1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "appmgrservicefirst_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 
21 #define private public
22 #include "app_mgr_service.h"
23 #undef private
24 
25 #include "ability_record.h"
26 #include "parcel.h"
27 #include "securec.h"
28 #include "want.h"
29 
30 using namespace OHOS::AAFwk;
31 using namespace OHOS::AppExecFwk;
32 
33 namespace OHOS {
34 namespace {
35 constexpr int INPUT_ZERO = 0;
36 constexpr int INPUT_ONE = 1;
37 constexpr int INPUT_THREE = 3;
38 constexpr size_t FOO_MAX_LEN = 1024;
39 constexpr size_t U32_AT_SIZE = 4;
40 constexpr uint8_t ENABLE = 2;
41 constexpr size_t OFFSET_ZERO = 24;
42 constexpr size_t OFFSET_ONE = 16;
43 constexpr size_t OFFSET_TWO = 8;
44 }
GetU32Data(const char * ptr)45 uint32_t GetU32Data(const char* ptr)
46 {
47     // convert fuzz input data to an integer
48     return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
49         ptr[INPUT_THREE];
50 }
GetFuzzAbilityToken()51 sptr<Token> GetFuzzAbilityToken()
52 {
53     sptr<Token> token = nullptr;
54     AbilityRequest abilityRequest;
55     abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
56     abilityRequest.abilityInfo.name = "MainAbility";
57     abilityRequest.abilityInfo.type = AbilityType::PAGE;
58     std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
59     if (abilityRecord) {
60         token = abilityRecord->GetToken();
61     }
62     return token;
63 }
DoSomethingInterestingWithMyAPI(const char * data,size_t size)64 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
65 {
66     AppMgrService* appMgrService = new AppMgrService();
67     std::shared_ptr<AppMgrServiceInner> innerService = std::make_shared<AppMgrServiceInner>();
68     appMgrService->appMgrServiceState_.serviceRunningState = ServiceRunningState::STATE_NOT_START;
69     appMgrService->SetInnerService(innerService);
70     appMgrService->OnStart();
71     sptr<IConfigurationObserver> configurationObserver;
72     appMgrService->RegisterConfigurationObserver(configurationObserver);
73     appMgrService->UnregisterConfigurationObserver(configurationObserver);
74     sptr<IApplicationStateObserver> applicationStateObserver;
75     appMgrService->RegisterApplicationStateObserver(applicationStateObserver);
76     appMgrService->UnregisterApplicationStateObserver(applicationStateObserver);
77     pid_t pid = static_cast<pid_t>(GetU32Data(data));
78     appMgrService->AddAppDeathRecipient(pid);
79     appMgrService->QueryServiceState();
80     sptr<IRemoteObject> app = nullptr;
81     appMgrService->AttachApplication(app);
82     std::vector<BundleInfo> bundleInfos;
83     appMgrService->StartupResidentProcess(bundleInfos);
84     Parcel wantParcel;
85     Want* want = nullptr;
86     if (wantParcel.WriteBuffer(data, size)) {
87         want = Want::Unmarshalling(wantParcel);
88     }
89     std::string renderParam(data, size);
90     int32_t ipcFd = static_cast<int32_t>(GetU32Data(data));
91     int32_t sharedFd = static_cast<int32_t>(GetU32Data(data));
92     int32_t crashFd = static_cast<int32_t>(GetU32Data(data));
93     pid_t renderPid = static_cast<pid_t>(GetU32Data(data));
94     appMgrService->StartRenderProcess(renderParam, ipcFd, sharedFd, crashFd, renderPid);
95     appMgrService->PreStartNWebSpawnProcess();
96     sptr<IRemoteObject> scheduler = nullptr;
97     appMgrService->AttachRenderProcess(scheduler);
98     bool isContinuousTask = *data % ENABLE;
99     appMgrService->SetContinuousTaskProcess(static_cast<int32_t>(pid), isContinuousTask);
100     int32_t recordId = static_cast<int32_t>(GetU32Data(data));
101     appMgrService->ApplicationForegrounded(recordId);
102     appMgrService->AddAbilityStageDone(recordId);
103     int fd = static_cast<int>(GetU32Data(data));
104     std::vector<std::u16string> args;
105     appMgrService->Dump(fd, args);
106     std::string result(data, size);
107     appMgrService->Dump(args, result);
108     appMgrService->ShowHelp(args, result);
109     std::string flag(data, size);
110     appMgrService->ScheduleAcceptWantDone(recordId, *want, flag);
111     Configuration config;
112     appMgrService->UpdateConfiguration(config);
113     appMgrService->GetAmsMgr();
114     std::vector<RunningProcessInfo> info;
115     appMgrService->GetAllRunningProcesses(info);
116     int32_t userId = static_cast<int32_t>(GetU32Data(data));
117     appMgrService->GetProcessRunningInfosByUserId(info, userId);
118     int32_t level = static_cast<int32_t>(GetU32Data(data));
119     appMgrService->NotifyMemoryLevel(level);
120     std::vector<AppStateData> list;
121     appMgrService->GetForegroundApplications(list);
122     std::vector<sptr<IRemoteObject>> tokens;
123     appMgrService->GetAbilityRecordsByProcessID(static_cast<int>(pid), tokens);
124     int status = static_cast<int>(GetU32Data(data));
125     appMgrService->GetRenderProcessTerminationStatus(renderPid, status);
126     appMgrService->GetConfiguration(config);
127     std::string bundleName(data, size);
128     appMgrService->GetAppRunningStateByBundleName(bundleName);
129     sptr<IQuickFixCallback> callback;
130     appMgrService->NotifyLoadRepairPatch(bundleName, callback);
131     appMgrService->NotifyHotReloadPage(bundleName, callback);
132     appMgrService->NotifyUnLoadRepairPatch(bundleName, callback);
133     appMgrService->ApplicationBackgrounded(recordId);
134     sptr<IRemoteObject> token = GetFuzzAbilityToken();
135     appMgrService->AbilityCleaned(token);
136     int32_t appCloneIndex = static_cast<int32_t>(GetU32Data(data));
137     appMgrService->ClearUpApplicationData(bundleName, appCloneIndex);
138     appMgrService->ApplicationTerminated(recordId);
139     std::string msg(data, size);
140     int64_t resultCode = static_cast<int64_t>(GetU32Data(data));
141     appMgrService->FinishUserTest(msg, resultCode, bundleName);
142     appMgrService->OnStop();
143     return appMgrService->IsReady();
144 }
145 }
146 
147 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)148 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
149 {
150     /* Run your code on data */
151     if (data == nullptr) {
152         std::cout << "invalid data" << std::endl;
153         return 0;
154     }
155 
156     /* Validate the length of size */
157     if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) {
158         return 0;
159     }
160 
161     char* ch = static_cast<char*>(malloc(size + 1));
162     if (ch == nullptr) {
163         std::cout << "malloc failed." << std::endl;
164         return 0;
165     }
166 
167     (void)memset_s(ch, size + 1, 0x00, size + 1);
168     if (memcpy_s(ch, size, data, size) != EOK) {
169         std::cout << "copy failed." << std::endl;
170         free(ch);
171         ch = nullptr;
172         return 0;
173     }
174 
175     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
176     free(ch);
177     ch = nullptr;
178     return 0;
179 }
180