1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "abilityautostartupdatamanagerb_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 
21 #define private public
22 #define protected public
23 #include "ability_auto_startup_data_manager.h"
24 #undef protected
25 #undef private
26 
27 #include "ability_record.h"
28 
29 using namespace OHOS::AAFwk;
30 using namespace OHOS::AppExecFwk;
31 using namespace OHOS::AbilityRuntime;
32 
33 namespace OHOS {
34 namespace {
35 constexpr int INPUT_ZERO = 0;
36 constexpr int INPUT_ONE = 1;
37 constexpr int INPUT_THREE = 3;
38 constexpr size_t FOO_MAX_LEN = 1024;
39 constexpr size_t U32_AT_SIZE = 4;
40 constexpr uint8_t ENABLE = 2;
41 constexpr size_t OFFSET_ZERO = 24;
42 constexpr size_t OFFSET_ONE = 16;
43 constexpr size_t OFFSET_TWO = 8;
44 
45 const std::string jsonKey1 = "{\n\"bundleName\": \"com.example.fuzzTest\", \n\"moduleName\": \"module\",\
46     \n\"abilityName\": \"ability\", \n\"appCloneIndex\": -1, \n\"accessTokenId\": \"token\",\
47     \n\"userId\": 100 }";
48 const std::string jsonValue1 = "{\n\"abilityTypeName\": \"typeName\"}";
49 const std::string jsonValue1Illegal = "{\n\"abilityTypeName\": \"typeName\"";
50 
51 const std::string jsonKey2 = "{\n\"bundleName2\": \"com.example.fuzzTest2\"}";
52 const std::string jsonValue2 = "{\n\"abilityTypeName2\": \"typeName\"}";
53 const std::string jsonValue3 = "{\n\"abilityTypeName\": 1 }";
54 }
55 
GetU32Data(const char * ptr)56 uint32_t GetU32Data(const char* ptr)
57 {
58     // convert fuzz input data to an integer
59     return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
60         ptr[INPUT_THREE];
61 }
62 
GetFuzzAbilityToken()63 sptr<Token> GetFuzzAbilityToken()
64 {
65     sptr<Token> token = nullptr;
66     AbilityRequest abilityRequest;
67     abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
68     abilityRequest.abilityInfo.name = "MainAbility";
69     abilityRequest.abilityInfo.type = AbilityType::DATA;
70     std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
71     if (abilityRecord) {
72         token = abilityRecord->GetToken();
73     }
74     return token;
75 }
76 
AbilityAutoStartupDataManagerFuzztest1(bool boolParam,std::string & stringParam,int32_t int32Param)77 void AbilityAutoStartupDataManagerFuzztest1(bool boolParam, std::string &stringParam, int32_t int32Param)
78 {
79     std::shared_ptr<AbilityAutoStartupDataManager> dataMgr = std::make_shared<AbilityAutoStartupDataManager>();
80     AutoStartupInfo info;
81     info.bundleName = "com.example.fuzzTest";
82     info.moduleName = "stringParam";
83     info.abilityName = "MainAbility";
84     info.appCloneIndex = int32Param;
85     info.accessTokenId = "accessTokenId";
86     info.userId = int32Param;
87     dataMgr->ConvertAutoStartupDataToKey(info);
88 
89     DistributedKv::Key key1(jsonKey1);
90     DistributedKv::Key key1Illegal(jsonValue1Illegal);
91     DistributedKv::Value value1(jsonValue1);
92     dataMgr->ConvertAutoStartupInfoFromKeyAndValue(key1, value1);
93     dataMgr->ConvertAutoStartupInfoFromKeyAndValue(key1Illegal, value1);
94 
95     DistributedKv::Key key2(jsonKey2);
96     DistributedKv::Value value2(jsonValue2);
97     DistributedKv::Value value2Illegal(jsonValue1Illegal);
98     DistributedKv::Value value3(jsonValue3);
99     dataMgr->ConvertAutoStartupInfoFromKeyAndValue(key2, value2);
100     dataMgr->ConvertAutoStartupInfoFromKeyAndValue(key2, value2Illegal);
101     dataMgr->ConvertAutoStartupInfoFromKeyAndValue(key2, value3);
102 
103     nlohmann::json jsonObject = nlohmann::json::parse(key1.ToString(), nullptr, false);
104     dataMgr->IsEqual(jsonObject, "abilityName", "ability", boolParam); // branch,return true
105     dataMgr->IsEqual(jsonObject, "abilityName", "NaN", boolParam); // branch,return true
106     dataMgr->IsEqual(jsonObject, "userId", "ability", boolParam); // branch
107     dataMgr->IsEqual(jsonObject, "NaN", "ability", boolParam); // branch
108 
109     dataMgr->IsEqual(jsonObject, "userId", 100); // 100 means userid,branch
110     dataMgr->IsEqual(jsonObject, "userId", int32Param); // branch
111     dataMgr->IsEqual(jsonObject, "NaN", int32Param);
112     dataMgr->IsEqual(key1, info);
113     dataMgr->IsEqual(key2, info);
114     dataMgr->IsEqual(key1Illegal, info);
115 
116     dataMgr->IsEqual(key1, "token");
117     dataMgr->IsEqual(key1, "NaN");
118     dataMgr->IsEqual(key1Illegal, "token");
119 
120     dataMgr->IsEqual(key1, 100); // 100 means userid
121     dataMgr->IsEqual(key1, int32Param);
122     dataMgr->IsEqual(key1Illegal, 0);
123 }
124 
DoSomethingInterestingWithMyAPI(const char * data,size_t size)125 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
126 {
127     bool boolParam = *data % ENABLE;
128     std::string stringParam(data, size);
129     int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
130     AbilityAutoStartupDataManagerFuzztest1(boolParam, stringParam, int32Param);
131     return true;
132 }
133 }
134 
135 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)136 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
137 {
138     /* Run your code on data */
139     if (data == nullptr) {
140         return 0;
141     }
142 
143     /* Validate the length of size */
144     if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
145         return 0;
146     }
147 
148     char* ch = static_cast<char*>(malloc(size + 1));
149     if (ch == nullptr) {
150         std::cout << "malloc failed." << std::endl;
151         return 0;
152     }
153 
154     (void)memset_s(ch, size + 1, 0x00, size + 1);
155     if (memcpy_s(ch, size, data, size) != EOK) {
156         std::cout << "copy failed." << std::endl;
157         free(ch);
158         ch = nullptr;
159         return 0;
160     }
161 
162     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
163     free(ch);
164     ch = nullptr;
165     return 0;
166 }
167 
168