diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index 111481c50c..a8ab6657ce 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -257,7 +257,10 @@ group("fuzztest") { "continuemission_fuzzer:fuzztest", "crowdtestinterceptor_fuzzer:fuzztest", "dataabilitymanager_fuzzer:fuzztest", + "deeplinkreserveconfig_fuzzer:fuzztest", "delegatordoabilityforeground_fuzzer:fuzztest", + "dialogsessioninfo_fuzzer:fuzztest", + "dialogsessionmanager_fuzzer:fuzztest", "disposedobserver_fuzzer:fuzztest", "doabilitybackground_fuzzer:fuzztest", "doabilityforeground_fuzzer:fuzztest", @@ -266,6 +269,7 @@ group("fuzztest") { "dumpsysstate_fuzzer:fuzztest", "extensionconfig_fuzzer:fuzztest", "extensioncontrolinterceptor_fuzzer:fuzztest", + "extensionpermissionsutil_fuzzer:fuzztest", "extensionrecordfactory_fuzzer:fuzztest", "extensionrecordmanagera_fuzzer:fuzztest", "faultdata_fuzzer:fuzztest", @@ -294,10 +298,13 @@ group("fuzztest") { "loadability_fuzzer:fuzztest", "lockmissionforcleanup_fuzzer:fuzztest", "minimizeability_fuzzer:fuzztest", + "missiondatastorage_fuzzer:fuzztest", "missioninfomgra_fuzzer:fuzztest", "missioninfomgrb_fuzzer:fuzztest", "missioninfomgrc_fuzzer:fuzztest", + "missionlistenercontroller_fuzzer:fuzztest", "missionlistenerstub_fuzzer:fuzztest", + "missionlistmanagerfirst_fuzzer:fuzztest", "missionlistmanagerfourth_fuzzer:fuzztest", "missionlistmanagersecond_fuzzer:fuzztest", "missionlistmanagerthird_fuzzer:fuzztest", diff --git a/test/fuzztest/deeplinkreserveconfig_fuzzer/BUILD.gn b/test/fuzztest/deeplinkreserveconfig_fuzzer/BUILD.gn new file mode 100644 index 0000000000..f877285453 --- /dev/null +++ b/test/fuzztest/deeplinkreserveconfig_fuzzer/BUILD.gn @@ -0,0 +1,47 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("DeepLinkReserveConfigFuzzTest") { + module_out_path = module_output_path + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/deeplinkreserveconfig_fuzzer" + include_dirs = + [ "${ability_runtime_path}/services/abilitymgr/include/deeplink_reserve" ] + + sources = [ "deeplinkreserveconfig_fuzzer.cpp" ] + + configs = [ "${ability_runtime_services_path}/abilitymgr:abilityms_config" ] + cflags = [] + deps = [ "${ability_runtime_services_path}/abilitymgr:abilityms" ] + + external_deps = [ "c_utils:utils" ] +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":DeepLinkReserveConfigFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/deeplinkreserveconfig_fuzzer/corpus/init b/test/fuzztest/deeplinkreserveconfig_fuzzer/corpus/init new file mode 100644 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/deeplinkreserveconfig_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.cpp b/test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.cpp new file mode 100644 index 0000000000..87b037e944 --- /dev/null +++ b/test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.cpp @@ -0,0 +1,168 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "deeplinkreserveconfig_fuzzer.h" + +#include +#include +#include + +#include "securec.h" + +#define private public +#include "deeplink_reserve_config.h" +#undef private + +using json = nlohmann::json; +using namespace OHOS::AAFwk; +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_TWO = 2; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +const std::string CONFIG_PATH = "/etc/ability_runtime/deeplink_reserve_config.json"; +const std::string DEFAULT_RESERVE_CONFIG_PATH = "/system/etc/deeplink_reserve_config.json"; +const std::string DEEPLINK_RESERVED_URI_NAME = "deepLinkReservedUri"; +const std::string BUNDLE_NAME = "bundleName"; +const std::string URIS_NAME = "uris"; +const std::string SCHEME_NAME = "scheme"; +const std::string HOST_NAME = "host"; +const std::string PORT_NAME = "port"; +const std::string PATH_NAME = "path"; +const std::string PATH_START_WITH_NAME = "pathStartWith"; +const std::string PATH_REGEX_NAME = "pathRegex"; +const std::string TYPE_NAME = "type"; +const std::string UTD_NAME = "utd"; +const std::string PORT_SEPARATOR = ":"; +const std::string SCHEME_SEPARATOR = "://"; +const std::string PATH_SEPARATOR = "/"; +const std::string PARAM_SEPARATOR = "?"; +} +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + auto &deepLinkReserveConfig = DeepLinkReserveConfig::GetInstance(); + deepLinkReserveConfig.GetConfigPath(); + deepLinkReserveConfig.LoadConfiguration(); + std::string linkString(data, size); + std::string bundleName(data, size); + deepLinkReserveConfig.isLinkReserved(linkString, bundleName); + ReserveUri reservedUri; + std::string link(data, size); + std::string strParam(data, size); + deepLinkReserveConfig.isUriMatched(reservedUri, link); + reservedUri.scheme = strParam; + deepLinkReserveConfig.isUriMatched(reservedUri, link); + reservedUri.host = strParam; + deepLinkReserveConfig.isUriMatched(reservedUri, link); + reservedUri.port = strParam; + deepLinkReserveConfig.isUriMatched(reservedUri, link); + reservedUri.path = strParam; + deepLinkReserveConfig.isUriMatched(reservedUri, link); + reservedUri.pathStartWith = strParam; + deepLinkReserveConfig.isUriMatched(reservedUri, link); + reservedUri.pathRegex = strParam; + deepLinkReserveConfig.isUriMatched(reservedUri, link); + std::vector uriList; + json jsonUriObject; + jsonUriObject["SCHEME_NAME"] = SCHEME_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["HOST_NAME"] = HOST_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["PORT_NAME"] = PORT_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["PATH_NAME"] = PATH_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["PATH_START_WITH_NAME"] = PATH_START_WITH_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["PATH_REGEX_NAME"] = PATH_REGEX_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["TYPE_NAME"] = TYPE_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + jsonUriObject["UTD_NAME"] = UTD_NAME; + deepLinkReserveConfig.LoadReservedUrilItem(jsonUriObject, uriList); + return true; +} + +bool DoSomethingInterestingWithMyAPIOne(const char* data, size_t size) +{ + auto &deepLinkReserveConfig1 = DeepLinkReserveConfig::GetInstance(); + std::string filePath(data, size); + json jsonBuf; + deepLinkReserveConfig1.ReadFileInfoJson(filePath, jsonBuf); + json object; + deepLinkReserveConfig1.LoadReservedUriList(object); + object["DEEPLINK_RESERVED_URI_NAME"] = DEEPLINK_RESERVED_URI_NAME; + deepLinkReserveConfig1.LoadReservedUriList(object); + int32_t