1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "accessibleabilitymanagerservicestub_fuzzer.h"
17 #include "accessible_ability_manager_service_stub.h"
18 #include "accessibility_ipc_interface_code.h"
19 #include "securec.h"
20 
21 namespace OHOS {
22 namespace Accessibility {
23 namespace {
24     constexpr size_t FOO_MAX_LEN = 1024;
25     constexpr size_t U32_AT_SIZE = 4;
26     constexpr size_t BASE_CODE = 800;
27     constexpr size_t MESSAGE_SIZE = 66;
28     constexpr size_t FUZZ_NUM1 = 1;
29     constexpr size_t FUZZ_NUM2 = 2;
30     constexpr size_t FUZZ_NUM3 = 3;
31     constexpr size_t FUZZ_NUM8 = 8;
32     constexpr size_t FUZZ_NUM16 = 16;
33     constexpr size_t FUZZ_NUM24 = 24;
34     constexpr uint8_t DEVISOR_TWO = 2;
35 }
36 
37 class AccessibleAbilityManagerServiceStubFuzzTest : public AccessibleAbilityManagerServiceStub {
38 public:
39     AccessibleAbilityManagerServiceStubFuzzTest() = default;
40     ~AccessibleAbilityManagerServiceStubFuzzTest() = default;
41 
SendEvent(const AccessibilityEventInfo & uiEvent,const int32_t flag)42     RetError SendEvent(const AccessibilityEventInfo &uiEvent, const int32_t flag) override {return RET_OK;}
43 
RegisterStateObserver(const sptr<IAccessibleAbilityManagerStateObserver> & callback)44     uint32_t RegisterStateObserver(const sptr<IAccessibleAbilityManagerStateObserver> &callback) override {return 0;}
45 
RegisterCaptionObserver(const sptr<IAccessibleAbilityManagerCaptionObserver> & callback)46     uint32_t RegisterCaptionObserver(const sptr<IAccessibleAbilityManagerCaptionObserver>
47         &callback) override {return 0;}
48 
RegisterEnableAbilityListsObserver(const sptr<IAccessibilityEnableAbilityListsObserver> & observer)49     void RegisterEnableAbilityListsObserver(
50         const sptr<IAccessibilityEnableAbilityListsObserver> &observer) override {}
51 
GetAbilityList(const uint32_t abilityTypes,const int32_t stateType,std::vector<AccessibilityAbilityInfo> & infos)52     RetError GetAbilityList(const uint32_t abilityTypes, const int32_t stateType,
53         std::vector<AccessibilityAbilityInfo> &infos) override {return RET_OK;}
54 
RegisterElementOperator(const int32_t windowId,const sptr<IAccessibilityElementOperator> & operation,bool isApp=false)55     RetError RegisterElementOperator(const int32_t windowId,
56         const sptr<IAccessibilityElementOperator> &operation, bool isApp = false) override {return RET_OK;}
57 
RegisterElementOperator(Registration parameter,const sptr<IAccessibilityElementOperator> & operation,bool isApp=false)58     RetError RegisterElementOperator(Registration parameter,
59         const sptr<IAccessibilityElementOperator> &operation, bool isApp = false) override {return RET_OK;}
60 
DeregisterElementOperator(const int32_t windowId)61     RetError DeregisterElementOperator(const int32_t windowId) override {return RET_OK;}
62 
DeregisterElementOperator(const int32_t windowId,const int32_t treeId)63     RetError DeregisterElementOperator(const int32_t windowId, const int32_t treeId) override {return RET_OK;}
64 
GetCaptionProperty(AccessibilityConfig::CaptionProperty & caption)65     RetError GetCaptionProperty(AccessibilityConfig::CaptionProperty &caption) override {return RET_OK;}
GetEnabledState()66     bool GetEnabledState() override {return true;}
GetCaptionState(bool & state)67     RetError GetCaptionState(bool &state) override {return RET_OK;}
GetTouchGuideState()68     bool GetTouchGuideState() override {return true;}
GetGestureState()69     bool GetGestureState() override {return true;}
GetKeyEventObserverState()70     bool GetKeyEventObserverState() override {return true;}
71 
SetCaptionProperty(const AccessibilityConfig::CaptionProperty & caption)72     RetError SetCaptionProperty(const AccessibilityConfig::CaptionProperty &caption) override {return RET_OK;}
SetCaptionState(const bool state)73     RetError SetCaptionState(const bool state) override {return RET_OK;}
74 
EnableAbility(const std::string & name,const uint32_t capabilities)75     RetError EnableAbility(const std::string &name, const uint32_t capabilities) override {return RET_OK;}
GetEnabledAbilities(std::vector<std::string> & enabledAbilities)76     RetError GetEnabledAbilities(std::vector<std::string> &enabledAbilities) override {return RET_OK;}
DisableAbility(const std::string & name)77     RetError DisableAbility(const std::string &name) override {return RET_OK;}
