description:add fuzz test case-01

Signed-off-by: 孙旭辉 <sunxuhui7@huawei.com>

test/fuzztest/BUILD.gn

@@ -257,7 +257,10 @@ group("fuzztest") {
     "continuemission_fuzzer:fuzztest",
     "crowdtestinterceptor_fuzzer:fuzztest",
     "dataabilitymanager_fuzzer:fuzztest",
+    "deeplinkreserveconfig_fuzzer:fuzztest",
     "delegatordoabilityforeground_fuzzer:fuzztest",
+    "dialogsessioninfo_fuzzer:fuzztest",
+    "dialogsessionmanager_fuzzer:fuzztest",
     "disposedobserver_fuzzer:fuzztest",
     "doabilitybackground_fuzzer:fuzztest",
     "doabilityforeground_fuzzer:fuzztest",
@@ -266,6 +269,7 @@ group("fuzztest") {
     "dumpsysstate_fuzzer:fuzztest",
     "extensionconfig_fuzzer:fuzztest",
     "extensioncontrolinterceptor_fuzzer:fuzztest",
+    "extensionpermissionsutil_fuzzer:fuzztest",
     "extensionrecordfactory_fuzzer:fuzztest",
     "extensionrecordmanagera_fuzzer:fuzztest",
     "faultdata_fuzzer:fuzztest",
@@ -294,10 +298,13 @@ group("fuzztest") {
     "loadability_fuzzer:fuzztest",
     "lockmissionforcleanup_fuzzer:fuzztest",
     "minimizeability_fuzzer:fuzztest",
+    "missiondatastorage_fuzzer:fuzztest",
     "missioninfomgra_fuzzer:fuzztest",
     "missioninfomgrb_fuzzer:fuzztest",
     "missioninfomgrc_fuzzer:fuzztest",
+    "missionlistenercontroller_fuzzer:fuzztest",
     "missionlistenerstub_fuzzer:fuzztest",
+    "missionlistmanagerfirst_fuzzer:fuzztest",
     "missionlistmanagerfourth_fuzzer:fuzztest",
     "missionlistmanagersecond_fuzzer:fuzztest",
     "missionlistmanagerthird_fuzzer:fuzztest",

test/fuzztest/deeplinkreserveconfig_fuzzer/BUILD.gn

@@ -0,0 +1,47 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+import("//foundation/ability/ability_runtime/ability_runtime.gni")
+module_output_path = "ability_runtime/abilitymgr"
+
+##############################fuzztest##########################################
+ohos_fuzztest("DeepLinkReserveConfigFuzzTest") {
+  module_out_path = module_output_path
+  fuzz_config_file =
+      "${ability_runtime_test_path}/fuzztest/deeplinkreserveconfig_fuzzer"
+  include_dirs =
+      [ "${ability_runtime_path}/services/abilitymgr/include/deeplink_reserve" ]
+
+  sources = [ "deeplinkreserveconfig_fuzzer.cpp" ]
+
+  configs = [ "${ability_runtime_services_path}/abilitymgr:abilityms_config" ]
+  cflags = []
+  deps = [ "${ability_runtime_services_path}/abilitymgr:abilityms" ]
+
+  external_deps = [ "c_utils:utils" ]
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":DeepLinkReserveConfigFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/deeplinkreserveconfig_fuzzer/corpus/init

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ

test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.cpp

@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "deeplinkreserveconfig_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <iostream>
+
+#include "securec.h"
+
+#define private public
+#include "deeplink_reserve_config.h"
+#undef private
+
+using json = nlohmann::json;
+using namespace OHOS::AAFwk;
+namespace OHOS {
+namespace {
+constexpr int INPUT_ZERO = 0;
+constexpr int INPUT_ONE = 1;
+constexpr int INPUT_TWO = 2;
+constexpr int INPUT_THREE = 3;
+constexpr size_t FOO_MAX_LEN = 1024;
+constexpr size_t U32_AT_SIZE = 4;
+constexpr size_t OFFSET_ZERO = 24;
+constexpr size_t OFFSET_ONE = 16;
+constexpr size_t OFFSET_TWO = 8;
+const std::string CONFIG_PATH = "/etc/ability_runtime/deeplink_reserve_config.json";
+const std::string DEFAULT_RESERVE_CONFIG_PATH = "/system/etc/deeplink_reserve_config.json";
+const std::string DEEPLINK_RESERVED_URI_NAME = "deepLinkReservedUri";
+const std::string BUNDLE_NAME = "bundleName";
+const std::string URIS_NAME = "uris";
+const std::string SCHEME_NAME = "scheme";
+const std::string HOST_NAME = "host";
+const std::string PORT_NAME = "port";
+const std::string PATH_NAME = "path";
+const std::string PATH_START_WITH_NAME = "pathStartWith";
+const std::string PATH_REGEX_NAME = "pathRegex";
+const std::string TYPE_NAME = "type";
+const std::string UTD_NAME = "utd";
+const std::string PORT_SEPARATOR = ":";
+const std::string SCHEME_SEPARATOR = "://";
+const std::string PATH_SEPARATOR = "/";
+const std::string PARAM_SEPARATOR = "?";
+}
+uint32_t GetU32Data(const char* ptr)
+{
+    // convert fuzz input data to an integer
+    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
+        ptr[INPUT_THREE];
+}
+bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
+{
+    auto &deepLinkReserveConfig = DeepLinkReserveConfig::GetInstance();
+    deepLinkReserveConfig.GetConfigPath();
+    deepLinkReserveConfig.LoadConfiguration();
+    std::string linkString(data, size);
+    std::string bundleName(data, size);
+    deepLinkReserveConfig.isLinkReserved(linkString, bundleName);
+    ReserveUri reservedUri;
+    std::string link(data, size);
+    std::string strParam(data, size);
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    reservedUri.scheme = strParam;
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    reservedUri.host = strParam;
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    reservedUri.port = strParam;
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    reservedUri.path = strParam;
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    reservedUri.pathStartWith = strParam;
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    reservedUri.pathRegex = strParam;
+    deepLinkReserveConfig.isUriMatched(reservedUri, link);
+    std::vector<ReserveUri> uriList;
+    json jsonUriObject;
+    jsonUriObject["SCHEME_NAME"] = SCHEME_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["HOST_NAME"] = HOST_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["PORT_NAME"] = PORT_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["PATH_NAME"] = PATH_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["PATH_START_WITH_NAME"] = PATH_START_WITH_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["PATH_REGEX_NAME"] = PATH_REGEX_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["TYPE_NAME"] = TYPE_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    jsonUriObject["UTD_NAME"] = UTD_NAME;
+    deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList);
+    return true;
+}
+
+bool DoSomethingInterestingWithMyAPIOne(const char* data, size_t size)
+{
+    auto &deepLinkReserveConfig1 = DeepLinkReserveConfig::GetInstance();
+    std::string filePath(data, size);
+    json jsonBuf;
+    deepLinkReserveConfig1.ReadFileInfoJson(filePath, jsonBuf);
+    json object;
+    deepLinkReserveConfig1.LoadReservedUriList(object);
+    object["DEEPLINK_RESERVED_URI_NAME"] = DEEPLINK_RESERVED_URI_NAME;
+    deepLinkReserveConfig1.LoadReservedUriList(object);
+    int32_t userId = static_cast<int32_t>(GetU32Data(data));
+    object["BUNDLE_NAME"] = userId;
+    deepLinkReserveConfig1.LoadReservedUriList(object);
+    object["BUNDLE_NAME"] = BUNDLE_NAME;
+    deepLinkReserveConfig1.LoadReservedUriList(object);
+    json uriArray = { "uri1", "uri2", "uri3" };
+    object["URIS_NAME"] = uriArray;
+    deepLinkReserveConfig1.LoadReservedUriList(object);
+    object["URIS_NAME"] = URIS_NAME;
+    deepLinkReserveConfig1.LoadReservedUriList(object);
+    return true;
+}
+}
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    if (data == nullptr) {
+        std::cout << "invalid data" << std::endl;
+        return 0;
+    }
+
+    /* Validate the length of size */
+    if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
+        return 0;
+    }
+
+    char* ch = (char*)malloc(size + 1);
+    if (ch == nullptr) {
+        std::cout << "malloc failed." << std::endl;
+        return 0;
+    }
+
+    (void)memset_s(ch, size + 1, 0x00, size + 1);
+    if (memcpy_s(ch, size + 1, data, size) != EOK) {
+        std::cout << "copy failed." << std::endl;
+        free(ch);
+        ch = nullptr;
+        return 0;
+    }
+
+    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
+    OHOS::DoSomethingInterestingWithMyAPIOne(ch, size);
+    free(ch);
+    ch = nullptr;
+    return 0;
+}
+

test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_DEEPLINKRESERVECONFIG_FUZZER_H
+#define FUZZTEST_OHOS_ABILITY_RUNTIME_DEEPLINKRESERVECONFIG_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "deeplinkreserveconfig_fuzzer"
+
+#endif

test/fuzztest/deeplinkreserveconfig_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>

test/fuzztest/dialogsessioninfo_fuzzer/dialogsessioninfo_fuzzer.cpp

@@ -52,6 +52,12 @@ bool DoSomethingInterestingWithMyAPI(const char *data, size_t size)
     auto dialogSessionInfo = std::make_shared<DialogSessionInfo>();
     dialogSessionInfo->ReadFromParcel(parcel);
     dialogSessionInfo->Marshalling(parcel);
+    DialogSessionInfo::Unmarshalling(parcel);
+
+    std::string str(data, size);
+    auto dialogAbilityInfo = std::make_shared<DialogAbilityInfo>();
+    dialogAbilityInfo->GetURI();
+
     return true;
 }
 } // namespace OHOS

test/fuzztest/dialogsessionmanager_fuzzer/BUILD.gn

@@ -0,0 +1,100 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+import("//foundation/ability/ability_runtime/ability_runtime.gni")
+module_output_path = "ability_runtime/abilitymgr"
+
+##############################fuzztest##########################################
+ohos_fuzztest("DialogSessionManagerFuzzTest") {
+  module_out_path = module_output_path
+
+  fuzz_config_file =
+      "${ability_runtime_test_path}/fuzztest/dialogsessionmanager_fuzzer"
+  include_dirs = [
+    "${ability_runtime_innerkits_path}/ability_manager/include",
+    "${ability_runtime_services_path}/abilitymgr/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [
+    "${ability_runtime_path}/services/abilitymgr/src/dialog_session/dialog_session_manager.cpp",
+    "${ability_runtime_services_path}/abilitymgr/src/start_ability_utils.cpp",
+    "dialogsessionmanager_fuzzer.cpp",
+  ]
+
+  configs = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
+    "${ability_runtime_services_path}/abilitymgr:abilityms_config",
+  ]
+  cflags = []
+  if (target_cpu == "arm") {
+    cflags += [ "-DBINDER_IPC_32BIT" ]
+  }
+  deps = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager",
+    "${ability_runtime_innerkits_path}/ability_manager:ability_start_options",
+    "${ability_runtime_innerkits_path}/app_manager:app_manager",
+    "${ability_runtime_native_path}/ability/native:abilitykit_native",
+    "${ability_runtime_native_path}/appkit:appkit_manager_helper",
+    "${ability_runtime_path}/utils/server/startup:startup_util",
+    "${ability_runtime_services_path}/abilitymgr:abilityms",
+    "${ability_runtime_services_path}/common:perm_verification",
+    "//third_party/jsoncpp:jsoncpp",
+    "//third_party/libjpeg-turbo:turbojpeg_static",
+  ]
+
+  external_deps = [
+    "ability_base:want",
+    "ability_base:zuri",
+    "bundle_framework:appexecfwk_base",
+    "bundle_framework:appexecfwk_core",
+    "c_utils:utils",
+    "common_event_service:cesfwk_innerkits",
+    "ffrt:libffrt",
+    "hilog:libhilog",
+    "hitrace:hitrace_meter",
+    "ipc:ipc_core",
+    "napi:ace_napi",
+    "safwk:system_ability_fwk",
+    "samgr:samgr_proxy",
+    "window_manager:libmodal_system_ui_extension_client",
+    "window_manager:libwsutils",
+  ]
+
+  if (background_task_mgr_continuous_task_enable) {
+    external_deps += [ "background_task_mgr:bgtaskmgr_innerkits" ]
+  }
+
+  if (ability_runtime_graphics) {
+    external_deps += [ "window_manager:libwm" ]
+  }
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":DialogSessionManagerFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/dialogsessionmanager_fuzzer/corpus/init

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ

test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.cpp

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dialogsessionmanager_fuzzer.h"
+#include <cstddef>
+#include <cstdint>
+#define private public
+#include "dialog_session_manager.h"
+#undef private
+#include "ability_record.h"
+
+using namespace OHOS::AAFwk;
+using namespace OHOS::AppExecFwk;
+
+namespace OHOS {
+namespace {
+constexpr int INPUT_ZERO = 0;
+constexpr int INPUT_ONE = 1;
+constexpr int INPUT_TWO = 2;
+constexpr int INPUT_THREE = 3;
+constexpr size_t FOO_MAX_LEN = 1024;
+constexpr size_t U32_AT_SIZE = 4;
+constexpr size_t OFFSET_ZERO = 24;
+constexpr size_t OFFSET_ONE = 16;
+constexpr size_t OFFSET_TWO = 8;
+constexpr uint8_t ENABLE = 2;
+} // namespace
+
+uint32_t GetU32Data(const char* ptr)
+{
+    // convert fuzz input data to an integer
+    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
+        ptr[INPUT_THREE];
+}
+
+sptr<Token> GetFuzzAbilityToken()
+{
+    sptr<Token> token = nullptr;
+    AbilityRequest abilityRequest;
+    abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
+    abilityRequest.abilityInfo.name = "MainAbility";
+    abilityRequest.abilityInfo.type = AbilityType::DATA;
+    std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
+    if (abilityRecord) {
+        token = abilityRecord->GetToken();
+    }
+    return token;
+}
+
+bool DoSomethingInterestingWithMyAPI(const char *data, size_t size)
+{
+    std::string bundleName(data, size);
+    std::string dialogSessionId(data, size);
+    std::string replaceWant(data, size);
+    bool isSelector = *data % ENABLE;
+    AAFwk::WantParams wantParams;
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    AbilityRequest abilityRequest;
+    std::vector<DialogAppInfo> dialogAppInfos;
+    std::vector<DialogAbilityInfo> targetAbilityInfos;
+    sptr<IRemoteObject> callerToken = GetFuzzAbilityToken();
+    Parcel wantParcel;
+    Want want;
+    auto dialogSessionInfo = std::make_shared<DialogSessionInfo>();
+    if (dialogSessionInfo == nullptr) {
+        return false;
+    }
+    std::shared_ptr<DialogCallerInfo> dialogCallerInfo = std::make_shared<DialogCallerInfo>();
+    if (dialogCallerInfo == nullptr) {
+        return false;
+    }
+    std::shared_ptr<DialogSessionManager> dialogSessionManager = std::make_shared<DialogSessionManager>();
+    if (dialogSessionManager == nullptr) {
+        return false;
+    }
+    dialogSessionManager->GenerateDialogSessionId();
+    dialogSessionManager->SetStartupSessionInfo(dialogSessionId, abilityRequest);
+    DialogAbilityInfo callerAbilityInfo;
+    dialogSessionManager->GenerateCallerAbilityInfo(abilityRequest, callerAbilityInfo);
+    dialogSessionManager->GenerateSelectorTargetAbilityInfos(dialogAppInfos, targetAbilityInfos);
+    dialogSessionManager->GenerateDialogCallerInfo(abilityRequest, int32Param, dialogCallerInfo, isSelector);
+    dialogSessionManager->NotifySCBToRecoveryAfterInterception(dialogSessionId, abilityRequest);
+    dialogSessionManager->GenerateDialogSessionRecordCommon(abilityRequest, int32Param, wantParams,
+        dialogAppInfos, isSelector);
+    dialogSessionManager->CreateJumpModalDialog(abilityRequest, int32Param, want);
+    dialogSessionManager->CreateImplicitSelectorModalDialog(abilityRequest, want, int32Param, dialogAppInfos);
+    dialogSessionManager->CreateCloneSelectorModalDialog(abilityRequest, want, int32Param, dialogAppInfos,
+        replaceWant);
+    dialogSessionManager->CreateModalDialogCommon(want, callerToken, dialogSessionId);
+    dialogSessionManager->HandleErmsResult(abilityRequest, int32Param, want);
+    dialogSessionManager->HandleErmsResultBySCB(abilityRequest, want);
+    dialogSessionManager->IsCreateCloneSelectorDialog(bundleName, int32Param);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    if (data == nullptr) {
+        std::cout << "invalid data" << std::endl;
+        return 0;
+    }
+
+    /* Validate the length of size */
+    if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
+        return 0;
+    }
+
+    char *ch = (char *)malloc(size + 1);
+    if (ch == nullptr) {
+        std::cout << "malloc failed." << std::endl;
+        return 0;
+    }
+
+    (void)memset_s(ch, size + 1, 0x00, size + 1);
+    if (memcpy_s(ch, size + 1, data, size) != EOK) {
+        std::cout << "copy failed." << std::endl;
+        free(ch);
+        ch = nullptr;
+        return 0;
+    }
+
+    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
+    free(ch);
+    ch = nullptr;
+    return 0;
+}

test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_DIALOG_SESSION_MANAGER_FUZZER_H
+#define FUZZTEST_OHOS_ABILITY_RUNTIME_DIALOG_SESSION_MANAGER_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "dialogsessionmanager_fuzzer"
+
+#endif

test/fuzztest/dialogsessionmanager_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>

test/fuzztest/extensionpermissionsutil_fuzzer/BUILD.gn

@@ -0,0 +1,89 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+import("//foundation/ability/ability_runtime/ability_runtime.gni")
+module_output_path = "ability_runtime/abilitymgr"
+
+##############################fuzztest##########################################
+ohos_fuzztest("ExtensionPermissionsUtilFuzzTest") {
+  module_out_path = module_output_path
+
+  fuzz_config_file =
+      "${ability_runtime_test_path}/fuzztest/extensionpermissionsutil_fuzzer"
+  include_dirs = [
+    "${ability_runtime_innerkits_path}/ability_manager/include",
+    "${ability_runtime_services_path}/abilitymgr/include",
+    "mock/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [
+    "${ability_runtime_services_path}/abilitymgr/src/utils/extension_permissions_util.cpp",
+    "extension_permissions_util_fuzzer.cpp",
+    "mock/src/mock_my_flag.cpp",
+    "mock/src/mock_permission_verification.cpp",
+  ]
+
+  configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ]
+  cflags = []
+  if (target_cpu == "arm") {
+    cflags += [ "-DBINDER_IPC_32BIT" ]
+  }
+  deps = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager",
+    "${ability_runtime_innerkits_path}/ability_manager:ability_start_options",
+    "${ability_runtime_native_path}/ability/native:abilitykit_native",
+    "${ability_runtime_services_path}/abilitymgr:abilityms",
+  ]
+
+  external_deps = [
+    "ability_base:want",
+    "ability_base:zuri",
+    "bundle_framework:appexecfwk_base",
+    "bundle_framework:appexecfwk_core",
+    "c_utils:utils",
+    "common_event_service:cesfwk_innerkits",
+    "config_policy:configpolicy_util",
+    "ffrt:libffrt",
+    "hilog:libhilog",
+    "hitrace:hitrace_meter",
+    "ipc:ipc_core",
+    "napi:ace_napi",
+    "safwk:system_ability_fwk",
+    "samgr:samgr_proxy",
+    "window_manager:libwsutils",
+  ]
+
+  if (ability_runtime_graphics) {
+    external_deps += [ "input:libmmi-client" ]
+  }
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":ExtensionPermissionsUtilFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/extensionpermissionsutil_fuzzer/corpus/init

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ

test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.cpp

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "extension_permissions_util.h"
+
+#include <cstddef>
+#include <cstdint>
+
+#include "ability_record.h"
+#define private public
+#include "extension_config.h"
+#define private public
+#include "mock_my_flag.h"
+#include "mock_permission_verification.h"
+
+using namespace OHOS::AAFwk;
+using namespace OHOS::AppExecFwk;
+
+namespace OHOS {
+namespace {
+constexpr int INPUT_ZERO = 0;
+constexpr int INPUT_ONE = 1;
+constexpr int INPUT_TWO = 2;
+constexpr int INPUT_THREE = 3;
+constexpr size_t FOO_MAX_LEN = 1024;
+constexpr size_t U32_AT_SIZE = 4;
+constexpr size_t OFFSET_ZERO = 24;
+constexpr size_t OFFSET_ONE = 16;
+constexpr size_t OFFSET_TWO = 8;
+constexpr uint8_t ENABLE = 2;
+} // namespace
+
+uint32_t GetU32Data(const char* ptr)
+{
+    // convert fuzz input data to an integer
+    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
+        ptr[INPUT_THREE];
+}
+
+bool DoSomethingInterestingWithMyAPI(const char *data, size_t size)
+{
+    std::string strParam(data, size);
+    MyFlag::flag_ = MyFlag::IS_SA_CALL;
+    auto extensionPermissionsUtil = std::make_shared<ExtensionPermissionsUtil>();
+    auto extensionType = GetU32Data(data) % static_cast<uint32_t>(ExtensionAbilityType::RECENT_PHOTO);
+    extensionPermissionsUtil->CheckSAPermission(static_cast<ExtensionAbilityType>(extensionType));
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    if (data == nullptr) {
+        std::cout << "invalid data" << std::endl;
+        return 0;
+    }
+
+    /* Validate the length of size */
+    if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
+        return 0;
+    }
+
+    char *ch = (char *)malloc(size + 1);
+    if (ch == nullptr) {
+        std::cout << "malloc failed." << std::endl;
+        return 0;
+    }
+
+    (void)memset_s(ch, size + 1, 0x00, size + 1);
+    if (memcpy_s(ch, size + 1, data, size) != EOK) {
+        std::cout << "copy failed." << std::endl;
+        free(ch);
+        ch = nullptr;
+        return 0;
+    }
+
+    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
+    free(ch);
+    ch = nullptr;
+    return 0;
+}

test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_EXTENSIONPERMISSIONSUTIL_FUZZER_H
+#define FUZZTEST_OHOS_ABILITY_RUNTIME_EXTENSIONPERMISSIONSUTIL_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "extensionpermissionsutil_fuzzer"
+
+#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_EXTENSIONPERMISSIONSUTIL_FUZZER_H

test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_my_flag.h

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef MOCK_MY_FLAG_H
+#define MOCK_MY_FLAG_H
+namespace OHOS {
+namespace AAFwk {
+class MyFlag {
+public:
+    enum FLAG {
+        IS_SA_CALL = 1,
+        IS_SHELL_CALL,
+        IS_SA_AND_SHELL_CALL,
+    };
+    static int flag_;
+};
+} // namespace AAFwk
+} // namespace OHOS
+#endif // MOCK_MY_FLAG_H

test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_permission_verification.h

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef OHOS_ABILITY_RUNTIME_PERMISSION_VERIFICATION_H
+#define OHOS_ABILITY_RUNTIME_PERMISSION_VERIFICATION_H
+
+#include "ipc_skeleton.h"
+#include "mock_my_flag.h"
+#include "singleton.h"
+#include "want.h"
+
+namespace OHOS {
+namespace AAFwk {
+
+class PermissionVerification : public DelayedSingleton<PermissionVerification> {
+public:
+    struct VerificationInfo {
+        bool visible = false;
+        bool isBackgroundCall = true;
+        bool associatedWakeUp = false;
+        uint32_t accessTokenId = 0;
+        int32_t apiTargetVersion = 0;
+    };
+
+    PermissionVerification() = default;
+    ~PermissionVerification() = default;
+
+    bool VerifyCallingPermission(const std::string &permissionName, const uint32_t specifyTokenId = 0) const;
+
+    bool IsSACall() const;
+
+    bool IsShellCall() const;
+
+    bool CheckSpecificSystemAbilityAccessPermission() const;
+
+    bool VerifyRunningInfoPerm() const;
+
+    bool VerifyControllerPerm() const;
+
+    bool VerifyDlpPermission(Want &want) const;
+
+    int VerifyAccountPermission() const;
+
+    bool VerifyMissionPermission() const;
+
+    int VerifyAppStateObserverPermission() const;
+
+    int32_t VerifyUpdateConfigurationPerm() const;
+
+    bool VerifyInstallBundlePermission() const;
+
+    bool VerifyGetBundleInfoPrivilegedPermission() const;
+
+    int CheckCallDataAbilityPermission(const VerificationInfo &verificationInfo, bool isShell) const;
+
+    int CheckCallServiceAbilityPermission(const VerificationInfo &verificationInfo) const;
+
+    int CheckCallAbilityPermission(const VerificationInfo &verificationInfo) const;
+
+    int CheckCallServiceExtensionPermission(const VerificationInfo &verificationInfo) const;
+
+    int CheckStartByCallPermission(const VerificationInfo &verificationInfo) const;
+
+    unsigned int GetCallingTokenID() const;
+
+    bool JudgeStartInvisibleAbility(const uint32_t accessTokenId, const bool visible) const;
+
+    bool JudgeStartAbilityFromBackground(const bool isBackgroundCall) const;
+
+    bool JudgeAssociatedWakeUp(const uint32_t accessTokenId, const bool associatedWakeUp) const;
+
+    int JudgeInvisibleAndBackground(const VerificationInfo &verificationInfo) const;
+
+    inline bool IsCallFromSameAccessToken(const uint32_t accessTokenId) const
+    {
+        return IPCSkeleton::GetCallingTokenID() == accessTokenId;
+    }
+
+    bool JudgeCallerIsAllowedToUseSystemAPI() const;
+    bool IsSystemAppCall() const;
+};
+} // namespace AAFwk
+} // namespace OHOS
+#endif // OHOS_ABILITY_RUNTIME_PERMISSION_VERIFICATION_H

test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_my_flag.cpp

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mock_my_flag.h"
+
+namespace OHOS {
+namespace AAFwk {
+int MyFlag::flag_ = 0;
+} // namespace AAFwk
+} // namespace OHOS

test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_permission_verification.cpp

@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "mock_permission_verification.h"
+
+namespace OHOS {
+namespace AAFwk {
+bool PermissionVerification::VerifyCallingPermission(
+    const std::string &permissionName, const uint32_t specifyTokenId) const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::IsSACall() const
+{
+    return (MyFlag::flag_ & MyFlag::FLAG::IS_SA_CALL);
+}
+bool PermissionVerification::IsShellCall() const
+{
+    return (MyFlag::flag_ & MyFlag::FLAG::IS_SHELL_CALL);
+}
+bool PermissionVerification::CheckSpecificSystemAbilityAccessPermission() const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::VerifyRunningInfoPerm() const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::VerifyControllerPerm() const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::VerifyDlpPermission(Want &want) const
+{
+    return !!(MyFlag::flag_);
+}
+int PermissionVerification::VerifyAccountPermission() const
+{
+    return MyFlag::flag_;
+}
+bool PermissionVerification::VerifyMissionPermission() const
+{
+    return !!(MyFlag::flag_);
+}
+int PermissionVerification::VerifyAppStateObserverPermission() const
+{
+    return MyFlag::flag_;
+}
+int32_t PermissionVerification::VerifyUpdateConfigurationPerm() const
+{
+    return static_cast<int32_t>(MyFlag::flag_);
+}
+bool PermissionVerification::VerifyInstallBundlePermission() const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::VerifyGetBundleInfoPrivilegedPermission() const
+{
+    return !!(MyFlag::flag_);
+}
+int PermissionVerification::CheckCallDataAbilityPermission(const VerificationInfo &verificationInfo, bool isShell) const
+{
+    return MyFlag::flag_;
+}
+int PermissionVerification::CheckCallServiceAbilityPermission(const VerificationInfo &verificationInfo) const
+{
+    return MyFlag::flag_;
+}
+int PermissionVerification::CheckCallAbilityPermission(const VerificationInfo &verificationInfo) const
+{
+    return MyFlag::flag_;
+}
+int PermissionVerification::CheckCallServiceExtensionPermission(const VerificationInfo &verificationInfo) const
+{
+    return MyFlag::flag_;
+}
+int PermissionVerification::CheckStartByCallPermission(const VerificationInfo &verificationInfo) const
+{
+    return MyFlag::flag_;
+}
+unsigned int PermissionVerification::GetCallingTokenID() const
+{
+    return static_cast<unsigned int>(MyFlag::flag_);
+}
+bool PermissionVerification::JudgeStartInvisibleAbility(const uint32_t accessTokenId, const bool visible) const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::JudgeStartAbilityFromBackground(const bool isBackgroundCall) const
+{
+    return !!(MyFlag::flag_);
+}
+bool PermissionVerification::JudgeAssociatedWakeUp(const uint32_t accessTokenId, const bool associatedWakeUp) const
+{
+    return !!(MyFlag::flag_);
+}
+int PermissionVerification::JudgeInvisibleAndBackground(const VerificationInfo &verificationInfo) const
+{
+    return MyFlag::flag_;
+}
+bool PermissionVerification::JudgeCallerIsAllowedToUseSystemAPI() const
+{
+    return true;
+}
+bool PermissionVerification::IsSystemAppCall() const
+{
+    return true;
+}
+} // namespace AAFwk
+} // namespace OHOS

test/fuzztest/extensionpermissionsutil_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>

test/fuzztest/missiondatastorage_fuzzer/BUILD.gn

@@ -0,0 +1,89 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+import("//foundation/ability/ability_runtime/ability_runtime.gni")
+module_output_path = "ability_runtime/abilitymgr"
+
+##############################fuzztest##########################################
+ohos_fuzztest("MissionDataStorageFuzzTest") {
+  module_out_path = module_output_path
+
+  fuzz_config_file =
+      "${ability_runtime_test_path}/fuzztest/missiondatastorage_fuzzer"
+  include_dirs = [
+    "${ability_runtime_innerkits_path}/ability_manager/include",
+    "${ability_runtime_innerkits_path}/dataobs_manager/include",
+    "${multimodalinput_path}/interfaces/native/innerkits/event/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "missiondatastorage_fuzzer.cpp" ]
+
+  configs = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
+    "${ability_runtime_services_path}/abilitymgr:abilityms_config",
+  ]
+
+  deps = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager",
+    "${ability_runtime_innerkits_path}/ability_manager:mission_info",
+    "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr",
+    "${ability_runtime_native_path}/ability/native:abilitykit_native",
+    "${ability_runtime_services_path}/abilitymgr:abilityms",
+    "${ability_runtime_services_path}/abilitymgr:mission_list",
+    "//third_party/jsoncpp:jsoncpp",
+  ]
+
+  external_deps = [
+    "ability_base:want",
+    "ability_base:zuri",
+    "bundle_framework:appexecfwk_base",
+    "c_utils:utils",
+    "common_event_service:cesfwk_core",
+    "common_event_service:cesfwk_innerkits",
+    "ffrt:libffrt",
+    "image_framework:image_native",
+    "ipc:ipc_core",
+    "napi:ace_napi",
+    "relational_store:native_dataability",
+    "relational_store:native_rdb",
+    "samgr:samgr_proxy",
+  ]
+
+  if (ability_runtime_graphics) {
+    deps += []
+    external_deps += [
+      "i18n:intl_util",
+      "window_manager:libwm",
+    ]
+  }
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":MissionDataStorageFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/missiondatastorage_fuzzer/corpus/init

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ

test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.cpp

@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "missiondatastorage_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+
+#define private public
+#include "mission_data_storage.h"
+#undef private
+
+#include "securec.h"
+#include "ability_record.h"
+
+using namespace OHOS::AAFwk;
+using namespace OHOS::AppExecFwk;
+
+namespace OHOS {
+namespace {
+constexpr int INPUT_ZERO = 0;
+constexpr int INPUT_ONE = 1;
+constexpr int INPUT_TWO = 2;
+constexpr int INPUT_THREE = 3;
+constexpr size_t FOO_MAX_LEN = 1024;
+constexpr size_t U32_AT_SIZE = 4;
+constexpr size_t OFFSET_ZERO = 24;
+constexpr size_t OFFSET_ONE = 16;
+constexpr size_t OFFSET_TWO = 8;
+constexpr uint8_t ENABLE = 2;
+} // namespace
+
+uint32_t GetU32Data(const char* ptr)
+{
+    // convert fuzz input data to an integer
+    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
+        ptr[INPUT_THREE];
+}
+
+bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
+{
+    int intParam = static_cast<int>(GetU32Data(data));
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    auto missionDataStorage = std::make_shared<MissionDataStorage>();
+    InnerMissionInfo missionInfo;
+    missionInfo.missionInfo.id = int32Param;
+    std::list<InnerMissionInfo> missionInfoList;
+    missionDataStorage->SaveMissionInfo(missionInfo);
+    missionDataStorage->LoadAllMissionInfo(missionInfoList);
+    missionDataStorage->DeleteMissionInfo(intParam);
+    missionDataStorage->DeleteMissionInfo(intParam + 1);
+    MissionSnapshot missionSnapshot;
+    missionDataStorage->SaveMissionSnapshot(int32Param, missionSnapshot);
+    missionDataStorage->DeleteMissionSnapshot(int32Param);
+    bool boolParam = *data % ENABLE;
+    missionDataStorage->GetMissionSnapshot(int32Param, missionSnapshot, boolParam);
+    missionDataStorage->GetMissionSnapshotPath(int32Param, boolParam);
+
+#ifdef SUPPORT_SCREEN
+    std::shared_ptr<OHOS::Media::PixelMap> snapshot = nullptr;
+    missionDataStorage->GetReducedPixelMap(snapshot);
+    snapshot = std::make_shared<Media::PixelMap>();
+    missionDataStorage->GetReducedPixelMap(snapshot);
+    missionDataStorage->GetSnapshot(int32Param, boolParam);
+    missionDataStorage->GetPixelMap(int32Param, boolParam);
+    std::string stringParam("mission_788529156.json");
+    size_t bufferSize;
+    missionDataStorage->ReadFileToBuffer(stringParam, bufferSize);
+    missionDataStorage->GetCachedSnapshot(int32Param, missionSnapshot);
+    missionDataStorage->SaveSnapshotFile(int32Param, missionSnapshot);
+    missionSnapshot.snapshot = std::make_shared<Media::PixelMap>();
+    missionDataStorage->SaveCachedSnapshot(int32Param, missionSnapshot);
+    missionDataStorage->DeleteCachedSnapshot(int32Param);
+    missionDataStorage->DeleteMissionSnapshot(int32Param);
+    missionDataStorage->SaveSnapshotFile(int32Param, missionSnapshot);
+#endif
+
+    return true;
+}
+}
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    if (data == nullptr) {
+        return 0;
+    }
+
+    /* Validate the length of size */
+    if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
+        return 0;
+    }
+
+    char* ch = (char*)malloc(size + 1);
+    if (ch == nullptr) {
+        std::cout << "malloc failed." << std::endl;
+        return 0;
+    }
+
+    (void)memset_s(ch, size + 1, 0x00, size + 1);
+    if (memcpy_s(ch, size + 1, data, size) != EOK) {
+        std::cout << "copy failed." << std::endl;
+        free(ch);
+        ch = nullptr;
+        return 0;
+    }
+
+    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
+    free(ch);
+    ch = nullptr;
+    return 0;
+}

test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONDATASTORAGE_FUZZER_H
+#define FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONDATASTORAGE_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "missiondatastorage_fuzzer"
+
+#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONDATASTORAGE_FUZZER_H

test/fuzztest/missiondatastorage_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>

test/fuzztest/missionlistenercontroller_fuzzer/BUILD.gn

@@ -0,0 +1,91 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+import("//foundation/ability/ability_runtime/ability_runtime.gni")
+module_output_path = "ability_runtime/abilitymgr"
+
+##############################fuzztest##########################################
+ohos_fuzztest("MissionListenerControllerFuzzTest") {
+  module_out_path = module_output_path
+
+  fuzz_config_file =
+      "${ability_runtime_test_path}/fuzztest/missionlistenercontroller_fuzzer"
+  include_dirs = [
+    "${ability_runtime_innerkits_path}/ability_manager/include",
+    "${ability_runtime_innerkits_path}/dataobs_manager/include",
+    "${bgtaskmgr_interfaces_path}/innerkits/include",
+    "${multimodalinput_path}/interfaces/native/innerkits/event/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "missionlistenercontroller_fuzzer.cpp" ]
+
+  configs = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
+    "${ability_runtime_services_path}/abilitymgr:abilityms_config",
+  ]
+
+  deps = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager",
+    "${ability_runtime_innerkits_path}/ability_manager:mission_info",
+    "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr",
+    "${ability_runtime_native_path}/ability/native:abilitykit_native",
+    "${ability_runtime_services_path}/abilitymgr:abilityms",
+    "${ability_runtime_services_path}/abilitymgr:mission_list",
+    "//third_party/jsoncpp:jsoncpp",
+  ]
+
+  external_deps = [
+    "ability_base:want",
+    "ability_base:zuri",
+    "ability_runtime:connection_obs_manager",
+    "bundle_framework:appexecfwk_base",
+    "c_utils:utils",
+    "common_event_service:cesfwk_core",
+    "common_event_service:cesfwk_innerkits",
+    "ffrt:libffrt",
+    "ipc:ipc_core",
+    "napi:ace_napi",
+    "relational_store:native_dataability",
+    "relational_store:native_rdb",
+    "samgr:samgr_proxy",
+  ]
+
+  if (ability_runtime_graphics) {
+    deps += []
+    external_deps += [
+      "i18n:intl_util",
+      "image_framework:image_native",
+      "window_manager:libwm",
+    ]
+  }
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":MissionListenerControllerFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/missionlistenercontroller_fuzzer/corpus/init

