied() override + {} +}; + +class MyAbilityConnectionObserver : public IConnectionObserver { +public: + MyAbilityConnectionObserver() = default; + virtual ~MyAbilityConnectionObserver() = default; + void OnExtensionConnected(const ConnectionData &data) override + {} + void OnExtensionDisconnected(const ConnectionData &data) override + {} + void OnDlpAbilityOpened(const DlpStateData &data) override + {} + void OnDlpAbilityClosed(const DlpStateData &data) override + {} + sptr AsObject() override + { + return {}; + } +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr observer = std::make_shared(); + // fuzz for connectionObserverClient + auto connectionObserverClient = std::make_shared(); + connectionObserverClient->UnregisterObserver(observer); + sptr remoteObj; + auto serviceProxyAdapter = std::make_shared(remoteObj); + sptr cobserver = new MyAbilityConnectionObserver(); + serviceProxyAdapter->UnregisterObserver(cobserver); + serviceProxyAdapter->GetProxyObject(); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.h b/test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.h new file mode 100644 index 0000000000..f35e3575e2 --- /dev/null +++ b/test/fuzztest/connectionobserverclient_fuzzer/connectionobserverclient_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONOBSERVERCLIENT_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONOBSERVERCLIENT_FUZZER_H + +#define FUZZ_PROJECT_NAME "connectionobserverclient_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONOBSERVERCLIENT_FUZZER_H diff --git a/test/fuzztest/connectionobserverclient_fuzzer/corpus/init b/test/fuzztest/connectionobserverclient_fuzzer/corpus/init new file mode 100644 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/connectionobserverclient_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/connectionobserverclient_fuzzer/project.xml b/test/fuzztest/connectionobserverclient_fuzzer/project.xml new file mode 100644 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/connectionobserverclient_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/connectionobserverclientimpl_fuzzer/BUILD.gn b/test/fuzztest/connectionobserverclientimpl_fuzzer/BUILD.gn new file mode 100644 index 0000000000..ddd7944d34 --- /dev/null +++ b/test/fuzztest/connectionobserverclientimpl_fuzzer/BUILD.gn @@ -0,0 +1,87 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +import("//foundation/resourceschedule/background_task_mgr/bgtaskmgr.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("ConnectionObserverClientImplFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = "${ability_runtime_test_path}/fuzztest/connectionobserverclientimpl_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${bgtaskmgr_interfaces_path}/innerkits/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "connectionobserverclientimpl_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:connection_obs_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":ConnectionObserverClientImplFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.cpp b/test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.cpp new file mode 100644 index 0000000000..557857bfd0 --- /dev/null +++ b/test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.cpp @@ -0,0 +1,122 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "connectionobserverclientimpl_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "connection_observer_client_impl.h" +#include "service_proxy_adapter.h" +#undef protected +#undef private + +#include "ability_record.h" +#include "continuous_task_callback_info.h" +#include "connection_observer.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; + +class MyConnectionObserver : public ConnectionObserver { +public: + MyConnectionObserver() = default; + virtual ~MyConnectionObserver() = default; + void OnExtensionConnected(const ConnectionData &data) override + {} + void OnExtensionDisconnected(const ConnectionData &data) override + {} + void OnDlpAbilityOpened(const DlpStateData &data) override + {} + void OnDlpAbilityClosed(const DlpStateData &data) override + {} + void OnServiceDied() override + {} +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr observer = std::make_shared(); + // fuzz for connectionObserverClientImpl + auto connectionObserverClientImpl = std::make_shared(); + connectionObserverClientImpl->UnregisterObserver(observer); + AbilityRuntime::ConnectionData connectionData; + connectionObserverClientImpl->HandleExtensionConnected(connectionData); + connectionObserverClientImpl->HandleExtensionDisconnected(connectionData); + AbilityRuntime::DlpStateData dlpStateData; + connectionObserverClientImpl->HandleDlpAbilityOpened(dlpStateData); + connectionObserverClientImpl->HandleDlpAbilityClosed(dlpStateData); + sptr remoteObj; + auto serviceProxyAdapter = std::make_shared(remoteObj); + connectionObserverClientImpl->UnregisterFromServiceLocked(serviceProxyAdapter); + connectionObserverClientImpl->RemoveObserversLocked(observer); + wptr remote; + connectionObserverClientImpl->HandleRemoteDied(remote); + connectionObserverClientImpl->ResetProxy(remote); + connectionObserverClientImpl->ResetStatus(); + connectionObserverClientImpl->NotifyServiceDiedToObservers(); + connectionObserverClientImpl->GetObservers(); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.h b/test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.h new file mode 100644 index 0000000000..c0d1d5e663 --- /dev/null +++ b/test/fuzztest/connectionobserverclientimpl_fuzzer/connectionobserverclientimpl_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONOBSERVERCLIENTIMPL_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONOBSERVERCLIENTIMPL_FUZZER_H + +#define FUZZ_PROJECT_NAME "connectionobserverclientimpl_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONOBSERVERCLIENTIMPL_FUZZER_H diff --git a/test/fuzztest/connectionobserverclientimpl_fuzzer/corpus/init b/test/fuzztest/connectionobserverclientimpl_fuzzer/corpus/init new file mode 100644 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/connectionobserverclientimpl_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/connectionobserverclientimpl_fuzzer/project.xml b/test/fuzztest/connectionobserverclientimpl_fuzzer/project.xml new file mode 100644 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/connectionobserverclientimpl_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + +