From dc0171f6bab70ebf76d4842bfeb86d17cd7fd783 Mon Sep 17 00:00:00 2001 From: xuzheheng Date: Tue, 8 Nov 2022 14:23:09 +0000 Subject: [PATCH] xuzheheng1@huawei.com Signed-off-by: xuzheheng Change-Id: I43137e02af772cbda169b47fa7b15a8fcfcf63db --- test/fuzztest/BUILD.gn | 2 + .../applicationanrlistener_fuzzer/BUILD.gn | 88 ++++++ .../applicationanrlistener_fuzzer.cpp | 224 +++++++++++++++ .../applicationanrlistener_fuzzer.h | 21 ++ .../applicationanrlistener_fuzzer/corpus/init | 16 ++ .../applicationanrlistener_fuzzer/project.xml | 25 ++ .../connectionstatemanager_fuzzer/BUILD.gn | 88 ++++++ .../connectionstatemanager_fuzzer.cpp | 256 ++++++++++++++++++ .../connectionstatemanager_fuzzer.h | 21 ++ .../connectionstatemanager_fuzzer/corpus/init | 16 ++ .../connectionstatemanager_fuzzer/project.xml | 25 ++ 11 files changed, 782 insertions(+) create mode 100755 test/fuzztest/applicationanrlistener_fuzzer/BUILD.gn create mode 100755 test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.cpp create mode 100755 test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.h create mode 100755 test/fuzztest/applicationanrlistener_fuzzer/corpus/init create mode 100755 test/fuzztest/applicationanrlistener_fuzzer/project.xml create mode 100755 test/fuzztest/connectionstatemanager_fuzzer/BUILD.gn create mode 100755 test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.cpp create mode 100755 test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.h create mode 100755 test/fuzztest/connectionstatemanager_fuzzer/corpus/init create mode 100755 test/fuzztest/connectionstatemanager_fuzzer/project.xml diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index f6ac920d6f..2a54dac4ce 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -29,6 +29,7 @@ group("fuzztest") { "acquiredataability_fuzzer:fuzztest", "addabilitystagedone_fuzzer:fuzztest", "amsmgrscheduler_fuzzer:fuzztest", + "applicationanrlistener_fuzzer:fuzztest", "applifecycledeal_fuzzer:fuzztest", "appmanager_fuzzer:fuzztest", "appmgrrest_fuzzer:fuzztest", @@ -47,6 +48,7 @@ group("fuzztest") { "closeability_fuzzer:fuzztest", "completefirstframedrawing_fuzzer:fuzztest", "connectability_fuzzer:fuzztest", + "connectionstatemanager_fuzzer:fuzztest", "continueability_fuzzer:fuzztest", "continuemission_fuzzer:fuzztest", "delegatordoabilitybackground_fuzzer:fuzztest", diff --git a/test/fuzztest/applicationanrlistener_fuzzer/BUILD.gn b/test/fuzztest/applicationanrlistener_fuzzer/BUILD.gn new file mode 100755 index 0000000000..453333b3e0 --- /dev/null +++ b/test/fuzztest/applicationanrlistener_fuzzer/BUILD.gn @@ -0,0 +1,88 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +import("//foundation/resourceschedule/background_task_mgr/bgtaskmgr.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("ApplicationAnrListenerFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/applicationanrlistener_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${bgtaskmgr_interfaces_path}/innerkits/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "applicationanrlistener_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "background_task_mgr:bgtaskmgr_innerkits", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":ApplicationAnrListenerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.cpp b/test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.cpp new file mode 100755 index 0000000000..212fe2d6d0 --- /dev/null +++ b/test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.cpp @@ -0,0 +1,224 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "applicationanrlistener_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "ability_manager_service.h" +#include "application_anr_listener.h" +#include "atomic_service_status_callback.h" +#include "atomic_service_status_callback_proxy.h" +#include "background_task_observer.h" +#include "call_container.h" +#include "call_record.h" +#include "caller_info.h" +#include "free_install_manager.h" +#undef protected +#undef private + +#include "ability_record.h" +#include "continuous_task_callback_info.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +class MyAbilityConnection : public IAbilityConnection { +public: + MyAbilityConnection() = default; + virtual ~MyAbilityConnection() = default; + void OnAbilityConnectDone( + const AppExecFwk::ElementName &element, const sptr &remoteObject, int resultCode) override + {} + void OnAbilityDisconnectDone(const AppExecFwk::ElementName &element, int resultCode) override + {} + sptr AsObject() override + { + return {}; + } +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +std::shared_ptr GetFuzzAbilityRecord() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (!abilityRecord) { + return nullptr; + } + return abilityRecord; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + std::shared_ptr abilityRecord = GetFuzzAbilityRecord(); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + int intParam = static_cast(GetU32Data(data)); + int32_t int32Param = static_cast(GetU32Data(data)); + int64_t int64Param = static_cast(GetU32Data(data)); + std::string stringParam(data, size); + Parcel wantParcel; + Want *want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (!want) { + return false; + } + } + sptr token = GetFuzzAbilityToken(); + sptr connect = new MyAbilityConnection(); + std::vector info; + std::shared_ptr targetService = GetFuzzAbilityRecord(); + + // fuzz for ApplicationAnrListener + auto applicationAnrListener = std::make_shared(); + applicationAnrListener->OnAnr(int32Param); + + // fuzz for FreeInstallManager + auto abilityms = std::make_shared(); + std::weak_ptr amsWeakPtr{abilityms}; + auto freeInstallManager = std::make_shared(amsWeakPtr); + freeInstallManager->IsTopAbility(token); + freeInstallManager->StartFreeInstall(*want, int32Param, intParam, token); + freeInstallManager->RemoteFreeInstall(*want, int32Param, intParam, token); + freeInstallManager->BuildFreeInstallInfo(*want, int32Param, intParam, token); + freeInstallManager->StartRemoteFreeInstall(*want, intParam, int32Param, token); + freeInstallManager->NotifyDmsCallback(*want, intParam); + freeInstallManager->NotifyFreeInstallResult(*want, intParam, int64Param); + freeInstallManager->FreeInstallAbilityFromRemote(*want, token, int32Param, intParam); + freeInstallManager->ConnectFreeInstall(*want, int32Param, token, stringParam); + freeInstallManager->GetTimeStamp(); + freeInstallManager->OnInstallFinished(intParam, *want, int32Param, int64Param); + freeInstallManager->OnRemoteInstallFinished(intParam, *want, int32Param, int64Param); + + // fuzz for AtomicServiceStatusCallback + std::weak_ptr fimWeakPtr{freeInstallManager}; + auto atomicServiceStatusCallback = std::make_shared(fimWeakPtr, int64Param); + atomicServiceStatusCallback->OnInstallFinished(intParam, *want, int32Param); + atomicServiceStatusCallback->OnRemoteInstallFinished(intParam, *want, int32Param); + + // fuzz for AtomicServiceStatusCallbackProxy + sptr impl = GetFuzzAbilityToken(); + auto atomicServiceStatusCallbackProxy = std::make_shared(impl); + atomicServiceStatusCallbackProxy->OnInstallFinished(intParam, *want, int32Param); + atomicServiceStatusCallbackProxy->OnRemoteInstallFinished(intParam, *want, int32Param); + + // fuzz for BackgroundTaskObserver + auto backgroundTaskObserver = std::make_shared(); + auto continuousTaskCallbackInfo = std::make_shared(); + backgroundTaskObserver->OnContinuousTaskStart(continuousTaskCallbackInfo); + backgroundTaskObserver->OnContinuousTaskStop(continuousTaskCallbackInfo); + wptr object{token}; + + // fuzz for CallRecord + auto callRecord = std::make_shared(int32Param, targetService, connect, token); + callRecord->CreateCallRecord(int32Param, targetService, connect, token); + callRecord->SetCallStub(token); + callRecord->GetCallStub(); + callRecord->SetConCallBack(connect); + callRecord->GetConCallBack(); + callRecord->GetTargetServiceName(); + callRecord->GetCallerToken(); + callRecord->SchedulerConnectDone(); + callRecord->SchedulerDisconnectDone(); + callRecord->OnCallStubDied(object); + callRecord->Dump(info); + callRecord->GetCallerUid(); + CallState state = CallState::INIT; + callRecord->IsCallState(state); + callRecord->SetCallState(state); + callRecord->GetCallRecordId(); + + // fuzz for CallContainer + auto callContainer = std::make_shared(); + callContainer->AddCallRecord(connect, callRecord); + callContainer->GetCallRecord(connect); + callContainer->RemoveCallRecord(connect); + callContainer->OnConnectionDied(object); + callContainer->CallRequestDone(token); + callContainer->Dump(info); + callContainer->IsNeedToCallRequest(); + callContainer->AddConnectDeathRecipient(connect); + callContainer->RemoveConnectDeathRecipient(connect); + + // fuzz for CallerInfo + auto callerInfo = std::make_shared(); + Parcel parcel; + callerInfo->Marshalling(parcel); + callerInfo->Unmarshalling(parcel); + callerInfo->ReadFromParcel(parcel); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.h