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ

test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.cpp

@@ -0,0 +1,252 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "missionlistenercontroller_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+
+#define private public
+#include "mission_listener_controller.h"
+#include "mission_listener_stub.h"
+#undef private
+
+#include "securec.h"
+#include "parcel.h"
+#include "ability_record.h"
+
+using namespace OHOS::AAFwk;
+using namespace OHOS::AppExecFwk;
+
+namespace OHOS {
+namespace {
+constexpr size_t FOO_MAX_LEN = 1024;
+constexpr size_t U32_AT_SIZE = 4;
+constexpr uint8_t ENABLE = 2;
+constexpr int INPUT_ZERO = 0;
+constexpr int INPUT_ONE = 1;
+constexpr int INPUT_TWO = 2;
+constexpr int INPUT_THREE = 3;
+constexpr size_t OFFSET_ZERO = 24;
+constexpr size_t OFFSET_ONE = 16;
+constexpr size_t OFFSET_TWO = 8;
+std::shared_ptr<MissionListenerController> Infot_ = nullptr;
+class MyMissionListenerFuszzer : public MissionListenerStub {
+public:
+    MyMissionListenerFuszzer() = default;
+    ~MyMissionListenerFuszzer() = default;
+
+    void OnMissionCreated(int32_t missionId) override
+    {
+        isMissionCreated_ = true;
+    }
+
+    void OnMissionDestroyed(int32_t missionId) override
+    {
+        isMissionDestroyed_ = true;
+    }
+
+    void OnMissionSnapshotChanged(int32_t missionId) override
+    {
+        isMissionSnapshotChanged_ = true;
+    }
+
+    void OnMissionMovedToFront(int32_t missionId) override
+    {
+        isMissionMovedToFront_ = true;
+    }
+
+    void OnMissionIconUpdated(int32_t missionId, const std::shared_ptr<OHOS::Media::PixelMap>& icon) override
+    {
+        isMissionIconUpdated_ = true;
+    }
+
+    void OnMissionClosed(int32_t missionId) override
+    {
+        isMissionClosed_ = true;
+    }
+
+    void OnMissionLabelUpdated(int32_t missionId) override
+    {
+        isMissionLabelUpdated_ = true;
+    }
+
+    bool IsMissionCreated() const
+    {
+        return isMissionCreated_;
+    }
+
+    bool IsMissionDestroyed() const
+    {
+        return isMissionDestroyed_;
+    }
+
+    bool IsMissionSnapshotChanged() const
+    {
+        return isMissionSnapshotChanged_;
+    }
+
+    bool IsMissionMovedToFront() const
+    {
+        return isMissionMovedToFront_;
+    }
+
+    bool IsMissionIconUpdated() const
+    {
+        return isMissionIconUpdated_;
+    }
+
+    bool IsMissionClosed() const
+    {
+        return isMissionClosed_;
+    }
+
+    bool IsMissionLabelUpdated() const
+    {
+        return isMissionLabelUpdated_;
+    }
+
+private:
+    bool isMissionCreated_ = false;
+    bool isMissionDestroyed_ = false;
+    bool isMissionSnapshotChanged_ = false;
+    bool isMissionMovedToFront_ = false;
+    bool isMissionIconUpdated_ = false;
+    bool isMissionClosed_ = false;
+    bool isMissionLabelUpdated_ = false;
+};
+
+class MyAbilityConnection : public IAbilityConnection {
+public:
+    MyAbilityConnection() = default;
+    virtual ~MyAbilityConnection() = default;
+    void OnAbilityConnectDone(
+        const AppExecFwk::ElementName& element, const sptr<IRemoteObject>& remoteObject, int resultCode) override
+    {}
+    void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override
+    {}
+    sptr<IRemoteObject> AsObject() override
+    {
+        return {};
+    }
+};
+}
+
+uint32_t GetU32Data(const char* ptr)
+{
+    // convert fuzz input data to an integer
+    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
+        ptr[INPUT_THREE];
+}
+
+std::shared_ptr<AbilityRecord> GetFuzzAbilityRecord()
+{
+    sptr<Token> token = nullptr;
+    AbilityRequest abilityRequest;
+    abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
+    abilityRequest.abilityInfo.name = "MainAbility";
+    abilityRequest.abilityInfo.type = AbilityType::DATA;
+    std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
+    if (!abilityRecord) {
+        return nullptr;
+    }
+    return abilityRecord;
+}
+
+sptr<Token> GetFuzzAbilityToken()
+{
+    sptr<Token> token = nullptr;
+    std::shared_ptr<AbilityRecord> abilityRecord = GetFuzzAbilityRecord();
+    if (abilityRecord) {
+        token = abilityRecord->GetToken();
+    }
+    return token;
+}
+
+bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
+{
+    std::shared_ptr<MissionListenerController> Info = std::make_shared<MissionListenerController>();
+    if (!Info) {
+        return false;
+    }
+    Info->handler_ = nullptr;
+    Info->Init();
+    std::shared_ptr<MissionListenerController> Infos = std::make_shared<MissionListenerController>();
+    Infos->Init();
+    sptr<IMissionListener> listener = nullptr;
+    Infos->AddMissionListener(listener);
+    Infos->DelMissionListener(listener);
+    listener = new MyMissionListenerFuszzer();
+    Infos->AddMissionListener(listener);
+    Infos->DelMissionListener(listener);
+    Infos->missionListeners_.push_back(listener);
+    Infos->AddMissionListener(listener);
+    Infos->DelMissionListener(listener);
+    std::list<int32_t> missions;
+    Infos->HandleUnInstallApp(missions);
+    wptr<IRemoteObject> remote;
+    Infos->OnListenerDied(remote);
+    if (!Infot_) {
+        Infot_ = std::make_shared<MissionListenerController>();
+    }
+    int32_t missionIds = static_cast<int32_t>(GetU32Data(data));
+    Infot_->NotifyMissionCreated(missionIds);
+    Infot_->NotifyMissionDestroyed(missionIds);
+    Infot_->NotifyMissionSnapshotChanged(missionIds);
+    Infot_->NotifyMissionMovedToFront(missionIds);
+    Infot_->NotifyMissionFocused(missionIds);
+    Infot_->NotifyMissionUnfocused(missionIds);
+    std::shared_ptr<OHOS::Media::PixelMap> icon;
+    #ifdef SUPPORT_SCREEN
+    Infot_->NotifyMissionIconChanged(missionIds, icon);
+    #endif
+    Infot_->NotifyMissionClosed(missionIds);
+    Infot_->NotifyMissionLabelUpdated(missionIds);
+    return true;
+}
+}
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    if (data == nullptr) {
+        return 0;
+    }
+
+    /* Validate the length of size */
+    if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
+        return 0;
+    }
+
+    char* ch = (char*)malloc(size + 1);
+    if (ch == nullptr) {
+        std::cout << "malloc failed." << std::endl;
+        return 0;
+    }
+
+    (void)memset_s(ch, size + 1, 0x00, size + 1);
+    if (memcpy_s(ch, size + 1, data, size) != EOK) {
+        std::cout << "copy failed." << std::endl;
+        free(ch);
+        ch = nullptr;
+        return 0;
+    }
+
+    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
+    free(ch);
+    ch = nullptr;
+    return 0;
+}

test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTENERCONTROLLER_FUZZER_H
+#define FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTENERCONTROLLER_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "missionlistenercontroller_fuzzer"
+
+#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTENERCONTROLLER_FUZZER_H

test/fuzztest/missionlistenercontroller_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>

test/fuzztest/missionlistmanagerfirst_fuzzer/BUILD.gn

@@ -0,0 +1,91 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+import("//foundation/ability/ability_runtime/ability_runtime.gni")
+module_output_path = "ability_runtime/abilitymgr"
+
+##############################fuzztest##########################################
+ohos_fuzztest("MissionListManagerFirstFuzzTest") {
+  module_out_path = module_output_path
+
+  fuzz_config_file =
+      "${ability_runtime_test_path}/fuzztest/missionlistmanagerfirst_fuzzer"
+  include_dirs = [
+    "${ability_runtime_innerkits_path}/ability_manager/include",
+    "${ability_runtime_innerkits_path}/dataobs_manager/include",
+    "${bgtaskmgr_interfaces_path}/innerkits/include",
+    "${multimodalinput_path}/interfaces/native/innerkits/event/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "missionlistmanagerfirst_fuzzer.cpp" ]
+
+  configs = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config",
+    "${ability_runtime_services_path}/abilitymgr:abilityms_config",
+  ]
+
+  deps = [
+    "${ability_runtime_innerkits_path}/ability_manager:ability_manager",
+    "${ability_runtime_innerkits_path}/ability_manager:mission_info",
+    "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr",
+    "${ability_runtime_native_path}/ability/native:abilitykit_native",
+    "${ability_runtime_services_path}/abilitymgr:abilityms",
+    "${ability_runtime_services_path}/abilitymgr:mission_list",
+    "//third_party/jsoncpp:jsoncpp",
+  ]
+
+  external_deps = [
+    "ability_base:want",
+    "ability_base:zuri",
+    "ability_runtime:connection_obs_manager",
+    "bundle_framework:appexecfwk_base",
+    "c_utils:utils",
+    "common_event_service:cesfwk_core",
+    "common_event_service:cesfwk_innerkits",
+    "ffrt:libffrt",
+    "ipc:ipc_core",
+    "napi:ace_napi",
+    "relational_store:native_dataability",
+    "relational_store:native_rdb",
+    "samgr:samgr_proxy",
+  ]
+
+  if (ability_runtime_graphics) {
+    deps += []
+    external_deps += [
+      "i18n:intl_util",
+      "image_framework:image_native",
+      "window_manager:libwm",
+    ]
+  }
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":MissionListManagerFirstFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/missionlistmanagerfirst_fuzzer/corpus/init

