1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "abilitymanagerservicefirst_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 
21 #define private public
22 #define protected public
23 #include "ability_manager_service.h"
24 #undef protected
25 #undef private
26 
27 #include "ability_connect_callback_interface.h"
28 #include "ability_connect_callback_stub.h"
29 #include "ability_record.h"
30 
31 using namespace OHOS::AAFwk;
32 using namespace OHOS::AppExecFwk;
33 
34 namespace OHOS {
35 namespace {
36 constexpr int INPUT_ZERO = 0;
37 constexpr int INPUT_ONE = 1;
38 constexpr int INPUT_THREE = 3;
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 constexpr uint8_t ENABLE = 2;
42 constexpr size_t OFFSET_ZERO = 24;
43 constexpr size_t OFFSET_ONE = 16;
44 constexpr size_t OFFSET_TWO = 8;
45 class MyAbilityConnection : public IAbilityConnection {
46 public:
47     MyAbilityConnection() = default;
48     virtual ~MyAbilityConnection() = default;
OnAbilityConnectDone(const AppExecFwk::ElementName & element,const sptr<IRemoteObject> & remoteObject,int resultCode)49     void OnAbilityConnectDone(
50         const AppExecFwk::ElementName& element, const sptr<IRemoteObject>& remoteObject, int resultCode) override
51     {}
OnAbilityDisconnectDone(const AppExecFwk::ElementName & element,int resultCode)52     void OnAbilityDisconnectDone(const AppExecFwk::ElementName& element, int resultCode) override
53     {}
AsObject()54     sptr<IRemoteObject> AsObject() override
55     {
56         return {};
57     }
58 };
59 }
60 
GetU32Data(const char * ptr)61 uint32_t GetU32Data(const char* ptr)
62 {
63     // convert fuzz input data to an integer
64     return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
65         ptr[INPUT_THREE];
66 }
67 
GetFuzzAbilityToken()68 sptr<Token> GetFuzzAbilityToken()
69 {
70     sptr<Token> token = nullptr;
71     AbilityRequest abilityRequest;
72     abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
73     abilityRequest.abilityInfo.name = "MainAbility";
74     abilityRequest.abilityInfo.type = AbilityType::DATA;
75     std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
76     if (abilityRecord) {
77         token = abilityRecord->GetToken();
78     }
79     return token;
80 }
81 
DoSomethingInterestingWithMyAPI1(AbilityManagerService & abilityms,Want & want,sptr<IRemoteObject> token,const char * data,size_t size)82 void DoSomethingInterestingWithMyAPI1(AbilityManagerService &abilityms, Want& want,
83     sptr<IRemoteObject> token, const char* data, size_t size)
84 {
85     bool boolParam = *data % ENABLE;
86     int intParam = static_cast<int>(GetU32Data(data));
87     int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
88     int64_t int64Param = static_cast<int64_t>(GetU32Data(data));
89     uint32_t uint32Param = GetU32Data(data);
90     std::string stringParam(data, size);
91     sptr<IAbilityConnection> connect(new MyAbilityConnection());
92     abilityms.InitStartupFlag();
93     abilityms.QueryServiceState();
94     AbilityRequest abilityRequest;
95     AppExecFwk::ExtensionAbilityType extensionType = ExtensionAbilityType::SERVICE;
96     abilityms.CheckOptExtensionAbility(want, abilityRequest, int32Param, extensionType);
97     AppExecFwk::AbilityInfo abilityInfo;
98     abilityms.ReportAbilityStartInfoToRSS(abilityInfo);
99     abilityms.ReportEventToRSS(abilityInfo, token);
100     abilityms.StartExtensionAbility(want, token, int32Param, extensionType);
101     abilityms.StopExtensionAbility(want, token, int32Param, extensionType);
102     abilityms.TerminateAbility(token, intParam, &want);
103     abilityms.CloseAbility(token, intParam, &want);
104     abilityms.TerminateAbilityWithFlag(token, intParam, &want, boolParam);
105     abilityms.SendResultToAbility(intParam, intParam, want);
106     abilityms.StartRemoteAbility(want, intParam, int32Param, token);
107     abilityms.CheckIfOperateRemote(want);
108     abilityms.AnonymizeDeviceId(stringParam);
109     abilityms.MinimizeAbility(token, boolParam);
110     abilityms.ConnectAbility(want, connect, token, int32Param);
111     abilityms.ConnectAbilityCommon(want, connect, token, extensionType, int32Param);
112     abilityms.BuildEventInfo(want, int32Param);
113     abilityms.DisconnectAbility(connect);