b/test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.h new file mode 100755 index 0000000000..9b3f26de56 --- /dev/null +++ b/test/fuzztest/applicationanrlistener_fuzzer/applicationanrlistener_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_APPLICATIONANRLISTENER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_APPLICATIONANRLISTENER_FUZZER_H + +#define FUZZ_PROJECT_NAME "applicationanrlistener_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_APPLICATIONANRLISTENER_FUZZER_H diff --git a/test/fuzztest/applicationanrlistener_fuzzer/corpus/init b/test/fuzztest/applicationanrlistener_fuzzer/corpus/init new file mode 100755 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/applicationanrlistener_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/applicationanrlistener_fuzzer/project.xml b/test/fuzztest/applicationanrlistener_fuzzer/project.xml new file mode 100755 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/applicationanrlistener_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/connectionstatemanager_fuzzer/BUILD.gn b/test/fuzztest/connectionstatemanager_fuzzer/BUILD.gn new file mode 100755 index 0000000000..35df529108 --- /dev/null +++ b/test/fuzztest/connectionstatemanager_fuzzer/BUILD.gn @@ -0,0 +1,88 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/ohos.gni") +import("//build/test.gni") +import("//foundation/ability/ability_runtime/ability_runtime.gni") +import("//foundation/resourceschedule/background_task_mgr/bgtaskmgr.gni") +module_output_path = "ability_runtime/abilitymgr" + +##############################fuzztest########################################## +ohos_fuzztest("ConnectionStateManagerFuzzTest") { + module_out_path = module_output_path + + fuzz_config_file = + "${ability_runtime_test_path}/fuzztest/connectionstatemanager_fuzzer" + include_dirs = [ + "${ability_runtime_innerkits_path}/ability_manager/include", + "${ability_runtime_innerkits_path}/dataobs_manager/include", + "${bgtaskmgr_interfaces_path}/innerkits/include", + "${multimodalinput_path}/interfaces/native/innerkits/event/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "connectionstatemanager_fuzzer.cpp" ] + + configs = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager_public_config", + "${ability_runtime_services_path}/abilitymgr:abilityms_config", + ] + + deps = [ + "${ability_runtime_innerkits_path}/ability_manager:ability_manager", + "${ability_runtime_innerkits_path}/uri_permission:uri_permission_mgr", + "${ability_runtime_native_path}/ability/native:abilitykit_native", + "${ability_runtime_services_path}/abilitymgr:abilityms", + "//third_party/jsoncpp:jsoncpp", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:connection_obs_manager", + "bundle_framework:appexecfwk_base", + "c_utils:utils", + "common_event_service:cesfwk_core", + "common_event_service:cesfwk_innerkits", + "eventhandler:libeventhandler", + "ipc:ipc_core", + "relational_store:native_dataability", + "relational_store:native_rdb", + "samgr:samgr_proxy", + ] + + if (ability_runtime_graphics) { + deps += [] + external_deps += [ + "i18n:intl_util", + "window_manager:libwm", + ] + } +} + +############################################################################### +group("fuzztest") { + testonly = true + deps = [] + deps += [ + # deps file + ":ConnectionStateManagerFuzzTest", + ] +} +############################################################################### diff --git a/test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.cpp b/test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.cpp new file mode 100755 index 0000000000..d92f6e010f --- /dev/null +++ b/test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.cpp @@ -0,0 +1,256 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "connectionstatemanager_fuzzer.h" + +#include +#include + +#define private public +#define protected public +#include "connection_observer_controller.h" +#include "connection_record.h" +#include "connection_state_item.h" +#include "connection_state_manager.h" +#undef protected +#undef private + +#include "ability_record.h" +#include "continuous_task_callback_info.h" + +using namespace OHOS::AAFwk; +using namespace OHOS::AppExecFwk; +using namespace OHOS::AbilityRuntime; + +namespace OHOS { +namespace { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t ENABLE = 2; +class