1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "fileaccessservicestub_fuzzer.h"
16
17 #include <cstring>
18 #include <memory>
19
20 #include "extension_context.h"
21 #include "file_access_service_stub.h"
22 #include "fileaccessservicemock.h"
23 #include "message_parcel.h"
24
25 namespace OHOS {
26 using namespace std;
27 using namespace FileAccessFwk;
28
29 template<class T>
TypeCast(const uint8_t * data,int * pos=nullptr)30 T TypeCast(const uint8_t *data, int *pos = nullptr)
31 {
32 if (pos) {
33 *pos += sizeof(T);
34 }
35 return *(reinterpret_cast<const T*>(data));
36 }
37
OnRemoteRequestFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub,const uint8_t * data,size_t size)38 bool OnRemoteRequestFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub, const uint8_t *data, size_t size)
39 {
40 if (data == nullptr || size < sizeof(uint32_t)) {
41 return true;
42 }
43
44 uint32_t code = TypeCast<uint32_t>(data);
45 MessageParcel msg;
46 msg.WriteInterfaceToken(FileAccessServiceStub::GetDescriptor());
47 MessageParcel reply;
48 MessageOption option;
49
50 fileAccessServiceStub->OnRemoteRequest(code, msg, reply, option);
51 return true;
52 }
53
CmdOnChangeFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub,const uint8_t * data,size_t size)54 ErrCode CmdOnChangeFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub, const uint8_t *data, size_t size)
55 {
56 if (data == nullptr || size < sizeof(uint32_t)) {
57 return true;
58 }
59
60 int pos = 0;
61 int32_t notifyType = TypeCast<int32_t>(data, &pos);
62 Uri uri(string(reinterpret_cast<const char*>(data + pos), size - pos));
63
64 MessageParcel msg;
65 MessageParcel reply;
66 msg.WriteParcelable(&uri);
67 msg.WriteInt32(notifyType);
68
69 fileAccessServiceStub->CmdOnChange(msg, reply);
70 return FileAccessFwk::ERR_OK;
71 }
72
CmdRegisterNotifyFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub,const uint8_t * data,size_t size)73 ErrCode CmdRegisterNotifyFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub, const uint8_t *data,
74 size_t size)
75 {
76 Uri uri(string(reinterpret_cast<const char*>(data), size));
77
78 MessageParcel msg;
79 MessageParcel reply;
80 msg.WriteParcelable(&uri);
81
82 fileAccessServiceStub->CmdOnChange(msg, reply);
83 return FileAccessFwk::ERR_OK;
84 }
85
CmdUnregisterNotifyFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub,const uint8_t * data,size_t size)86 ErrCode CmdUnregisterNotifyFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub, const uint8_t *data,
87 size_t size)
88 {
89 if (data == nullptr || size < sizeof(bool)) {
90 return true;
91 }
92
93 int pos = 0;
94 bool observerNotNull = TypeCast<bool>(data, &pos);
95 Uri uri(string(reinterpret_cast<const char*>(data + pos), size - pos));
96
97 MessageParcel msg;
98 MessageParcel reply;
99 msg.WriteParcelable(&uri);
100 msg.WriteBool(observerNotNull);
101
102 fileAccessServiceStub->CmdUnregisterNotify(msg, reply);
103 return FileAccessFwk::ERR_OK;
104 }
105
CmdGetExensionProxyFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub,const uint8_t * data,size_t size)106 ErrCode CmdGetExensionProxyFuzzTest(shared_ptr<FileAccessServiceStub> fileAccessServiceStub, const uint8_t *data,
107 size_t size)
108 {
109 AAFwk::Want want = {};
110 MessageParcel msg;
111 MessageParcel reply;
112 msg.WriteParcelable(&want);
113 msg.WriteRemoteObject(nullptr);
114
115 fileAccessServiceStub->CmdGetExensionProxy(msg, reply);
116 return FileAccessFwk::ERR_OK;
117 }
118
119 } // namespace OHOS
120
121 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)122 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
123 {
124 auto stub = std::make_shared<OHOS::FileAccessFwk::FileAccessServiceMock>();
125 if (stub == nullptr) {
126 return 0;
127 }
128
129 OHOS::OnRemoteRequestFuzzTest(stub, data, size);
130 OHOS::CmdOnChangeFuzzTest(stub, data, size);
131 OHOS::CmdRegisterNotifyFuzzTest(stub, data, size);
132 OHOS::CmdUnregisterNotifyFuzzTest(stub, data, size);
133 OHOS::CmdGetExensionProxyFuzzTest(stub, data, size);
134 return 0;
135 }
136