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ

test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.cpp

@@ -0,0 +1,320 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "missionlistmanagerfirst_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+
+#define private public
+#define protected public
+#include "ability_record.h"
+#include "mission_info_mgr.h"
+#include "mission_list_manager.h"
+#undef protected
+#undef private
+
+using namespace OHOS::AAFwk;
+using namespace OHOS::AppExecFwk;
+
+namespace OHOS {
+namespace {
+constexpr uint8_t ENABLE = 2;
+constexpr int INPUT_ZERO = 0;
+constexpr int INPUT_ONE = 1;
+constexpr int INPUT_TWO = 2;
+constexpr int INPUT_THREE = 3;
+constexpr size_t FOO_MAX_LEN = 1024;
+constexpr size_t U32_AT_SIZE = 4;
+constexpr uint8_t OFFSET_32_VAL = 32;
+constexpr size_t OFFSET_ZERO = 24;
+constexpr size_t OFFSET_ONE = 16;
+constexpr size_t OFFSET_TWO = 8;
+constexpr uint8_t ABILITY_STATE_MOD = 20;
+const std::string PARAM_APP_CLONE_INDEX_KEY("ohos.extra.param.key.appCloneIndex");
+class MyAbilityConnection : public IAbilityConnection {
+public:
+    MyAbilityConnection() = default;
+    virtual ~MyAbilityConnection() = default;
+    void OnAbilityConnectDone(
+        const AppExecFwk::ElementName& element, const sptr<IRemoteObject>& remoteObject, int resultCode) override
+    {}
+    void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override
+    {}
+    sptr<IRemoteObject> AsObject() override
+    {
+        return {};
+    }
+};
+}
+
+uint32_t GetU32Data(const char* ptr)
+{
+    // convert fuzz input data to an integer
+    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) |
+        ptr[INPUT_THREE];
+}
+
+std::shared_ptr<AbilityRecord> GetFuzzAbilityRecord()
+{
+    sptr<Token> token = nullptr;
+    AbilityRequest abilityRequest;
+    abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
+    abilityRequest.abilityInfo.name = "MainAbility";
+    abilityRequest.abilityInfo.type = AbilityType::DATA;
+    std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
+    if (!abilityRecord) {
+        return nullptr;
+    }
+    return abilityRecord;
+}
+
+sptr<Token> GetFuzzAbilityToken()
+{
+    sptr<Token> token = nullptr;
+    std::shared_ptr<AbilityRecord> abilityRecord = GetFuzzAbilityRecord();
+    if (abilityRecord) {
+        token = abilityRecord->GetToken();
+    }
+    return token;
+}
+
+AbilityRequest InitAbilityRequest(const char* data)
+{
+    AbilityRequest abilityRequest;
+    uint32_t mod = static_cast<uint32_t>(LaunchMode::SPECIFIED) + 1;
+    abilityRequest.abilityInfo.launchMode = static_cast<LaunchMode>(GetU32Data(data) % mod);
+    mod = static_cast<uint32_t>(AbilityCallType::START_EXTENSION_TYPE) + 1;
+    abilityRequest.callType = static_cast<AbilityCallType>(GetU32Data(data) % mod);
+    return abilityRequest;
+}
+
+std::shared_ptr<MissionListManager> InitMissionListManager(int32_t intParam)
+{
+    static std::once_flag flag;
+    auto missionListMgr = std::make_shared<MissionListManager>(intParam);
+    missionListMgr->Init();
+    return missionListMgr;
+}
+
+void DoSomethingTestWithMyAPI0(std::shared_ptr<MissionListManager> missionListMgr, const char* data)
+{
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    missionListMgr->RegisterMissionListener(nullptr);
+    missionListMgr->GetMissionCount();
+    missionListMgr->FindEarliestMission();
+    AbilityRequest abilityRequest;
+    missionListMgr->EnqueueWaitingAbility(abilityRequest);
+    missionListMgr->EnqueueWaitingAbilityToFront(abilityRequest);
+    missionListMgr->StartWaitingAbility();
+    missionListMgr->UnRegisterMissionListener(nullptr);
+    std::shared_ptr<AbilityRecord> targetAbilityRecord = GetFuzzAbilityRecord();
+    missionListMgr->AddRecord(abilityRequest, targetAbilityRecord);
+    std::shared_ptr<Mission> targetMission = std::make_shared<Mission>(int32Param, targetAbilityRecord);
+    missionListMgr->GetTargetMission(abilityRequest, targetMission, targetAbilityRecord);
+    missionListMgr->StartAbilityLocked(nullptr, nullptr, abilityRequest);
+    abilityRequest.want.SetParam(PARAM_APP_CLONE_INDEX_KEY, int32Param);
+    missionListMgr->GetMissionName(abilityRequest);
+    bool boolParam = *data % ENABLE;
+    missionListMgr->GetTargetMissionAndAbility(abilityRequest, targetMission, targetAbilityRecord, boolParam);
+    missionListMgr->EnableRecoverAbility(int32Param);
+    missionListMgr->GetTargetMissionList(nullptr, abilityRequest);
+    targetAbilityRecord->isLauncherAbility_ = boolParam;
+    std::shared_ptr<Mission> mission = std::make_shared<Mission>(int32Param, targetAbilityRecord);
+    missionListMgr->launcherList_->AddMissionToTop(mission);
+    missionListMgr->GetTargetMissionList(targetAbilityRecord, abilityRequest);
+    uint32_t uint32Param = static_cast<uint32_t>(GetU32Data(data));
+    abilityRequest.abilityInfo.launchMode = static_cast<LaunchMode>(uint32Param % 3);  // 3 means luanch mode max enum
+    missionListMgr->GetReusedMission(abilityRequest);
+    missionListMgr->MoveNoneTopMissionToDefaultList(targetMission);
+    missionListMgr->MoveMissionListToTop(nullptr);
+    missionListMgr->MoveMissionListToTop(missionListMgr->launcherList_);
+    auto token = targetAbilityRecord->GetToken();
+    missionListMgr->GetAbilityRecordByToken(nullptr);
+    missionListMgr->GetAbilityRecordByToken(token);
+    targetAbilityRecord->currentState_ = static_cast<AAFwk::AbilityState>(uint32Param % ABILITY_STATE_MOD);
+    missionListMgr->DispatchState(targetAbilityRecord, uint32Param % ABILITY_STATE_MOD);
+    missionListMgr->CompleteForegroundSuccess(targetAbilityRecord);
+    std::shared_ptr<AbilityRecord> prevAbilityRecord = GetFuzzAbilityRecord();
+    prevAbilityRecord->isTerminating_ = boolParam;
+    prevAbilityRecord->currentState_ = static_cast<AAFwk::AbilityState>(uint32Param % ABILITY_STATE_MOD);
+    targetAbilityRecord->SetPreAbilityRecord(prevAbilityRecord);
+    missionListMgr->TerminatePreviousAbility(targetAbilityRecord);
+    missionListMgr->CompleteBackground(targetAbilityRecord);
+}
+
+void DoSomethingTestWithMyAPI1(std::shared_ptr<MissionListManager> missionListMgr, const char* data, size_t size)
+{
+    bool boolParam = *data % ENABLE;
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    uint32_t uint32Param = static_cast<uint32_t>(GetU32Data(data));
+    MissionInfo missionInfo;
+    missionListMgr->GetMissionInfo(int32Param, missionInfo);
+    std::shared_ptr<StartOptions> startOptions = nullptr;
+    missionListMgr->MoveMissionToFront(int32Param, startOptions);
+    std::shared_ptr<AbilityRecord> callerAbility = GetFuzzAbilityRecord();
+    auto abilityRecord = GetFuzzAbilityRecord();
+    std::shared_ptr<Mission> mission = std::make_shared<Mission>(int32Param, abilityRecord);
+    missionListMgr->defaultStandardList_->AddMissionToTop(mission);
+    missionListMgr->MoveMissionToFront(int32Param, boolParam, boolParam, callerAbility, startOptions);
+}
+
+void DoSomethingTestWithMyAPI2(std::shared_ptr<MissionListManager> missionListMgr, const char* data, size_t size)
+{
+    bool boolParam = *data % ENABLE;
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    uint32_t uint32Param = static_cast<uint32_t>(GetU32Data(data));
+    InnerMissionInfo info;