MyAbilityConnection : public IAbilityConnection { +public: + MyAbilityConnection() = default; + virtual ~MyAbilityConnection() = default; + void OnAbilityConnectDone( + const AppExecFwk::ElementName &element, const sptr &remoteObject, int resultCode) override + {} + void OnAbilityDisconnectDone(const AppExecFwk::ElementName &element, int resultCode) override + {} + sptr AsObject() override + { + return {}; + } +}; +class MyAbilityConnectionObserver : public IConnectionObserver { +public: + MyAbilityConnectionObserver() = default; + virtual ~MyAbilityConnectionObserver() = default; + void OnExtensionConnected(const ConnectionData &data) override + {} + void OnExtensionDisconnected(const ConnectionData &data) override + {} + void OnDlpAbilityOpened(const DlpStateData &data) override + {} + void OnDlpAbilityClosed(const DlpStateData &data) override + {} + sptr AsObject() override + { + return {}; + } +}; +} + +uint32_t GetU32Data(const char* ptr) +{ + // convert fuzz input data to an integer + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; +} + +std::shared_ptr GetFuzzAbilityRecord() +{ + sptr token = nullptr; + AbilityRequest abilityRequest; + abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; + abilityRequest.abilityInfo.name = "MainAbility"; + abilityRequest.abilityInfo.type = AbilityType::DATA; + std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); + if (!abilityRecord) { + return nullptr; + } + return abilityRecord; +} + +sptr GetFuzzAbilityToken() +{ + sptr token = nullptr; + std::shared_ptr abilityRecord = GetFuzzAbilityRecord(); + if (abilityRecord) { + token = abilityRecord->GetToken(); + } + return token; +} + +bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) +{ + bool boolParam = *data % ENABLE; + int intParam = static_cast(GetU32Data(data)); + int32_t int32Param = static_cast(GetU32Data(data)); + std::string stringParam(data, size); + Parcel wantParcel; + Want *want = nullptr; + if (wantParcel.WriteBuffer(data, size)) { + want = Want::Unmarshalling(wantParcel); + if (!want) { + return false; + } + } + sptr token = GetFuzzAbilityToken(); + sptr connect = new MyAbilityConnection(); + sptr observer = new MyAbilityConnectionObserver(); + std::vector info; + AbilityRuntime::ConnectionData connectionData; + + // fuzz for ConnectionObserverController + auto connectionObserverController = std::make_shared(); + connectionObserverController->AddObserver(observer); + connectionObserverController->RemoveObserver(observer); + connectionObserverController->NotifyExtensionConnected(connectionData); + connectionObserverController->NotifyExtensionDisconnected(connectionData); + AbilityRuntime::DlpStateData dlpStateData; + connectionObserverController->NotifyDlpAbilityOpened(dlpStateData); + connectionObserverController->NotifyDlpAbilityClosed(dlpStateData); + connectionObserverController->GetObservers(); + wptr remote; + connectionObserverController->HandleRemoteDied(remote); + ConnectionObserverController::ObserverDeathRecipient::ObserverDeathHandler handler; + auto observerDeathRecipient = + new ConnectionObserverController::ObserverDeathRecipient(handler); + observerDeathRecipient->OnRemoteDied(remote); + + // fuzz for ConnectionRecord + std::shared_ptr targetService = GetFuzzAbilityRecord(); + auto connectionRecord = std::make_shared(token, targetService, connect); + connectionRecord->CreateConnectionRecord(token, targetService, connect); + ConnectionState state = ConnectionState::CONNECTED; + connectionRecord->SetConnectState(state); + connectionRecord->GetConnectState(); + connectionRecord->GetToken(); + connectionRecord->GetAbilityRecord(); + connectionRecord->GetAbilityConnectCallback(); + connectionRecord->ClearConnCallBack(); + connectionRecord->DisconnectAbility(); + connectionRecord->CompleteConnect(intParam); + connectionRecord->CompleteDisconnect(intParam, boolParam); + connectionRecord->ScheduleDisconnectAbilityDone(); + connectionRecord->ScheduleConnectAbilityDone(); + connectionRecord->DisconnectTimeout(); + connectionRecord->ConvertConnectionState(state); + connectionRecord->Dump(info); + connectionRecord->AttachCallerInfo(); + connectionRecord->GetCallerUid(); + connectionRecord->GetCallerPid(); + connectionRecord->GetCallerName(); + connectionRecord->GetTargetToken(); + connectionRecord->GetConnection(); + + // fuzz for ConnectionRecord + auto connectionStateItem = std::make_shared(int32Param, int32Param, stringParam); + std::shared_ptr