1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "backupsaanother_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 #include <cstring>
21 #include <climits>
22 #include <vector>
23 
24 #include "message_parcel.h"
25 #include "service.h"
26 #include "service_proxy.h"
27 #include "service_reverse.h"
28 #include "service_stub.h"
29 #include "securec.h"
30 #include "system_ability.h"
31 
32 using namespace std;
33 using namespace OHOS::FileManagement::Backup;
34 
35 namespace OHOS {
36 constexpr int32_t SERVICE_ID = 5203;
37 
CmdGetFileHandleFuzzTest(const uint8_t * data,size_t size)38 bool CmdGetFileHandleFuzzTest(const uint8_t *data, size_t size)
39 {
40     MessageParcel datas;
41     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
42     int pos = (size + 1) >> 1;
43     if (size > 0) {
44         std::string param(string(reinterpret_cast<const char*>(data), pos));
45         datas.WriteString(param);
46     }
47 
48     if (size > 1) {
49         std::string param(string(reinterpret_cast<const char*>(data + pos), size - pos));
50         datas.WriteString(param);
51     }
52     datas.RewindRead(0);
53     MessageParcel reply;
54     MessageOption option;
55 
56     sptr service(new Service(SERVICE_ID));
57     service->OnRemoteRequest(static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_GET_FILE_NAME),
58         datas, reply, option);
59     service = nullptr;
60     return true;
61 }
62 
CmdAppendBundlesBackupSessionFuzzTest(const uint8_t * data,size_t size)63 bool CmdAppendBundlesBackupSessionFuzzTest(const uint8_t *data, size_t size)
64 {
65     MessageParcel datas;
66     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
67     if (size > 0) {
68         vector<string> bundleNames;
69         for (size_t i = 0; i < size; i++) {
70             string param(reinterpret_cast<const char*>(data), size);
71             string name = param + to_string(i);
72             bundleNames.push_back(name);
73         }
74         datas.WriteStringVector(bundleNames);
75     }
76 
77     datas.RewindRead(0);
78     MessageParcel reply;
79     MessageOption option;
80 
81     sptr service(new Service(SERVICE_ID));
82     uint32_t code = static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_APPEND_BUNDLES_BACKUP_SESSION);
83     service->OnRemoteRequest(code, datas, reply, option);
84     service = nullptr;
85     return true;
86 }
87 
CmdReleaseFuzzTest(const uint8_t * data,size_t size)88 bool CmdReleaseFuzzTest(const uint8_t *data, size_t size)
89 {
90     MessageParcel datas;
91     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
92     datas.WriteBuffer(data, size);
93     datas.RewindRead(0);
94     MessageParcel reply;
95     MessageOption option;
96 
97     sptr service(new Service(SERVICE_ID));
98     uint32_t code = static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_RELSEASE_SESSION);
99     service->OnRemoteRequest(code, datas, reply, option);
100     service = nullptr;
101     return true;
102 }
103 
GetBundleNamesData(const uint8_t * data,size_t size,vector<BIncrementalData> & bundleNames)104 void GetBundleNamesData(const uint8_t *data, size_t size, vector<BIncrementalData> &bundleNames)
105 {
106     for (size_t i = 0; i < size; i++) {
107         string param(reinterpret_cast<const char*>(data), size);
108         string name = param + to_string(i);
109         if (size < sizeof(int64_t)) {
110             BIncrementalData data(name, 0);
111             bundleNames.push_back(data);
112             continue;
113         }
114 
115         int64_t nTime = *(reinterpret_cast<const int64_t*>(data));
116         int32_t fd = *(reinterpret_cast<const int32_t*>(data));
117         int32_t priority = *(reinterpret_cast<const int32_t*>(data + sizeof(int32_t)));
118         string parameters = string(reinterpret_cast<const char*>(data), size) + to_string(size - i);