+    AbilityRequest abilityRequest = InitAbilityRequest(data);
+    missionListMgr->CreateOrReusedMissionInfo(abilityRequest, info);
+    auto abilityRecord = GetFuzzAbilityRecord();
+    abilityRecord->SetPendingState(static_cast<AAFwk::AbilityState>(GetU32Data(data) % ABILITY_STATE_MOD));
+    abilityRecord->currentState_ = static_cast<AAFwk::AbilityState>(GetU32Data(data) % ABILITY_STATE_MOD);
+    auto token = abilityRecord->GetToken();
+    std::shared_ptr<Mission> mission = std::make_shared<Mission>(int32Param, abilityRecord);
+    missionListMgr->defaultStandardList_->AddMissionToTop(mission);
+    missionListMgr->MinimizeAbility(token, boolParam);
+    missionListMgr->MoveAbilityToBackground(abilityRecord);
+    Want *resultWant = new Want();
+    int64_t int64Param = (static_cast<int64_t>(GetU32Data(data)) << OFFSET_32_VAL) + GetU32Data(data);
+    missionListMgr->BackToCallerAbilityWithResult(abilityRecord, int32Param, resultWant, int64Param);
+}
+
+void DoSomethingTestWithMyAPI3(std::shared_ptr<MissionListManager> missionListMgr, const char* data, size_t size)
+{
+    bool boolParam = *data % ENABLE;
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    uint32_t uint32Param = static_cast<uint32_t>(GetU32Data(data));
+    auto abilityRecord = GetFuzzAbilityRecord();
+    std::shared_ptr<Mission> mission = std::make_shared<Mission>(int32Param, abilityRecord);
+    abilityRecord->SetMissionId(int32Param);
+    missionListMgr->defaultStandardList_->AddMissionToTop(mission);
+    missionListMgr->SetMissionLockedState(int32Param, boolParam);
+    const AppExecFwk::ElementName element;
+    missionListMgr->GetAbilityNumber(element);
+    missionListMgr->MoveToBackgroundTask(abilityRecord, boolParam);
+    missionListMgr->PrintTimeOutLog(abilityRecord, uint32Param, boolParam);
+    uint32_t msgId = uint32Param % ABILITY_STATE_MOD;
+    std::string stringParam(data, size);
+    missionListMgr->GetContentAndTypeId(msgId, stringParam, int32Param);
+    abilityRecord->recordId_ = int32Param;
+    missionListMgr->OnTimeOut(msgId, int32Param, boolParam);
+    missionListMgr->HandleLoadTimeout(abilityRecord);
+    auto state = static_cast<AAFwk::AbilityState>(GetU32Data(data) % ABILITY_STATE_MOD);
+    abilityRecord->currentState_ = static_cast<AAFwk::AbilityState>(GetU32Data(data) % ABILITY_STATE_MOD);
+    missionListMgr->HandleForegroundTimeout(abilityRecord, state);
+    missionListMgr->CompleteForegroundFailed(abilityRecord, state);
+    missionListMgr->HandleTimeoutAndResumeAbility(abilityRecord, state);
+    missionListMgr->DelayedResumeTimeout(abilityRecord);
+    missionListMgr->MoveToTerminateList(abilityRecord);
+}
+
+void DoSomethingTestWithMyAPI4(std::shared_ptr<MissionListManager> missionListMgr, const char* data, size_t size)
+{
+    bool boolParam = *data % ENABLE;
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    uint32_t uint32Param = static_cast<uint32_t>(GetU32Data(data));
+    auto abilityRecord = GetFuzzAbilityRecord();
+    std::shared_ptr<Mission> mission = std::make_shared<Mission>(int32Param, abilityRecord);
+    abilityRecord->SetMissionId(int32Param);
+    abilityRecord->recordId_ = int32Param;
+    missionListMgr->defaultStandardList_->AddMissionToTop(mission);
+    missionListMgr->launcherList_->AddMissionToTop(mission);
+    missionListMgr->GetAbilityRecordByCaller(abilityRecord, int32Param);
+    missionListMgr->OnAbilityDied(abilityRecord, int32Param);
+    int64_t abilityRecordId = static_cast<int64_t>(int32Param);
+    missionListMgr->GetAbilityRecordById(abilityRecordId);
+    missionListMgr->PostStartWaitingAbility();
+    auto type = static_cast<AbilityType>(GetU32Data(data) % ABILITY_STATE_MOD);
+    const_cast<AppExecFwk::AbilityInfo&>(abilityRecord->GetAbilityInfo()).type = type;
+    auto state = static_cast<AAFwk::AbilityState>(GetU32Data(data) % ABILITY_STATE_MOD);
+    abilityRecord->currentState_ = state;
+    abilityRecord->isTerminating_ = boolParam;
+    missionListMgr->HandleAbilityDied(abilityRecord);
+    missionListMgr->DelayedStartLauncher();
+    missionListMgr->BackToLauncher();
+    auto continueState = static_cast<ContinueState>(GetU32Data(data) % ABILITY_STATE_MOD);
+    missionListMgr->SetMissionContinueState(nullptr, int32Param, continueState);
+    missionListMgr->SetMissionContinueState(abilityRecord->GetToken(), int32Param, continueState);
+    std::vector<std::string> info;
+    std::vector<std::string> params;
+    std::string stringParam(data, size);
+    missionListMgr->Dump(info);
+    missionListMgr->DumpMissionListByRecordId(info, boolParam, int32Param, params);
+    missionListMgr->DumpMissionList(info, boolParam, stringParam);
+    missionListMgr->DumpMissionInfos(info);
+    missionListMgr->DumpMission(int32Param, info);
+    auto abilityRequest = InitAbilityRequest(data);
+    abilityRequest.callType = static_cast<AbilityCallType>(GetU32Data(data) % ABILITY_STATE_MOD);
+    missionListMgr->CallAbilityLocked(abilityRequest);
+    ElementName element;
+    missionListMgr->GetAbilityRecordByName(element);
+    missionListMgr->GetAbilityRecordsByName(element);
+    auto callRecord = std::make_shared<CallRecord>(int32Param, abilityRecord, nullptr, abilityRecord->GetToken());
+    missionListMgr->OnCallConnectDied(callRecord);
+    Want want;
+    missionListMgr->OnAcceptWantResponse(want, stringParam);
+    missionListMgr->EnqueueWaitingAbility(abilityRequest);
+    missionListMgr->EnqueueWaitingAbility(abilityRequest); // add twice
+    missionListMgr->OnStartSpecifiedAbilityTimeoutResponse(want);
+    missionListMgr->GetMissionBySpecifiedFlag(want, stringParam);
+}
+
+bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
+{
+    // fuzz for MissionListManager
+    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
+    auto missionListMgr = InitMissionListManager(int32Param);
+    DoSomethingTestWithMyAPI0(missionListMgr, data);
+    DoSomethingTestWithMyAPI1(missionListMgr, data, size);
+    DoSomethingTestWithMyAPI2(missionListMgr, data, size);
+    DoSomethingTestWithMyAPI3(missionListMgr, data, size);
+    DoSomethingTestWithMyAPI4(missionListMgr, data, size);
+    return true;
+}
+}
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    if (data == nullptr) {
+        return 0;
+    }
+
+    /* Validate the length of size */
+    if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
+        return 0;
+    }
+
+    char* ch = (char*)malloc(size + 1);
+    if (ch == nullptr) {
+        std::cout << "malloc failed." << std::endl;
+        return 0;
+    }
+
+    (void)memset_s(ch, size + 1, 0x00, size + 1);
+    if (memcpy_s(ch, size, data, size) != EOK) {
+        std::cout << "copy failed." << std::endl;
+        free(ch);
+        ch = nullptr;
+        return 0;
+    }
+
+    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
+    free(ch);
+    ch = nullptr;
+    return 0;
+}

test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTMANAGERSECOND_FUZZER_H
+#define FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTMANAGERSECOND_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "missionlistmanagersecond_fuzzer"
+
+#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTMANAGERSECOND_FUZZER_H

test/fuzztest/missionlistmanagerfirst_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>