userId = static_cast(GetU32Data(data)); + object["BUNDLE_NAME"] = userId; + deepLinkReserveConfig1.LoadReservedUriList(object); + object["BUNDLE_NAME"] = BUNDLE_NAME; + deepLinkReserveConfig1.LoadReservedUriList(object); + json uriArray = { "uri1", "uri2", "uri3" }; + object["URIS_NAME"] = uriArray; + deepLinkReserveConfig1.LoadReservedUriList(object); + object["URIS_NAME"] = URIS_NAME; + deepLinkReserveConfig1.LoadReservedUriList(object); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size + 1, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + OHOS::DoSomethingInterestingWithMyAPIOne(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.h b/test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.h new file mode 100644 index 0000000000..6e6242a9cd --- /dev/null +++ b/test/fuzztest/deeplinkreserveconfig_fuzzer/deeplinkreserveconfig_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_DEEPLINKRESERVECONFIG_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_DEEPLINKRESERVECONFIG_FUZZER_H + +#define FUZZ_PROJECT_NAME "deeplinkreserveconfig_fuzzer" + +#endif diff --git a/test/fuzztest/deeplinkreserveconfig_fuzzer/project.xml b/test/fuzztest/deeplinkreserveconfig_fuzzer/project.xml new file mode 100644 index 0000000000..7133b2b924 --- /dev/null +++ b/test/fuzztest/deeplinkreserveconfig_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/dialogsessioninfo_fuzzer/dialogsessioninfo_fuzzer.cpp b/test/fuzztest/dialogsessioninfo_fuzzer/dialogsessioninfo_fuzzer.cpp index e14d99d065..7ab19b6855 100644 --- a/test/fuzztest/dialogsessioninfo_fuzzer/dialogsessioninfo_fuzzer.cpp +++ b/test/fuzztest/dialogsessioninfo_fuzzer/dialogsessioninfo_fuzzer.cpp @@ -52,6 +52,12 @@ bool DoSomethingInterestingWithMyAPI(const char *data, size_t size) auto dialogSessionInfo = std::make_shared(); dialogSessionInfo->ReadFromParcel(parcel); dialogSessionInfo->Marshalling(parcel); + DialogSessionInfo::Unmarshalling(parcel); + + std::string str(data, size); + auto dialogAbilityInfo = std::make_shared(); + dialogAbilityInfo->GetURI(); + return true; } } // namespace OHOS diff --git a/test/fuzztest/dialogsessionmanager_fuzzer/BUILD.gn b/test/fuzztest/dialogsessionmanager_fuzzer/BUILD.gn new file mode 100644 index 0000000000..0afe6c8753 --- /dev/null +++ b/test/fuzztest/dialogsessionmanager_fuzzer/BUILD.gn @@ -0,0 +1,100 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("DialogSessionManagerFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/dialogsessionmanager_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_services_path}/abilitymgr/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ + "${ability_runtime_path}/services/abilitymgr/src/dialog_session/dialog_session_manager.cpp", + "${ability_runtime_services_path}/abilitymgr/src/start_ability_utils.cpp", + "dialogsessionmanager_fuzzer.cpp", + ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + cflags = [] + if (target_cpu == "arm") { + cflags += [ "-DBINDER_IPC_32BIT" ] + } + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:ability_start_options", + "${ability_runtime_innerkits_path}/app_manager:app_manager", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_native_path}/appkit:appkit_manager_helper", + "${ability_runtime_path}/utils/server/startup:startup_util", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "${ability_runtime_services_path}/common:perm_verification", + "//third_party/jsoncpp:jsoncpp", + "//third_party/libjpeg-turbo:turbojpeg_static", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "hilog:libhilog", + "hitrace:hitrace_meter", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + "window_manager:libmodal_system_ui_extension_client", + "window_manager:libwsutils", + ] + + if (background_task_mgr_continuous_task_enable) { + external_deps += [ "background_task_mgr:bgtaskmgr_innerkits" ] + } + + if (ability_runtime_graphics) { + external_deps += [ "window_manager:libwm" ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":DialogSessionManagerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/dialogsessionmanager_fuzzer/corpus/init b/test/fuzztest/dialogsessionmanager_fuzzer/corpus/init new file mode 100644 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/dialogsessionmanager_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.cpp b/test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.cpp new file mode 100644 index 0000000000..3773de491d --- /dev/null +++ b/test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.cpp @@ -0,0 +1,141 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "dialogsessionmanager_fuzzer.h" +#include +#include +#define private public +#include "dialog_session_manager.h" +#undef private +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_TWO = 2; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +constexpr uint8_t ENABLE = 2; +} // namespace + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char *data, size_t size) +{ + std::string bundleName(data, size); + std::string dialogSessionId(data, size); + std::string replaceWant(data, size); + bool isSelector = *data % ENABLE; + AAFwk::WantParams wantParams; + int32_t int32Param = static_cast(GetU32Data(data)); + AbilityRequest abilityRequest; + std::vector dialogAppInfos; + std::vector targetAbilityInfos; + sptr callerToken = GetFuzzAbilityToken(); + Parcel wantParcel; + Want want; + auto dialogSessionInfo = std::make_shared(); + if (dialogSessionInfo == nullptr) { + return false; + } + std::shared_ptr dialogCallerInfo = std::make_shared(); + if (dialogCallerInfo == nullptr) { + return false; + } + std::shared_ptr dialogSessionManager = std::make_shared(); + if (dialogSessionManager == nullptr) { + return false; + } + dialogSessionManager->GenerateDialogSessionId(); + dialogSessionManager->SetStartupSessionInfo(dialogSessionId, abilityRequest); + DialogAbilityInfo