mirror of
https://github.com/openharmony/notification_distributed_notification_service.git
synced 2026-08-24 07:03:05 -04:00
CheerfulRicky
2f0a1cf4f6
Root cause: FFRT async tasks access static resources during process exit when static destruction order is undefined, causing UAF. The sleep(1000ms) calls were a probabilistic workaround that reduced fuzzer throughput by 50-100x without deterministically preventing UAF. Changes: - Repurpose SelfClean(bool resetQueues) to support both drain-only and drain+reset modes. Per-iteration uses drain-only (queues stay alive for coverage), atexit uses drain+reset (queues set to null before static destructors run) - Add WaitForFfrtQueue() to NotificationSubscriberManager, DistributedNotificationManager, and NotificationLocalLiveViewSubscriberManager (drain without reset) - Use existing SyncSubmit() for FfrtQueueImpl drain instead of new method - Enhance Reset()/ResetFfrtQueue() to drain before release - Add ENSURE_ANS_SERVICE_CLEANED_AT_EXIT() macro in fuzz_common_base.h that calls GetInstance()->SelfClean() after each iteration's DoSomethingInterestingWithMyAPI to drain pending FFRT tasks, and registers atexit to call SelfClean(true) + _exit(0) to skip all static destructors and prevent exit-time crashes (timer callbacks, CFI violations, FFRT queue destruction races) - Move StopCacheCleanupTimer() to public in NotificationPreferences so SelfClean(true) can cancel delayed global ffrt::submit_h task - Remove all sleep/sleep_for calls from 146 fuzz test files - Convert 9 LOCAL-pattern fuzzers (ansmanagerstub*, serviceprivate*) from new/make_shared to GetInstance() singleton pattern Reminder fuzzers (reminderdatamanager*) and services/reminder/ are not modified per project maintenance boundary. Verified: 16/16 rounds across 3 fuzz targets, 0% crash rate. Co-Authored-By: Agent Signed-off-by: CheerfulRicky <yuegang7@h-partners.com> Change-Id: I67bcba081d346cbdfcae8e001e12382214d523d7