1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "cacheprocessmanagera_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 
21 #define private public
22 #define protected public
23 #include "cache_process_manager.h"
24 #include "ability_record.h"
25 #undef protected
26 #undef private
27 
28 #include "app_mgr_service_inner.h"
29 
30 using namespace OHOS::AAFwk;
31 using namespace OHOS::AppExecFwk;
32 using namespace OHOS::AbilityRuntime;
33 
34 namespace OHOS {
35 namespace {
36 constexpr int INPUT_ZERO = 0;
37 constexpr int INPUT_ONE = 1;
38 constexpr int INPUT_THREE = 3;
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 constexpr uint8_t ENABLE = 2;
42 constexpr size_t OFFSET_ZERO = 24;
43 constexpr size_t OFFSET_ONE = 16;
44 constexpr size_t OFFSET_TWO = 8;
45 }
46 
GetU32Data(const char * ptr)47 uint32_t GetU32Data(const char* ptr)
48 {
49     // convert fuzz input data to an integer
50     return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
51         ptr[INPUT_THREE];
52 }
53 
GetFuzzAbilityToken()54 sptr<Token> GetFuzzAbilityToken()
55 {
56     sptr<Token> token = nullptr;
57     AbilityRequest abilityRequest;
58     abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
59     abilityRequest.abilityInfo.name = "MainAbility";
60     abilityRequest.abilityInfo.type = AbilityType::DATA;
61     std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
62     if (abilityRecord) {
63         token = abilityRecord->GetToken();
64     }
65     return token;
66 }
67 
CacheProcessManagerFuzztestFunc1(bool boolParam,std::string & stringParam,int32_t int32Param)68 void CacheProcessManagerFuzztestFunc1(bool boolParam, std::string &stringParam, int32_t int32Param)
69 {
70     std::shared_ptr<CacheProcessManager> mgr = std::make_shared<CacheProcessManager>();
71     std::shared_ptr<AppMgrServiceInner> serviceInner1;
72     mgr->SetAppMgr(serviceInner1); // null mgr
73     mgr->RefreshCacheNum(); // called.
74     mgr->QueryEnableProcessCache(); // called.
75     mgr->maxProcCacheNum_ = 0;
76     mgr->PenddingCacheProcess(nullptr); // called.
77     mgr->maxProcCacheNum_ = int32Param;
78 
79     std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
80     std::shared_ptr<AppRunningRecord> appRecord1 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
81     mgr->PenddingCacheProcess(nullptr); // nullptr
82     appRecord1->isKeepAliveRdb_ = true;
83     appRecord1->isKeepAliveBundle_ = true;
84     appRecord1->isSingleton_ = true;
85     appRecord1->isMainProcess_ = true;
86     mgr->PenddingCacheProcess(appRecord1); // keepalive
87     std::shared_ptr<AppRunningRecord> appRecord2 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
88     mgr->PenddingCacheProcess(appRecord2); // not alive
89 
90     mgr->maxProcCacheNum_ = 0;
91     mgr->CheckAndCacheProcess(nullptr); // nullptr
92     mgr->maxProcCacheNum_ = int32Param;
93     mgr->CheckAndCacheProcess(appRecord2); // not cached
94     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
95     mgr->CheckAndCacheProcess(appRecord2); // cached
96 
97     mgr->CheckAndNotifyCachedState(nullptr);
98     std::shared_ptr<AppMgrServiceInner> serviceInner = std::make_shared<AppMgrServiceInner>();
99     mgr->SetAppMgr(serviceInner);
100     mgr->CheckAndNotifyCachedState(appRecord2); // appMgr not null
101 }
102 
CacheProcessManagerFuzztestFunc2(bool boolParam,std::string & stringParam,int32_t int32Param)103 void CacheProcessManagerFuzztestFunc2(bool boolParam, std::string &stringParam, int32_t int32Param)
104 {
105     std::shared_ptr<CacheProcessManager> mgr = std::make_shared<CacheProcessManager>();
106     std::shared_ptr<AppMgrServiceInner> serviceInner1;
107     mgr->SetAppMgr(serviceInner1);
108     mgr->IsCachedProcess(nullptr); // called.
109     std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
110     std::shared_ptr<AppRunningRecord> appRecord2 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
111     mgr->IsCachedProcess(appRecord2); // not cached called.
112     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
113     mgr->IsCachedProcess(appRecord2); // cached called.
114     mgr->cachedAppRecordQueue_.clear(); // clear
115 
116     mgr->maxProcCacheNum_ = int32Param;
117     mgr->OnProcessKilled(nullptr); // nullptr called.
118     mgr->OnProcessKilled(appRecord2); // not cached called.
119     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
120     mgr->OnProcessKilled(appRecord2); // cached called.
121     mgr->cachedAppRecordQueue_.clear(); // clear
122 
123     mgr->maxProcCacheNum_ = int32Param;
124     mgr->ReuseCachedProcess(nullptr);
125     mgr->ReuseCachedProcess(appRecord2); // not cached
126     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
127     mgr->ReuseCachedProcess(appRecord2); // cached
128     mgr->cachedAppRecordQueue_.clear(); // clear
129 
130     std::shared_ptr<AppMgrServiceInner> serviceInner = std::make_shared<AppMgrServiceInner>();
131     mgr->SetAppMgr(serviceInner); // appInner not null
132     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
133     mgr->ReuseCachedProcess(appRecord2); // cached
134 
135     mgr->IsAppSupportProcessCache(nullptr); // null ptr check
136     std::shared_ptr<AppRunningRecord> appRecord3 = std::make_shared<AppRunningRecord>(nullptr, int32Param, stringParam);
137     mgr->IsAppSupportProcessCache(appRecord3); // null appInfo
138     mgr->srvExtRecords.emplace(appRecord2);
139     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null
140     mgr->srvExtRecords.clear();
141 
142     appRecord2->SetAttachedToStatusBar(true);
143     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null &attached true
144     appRecord2->SetAttachedToStatusBar(false);
145     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null &attached false
146     appRecord2->isKeepAliveRdb_ = true;
147     appRecord2->isKeepAliveBundle_ = true;
148     appRecord2->isSingleton_ = true;
149     appRecord2->isMainProcess_ = true;
150     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null &attached false & keepalive called
151 }
152 
CacheProcessManagerFuzztestFunc3(bool boolParam,std::string & stringParam,int32_t int32Param)153 void CacheProcessManagerFuzztestFunc3(bool boolParam, std::string &stringParam, int32_t int32Param)
154 {
155     std::shared_ptr<CacheProcessManager> mgr = std::make_shared<CacheProcessManager>();
156     std::shared_ptr<AppMgrServiceInner> serviceInner1;
157     std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
158     std::shared_ptr<AppRunningRecord> appRecord1 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
159     mgr->SetAppMgr(serviceInner1);
160     mgr->IsAppShouldCache(nullptr); // called.
161     mgr->maxProcCacheNum_ = int32Param;
162     mgr->IsAppShouldCache(appRecord1); // not ccached called.
163     mgr->cachedAppRecordQueue_.emplace_back(appRecord1);
164     mgr->IsAppShouldCache(appRecord1); //ccached called.
165     mgr->IsAppAbilitiesEmpty(nullptr); // called
166     mgr->IsAppAbilitiesEmpty(appRecord1); // called
167 }
168 
DoSomethingInterestingWithMyAPI(const char * data,size_t size)169 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
170 {
171     bool boolParam = *data % ENABLE;
172     std::string stringParam(data, size);
173     int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
174     CacheProcessManagerFuzztestFunc1(boolParam, stringParam, int32Param);
175     CacheProcessManagerFuzztestFunc2(boolParam, stringParam, int32Param);
176     CacheProcessManagerFuzztestFunc3(boolParam, stringParam, int32Param);
177     return true;
178 }
179 }
180 
181 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)182 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
183 {
184     /* Run your code on data */
185     if (data == nullptr) {
186         return 0;
187     }
188 
189     /* Validate the length of size */
190     if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
191         return 0;
192     }
193 
194     char* ch = static_cast<char*>(malloc(size + 1));
195     if (ch == nullptr) {
196         std::cout << "malloc failed." << std::endl;
197         return 0;
198     }
199 
200     (void)memset_s(ch, size + 1, 0x00, size + 1);
201     if (memcpy_s(ch, size, data, size) != EOK) {
202         std::cout << "copy failed." << std::endl;
203         free(ch);
204         ch = nullptr;
205         return 0;
206     }
207 
208     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
209     free(ch);
210     ch = nullptr;
211     return 0;
212 }
213 
214