callerAbilityInfo; + dialogSessionManager->GenerateCallerAbilityInfo(abilityRequest, callerAbilityInfo); + dialogSessionManager->GenerateSelectorTargetAbilityInfos(dialogAppInfos, targetAbilityInfos); + dialogSessionManager->GenerateDialogCallerInfo(abilityRequest, int32Param, dialogCallerInfo, isSelector); + dialogSessionManager->NotifySCBToRecoveryAfterInterception(dialogSessionId, abilityRequest); + dialogSessionManager->GenerateDialogSessionRecordCommon(abilityRequest, int32Param, wantParams, + dialogAppInfos, isSelector); + dialogSessionManager->CreateJumpModalDialog(abilityRequest, int32Param, want); + dialogSessionManager->CreateImplicitSelectorModalDialog(abilityRequest, want, int32Param, dialogAppInfos); + dialogSessionManager->CreateCloneSelectorModalDialog(abilityRequest, want, int32Param, dialogAppInfos, + replaceWant); + dialogSessionManager->CreateModalDialogCommon(want, callerToken, dialogSessionId); + dialogSessionManager->HandleErmsResult(abilityRequest, int32Param, want); + dialogSessionManager->HandleErmsResultBySCB(abilityRequest, want); + dialogSessionManager->IsCreateCloneSelectorDialog(bundleName, int32Param); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char *ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size + 1, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.h b/test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.h new file mode 100644 index 0000000000..dc2c4b1583 --- /dev/null +++ b/test/fuzztest/dialogsessionmanager_fuzzer/dialogsessionmanager_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_DIALOG_SESSION_MANAGER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_DIALOG_SESSION_MANAGER_FUZZER_H + +#define FUZZ_PROJECT_NAME "dialogsessionmanager_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/dialogsessionmanager_fuzzer/project.xml b/test/fuzztest/dialogsessionmanager_fuzzer/project.xml new file mode 100644 index 0000000000..6d3e765c7d --- /dev/null +++ b/test/fuzztest/dialogsessionmanager_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + \ No newline at end of file diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/BUILD.gn b/test/fuzztest/extensionpermissionsutil_fuzzer/BUILD.gn new file mode 100755 index 0000000000..0a4074974b --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/BUILD.gn @@ -0,0 +1,89 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("ExtensionPermissionsUtilFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/extensionpermissionsutil_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_services_path}/abilitymgr/include", + "mock/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ + "${ability_runtime_services_path}/abilitymgr/src/utils/extension_permissions_util.cpp", + "extension_permissions_util_fuzzer.cpp", + "mock/src/mock_my_flag.cpp", + "mock/src/mock_permission_verification.cpp", + ] + + configs = [ "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config" ] + cflags = [] + if (target_cpu == "arm") { + cflags += [ "-DBINDER_IPC_32BIT" ] + } + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:ability_start_options", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "common_event_service:cesfwk_innerkits", + "config_policy:configpolicy_util", + "ffrt:libffrt", + "hilog:libhilog", + "hitrace:hitrace_meter", + "ipc:ipc_core", + "napi:ace_napi", + "safwk:system_ability_fwk", + "samgr:samgr_proxy", + "window_manager:libwsutils", + ] + + if (ability_runtime_graphics) { + external_deps += [ "input:libmmi-client" ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":ExtensionPermissionsUtilFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/corpus/init b/test/fuzztest/extensionpermissionsutil_fuzzer/corpus/init new file mode 100755 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.cpp b/test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.cpp new file mode 100755 index 0000000000..a80ad668c5 --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.cpp @@ -0,0 +1,95 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "extension_permissions_util.h" + +#include +#include + +#include "ability_record.h" +#define private public +#include "extension_config.h" +#define private public +#include "mock_my_flag.h" +#include "mock_permission_verification.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_TWO = 2; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +constexpr uint8_t ENABLE = 2; +} // namespace + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +bool DoSomethingInterestingWithMyAPI(const char *data, size_t size) +{ + std::string strParam(data, size); + MyFlag::flag_ = MyFlag::IS_SA_CALL; + auto extensionPermissionsUtil = std::make_shared(); + auto extensionType = GetU32Data(data) % static_cast(ExtensionAbilityType::RECENT_PHOTO); + extensionPermissionsUtil->CheckSAPermission(static_cast(extensionType)); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + std::cout << "invalid data" << std::endl; + return 0; + } + + /* Validate the length of size */ + if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { + return 0; + } + + char *ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size + 1, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.h b/test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.h new file mode 100755 index 0000000000..c3fc416940 --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/extension_permissions_util_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_EXTENSIONPERMISSIONSUTIL_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_EXTENSIONPERMISSIONSUTIL_FUZZER_H + +#define FUZZ_PROJECT_NAME "extensionpermissionsutil_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_EXTENSIONPERMISSIONSUTIL_FUZZER_H \ No newline at end of file diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_my_flag.h b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_my_flag.h new file mode 100755 index 0000000000..0db541ffb5 --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_my_flag.h @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MOCK_MY_FLAG_H +#define MOCK_MY_FLAG_H +namespace OHOS { +namespace AAFwk { +class MyFlag { +public: + enum FLAG { + IS_SA_CALL = 1, + IS_SHELL_CALL, + IS_SA_AND_SHELL_CALL, + }; + static int flag_; +}; +} // namespace AAFwk +} // namespace OHOS +#endif // MOCK_MY_FLAG_H diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_permission_verification.h b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_permission_verification.h new file mode 100755 index 0000000000..5f7c42ddf9 --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/include/mock_permission_verification.h @@ -0,0 +1,96 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef OHOS_ABILITY_RUNTIME_PERMISSION_VERIFICATION_H +#define OHOS_ABILITY_RUNTIME_PERMISSION_VERIFICATION_H + +#include "ipc_skeleton.h" +#include "mock_my_flag.h" +#include "singleton.h" +#include "want.h" + +namespace OHOS { +namespace AAFwk { + +class PermissionVerification : public DelayedSingleton { +public: + struct VerificationInfo { + bool visible = false; + bool isBackgroundCall = true; + bool associatedWakeUp = false; + uint32_t accessTokenId = 0; + int32_t apiTargetVersion = 0; + }; + + PermissionVerification() = default; + ~PermissionVerification() = default; + + bool VerifyCallingPermission(const std::string &permissionName, const uint32_t specifyTokenId = 0) const; + + bool IsSACall() const; + + bool IsShellCall() const; + + bool CheckSpecificSystemAbilityAccessPermission() const; + + bool VerifyRunningInfoPerm() const; + + bool VerifyControllerPerm() const; + + bool VerifyDlpPermission(Want &want) const; + + int VerifyAccountPermission() const; + + bool VerifyMissionPermission() const; + + int VerifyAppStateObserverPermission() const; + + int32_t VerifyUpdateConfigurationPerm() const; + + bool VerifyInstallBundlePermission() const; + + bool VerifyGetBundleInfoPrivilegedPermission() const; + + int CheckCallDataAbilityPermission(const VerificationInfo &verificationInfo, bool isShell) const; + + int CheckCallServiceAbilityPermission(const VerificationInfo &verificationInfo) const; + + int CheckCallAbilityPermission(const VerificationInfo &verificationInfo) const; + + int CheckCallServiceExtensionPermission(const VerificationInfo &verificationInfo) const; + + int CheckStartByCallPermission(const VerificationInfo &verificationInfo) const; + + unsigned int GetCallingTokenID() const; + + bool JudgeStartInvisibleAbility(const uint32_t accessTokenId, const bool visible) const; + + bool JudgeStartAbilityFromBackground(const bool isBackgroundCall) const; + + bool JudgeAssociatedWakeUp(const uint32_t accessTokenId, const bool associatedWakeUp) const; + + int JudgeInvisibleAndBackground(const VerificationInfo &verificationInfo) const; + + inline bool IsCallFromSameAccessToken(const uint32_t accessTokenId) const + { + return IPCSkeleton::GetCallingTokenID() == accessTokenId; + } + + bool JudgeCallerIsAllowedToUseSystemAPI() const; + bool IsSystemAppCall() const; +}; +} // namespace AAFwk +} // namespace OHOS +#endif // OHOS_ABILITY_RUNTIME_PERMISSION_VERIFICATION_H \ No newline at end of file diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_my_flag.cpp b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_my_flag.cpp new file mode 100755 index 0000000000..ce14cafa2c --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_my_flag.cpp @@ -0,0 +1,22 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "mock_my_flag.h" + +namespace OHOS { +namespace AAFwk { +int MyFlag::flag_ = 0; +} // namespace AAFwk +} // namespace OHOS diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_permission_verification.cpp b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_permission_verification.cpp new file mode 100755 index 0000000000..2a6150f2bd --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/mock/src/mock_permission_verification.cpp @@ -0,0 +1,122 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "mock_permission_verification.h" + +namespace OHOS { +namespace AAFwk { +bool PermissionVerification::VerifyCallingPermission( + const std::string &permissionName, const uint32_t specifyTokenId) const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::IsSACall() const +{ + return (MyFlag::flag_ & MyFlag::FLAG::IS_SA_CALL); +} +bool PermissionVerification::IsShellCall() const +{ + return (MyFlag::flag_ & MyFlag::FLAG::IS_SHELL_CALL); +} +bool PermissionVerification::CheckSpecificSystemAbilityAccessPermission() const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::VerifyRunningInfoPerm() const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::VerifyControllerPerm() const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::VerifyDlpPermission(Want &want) const +{ + return !!(MyFlag::flag_); +} +int PermissionVerification::VerifyAccountPermission() const +{ + return MyFlag::flag_; +} +bool PermissionVerification::VerifyMissionPermission() const +{ + return !!(MyFlag::flag_); +} +int PermissionVerification::VerifyAppStateObserverPermission() const +{ + return MyFlag::flag_; +} +int32_t PermissionVerification::VerifyUpdateConfigurationPerm() const +{ + return static_cast(MyFlag::flag_); +} +bool PermissionVerification::VerifyInstallBundlePermission() const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::VerifyGetBundleInfoPrivilegedPermission() const +{ + return !!(MyFlag::flag_); +} +int PermissionVerification::CheckCallDataAbilityPermission(const VerificationInfo &verificationInfo, bool isShell) const +{ + return MyFlag::flag_; +} +int PermissionVerification::CheckCallServiceAbilityPermission(const VerificationInfo &verificationInfo) const +{ + return MyFlag::flag_; +} +int PermissionVerification::CheckCallAbilityPermission(const VerificationInfo &verificationInfo) const +{ + return MyFlag::flag_; +} +int PermissionVerification::CheckCallServiceExtensionPermission(const VerificationInfo &verificationInfo) const +{ + return MyFlag::flag_; +} +int PermissionVerification::CheckStartByCallPermission(const VerificationInfo &verificationInfo) const +{ + return MyFlag::flag_; +} +unsigned int PermissionVerification::GetCallingTokenID() const +{ + return static_cast(MyFlag::flag_); +} +bool PermissionVerification::JudgeStartInvisibleAbility(const uint32_t accessTokenId, const bool visible) const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::JudgeStartAbilityFromBackground(const bool isBackgroundCall) const +{ + return !!(MyFlag::flag_); +} +bool PermissionVerification::JudgeAssociatedWakeUp(const uint32_t accessTokenId, const bool associatedWakeUp) const +{ + return !!