GetActiveWindow()78     int32_t GetActiveWindow() override {return 0;}
79 
EnableUITestAbility(const sptr<IRemoteObject> & obj)80     RetError EnableUITestAbility(const sptr<IRemoteObject> &obj) override {return RET_OK;}
DisableUITestAbility()81     RetError DisableUITestAbility() override {return RET_OK;}
82 
SetScreenMagnificationState(const bool state)83     RetError SetScreenMagnificationState(const bool state) override {return RET_OK;}
SetShortKeyState(const bool state)84     RetError SetShortKeyState(const bool state) override {return RET_OK;}
SetMouseKeyState(const bool state)85     RetError SetMouseKeyState(const bool state) override {return RET_OK;}
SetMouseAutoClick(const int32_t time)86     RetError SetMouseAutoClick(const int32_t time) override {return RET_OK;}
SetShortkeyTarget(const std::string & name)87     RetError SetShortkeyTarget(const std::string &name) override {return RET_OK;}
SetShortkeyMultiTarget(const std::vector<std::string> & name)88     RetError SetShortkeyMultiTarget(const std::vector<std::string> &name) override {return RET_OK;}
SetHighContrastTextState(const bool state)89     RetError SetHighContrastTextState(const bool state) override {return RET_OK;}
SetInvertColorState(const bool state)90     RetError SetInvertColorState(const bool state) override {return RET_OK;}
SetAnimationOffState(const bool state)91     RetError SetAnimationOffState(const bool state) override {return RET_OK;}
SetAudioMonoState(const bool state)92     RetError SetAudioMonoState(const bool state) override {return RET_OK;}
SetDaltonizationState(const bool state)93     RetError SetDaltonizationState(const bool state) override {return RET_OK;}
SetDaltonizationColorFilter(const uint32_t filter)94     RetError SetDaltonizationColorFilter(const uint32_t filter) override {return RET_OK;}
SetContentTimeout(const uint32_t time)95     RetError SetContentTimeout(const uint32_t time) override {return RET_OK;}
SetBrightnessDiscount(const float discount)96     RetError SetBrightnessDiscount(const float discount) override {return RET_OK;}
SetAudioBalance(const float balance)97     RetError SetAudioBalance(const float balance) override {return RET_OK;}
SetClickResponseTime(const uint32_t time)98     RetError SetClickResponseTime(const uint32_t time) override {return RET_OK;}
SetIgnoreRepeatClickState(const bool state)99     RetError SetIgnoreRepeatClickState(const bool state) override {return RET_OK;}
SetIgnoreRepeatClickTime(const uint32_t time)100     RetError SetIgnoreRepeatClickTime(const uint32_t time) override {return RET_OK;}
101 
GetScreenMagnificationState(bool & state)102     RetError GetScreenMagnificationState(bool &state) override {return RET_OK;}
GetShortKeyState(bool & state)103     RetError GetShortKeyState(bool &state) override {return RET_OK;}
GetMouseKeyState(bool & state)104     RetError GetMouseKeyState(bool &state) override {return RET_OK;}
GetMouseAutoClick(int32_t & time)105     RetError GetMouseAutoClick(int32_t &time) override {return RET_OK;}
GetShortkeyTarget(std::string & name)106     RetError GetShortkeyTarget(std::string &name) override {return RET_OK;}
GetShortkeyMultiTarget(std::vector<std::string> & name)107     RetError GetShortkeyMultiTarget(std::vector<std::string> &name) override {return RET_OK;}
GetHighContrastTextState(bool & state)108     RetError GetHighContrastTextState(bool &state) override {return RET_OK;}
GetInvertColorState(bool & state)109     RetError GetInvertColorState(bool &state) override {return RET_OK;}
GetAnimationOffState(bool & state)110     RetError GetAnimationOffState(bool &state) override {return RET_OK;}
GetAudioMonoState(bool & state)111     RetError GetAudioMonoState(bool &state) override {return RET_OK;}
GetDaltonizationState(bool & state)112     RetError GetDaltonizationState(bool &state) override {return RET_OK;}
GetDaltonizationColorFilter(uint32_t & type)113     RetError GetDaltonizationColorFilter(uint32_t &type) override {return RET_OK;}
GetContentTimeout(uint32_t & timer)114     RetError GetContentTimeout(uint32_t &timer) override {return RET_OK;}
GetBrightnessDiscount(float & brightness)115     RetError GetBrightnessDiscount(float &brightness) override {return RET_OK;}
GetAudioBalance(float & balance)116     RetError GetAudioBalance(float &balance) override {return RET_OK;}
GetClickResponseTime(uint32_t & time)117     RetError GetClickResponseTime(uint32_t& time) override {return RET_OK;}
GetIgnoreRepeatClickState(bool & state)118     RetError GetIgnoreRepeatClickState(bool& state) override {return RET_OK;}
GetIgnoreRepeatClickTime(uint32_t & time)119     RetError GetIgnoreRepeatClickTime(uint32_t& time) override {return RET_OK;}
GetAllConfigs(AccessibilityConfigData & configData)120     void GetAllConfigs(AccessibilityConfigData& configData) override {}
GetRealWindowAndElementId(int32_t & windowId,int64_t & elementId)121     void GetRealWindowAndElementId(int32_t& windowId, int64_t& elementId) override {}
GetSceneBoardInnerWinId(int32_t windowId,int64_t elementId,int32_t & innerWid)122     void GetSceneBoardInnerWinId(int32_t windowId, int64_t elementId, int32_t& innerWid) override {}
GetFocusedWindowId(int32_t & focusedWindowId)123     RetError GetFocusedWindowId(int32_t &focusedWindowId) override {return RET_OK;}
RegisterConfigObserver(const sptr<IAccessibleAbilityManagerConfigObserver> & callback)124     uint32_t RegisterConfigObserver(const sptr<IAccessibleAbilityManagerConfigObserver> &callback) override {return 0;}
PostDelayUnloadTask()125     void PostDelayUnloadTask() override {}
RemoveRequestId(int32_t requestId)126     void RemoveRequestId(int32_t requestId) override {}
GetRootParentId(int32_t windowsId,int32_t treeId)127     int64_t GetRootParentId(int32_t windowsId, int32_t treeId) override {return 0;}
GetAllTreeId(int32_t windowId,std::vector<int32_t> & treeIds)128     RetError GetAllTreeId(int32_t windowId, std::vector<int32_t> &treeIds) override {return RET_OK;}
129 };
130 
GetU32Data(const uint8_t * ptr)131 uint32_t GetU32Data(const uint8_t* ptr)
132 {
133     return (ptr[0] << FUZZ_NUM24) | (ptr[FUZZ_NUM1] << FUZZ_NUM16) |
134         (ptr[FUZZ_NUM2] << FUZZ_NUM8) | (ptr[FUZZ_NUM3]);
135 }
136 
OnRemoteRequestSvcFuzzTest(const uint8_t * data,size_t size)137 bool OnRemoteRequestSvcFuzzTest(const uint8_t* data, size_t size)
138 {
139     uint32_t code = (GetU32Data(data) % MESSAGE_SIZE) + BASE_CODE;
140     MessageParcel datas;
141     std::u16string descriptor = AccessibleAbilityManagerServiceStubFuzzTest::GetDescriptor();
142     datas.WriteInterfaceToken(descriptor);
143     datas.WriteBuffer(data, size);
144     datas.RewindRead(0);
145     MessageParcel reply;
146     MessageOption option;
147     AccessibleAbilityManagerServiceStubFuzzTest serviceStub;
148     serviceStub.OnRemoteRequest(code, datas, reply, option);
149     return true;
150 }
151 
HandleSetDaltonizationStateTest(const uint8_t * data,size_t size)152 bool HandleSetDaltonizationStateTest(const uint8_t *data, size_t size)
153 {
154     MessageParcel datas;
155     bool isSetDaltonizationState = data[0] % DEVISOR_TWO;
156     std::u16string descriptor = AccessibleAbilityManagerServiceStubFuzzTest::GetDescriptor();
157     datas.WriteInterfaceToken(descriptor);
158     datas.WriteBool(isSetDaltonizationState);
159     MessageParcel reply;
160     MessageOption option;
161     AccessibleAbilityManagerServiceStubFuzzTest serviceStub;
162 
163     serviceStub.OnRemoteRequest(static_cast<uint32_t>(AccessibilityInterfaceCode::SET_DALTONIZATION_STATE),
164         datas, reply, option);
165     return true;
166 }
167 
HandleRemoveRequestIdTest(const uint8_t * data,size_t size)168 bool HandleRemoveRequestIdTest(const uint8_t *data, size_t size)
169 {
170     MessageParcel datas;
171     int32_t requestId = static_cast<int32_t>(*data);
172     std::u16string descriptor = AccessibleAbilityManagerServiceStubFuzzTest::GetDescriptor();
173     datas.WriteInterfaceToken(descriptor);
174     datas.WriteInt32(requestId);
175     MessageParcel reply;
176     MessageOption option;
177     AccessibleAbilityManagerServiceStubFuzzTest serviceStub;
178 
179     serviceStub.OnRemoteRequest(static_cast<uint32_t>(AccessibilityInterfaceCode::REMOVE_REQUEST_ID),
180         datas, reply, option);
181     return true;
182 }
183 } // namespace Accessibility
184 } // namespace OHOS
185 
186 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)187 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
188 {
189     /* Run your code on data */
190     if (data == nullptr) {
191         return 0;
192     }
193 
194     if (size < OHOS::Accessibility::U32_AT_SIZE) {
195         return 0;
196     }
197 
198     OHOS::Accessibility::OnRemoteRequestSvcFuzzTest(data, size);
199     OHOS::Accessibility::HandleSetDaltonizationStateTest(data, size);
200     OHOS::Accessibility::HandleRemoveRequestIdTest(data, size);
201     return 0;
202 }
203