From 2bafa33e9ade1ed59a8ceea3d30eed59e821eeb0 Mon Sep 17 00:00:00 2001 From: shipengtao9579 Date: Wed, 25 May 2022 15:41:09 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=20user=5Fidm=20=E7=9A=84FUZZ?= =?UTF-8?q?=E6=B5=8B=E8=AF=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: shipengtao9579 --- bundle.json | 3 +- .../fuzztest/user_idm_fuzzer/BUILD.gn | 51 ++++ .../fuzztest/user_idm_fuzzer/corpus/init | 14 + .../fuzztest/user_idm_fuzzer/project.xml | 25 ++ .../user_idm_fuzzer/user_idm_fuzzer.cpp | 258 ++++++++++++++++++ .../user_idm_fuzzer/user_idm_fuzzer.h | 21 ++ 6 files changed, 371 insertions(+), 1 deletion(-) create mode 100644 test/user_idm/fuzztest/user_idm_fuzzer/BUILD.gn create mode 100644 test/user_idm/fuzztest/user_idm_fuzzer/corpus/init create mode 100644 test/user_idm/fuzztest/user_idm_fuzzer/project.xml create mode 100644 test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.cpp create mode 100644 test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.h diff --git a/bundle.json b/bundle.json index 1ae9187..034caa2 100644 --- a/bundle.json +++ b/bundle.json @@ -119,7 +119,8 @@ ], "test": [ "//base/user_iam/user_auth/test/user_idm:user_idm_unittest", - "//base/user_iam/user_auth/test/user_auth:user_auth_unittest" + "//base/user_iam/user_auth/test/user_auth:user_auth_unittest", + "//base/user_iam/user_auth/test/user_idm/fuzztest/user_idm_fuzzer:UserIdmFuzzTest" ] } } diff --git a/test/user_idm/fuzztest/user_idm_fuzzer/BUILD.gn b/test/user_idm/fuzztest/user_idm_fuzzer/BUILD.gn new file mode 100644 index 0000000..6267f8d --- /dev/null +++ b/test/user_idm/fuzztest/user_idm_fuzzer/BUILD.gn @@ -0,0 +1,51 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/ohos.gni") +import("//build/test.gni") + +ohos_fuzztest("UserIdmFuzzTest") { + module_out_path = "user_iam/user_auth/user_idm" + fuzz_config_file = + "//base/user_iam/user_auth/test/user_idm/fuzztest/user_idm_fuzzer" + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + include_dirs = [ + "//base/user_iam/user_auth/common/logs/user_idm", + "//base/user_iam/user_auth/frameworks/user_idm/inc", + "//base/user_iam/user_auth/services/user_idm/inc", + "//base/user_iam/user_auth/interfaces/inner_api/user_idm", + "//base/user_iam/user_auth/common/logs", + ] + + sources = [ "user_idm_fuzzer.cpp" ] + + deps = [ + "//base/user_iam/user_auth/common:iam_test", + "//base/user_iam/user_auth/services:userauthservice", + ] + + external_deps = [ + "hiviewdfx_hilog_native:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + "samgr_standard:samgr_proxy", + "utils_base:utils", + ] +} diff --git a/test/user_idm/fuzztest/user_idm_fuzzer/corpus/init b/test/user_idm/fuzztest/user_idm_fuzzer/corpus/init new file mode 100644 index 0000000..bc977bd --- /dev/null +++ b/test/user_idm/fuzztest/user_idm_fuzzer/corpus/init @@ -0,0 +1,14 @@ +# Copyright (c) 2022 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FUZZ \ No newline at end of file diff --git a/test/user_idm/fuzztest/user_idm_fuzzer/project.xml b/test/user_idm/fuzztest/user_idm_fuzzer/project.xml new file mode 100644 index 0000000..406517d --- /dev/null +++ b/test/user_idm/fuzztest/user_idm_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 2000 + + 300 + + 4096 + + diff --git a/test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.cpp b/test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.cpp new file mode 100644 index 0000000..1c15d9d --- /dev/null +++ b/test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.cpp @@ -0,0 +1,258 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "user_idm_fuzzer.h" +#include "parcel.h" +#include "securec.h" +#include "iam_fuzz_test.h" +#include "useridm_service.h" +#include "useridm_hilog_wrapper.h" + + +#undef private + +using namespace std; +using namespace OHOS::UserIAM::Common; + +namespace OHOS { +namespace UserIAM { +namespace UserIDM { +namespace { +class GetInfoCallbackFuzzer : public IRemoteStub { +public: + virtual ~GetInfoCallbackFuzzer() = default; + void OnGetInfo(std::vector &info) override + { + USERIDM_HILOGI(MODULE_SERVICE, "GetInfoCallbackFuzzer OnGetInfo"); + return; + } +}; + +class GetSecInfoCallbackFuzzer : public IRemoteStub { +public: + virtual ~GetSecInfoCallbackFuzzer() = default; + void OnGetSecInfo(SecInfo &info) override + { + USERIDM_HILOGI(MODULE_SERVICE, "GetSecInfoCallbackFuzzer OnGetSecInfo"); + return; + } +}; + +class IdmCallbackFuzzer : public IRemoteStub { +public: + virtual ~IdmCallbackFuzzer() = default; + void OnResult(int32_t result, RequestResult reqRet) override + { + USERIDM_HILOGI(MODULE_SERVICE, "IdmCallbackFuzzer OnResult"); + return; + } + + void OnAcquireInfo(int32_t module, int32_t acquire, RequestResult reqRet) override + { + USERIDM_HILOGI(MODULE_SERVICE, "IdmCallbackFuzzer OnAcquireInfo"); + return; + } +}; + +void FillFuzzAddCredInfo(Parcel &parcel, AddCredInfo &credInfo) +{ + credInfo.authType = static_cast(parcel.ReadUint32()); + credInfo.authSubType = static_cast(parcel.ReadUint64()); + FillFuzzUint8Vector(parcel, credInfo.token); + USERIDM_HILOGI(MODULE_SERVICE, "success"); +} + +UserIDMService g_userIdmService(SUBSYS_USERIAM_SYS_ABILITY_USERIDM, true); + +void FuzzOnStart(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + static_cast(parcel); + g_userIdmService.OnStart(); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzOnStop(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + static_cast(parcel); + g_userIdmService.OnStop(); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzOpenSession(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + static_cast(parcel); + g_userIdmService.OpenSession(); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzCloseSession(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + static_cast(parcel); + g_userIdmService.CloseSession(); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzGetAuthInfo_a(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + AuthType authType = static_cast(parcel.ReadUint32()); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) GetInfoCallbackFuzzer(); + } + g_userIdmService.GetAuthInfo(authType, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzGetAuthInfo_b(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + int32_t userId = parcel.ReadInt32(); + AuthType authType = static_cast(parcel.ReadUint32()); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) GetInfoCallbackFuzzer(); + } + g_userIdmService.GetAuthInfo(userId, authType, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzGetSecInfo(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + int32_t userId = parcel.ReadInt32(); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) GetSecInfoCallbackFuzzer(); + } + g_userIdmService.GetSecInfo(userId, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzAddCredential(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + AddCredInfo credInfo; + FillFuzzAddCredInfo(parcel, credInfo); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) IdmCallbackFuzzer(); + } + g_userIdmService.AddCredential(credInfo, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzUpdateCredential(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + AddCredInfo credInfo; + FillFuzzAddCredInfo(parcel, credInfo); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) IdmCallbackFuzzer(); + } + g_userIdmService.UpdateCredential(credInfo, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzCancel(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + uint64_t challenge = parcel.ReadUint64(); + g_userIdmService.Cancel(challenge); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzEnforceDelUser(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + uint32_t userId = parcel.ReadUint32(); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) IdmCallbackFuzzer(); + } + g_userIdmService.EnforceDelUser(userId, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzDelUser(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + std::vector authToken; + FillFuzzUint8Vector(parcel, authToken); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) IdmCallbackFuzzer(); + } + g_userIdmService.DelUser(authToken, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +void FuzzDelCred(Parcel &parcel) +{ + USERIDM_HILOGI(MODULE_SERVICE, "begin"); + uint64_t credentialId = parcel.ReadUint64(); + std::vector authToken; + FillFuzzUint8Vector(parcel, authToken); + sptr callback = nullptr; + if (parcel.ReadBool()) { + callback = new (std::nothrow) IdmCallbackFuzzer(); + } + g_userIdmService.DelCred(credentialId, authToken, callback); + USERIDM_HILOGI(MODULE_SERVICE, "end"); +} + +using FuzzFunc = decltype(FuzzDelCred); +FuzzFunc *g_fuzzFuncs[] = { + FuzzOnStart, + FuzzOnStop, + FuzzOpenSession, + FuzzCloseSession, + FuzzGetAuthInfo_a, + FuzzGetAuthInfo_b, + FuzzGetSecInfo, + FuzzAddCredential, + FuzzUpdateCredential, + FuzzCancel, + FuzzEnforceDelUser, + FuzzDelUser, + FuzzDelCred, +}; + +void UserIdmFuzzTest(const uint8_t *data, size_t size) +{ + Parcel parcel; + parcel.WriteBuffer(data, size); + parcel.RewindRead(0); + uint32_t index = parcel.ReadUint32() % (sizeof(g_fuzzFuncs) / sizeof(FuzzFunc *)); + auto fuzzFunc = g_fuzzFuncs[index]; + fuzzFunc(parcel); + return; +} +} +} // namespace UserIDM +} // namespace UserIAM +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int32_t LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + OHOS::UserIAM::UserIDM::UserIdmFuzzTest(data, size); + return 0; +} diff --git a/test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.h b/test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.h new file mode 100644 index 0000000..8b15753 --- /dev/null +++ b/test/user_idm/fuzztest/user_idm_fuzzer/user_idm_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef USER_IDM_FUZZER_H +#define USER_IDM_FUZZER_H + +#define FUZZ_PROJECT_NAME "UserIdmFuzzTest" + +#endif // USER_IDM_FUZZER_H