/* * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "connectionstatemanager_fuzzer.h" #include #include #define private public #define protected public #include "connection_observer_controller.h" #include "connection_record.h" #include "connection_state_item.h" #include "connection_state_manager.h" #undef protected #undef private #include "ability_record.h" #include "continuous_task_callback_info.h" using namespace OHOS::AAFwk; using namespace OHOS::AppExecFwk; using namespace OHOS::AbilityRuntime; namespace OHOS { namespace { constexpr size_t FOO_MAX_LEN = 1024; constexpr size_t U32_AT_SIZE = 4; constexpr uint8_t ENABLE = 2; class MyAbilityConnection : public IAbilityConnection { public: MyAbilityConnection() = default; virtual ~MyAbilityConnection() = default; void OnAbilityConnectDone( const AppExecFwk::ElementName& element, const sptr& remoteObject, int resultCode) override {} void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override {} sptr AsObject() override { return {}; } }; class MyAbilityConnectionObserver : public IConnectionObserver { public: MyAbilityConnectionObserver() = default; virtual ~MyAbilityConnectionObserver() = default; void OnExtensionConnected(const ConnectionData& data) override {} void OnExtensionDisconnected(const ConnectionData& data) override {} #ifdef WITH_DLP void OnDlpAbilityOpened(const DlpStateData& data) override {} void OnDlpAbilityClosed(const DlpStateData& data) override {} #endif // WITH_DLP sptr AsObject() override { return {}; } }; } uint32_t GetU32Data(const char* ptr) { // convert fuzz input data to an integer return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | ptr[3]; } std::shared_ptr GetFuzzAbilityRecord() { sptr token = nullptr; AbilityRequest abilityRequest; abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; abilityRequest.abilityInfo.name = "MainAbility"; abilityRequest.abilityInfo.type = AbilityType::DATA; std::shared_ptr abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); if (!abilityRecord) { return nullptr; } return abilityRecord; } sptr GetFuzzAbilityToken() { sptr token = nullptr; std::shared_ptr abilityRecord = GetFuzzAbilityRecord(); if (abilityRecord) { token = abilityRecord->GetToken(); } return token; } bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) { bool boolParam = *data % ENABLE; int intParam = static_cast(GetU32Data(data)); int32_t int32Param = static_cast(GetU32Data(data)); std::string stringParam(data, size); Parcel wantParcel; Want* want = nullptr; if (wantParcel.WriteBuffer(data, size)) { want = Want::Unmarshalling(wantParcel); if (!want) { return false; } } sptr token = GetFuzzAbilityToken(); sptr connect = new MyAbilityConnection(); sptr observer = new MyAbilityConnectionObserver(); std::vector info; AbilityRuntime::ConnectionData connectionData; // fuzz for ConnectionObserverController auto connectionObserverController = std::make_shared(); connectionObserverController->AddObserver(observer); connectionObserverController->RemoveObserver(observer); connectionObserverController->NotifyExtensionConnected(connectionData); connectionObserverController->NotifyExtensionDisconnected(connectionData); #ifdef WITH_DLP AbilityRuntime::DlpStateData dlpStateData; connectionObserverController->NotifyDlpAbilityOpened(dlpStateData); connectionObserverController->NotifyDlpAbilityClosed(dlpStateData); #endif // WITH_DLP connectionObserverController->GetObservers(); wptr remote; connectionObserverController->HandleRemoteDied(remote); ConnectionObserverController::ObserverDeathRecipient::ObserverDeathHandler handler; std::shared_ptr observerDeathRecipient = std::make_shared(handler); observerDeathRecipient->OnRemoteDied(remote); // fuzz for ConnectionRecord std::shared_ptr targetService = GetFuzzAbilityRecord(); auto connectionRecord = std::make_shared(token, targetService, connect); connectionRecord->CreateConnectionRecord(token, targetService, connect); ConnectionState state = ConnectionState::CONNECTED; connectionRecord->SetConnectState(state); connectionRecord->GetConnectState(); connectionRecord->GetToken(); connectionRecord->GetAbilityRecord(); connectionRecord->GetAbilityConnectCallback(); connectionRecord->ClearConnCallBack(); connectionRecord->DisconnectAbility(); connectionRecord->CompleteConnect(); connectionRecord->CompleteDisconnect(intParam, boolParam); connectionRecord->ScheduleDisconnectAbilityDone(); connectionRecord->ScheduleConnectAbilityDone(); connectionRecord->DisconnectTimeout(); connectionRecord->ConvertConnectionState(state); connectionRecord->Dump(info); connectionRecord->AttachCallerInfo(); connectionRecord->GetCallerUid(); connectionRecord->GetCallerPid(); connectionRecord->GetCallerName(); connectionRecord->GetTargetToken(); connectionRecord->GetConnection(); // fuzz for ConnectionRecord auto connectionStateItem = std::make_shared(int32Param, int32Param, stringParam); std::shared_ptr record; connectionStateItem->CreateConnectionStateItem(record); DataAbilityCaller dataCaller; connectionStateItem->CreateConnectionStateItem(dataCaller); connectionStateItem->AddConnection(record, connectionData); connectionStateItem->RemoveConnection(record, connectionData); std::shared_ptr dataAbility; connectionStateItem->AddDataAbilityConnection(dataCaller, dataAbility, connectionData); connectionStateItem->RemoveDataAbilityConnection(dataCaller, dataAbility, connectionData); connectionStateItem->HandleDataAbilityDied(token, connectionData); connectionStateItem->IsEmpty(); std::vector datas; connectionStateItem->GenerateAllConnectionData(datas); std::shared_ptr connectedExtension; connectionStateItem->GenerateConnectionData(connectedExtension, connectionData); std::shared_ptr connectedDataAbility; connectionStateItem->GenerateConnectionData(connectedDataAbility, connectionData); // fuzz for ConnectionStateManager auto connectionStateManager = std::make_shared(); connectionStateManager->GetProcessNameByPid(int32Param); connectionStateManager->Init(); connectionStateManager->RegisterObserver(observer); connectionStateManager->UnregisterObserver(observer); connectionStateManager->AddConnection(record); connectionStateManager->RemoveConnection(record, boolParam); connectionStateManager->AddDataAbilityConnection(dataCaller, dataAbility); connectionStateManager->RemoveDataAbilityConnection(dataCaller, dataAbility); connectionStateManager->CheckDataAbilityConnectionParams(dataCaller, dataAbility); connectionStateManager->HandleDataAbilityDied(dataAbility); connectionStateManager->HandleDataAbilityCallerDied(int32Param); #ifdef WITH_DLP std::shared_ptr dlpManger = GetFuzzAbilityRecord(); connectionStateManager->AddDlpManager(dlpManger); connectionStateManager->RemoveDlpManager(dlpManger); connectionStateManager->AddDlpAbility(dlpManger); connectionStateManager->RemoveDlpAbility(dlpManger); #endif // WITH_DLP connectionStateManager->HandleAppDied(int32Param); #ifdef WITH_DLP std::vector infos; connectionStateManager->GetDlpConnectionInfos(infos); #endif // WITH_DLP connectionStateManager->AddConnectionInner(connectionRecord, connectionData); connectionStateManager->RemoveConnectionInner(connectionRecord, connectionData); connectionStateManager->HandleCallerDied(int32Param); connectionStateManager->RemoveDiedCaller(int32Param); connectionStateManager->AddDataAbilityConnectionInner(dataCaller, dataAbility, connectionData); connectionStateManager->RemoveDataAbilityConnectionInner(dataCaller, dataAbility, connectionData); connectionStateManager->HandleDataAbilityDiedInner(token, datas); #ifdef WITH_DLP AbilityRuntime::DlpStateData dlpData; connectionStateManager->HandleDlpAbilityInner(dlpManger, boolParam, dlpData); #endif // WITH_DLP connectionStateManager->InitAppStateObserver(); if (want) { delete want; want = nullptr; } return true; } } /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ if (data == nullptr) { return 0; } /* Validate the length of size */ if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { return 0; } char* ch = static_cast(malloc(size + 1)); if (ch == nullptr) { std::cout << "malloc failed." << std::endl; return 0; } (void)memset_s(ch, size + 1, 0x00, size + 1); if (memcpy_s(ch, size, data, size) != EOK) { std::cout << "copy failed." << std::endl; free(ch); ch = nullptr; return 0; } OHOS::DoSomethingInterestingWithMyAPI(ch, size); free(ch); ch = nullptr; return 0; }