record; + connectionStateItem->CreateConnectionStateItem(record); + DataAbilityCaller dataCaller; + connectionStateItem->CreateConnectionStateItem(dataCaller); + connectionStateItem->AddConnection(record, connectionData); + connectionStateItem->RemoveConnection(record, connectionData); + std::shared_ptr dataAbility; + connectionStateItem->AddDataAbilityConnection(dataCaller, dataAbility, connectionData); + connectionStateItem->RemoveDataAbilityConnection(dataCaller, dataAbility, connectionData); + connectionStateItem->HandleDataAbilityDied(token, connectionData); + connectionStateItem->IsEmpty(); + std::vector datas; + connectionStateItem->GenerateAllConnectionData(datas); + std::shared_ptr connectedExtension; + connectionStateItem->GenerateConnectionData(connectedExtension, connectionData); + std::shared_ptr connectedDataAbility; + connectionStateItem->GenerateConnectionData(connectedDataAbility, connectionData); + + // fuzz for ConnectionStateManager + auto connectionStateManager = std::make_shared(); + connectionStateManager->GetProcessNameByPid(int32Param); + connectionStateManager->Init(); + connectionStateManager->RegisterObserver(observer); + connectionStateManager->UnregisterObserver(observer); + connectionStateManager->AddConnection(record); + connectionStateManager->RemoveConnection(record, boolParam); + connectionStateManager->AddDataAbilityConnection(dataCaller, dataAbility); + connectionStateManager->RemoveDataAbilityConnection(dataCaller, dataAbility); + connectionStateManager->CheckDataAbilityConnectionParams(dataCaller, dataAbility); + connectionStateManager->HandleDataAbilityDied(dataAbility); + connectionStateManager->HandleDataAbilityCallerDied(int32Param); + std::shared_ptr dlpManger = GetFuzzAbilityRecord(); + connectionStateManager->AddDlpManager(dlpManger); + connectionStateManager->RemoveDlpManager(dlpManger); + connectionStateManager->AddDlpAbility(dlpManger); + connectionStateManager->RemoveDlpAbility(dlpManger); + connectionStateManager->HandleAppDied(int32Param); + std::vector infos; + connectionStateManager->GetDlpConnectionInfos(infos); + connectionStateManager->AddConnectionInner(connectionRecord, connectionData); + connectionStateManager->RemoveConnectionInner(connectionRecord, connectionData); + connectionStateManager->HandleCallerDied(int32Param); + connectionStateManager->RemoveDiedCaller(int32Param); + connectionStateManager->AddDataAbilityConnectionInner(dataCaller, dataAbility, connectionData); + connectionStateManager->RemoveDataAbilityConnectionInner(dataCaller, dataAbility, connectionData); + connectionStateManager->HandleDataAbilityDiedInner(token, datas); + AbilityRuntime::DlpStateData dlpData; + connectionStateManager->HandleDlpAbilityInner(dlpManger, boolParam, dlpData); + connectionStateManager->InitAppStateObserver(); + + return true; +} +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + char* ch = (char *)malloc(size + 1); + if (ch == nullptr) { + std::cout << "malloc failed." << std::endl; + return 0; + } + + (void)memset_s(ch, size + 1, 0x00, size + 1); + if (memcpy_s(ch, size, data, size) != EOK) { + std::cout << "copy failed." << std::endl; + free(ch); + ch = nullptr; + return 0; + } + + OHOS::DoSomethingInterestingWithMyAPI(ch, size); + free(ch); + ch = nullptr; + return 0; +} + diff --git a/test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.h b/test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.h new file mode 100755 index 0000000000..d0da23cf97 --- /dev/null +++ b/test/fuzztest/connectionstatemanager_fuzzer/connectionstatemanager_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONSTATEMANAGER_FUZZER_H +#define FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONSTATEMANAGER_FUZZER_H + +#define FUZZ_PROJECT_NAME "connectionstatemanager_fuzzer" + +#endif // FUZZTEST_OHOS_ABILITY_RUNTIME_CONNECTIONSTATEMANAGER_FUZZER_H diff --git a/test/fuzztest/connectionstatemanager_fuzzer/corpus/init b/test/fuzztest/connectionstatemanager_fuzzer/corpus/init new file mode 100755 index 0000000000..8eb5a7d6eb --- /dev/null +++ b/test/fuzztest/connectionstatemanager_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/connectionstatemanager_fuzzer/project.xml b/test/fuzztest/connectionstatemanager_fuzzer/project.xml new file mode 100755 index 0000000000..6e8ad2cfde --- /dev/null +++ b/test/fuzztest/connectionstatemanager_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + +