1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "accessibilityconfig_fuzzer.h"
17 #include "accessibility_config.h"
18 #include "accesstoken_kit.h"
19 #include "nativetoken_kit.h"
20 #include "securec.h"
21 #include "token_setproc.h"
22 
23 namespace OHOS {
24 namespace {
25     constexpr size_t DATA_MIN_SIZE = 181;
26     constexpr char END_CHAR = '\0';
27     constexpr size_t LEN = 10;
28     bool g_flag = true;
29 } // namespace
30 using namespace OHOS::Security::AccessToken;
31 
32 class ConfigObserver : public OHOS::AccessibilityConfig::AccessibilityConfigObserver {
33 public:
OnConfigChanged(const OHOS::AccessibilityConfig::CONFIG_ID id,const OHOS::AccessibilityConfig::ConfigValue & value)34     void OnConfigChanged(const OHOS::AccessibilityConfig::CONFIG_ID id,
35         const OHOS::AccessibilityConfig::ConfigValue &value) override
36     {
37     }
38 };
39 
40 class EnableAbilityListObserver : public OHOS::AccessibilityConfig::AccessibilityEnableAbilityListsObserver {
41 public:
OnEnableAbilityListsStateChanged()42     void OnEnableAbilityListsStateChanged() override
43     {
44     }
OnInstallAbilityListsStateChanged()45     void OnInstallAbilityListsStateChanged() override
46     {
47     }
48 };
49 
50 template<class T>
GetObject(T & object,const uint8_t * data,size_t size)51 size_t GetObject(T &object, const uint8_t *data, size_t size)
52 {
53     size_t objectSize = sizeof(object);
54     if (objectSize > size) {
55         return 0;
56     }
57     return memcpy_s(&object, objectSize, data, objectSize) == EOK ? objectSize : 0;
58 }
59 
AddPermission()60 void AddPermission()
61 {
62     if (g_flag) {
63         const char *perms[2];
64         perms[0] = OHOS::Accessibility::OHOS_PERMISSION_READ_ACCESSIBILITY_CONFIG.c_str();
65         perms[1] = OHOS::Accessibility::OHOS_PERMISSION_WRITE_ACCESSIBILITY_CONFIG.c_str();
66         NativeTokenInfoParams infoInstance = {
67             .dcapsNum = 0,
68             .permsNum = 2,
69             .aclsNum = 0,
70             .dcaps = nullptr,
71             .perms = perms,
72             .acls = nullptr,
73             .processName = "com.accessibility.config.fuzzer.test",
74             .aplStr = "normal",
75         };
76         uint64_t tokenId = GetAccessTokenId(&infoInstance);
77         SetSelfTokenID(tokenId);
78         AccessTokenKit::ReloadNativeTokenInfo();
79         g_flag = false;
80     }
81 }
82 
GenerateCaptionProperty(OHOS::AccessibilityConfig::CaptionProperty & property,const uint8_t * data,size_t size)83 static size_t GenerateCaptionProperty(
84     OHOS::AccessibilityConfig::CaptionProperty &property, const uint8_t* data, size_t size)
85 {
86     size_t position = 0;
87     uint32_t temp = 0;
88     position += GetObject<uint32_t>(temp, &data[position], size - position);
89     property.SetFontColor(temp);
90 
91     position += GetObject<uint32_t>(temp, &data[position], size - position);
92     property.SetWindowColor(temp);
93 
94     position += GetObject<uint32_t>(temp, &data[position], size - position);
95     property.SetBackgroundColor(temp);
96 
97     position += GetObject<uint32_t>(temp, &data[position], size - position);
98     property.SetFontScale(static_cast<int32_t>(temp));
99 
100     char name[LEN + 1];
101     name[LEN] = END_CHAR;
102     for (size_t i = 0; i < LEN; i++) {
103         position += GetObject<char>(name[i], &data[position], size - position);
104     }
105     std::string family(name);
106     property.SetFontFamily(family);
107 
108     for (size_t i = 0; i < LEN; i++) {
109         position += GetObject<char>(name[i], &data[position], size - position);
110     }
111     std::string type(name);
112     property.SetFontFamily(type);
113 
114     return position;
115 }
116 
DoSomethingInterestingSetConfig(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)117 void DoSomethingInterestingSetConfig(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
118     const uint8_t* data, size_t size, size_t& startPos)
119 {
120     abConfig.SetScreenMagnificationState(data[startPos++] & 0x01);
121     abConfig.SetShortKeyState(data[startPos++] & 0x01);
122     abConfig.SetMouseKeyState(data[startPos++] & 0x01);
123     abConfig.SetCaptionsState(data[startPos++] & 0x01);
124     abConfig.SetHighContrastTextState(data[startPos++] & 0x01);
125     abConfig.SetDaltonizationState(data[startPos++] & 0x01);
126     abConfig.SetInvertColorState(data[startPos++] & 0x01);
127     abConfig.SetAnimationOffState(data[startPos++] & 0x01);
128     abConfig.SetAudioMonoState(data[startPos++] & 0x01);
129 
130     uint32_t temp = 0;
131     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
132     abConfig.SetContentTimeout(temp);
133 
134     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
135     abConfig.SetDaltonizationColorFilter(static_cast<OHOS::AccessibilityConfig::DALTONIZATION_TYPE>(temp));
136 
137     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
138     abConfig.SetMouseAutoClick(static_cast<int32_t>(temp));
139 
140     float tempFloat = 0;
141     startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
142     abConfig.SetBrightnessDiscount(tempFloat);
143 
144     startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
145     abConfig.SetAudioBalance(tempFloat);
146 
147     char name[LEN + 1];
148     name[LEN] = END_CHAR;
149     for (size_t i = 0; i < LEN; i++) {
150         startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
151     }
152     std::string nameStr(name);
153     abConfig.SetShortkeyTarget(nameStr);
154 
155     OHOS::AccessibilityConfig::CaptionProperty property;
156     startPos += GenerateCaptionProperty(property, &data[startPos], size - startPos);
157     abConfig.SetCaptionsProperty(property);
158 }
159 
DoSomethingInterestingGetAbility(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)160 void DoSomethingInterestingGetAbility(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
161     const uint8_t* data, size_t size, size_t& startPos)
162 {
163     char name[LEN + 1];
164     name[LEN] = END_CHAR;
165     uint32_t temp = 0;
166     std::shared_ptr<ConfigObserver> cObserver = std::make_shared<ConfigObserver>();
167     std::shared_ptr<EnableAbilityListObserver> eObserver = std::make_shared<EnableAbilityListObserver>();
168 
169     for (size_t i = 0; i < LEN; i++) {
170         startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
171     }
172     std::string abilityName1(name);
173     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
174     abConfig.EnableAbility(abilityName1, temp);
175 
176     for (size_t i = 0; i < LEN; i++) {
177         startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
178     }
179     std::string abilityName2(name);
180     abConfig.DisableAbility(abilityName2);
181 
182     bool flag = data[startPos++] & 0x01;
183     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
184     abConfig.SubscribeConfigObserver(static_cast<OHOS::AccessibilityConfig::CONFIG_ID>(temp), cObserver, flag);
185     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
186     abConfig.UnsubscribeConfigObserver(static_cast<OHOS::AccessibilityConfig::CONFIG_ID>(temp), cObserver);
187     abConfig.SubscribeEnableAbilityListsObserver(eObserver);
188     abConfig.UnsubscribeEnableAbilityListsObserver(eObserver);
189 }
190 
DoSomethingInterestingGetConfig(OHOS::AccessibilityConfig::AccessibilityConfig & abConfig,const uint8_t * data,size_t size,size_t & startPos)191 void DoSomethingInterestingGetConfig(OHOS::AccessibilityConfig::AccessibilityConfig& abConfig,
192     const uint8_t* data, size_t size, size_t& startPos)
193 {
194     bool flag = data[startPos++] & 0x01;
195     abConfig.GetScreenMagnificationState(flag);
196     flag = data[startPos++] & 0x01;
197     abConfig.GetShortKeyState(flag);
198     flag = data[startPos++] & 0x01;
199     abConfig.GetMouseKeyState(flag);
200     flag = data[startPos++] & 0x01;
201     abConfig.GetCaptionsState(flag);
202     flag = data[startPos++] & 0x01;
203     abConfig.GetHighContrastTextState(flag);
204     flag = data[startPos++] & 0x01;
205     abConfig.GetDaltonizationState(flag);
206     flag = data[startPos++] & 0x01;
207     abConfig.GetInvertColorState(flag);
208     flag = data[startPos++] & 0x01;
209     abConfig.GetAnimationOffState(flag);
210     flag = data[startPos++] & 0x01;
211     abConfig.GetAudioMonoState(flag);
212 
213     uint32_t temp = 0;
214     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
215     abConfig.GetContentTimeout(temp);
216 
217     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
218     OHOS::AccessibilityConfig::DALTONIZATION_TYPE types =
219         static_cast<OHOS::AccessibilityConfig::DALTONIZATION_TYPE>(temp);
220     abConfig.GetDaltonizationColorFilter(types);
221 
222     startPos += GetObject<uint32_t>(temp, &data[startPos], size - startPos);
223     int32_t clicks = static_cast<int32_t>(temp);
224     abConfig.GetMouseAutoClick(clicks);
225 
226     float tempFloat = 0;
227     startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
228     abConfig.GetBrightnessDiscount(tempFloat);
229 
230     startPos += GetObject<float>(tempFloat, &data[startPos], size - startPos);
231     abConfig.GetAudioBalance(tempFloat);
232 
233     char name[LEN + 1];
234     name[LEN] = END_CHAR;
235     for (size_t i = 0; i < LEN; i++) {
236         startPos += GetObject<char>(name[i], &data[startPos], size - startPos);
237     }
238     std::string nameStrForGet(name);
239     abConfig.GetShortkeyTarget(nameStrForGet);
240 
241     OHOS::AccessibilityConfig::CaptionProperty propertyForGet;
242     GenerateCaptionProperty(propertyForGet, &data[startPos], size - startPos);
243     abConfig.GetCaptionsProperty(propertyForGet);
244 }
245 
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)246 bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
247 {
248     if (data == nullptr || size < DATA_MIN_SIZE) {
249         return false;
250     }
251 
252     auto &abConfig = OHOS::AccessibilityConfig::AccessibilityConfig::GetInstance();
253     (void)abConfig.InitializeContext();
254     size_t startPos = 0;
255     DoSomethingInterestingSetConfig(abConfig, data, size, startPos);
256     DoSomethingInterestingGetAbility(abConfig, data, size, startPos);
257     DoSomethingInterestingGetConfig(abConfig, data, size, startPos);
258 
259     return true;
260 }
261 }
262 
263 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)264 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
265 {
266     OHOS::AddPermission();
267     /* Run your code on data */
268     OHOS::DoSomethingInterestingWithMyAPI(data, size);
269     return 0;
270 }
271