119         BIncrementalData incrementaData(name, nTime, fd, parameters, priority);
120         bundleNames.push_back(incrementaData);
121     }
122 }
123 
124 template <typename T>
WriteParcelableVector(const std::vector<T> & parcelableVector,Parcel & data)125 void WriteParcelableVector(const std::vector<T> &parcelableVector, Parcel &data)
126 {
127     if (!data.WriteUint32(parcelableVector.size())) {
128         return;
129     }
130 
131     for (const auto &parcelable : parcelableVector) {
132         if (!data.WriteParcelable(&parcelable)) {
133             return;
134         }
135     }
136 
137     return;
138 }
139 
CmdGetLocalCapabilitiesIncrementalFuzzTest(const uint8_t * data,size_t size)140 bool CmdGetLocalCapabilitiesIncrementalFuzzTest(const uint8_t *data, size_t size)
141 {
142     MessageParcel datas;
143     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
144     if (size >= sizeof(int32_t)) {
145         vector<BIncrementalData> bundleNames;
146         GetBundleNamesData(data, size, bundleNames);
147         WriteParcelableVector(bundleNames, datas);
148     }
149 
150     datas.RewindRead(0);
151     MessageParcel reply;
152     MessageOption option;
153 
154     sptr service(new Service(SERVICE_ID));
155     uint32_t code = static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_GET_LOCAL_CAPABILITIES_INCREMENTAL);
156     service->OnRemoteRequest(code, datas, reply, option);
157     service = nullptr;
158     return true;
159 }
160 
CmdInitIncrementalBackupSessionFuzzTest(const uint8_t * data,size_t size)161 bool CmdInitIncrementalBackupSessionFuzzTest(const uint8_t *data, size_t size)
162 {
163     MessageParcel datas;
164     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
165     datas.WriteBuffer(data, size);
166     datas.RewindRead(0);
167     MessageParcel reply;
168     MessageOption option;
169 
170     sptr service(new Service(SERVICE_ID));
171     uint32_t code = static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_INIT_INCREMENTAL_BACKUP_SESSION);
172     service->OnRemoteRequest(code, datas, reply, option);
173     service = nullptr;
174     return true;
175 }
176 
CmdAppendBundlesIncrementalBackupSessionFuzzTest(const uint8_t * data,size_t size)177 bool CmdAppendBundlesIncrementalBackupSessionFuzzTest(const uint8_t *data, size_t size)
178 {
179     MessageParcel datas;
180     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
181     if (size >= sizeof(int32_t)) {
182         vector<BIncrementalData> bundleNames;
183         GetBundleNamesData(data, size, bundleNames);
184         WriteParcelableVector(bundleNames, datas);
185     }
186     datas.RewindRead(0);
187     MessageParcel reply;
188     MessageOption option;
189 
190     sptr service(new Service(SERVICE_ID));
191     uint32_t code = static_cast<uint32_t>(
192         IServiceInterfaceCode::SERVICE_CMD_APPEND_BUNDLES_INCREMENTAL_BACKUP_SESSION);
193     service->OnRemoteRequest(code, datas, reply, option);
194     service = nullptr;
195     return true;
196 }
197 
CmdPublishIncrementalFileFuzzTest(const uint8_t * data,size_t size)198 bool CmdPublishIncrementalFileFuzzTest(const uint8_t *data, size_t size)
199 {
200     MessageParcel datas;
201     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
202     if (size > 0) {
203         int pos = (size + 1) >> 1;
204         std::string fileName(reinterpret_cast<const char *>(data), pos);
205         std::string bundleName(reinterpret_cast<const char *>(data) + pos, size - pos);
206         uint32_t sn = 0;
207         if (size > sizeof(uint32_t)) {
208             sn = *(reinterpret_cast<const uint32_t *>(data));
209         }
210         BFileInfo fileInfo(fileName, bundleName, sn);
211         datas.WriteParcelable(&fileInfo);
212     }
213 
214     datas.RewindRead(0);
215     MessageParcel reply;
216     MessageOption option;
217 
218     sptr service(new Service(SERVICE_ID));
219     uint32_t code = static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_PUBLISH_INCREMENTAL_FILE);
220     service->OnRemoteRequest(code, datas, reply, option);
221     service = nullptr;
222     return true;
223 }
224 
CmdAppIncrementalFileReadyFuzzTest(const uint8_t * data,size_t size)225 bool CmdAppIncrementalFileReadyFuzzTest(const uint8_t *data, size_t size)
226 {
227     MessageParcel datas;
228     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
229     std::string fileName(reinterpret_cast<const char *>(data), size);
230     datas.WriteString(fileName);
231     if (size >= sizeof(int)) {
232         int fd = *(reinterpret_cast<const int *>(data));
233         datas.WriteFileDescriptor(UniqueFd(fd));
234     }
235 
236     if (size >= sizeof(int) + sizeof(int))  {
237         int manifestId = *(reinterpret_cast<const int *>(data + sizeof(int)));
238         datas.WriteFileDescriptor(UniqueFd(manifestId));
239     }
240     datas.RewindRead(0);
241     MessageParcel reply;
242     MessageOption option;
243 
244     sptr service(new Service(SERVICE_ID));
245     uint32_t code = static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_APP_INCREMENTAL_FILE_READY);
246     service->OnRemoteRequest(code, datas, reply, option);
247     service = nullptr;
248     return true;
249 }
250 
CmdAppIncrementalDoneFuzzTest(const uint8_t * data,size_t size)251 bool CmdAppIncrementalDoneFuzzTest(const uint8_t *data, size_t size)
252 {
253     MessageParcel datas;
254     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
255     if (size >= sizeof(int32_t)) {
256         datas.WriteInt32(*(reinterpret_cast<const int32_t *>(data)));
257     }
258 
259     datas.RewindRead(0);
260     MessageParcel reply;
261     MessageOption option;
262 
263     sptr service(new Service(SERVICE_ID));
264     service->OnRemoteRequest(static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_APP_INCREMENTAL_DONE),
265         datas, reply, option);
266     service = nullptr;
267     return true;
268 }
269 
CmdGetIncrementalFileHandleFuzzTest(const uint8_t * data,size_t size)270 bool CmdGetIncrementalFileHandleFuzzTest(const uint8_t *data, size_t size)
271 {
272     MessageParcel datas;
273     datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
274     int pos = (size + 1) >> 1;
275     if (size > 0) {
276         string param(reinterpret_cast<const char*>(data), pos);
277         datas.WriteString(param);
278     }
279 
280     if (size > 1) {
281         string param(reinterpret_cast<const char*>(data + pos), size - pos);
282         datas.WriteString(param);
283     }
284 
285     datas.RewindRead(0);
286     MessageParcel reply;
287     MessageOption option;
288 
289     sptr service(new Service(SERVICE_ID));
290     service->OnRemoteRequest(static_cast<uint32_t>(IServiceInterfaceCode::SERVICE_CMD_GET_INCREMENTAL_FILE_NAME),
291         datas, reply, option);
292     service = nullptr;
293     return true;
294 }
295 } // namespace OHOS
296 
297 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)298 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
299 {
300     /* Run your code on data */
301     if (data == nullptr) {
302         return 0;
303     }
304 
305     OHOS::CmdGetFileHandleFuzzTest(data, size);
306     OHOS::CmdAppendBundlesBackupSessionFuzzTest(data, size);
307     OHOS::CmdReleaseFuzzTest(data, size);
308     OHOS::CmdGetLocalCapabilitiesIncrementalFuzzTest(data, size);
309     OHOS::CmdInitIncrementalBackupSessionFuzzTest(data, size);
310     OHOS::CmdPublishIncrementalFileFuzzTest(data, size);
311     OHOS::CmdAppIncrementalFileReadyFuzzTest(data, size);
312     OHOS::CmdAppIncrementalDoneFuzzTest(data, size);
313     OHOS::CmdGetIncrementalFileHandleFuzzTest(data, size);
314     OHOS::CmdAppendBundlesIncrementalBackupSessionFuzzTest(data, size);
315     return 0;
316 }