(MyFlag::flag_); +} +int PermissionVerification::JudgeInvisibleAndBackground(const VerificationInfo &verificationInfo) const +{ + return MyFlag::flag_; +} +bool PermissionVerification::JudgeCallerIsAllowedToUseSystemAPI() const +{ + return true; +} +bool PermissionVerification::IsSystemAppCall() const +{ + return true; +} +} // namespace AAFwk +} // namespace OHOS diff --git a/test/fuzztest/extensionpermissionsutil_fuzzer/project.xml b/test/fuzztest/extensionpermissionsutil_fuzzer/project.xml new file mode 100755 index 0000000000..6d3e765c7d --- /dev/null +++ b/test/fuzztest/extensionpermissionsutil_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + \ No newline at end of file diff --git a/test/fuzztest/missiondatastorage_fuzzer/BUILD.gn b/test/fuzztest/missiondatastorage_fuzzer/BUILD.gn new file mode 100644 index 0000000000..3c7b94aca9 --- /dev/null +++ b/test/fuzztest/missiondatastorage_fuzzer/BUILD.gn @@ -0,0 +1,89 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("MissionDataStorageFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/missiondatastorage_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "missiondatastorage_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:mission_info", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "${ability_runtime_services_path}/abilitymgr:mission_list", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "image_framework:image_native", + "ipc:ipc_core", + "napi:ace_napi", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":MissionDataStorageFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/missiondatastorage_fuzzer/corpus/init b/test/fuzztest/missiondatastorage_fuzzer/corpus/init new file mode 100644 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/missiondatastorage_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.cpp b/test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.cpp new file mode 100644 index 0000000000..2eb988db9c --- /dev/null +++ b/test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.cpp @@ -0,0 +1,125 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "missiondatastorage_fuzzer.h" + +#include +#include + +#define private public +#include "mission_data_storage.h" +#undef private + +#include "securec.h" +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_TWO = 2; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +constexpr uint8_t ENABLE = 2; +} // namespace + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + int intParam = static_cast(GetU32Data(data)); + int32_t int32Param = static_cast(GetU32Data(data)); + auto missionDataStorage = std::make_shared(); + InnerMissionInfo missionInfo; + missionInfo.missionInfo.id = int32Param; + std::list missionInfoList; + missionDataStorage->SaveMissionInfo(missionInfo); + missionDataStorage->LoadAllMissionInfo(missionInfoList); + missionDataStorage->DeleteMissionInfo(intParam); + missionDataStorage->DeleteMissionInfo(intParam + 1); + MissionSnapshot missionSnapshot; + missionDataStorage->SaveMissionSnapshot(int32Param, missionSnapshot); + missionDataStorage->DeleteMissionSnapshot(int32Param); + bool boolParam = *data % ENABLE; + missionDataStorage->GetMissionSnapshot(int32Param, missionSnapshot, boolParam); + missionDataStorage->GetMissionSnapshotPath(int32Param, boolParam); + +#ifdef SUPPORT_SCREEN + std::shared_ptr snapshot = nullptr; + missionDataStorage->GetReducedPixelMap(snapshot); + snapshot = std::make_shared(); + missionDataStorage->GetReducedPixelMap(snapshot); + missionDataStorage->GetSnapshot(int32Param, boolParam); + missionDataStorage->GetPixelMap(int32Param, boolParam); + std::string stringParam("mission_788529156.json"); + size_t bufferSize; + missionDataStorage->ReadFileToBuffer(stringParam, bufferSize); + missionDataStorage->GetCachedSnapshot(int32Param, missionSnapshot); + missionDataStorage->SaveSnapshotFile(int32Param, missionSnapshot); + missionSnapshot.snapshot = std::make_shared(); + missionDataStorage->SaveCachedSnapshot(int32Param, missionSnapshot); + missionDataStorage->DeleteCachedSnapshot(int32Param); + missionDataStorage->DeleteMissionSnapshot(int32Param); + missionDataStorage->SaveSnapshotFile(int32Param, missionSnapshot); +#endif + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size + 1, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.h b/test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.h new file mode 100644 index 0000000000..0a05344c13 --- /dev/null +++ b/test/fuzztest/missiondatastorage_fuzzer/missiondatastorage_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONDATASTORAGE_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONDATASTORAGE_FUZZER_H + +#define FUZZ_PROJECT_NAME "missiondatastorage_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONDATASTORAGE_FUZZER_H \ No newline at end of file diff --git a/test/fuzztest/missiondatastorage_fuzzer/project.xml b/test/fuzztest/missiondatastorage_fuzzer/project.xml new file mode 100644 index 0000000000..6d3e765c7d --- /dev/null +++ b/test/fuzztest/missiondatastorage_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + \ No newline at end of file diff --git a/test/fuzztest/missionlistenercontroller_fuzzer/BUILD.gn b/test/fuzztest/missionlistenercontroller_fuzzer/BUILD.gn new file mode 100644 index 0000000000..5b3a96e1ac --- /dev/null +++ b/test/fuzztest/missionlistenercontroller_fuzzer/BUILD.gn @@ -0,0 +1,91 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("MissionListenerControllerFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/missionlistenercontroller_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${bgtaskmgr_interfaces_path}/innerkits/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "missionlistenercontroller_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:mission_info", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "${ability_runtime_services_path}/abilitymgr:mission_list", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:connection_obs_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "ipc:ipc_core", + "napi:ace_napi", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "image_framework:image_native", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":MissionListenerControllerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/missionlistenercontroller_fuzzer/corpus/init b/test/fuzztest/missionlistenercontroller_fuzzer/corpus/init new file mode 100644 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/missionlistenercontroller_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.cpp b/test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.cpp new file mode 100644 index 0000000000..f3b4424172 --- /dev/null +++ b/test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.cpp @@ -0,0 +1,252 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "missionlistenercontroller_fuzzer.h" + +#include +#include + +#define private public +#include "mission_listener_controller.h" +#include "mission_listener_stub.h" +#undef private + +#include "securec.h" +#include "parcel.h" +#include "ability_record.