114     abilityms.ConnectLocalAbility(want, int32Param, connect, token, extensionType);
115     abilityms.ConnectRemoteAbility(want, token, token);
116     abilityms.DisconnectLocalAbility(connect);
117     abilityms.DisconnectRemoteAbility(token);
118     AAFwk::WantParams wantParams;
119     abilityms.ContinueMission(stringParam, stringParam, int32Param, token, wantParams);
120     abilityms.ContinueAbility(stringParam, int32Param, uint32Param);
121     abilityms.StartContinuation(want, token, int32Param);
122     abilityms.NotifyCompleteContinuation(stringParam, int32Param, boolParam);
123     abilityms.NotifyContinuationResult(int32Param, int32Param);
124     abilityms.StartSyncRemoteMissions(stringParam, boolParam, int64Param);
125     abilityms.StopSyncRemoteMissions(stringParam);
126 }
127 
DoSomethingInterestingWithMyAPI2(AbilityManagerService & abilityms,Want & want,sptr<IRemoteObject> token,const char * data,size_t size)128 void DoSomethingInterestingWithMyAPI2(AbilityManagerService &abilityms, Want& want,
129     sptr<IRemoteObject> token, const char* data, size_t size)
130 {
131     int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
132     int64_t int64Param = static_cast<int64_t>(GetU32Data(data));
133     std::string stringParam(data, size);
134     sptr<AbilityRuntime::IConnectionObserver> observer;
135     abilityms.RegisterObserver(observer);
136     abilityms.UnregisterObserver(observer);
137 #ifdef WITH_DLP
138     std::vector<AbilityRuntime::DlpConnectionInfo> infos;
139     abilityms.GetDlpConnectionInfos(infos);
140 #endif // WITH_DLP
141     std::vector<AbilityRuntime::ConnectionData> connectionData;
142     abilityms.GetConnectionData(connectionData);
143 
144     sptr<SessionInfo> extensionSessionInfo;
145     abilityms.StartUIExtensionAbility(extensionSessionInfo, int32Param);
146     extensionSessionInfo = sptr<SessionInfo>(new (std::nothrow) SessionInfo());
147     extensionSessionInfo->sessionToken = token;
148     extensionSessionInfo->callerToken = token;
149     extensionSessionInfo->persistentId = int32Param;
150     extensionSessionInfo->resultCode = int32Param;
151     extensionSessionInfo->requestCode = int32Param;
152     extensionSessionInfo->errorReason = stringParam;
153     extensionSessionInfo->errorCode = int32Param;
154     extensionSessionInfo->uiAbilityId = int64Param;
155     extensionSessionInfo->userId = int32Param;
156     extensionSessionInfo->state = CallToState::FOREGROUND;
157     extensionSessionInfo->want = want;
158     abilityms.StartUIExtensionAbility(extensionSessionInfo, int32Param);
159 }
160 
DoSomethingInterestingWithMyAPI(const char * data,size_t size)161 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
162 {
163     Parcel wantParcel;
164     Want* want = nullptr;
165     if (wantParcel.WriteBuffer(data, size)) {
166         want = Want::Unmarshalling(wantParcel);
167         if (!want) {
168             return false;
169         }
170     }
171     sptr<IRemoteObject> token = GetFuzzAbilityToken();
172 
173     // fuzz for AbilityManagerService
174     auto abilityms = std::make_shared<AbilityManagerService>();
175     DoSomethingInterestingWithMyAPI1(*abilityms, *want, token, data, size);
176     DoSomethingInterestingWithMyAPI2(*abilityms, *want, token, data, size);
177     if (!want) {
178         delete want;
179         want = nullptr;
180     }
181 
182     return true;
183 }
184 }
185 
186 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)187 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
188 {
189     /* Run your code on data */
190     if (data == nullptr) {
191         return 0;
192     }
193 
194     /* Validate the length of size */
195     if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
196         return 0;
197     }
198 
199     char* ch = static_cast<char*>(malloc(size + 1));
200     if (ch == nullptr) {
201         std::cout << "malloc failed." << std::endl;
202         return 0;
203     }
204 
205     (void)memset_s(ch, size + 1, 0x00, size + 1);
206     if (memcpy_s(ch, size, data, size) != EOK) {
207         std::cout << "copy failed." << std::endl;
208         free(ch);
209         ch = nullptr;
210         return 0;
211     }
212 
213     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
214     free(ch);
215     ch = nullptr;
216     return 0;
217 }
218 
219