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_TWO = 2; +constexpr int INPUT_THREE = 3; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +std::shared_ptr Infot_ = nullptr; +class MyMissionListenerFuszzer : public MissionListenerStub { +public: + MyMissionListenerFuszzer() = default; + ~MyMissionListenerFuszzer() = default; + + void OnMissionCreated(int32_t missionId) override + { + isMissionCreated_ = true; + } + + void OnMissionDestroyed(int32_t missionId) override + { + isMissionDestroyed_ = true; + } + + void OnMissionSnapshotChanged(int32_t missionId) override + { + isMissionSnapshotChanged_ = true; + } + + void OnMissionMovedToFront(int32_t missionId) override + { + isMissionMovedToFront_ = true; + } + + void OnMissionIconUpdated(int32_t missionId, const std::shared_ptr& icon) override + { + isMissionIconUpdated_ = true; + } + + void OnMissionClosed(int32_t missionId) override + { + isMissionClosed_ = true; + } + + void OnMissionLabelUpdated(int32_t missionId) override + { + isMissionLabelUpdated_ = true; + } + + bool IsMissionCreated() const + { + return isMissionCreated_; + } + + bool IsMissionDestroyed() const + { + return isMissionDestroyed_; + } + + bool IsMissionSnapshotChanged() const + { + return isMissionSnapshotChanged_; + } + + bool IsMissionMovedToFront() const + { + return isMissionMovedToFront_; + } + + bool IsMissionIconUpdated() const + { + return isMissionIconUpdated_; + } + + bool IsMissionClosed() const + { + return isMissionClosed_; + } + + bool IsMissionLabelUpdated() const + { + return isMissionLabelUpdated_; + } + +private: + bool isMissionCreated_ = false; + bool isMissionDestroyed_ = false; + bool isMissionSnapshotChanged_ = false; + bool isMissionMovedToFront_ = false; + bool isMissionIconUpdated_ = false; + bool isMissionClosed_ = false; + bool isMissionLabelUpdated_ = false; +}; + +class MyAbilityConnection : public IAbilityConnection { +public: + MyAbilityConnection() = default; + virtual ~MyAbilityConnection() = default; + void OnAbilityConnectDone( + const AppExecFwk::ElementName& element, const sptr& remoteObject, int resultCode) override + {} + void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override + {} + sptr AsObject() override + { + return {}; + } +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +std::shared_ptr GetFuzzAbilityRecord() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (!abilityRecord) { + return nullptr; + } + return abilityRecord; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + std::shared_ptr abilityRecord = GetFuzzAbilityRecord(); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + std::shared_ptr Info = std::make_shared(); + if (!Info) { + return false; + } + Info->handler_ = nullptr; + Info->Init(); + std::shared_ptr Infos = std::make_shared(); + Infos->Init(); + sptr listener = nullptr; + Infos->AddMissionListener(listener); + Infos->DelMissionListener(listener); + listener = new MyMissionListenerFuszzer(); + Infos->AddMissionListener(listener); + Infos->DelMissionListener(listener); + Infos->missionListeners_.push_back(listener); + Infos->AddMissionListener(listener); + Infos->DelMissionListener(listener); + std::list missions; + Infos->HandleUnInstallApp(missions); + wptr remote; + Infos->OnListenerDied(remote); + if (!Infot_) { + Infot_ = std::make_shared(); + } + int32_t missionIds = static_cast(GetU32Data(data)); + Infot_->NotifyMissionCreated(missionIds); + Infot_->NotifyMissionDestroyed(missionIds); + Infot_->NotifyMissionSnapshotChanged(missionIds); + Infot_->NotifyMissionMovedToFront(missionIds); + Infot_->NotifyMissionFocused(missionIds); + Infot_->NotifyMissionUnfocused(missionIds); + std::shared_ptr icon; + #ifdef SUPPORT_SCREEN + Infot_->NotifyMissionIconChanged(missionIds, icon); + #endif + Infot_->NotifyMissionClosed(missionIds); + Infot_->NotifyMissionLabelUpdated(missionIds); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size + 1, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.h b/test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.h new file mode 100644 index 0000000000..6c720363f3 --- /dev/null +++ b/test/fuzztest/missionlistenercontroller_fuzzer/missionlistenercontroller_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTENERCONTROLLER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTENERCONTROLLER_FUZZER_H + +#define FUZZ_PROJECT_NAME "missionlistenercontroller_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTENERCONTROLLER_FUZZER_H \ No newline at end of file diff --git a/test/fuzztest/missionlistenercontroller_fuzzer/project.xml b/test/fuzztest/missionlistenercontroller_fuzzer/project.xml new file mode 100644 index 0000000000..6d3e765c7d --- /dev/null +++ b/test/fuzztest/missionlistenercontroller_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + \ No newline at end of file diff --git a/test/fuzztest/missionlistmanagerfirst_fuzzer/BUILD.gn b/test/fuzztest/missionlistmanagerfirst_fuzzer/BUILD.gn new file mode 100644 index 0000000000..ec114f5213 --- /dev/null +++ b/test/fuzztest/missionlistmanagerfirst_fuzzer/BUILD.gn @@ -0,0 +1,91 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("MissionListManagerFirstFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/missionlistmanagerfirst_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${bgtaskmgr_interfaces_path}/innerkits/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "missionlistmanagerfirst_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/ability_manager:mission_info", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "${ability_runtime_services_path}/abilitymgr:mission_list", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:connection_obs_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "ffrt:libffrt", + "ipc:ipc_core", + "napi:ace_napi", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "image_framework:image_native", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":MissionListManagerFirstFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/missionlistmanagerfirst_fuzzer/corpus/init b/test/fuzztest/missionlistmanagerfirst_fuzzer/corpus/init new file mode 100644 index 0000000000..6198079a28 --- /dev/null +++ b/test/fuzztest/missionlistmanagerfirst_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.cpp b/test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.cpp new file mode 100644 index 0000000000..768fce5003 --- /dev/null +++ b/test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.cpp @@ -0,0 +1,320 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "missionlistmanagerfirst_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "ability_record.h" +#include "mission_info_mgr.h" +#include "mission_list_manager.h" +#undef protected +#undef private + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr uint8_t ENABLE = 2; +constexpr int INPUT_ZERO = 0; +constexpr int INPUT_ONE = 1; +constexpr int INPUT_TWO = 2; +constexpr int INPUT_THREE = 3; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t OFFSET_32_VAL = 32; +constexpr size_t OFFSET_ZERO = 24; +constexpr size_t OFFSET_ONE = 16; +constexpr size_t OFFSET_TWO = 8; +constexpr uint8_t ABILITY_STATE_MOD = 20; +const std::string PARAM_APP_CLONE_INDEX_KEY("ohos.extra.param.key.appCloneIndex"); +class MyAbilityConnection : public IAbilityConnection { +public: + MyAbilityConnection() = default; + virtual ~MyAbilityConnection() = default; + void OnAbilityConnectDone( + const AppExecFwk::ElementName& element, const sptr& remoteObject, int resultCode) override + {} + void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override + {} + sptr AsObject() override + { + return {}; + } +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | + ptr[INPUT_THREE]; +} + +std::shared_ptr GetFuzzAbilityRecord() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (!abilityRecord) { + return nullptr; + } + return abilityRecord; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + std::shared_ptr abilityRecord = GetFuzzAbilityRecord(); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +AbilityRequest InitAbilityRequest(const char* data) +{ + AbilityRequest abilityRequest; + uint32_t mod = static_cast(LaunchMode::SPECIFIED) + 1; + abilityRequest.abilityInfo.launchMode = static_cast(GetU32Data(data) % mod); + mod = static_cast(AbilityCallType::START_EXTENSION_TYPE) + 1; + abilityRequest.callType = static_cast(GetU32Data(data) % mod); + return abilityRequest; +} + +std::shared_ptr InitMissionListManager(int32_t intParam) +{ + static std::once_flag flag; + auto missionListMgr = std::make_shared(intParam); + missionListMgr->Init(); + return missionListMgr; +} + +void DoSomethingTestWithMyAPI0(std::shared_ptr missionListMgr, const char* data) +{ + int32_t int32Param = static_cast(GetU32Data(data)); + missionListMgr->RegisterMissionListener(nullptr); + missionListMgr->GetMissionCount(); + missionListMgr->FindEarliestMission(); + AbilityRequest abilityRequest; + missionListMgr->EnqueueWaitingAbility(abilityRequest); + missionListMgr->EnqueueWaitingAbilityToFront(abilityRequest); + missionListMgr->StartWaitingAbility(); + missionListMgr->UnRegisterMissionListener(nullptr); + std::shared_ptr targetAbilityRecord = GetFuzzAbilityRecord(); + missionListMgr->AddRecord(abilityRequest, targetAbilityRecord); + std::shared_ptr targetMission = std::make_shared(int32Param, targetAbilityRecord); + missionListMgr->GetTargetMission(abilityRequest, targetMission, targetAbilityRecord); + missionListMgr->StartAbilityLocked(nullptr, nullptr, abilityRequest); + abilityRequest.want.SetParam(PARAM_APP_CLONE_INDEX_KEY, int32Param); + missionListMgr->GetMissionName(abilityRequest); + bool boolParam = *data % ENABLE; + missionListMgr->GetTargetMissionAndAbility(abilityRequest, targetMission, targetAbilityRecord, boolParam); + missionListMgr->EnableRecoverAbility(int32Param); + missionListMgr->GetTargetMissionList(nullptr, abilityRequest); + targetAbilityRecord->isLauncherAbility_ = boolParam; + std::shared_ptr mission = std::make_shared(int32Param, targetAbilityRecord); + missionListMgr->launcherList_->AddMissionToTop(mission); + missionListMgr->GetTargetMissionList(targetAbilityRecord, abilityRequest); + uint32_t uint32Param = static_cast(GetU32Data(data)); + abilityRequest.abilityInfo.launchMode = static_cast(uint32Param % 3); // 3 means luanch mode max enum + missionListMgr->GetReusedMission(abilityRequest); + missionListMgr->MoveNoneTopMissionToDefaultList(targetMission); + missionListMgr->MoveMissionListToTop(nullptr); + missionListMgr->MoveMissionListToTop(missionListMgr->launcherList_); + auto token = targetAbilityRecord->GetToken(); + missionListMgr->GetAbilityRecordByToken(nullptr); + missionListMgr->GetAbilityRecordByToken(token); + targetAbilityRecord->currentState_ = static_cast(uint32Param % ABILITY_STATE_MOD); + missionListMgr->DispatchState(targetAbilityRecord, uint32Param % ABILITY_STATE_MOD); + missionListMgr->CompleteForegroundSuccess(targetAbilityRecord); + std::shared_ptr prevAbilityRecord = GetFuzzAbilityRecord(); + prevAbilityRecord->isTerminating_ = boolParam; + prevAbilityRecord->currentState_ = static_cast(uint32Param % ABILITY_STATE_MOD); + targetAbilityRecord->SetPreAbilityRecord(prevAbilityRecord); + missionListMgr->TerminatePreviousAbility(targetAbilityRecord); + missionListMgr->CompleteBackground(targetAbilityRecord); +} + +void DoSomethingTestWithMyAPI1(std::shared_ptr missionListMgr, const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + int32_t int32Param = static_cast(GetU32Data(data)); + uint32_t uint32Param = static_cast(GetU32Data(data)); + MissionInfo missionInfo; + missionListMgr->GetMissionInfo(int32Param, missionInfo); + std::shared_ptr startOptions = nullptr; + missionListMgr->MoveMissionToFront(int32Param, startOptions); + std::shared_ptr callerAbility = GetFuzzAbilityRecord(); + auto abilityRecord = GetFuzzAbilityRecord(); + std::shared_ptr mission = std::make_shared(int32Param, abilityRecord); + missionListMgr->defaultStandardList_->AddMissionToTop(mission); + missionListMgr->MoveMissionToFront(int32Param, boolParam, boolParam, callerAbility, startOptions); +} + +void DoSomethingTestWithMyAPI2(std::shared_ptr missionListMgr, const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + int32_t int32Param = static_cast(GetU32Data(data)); + uint32_t uint32Param = static_cast(GetU32Data(data)); + InnerMissionInfo info; + AbilityRequest abilityRequest = InitAbilityRequest(data); + missionListMgr->CreateOrReusedMissionInfo(abilityRequest, info); + auto abilityRecord = GetFuzzAbilityRecord(); + abilityRecord->SetPendingState(static_cast(GetU32Data(data) % ABILITY_STATE_MOD)); + abilityRecord->currentState_ = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + auto token = abilityRecord->GetToken(); + std::shared_ptr mission = std::make_shared(int32Param, abilityRecord); + missionListMgr->defaultStandardList_->AddMissionToTop(mission); + missionListMgr->MinimizeAbility(token, boolParam); + missionListMgr->MoveAbilityToBackground(abilityRecord); + Want *resultWant = new Want(); + int64_t int64Param = (static_cast(GetU32Data(data)) << OFFSET_32_VAL) + GetU32Data(data); + missionListMgr->BackToCallerAbilityWithResult(abilityRecord, int32Param, resultWant, int64Param); +} + +void DoSomethingTestWithMyAPI3(std::shared_ptr missionListMgr, const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + int32_t int32Param = static_cast(GetU32Data(data)); + uint32_t uint32Param = static_cast(GetU32Data(data)); + auto abilityRecord = GetFuzzAbilityRecord(); + std::shared_ptr mission = std::make_shared(int32Param, abilityRecord); + abilityRecord->SetMissionId(int32Param); + missionListMgr->defaultStandardList_->AddMissionToTop(mission); + missionListMgr->SetMissionLockedState(int32Param, boolParam); + const AppExecFwk::ElementName element; + missionListMgr->GetAbilityNumber(element); + missionListMgr->MoveToBackgroundTask(abilityRecord, boolParam); + missionListMgr->PrintTimeOutLog(abilityRecord, uint32Param, boolParam); + uint32_t msgId = uint32Param % ABILITY_STATE_MOD; + std::string stringParam(data, size); + missionListMgr->GetContentAndTypeId(msgId, stringParam, int32Param); + abilityRecord->recordId_ = int32Param; + missionListMgr->OnTimeOut(msgId, int32Param, boolParam); + missionListMgr->HandleLoadTimeout(abilityRecord); + auto state = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + abilityRecord->currentState_ = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + missionListMgr->HandleForegroundTimeout(abilityRecord, state); + missionListMgr->CompleteForegroundFailed(abilityRecord, state); + missionListMgr->HandleTimeoutAndResumeAbility(abilityRecord, state); + missionListMgr->DelayedResumeTimeout(abilityRecord); + missionListMgr->MoveToTerminateList(abilityRecord); +} + +void DoSomethingTestWithMyAPI4(std::shared_ptr missionListMgr, const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + int32_t int32Param = static_cast(GetU32Data(data)); + uint32_t uint32Param = static_cast(GetU32Data(data)); + auto abilityRecord = GetFuzzAbilityRecord(); + std::shared_ptr mission = std::make_shared(int32Param, abilityRecord); + abilityRecord->SetMissionId(int32Param); + abilityRecord->recordId_ = int32Param; + missionListMgr->defaultStandardList_->AddMissionToTop(mission); + missionListMgr->launcherList_->AddMissionToTop(mission); + missionListMgr->GetAbilityRecordByCaller(abilityRecord, int32Param); + missionListMgr->OnAbilityDied(abilityRecord, int32Param); + int64_t abilityRecordId = static_cast(int32Param); + missionListMgr->GetAbilityRecordById(abilityRecordId); + missionListMgr->PostStartWaitingAbility(); + auto type = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + const_cast(abilityRecord->GetAbilityInfo()).type = type; + auto state = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + abilityRecord->currentState_ = state; + abilityRecord->isTerminating_ = boolParam; + missionListMgr->HandleAbilityDied(abilityRecord); + missionListMgr->DelayedStartLauncher(); + missionListMgr->BackToLauncher(); + auto continueState = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + missionListMgr->SetMissionContinueState(nullptr, int32Param, continueState); + missionListMgr->SetMissionContinueState(abilityRecord->GetToken(), int32Param, continueState); + std::vector info; + std::vector params; + std::string stringParam(data, size); + missionListMgr->Dump(info); + missionListMgr->DumpMissionListByRecordId(info, boolParam, int32Param, params); + missionListMgr->DumpMissionList(info, boolParam, stringParam); + missionListMgr->DumpMissionInfos(info); + missionListMgr->DumpMission(int32Param, info); + auto abilityRequest = InitAbilityRequest(data); + abilityRequest.callType = static_cast(GetU32Data(data) % ABILITY_STATE_MOD); + missionListMgr->CallAbilityLocked(abilityRequest); + ElementName element; + missionListMgr->GetAbilityRecordByName(element); + missionListMgr->GetAbilityRecordsByName(element); + auto callRecord = std::make_shared(int32Param, abilityRecord, nullptr, abilityRecord->GetToken()); + missionListMgr->OnCallConnectDied(callRecord); + Want want; + missionListMgr->OnAcceptWantResponse(want, stringParam); + missionListMgr->EnqueueWaitingAbility(abilityRequest); + missionListMgr->EnqueueWaitingAbility(abilityRequest); // add twice + missionListMgr->OnStartSpecifiedAbilityTimeoutResponse(want); + missionListMgr->GetMissionBySpecifiedFlag(want, stringParam); +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + // fuzz for MissionListManager + int32_t int32Param = static_cast(GetU32Data(data)); + auto missionListMgr = InitMissionListManager(int32Param); + DoSomethingTestWithMyAPI0(missionListMgr, data); + DoSomethingTestWithMyAPI1(missionListMgr, data, size); + DoSomethingTestWithMyAPI2(missionListMgr, data, size); + DoSomethingTestWithMyAPI3(missionListMgr, data, size); + DoSomethingTestWithMyAPI4(missionListMgr, data, size); + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char*)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.h b/test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.h new file mode 100644 index 0000000000..7409b531fd --- /dev/null +++ b/test/fuzztest/missionlistmanagerfirst_fuzzer/missionlistmanagerfirst_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTMANAGERSECOND_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTMANAGERSECOND_FUZZER_H + +#define FUZZ_PROJECT_NAME "missionlistmanagersecond_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_MISSIONLISTMANAGERSECOND_FUZZER_H \ No newline at end of file diff --git a/test/fuzztest/missionlistmanagerfirst_fuzzer/project.xml b/test/fuzztest/missionlistmanagerfirst_fuzzer/project.xml new file mode 100644 index 0000000000..6d3e765c7d --- /dev/null +++ b/test/fuzztest/missionlistmanagerfirst_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + \ No newline at end of file