1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "devicestandby_fuzzer.h"
17 #include "securec.h"
18 #ifdef DEVICE_STANDBY_ACCESS_TOKEN_ENABLE
19 #include "access_token.h"
20 #include "accesstoken_kit.h"
21 #include "access_token_error.h"
22 #include "nativetoken_kit.h"
23 #include "token_setproc.h"
24 #endif
25 #include "resourcce_request.h"
26 #include "istandby_service_subscriber.h"
27 #include "standby_service.h"
28 #include "istandby_ipc_inteface_code.h"
29 #include "standby_service_log.h"
30 #include "standby_service_subscriber_stub.h"
31
32 namespace OHOS {
33 namespace DevStandbyMgr {
34 constexpr size_t U32_AT_SIZE = 17;
35 constexpr uint32_t MAX_CODE = 13;
36 constexpr uint32_t CONSTANT_ONE = 1;
37 constexpr int32_t CONSTANT_TWO = 2;
38 const std::string STR_TEST = "test";
39 const std::string RSS_NAME = "resource_schedule_service";
40 const std::u16string DEVICE_STANDBY_TOKEN = u"ohos.resourceschedule.IStandbyService";
41 bool g_initFlag = false;
42 sptr<IStandbyServiceSubscriber> subscriber = new StandbyServiceSubscriberStub();
43 std::unique_ptr<ResourceRequest> resourceRequest = std::make_unique<ResourceRequest>(CONSTANT_ONE, CONSTANT_TWO,
44 STR_TEST, CONSTANT_TWO, STR_TEST, CONSTANT_ONE);
45 const uint8_t *g_baseFuzzData = nullptr;
46 size_t g_baseFuzzSize = 0;
47 size_t g_baseFuzzPos;
48 bool g_paramBool;
49 int32_t g_paramInt32;
50 uint32_t g_paramUint32;
51 uint64_t g_paramUint64;
52 std::string g_paramString;
53
GetData()54 template <class T> T GetData()
55 {
56 T object{};
57 size_t objectSize = sizeof(object);
58 if (g_baseFuzzData == nullptr || objectSize > g_baseFuzzSize - g_baseFuzzPos) {
59 return object;
60 }
61 errno_t ret = memcpy_s(&object, objectSize, g_baseFuzzData + g_baseFuzzPos, objectSize);
62 if (ret != EOK) {
63 return {};
64 }
65 g_baseFuzzPos += objectSize;
66 return object;
67 }
68
InitParam()69 void InitParam()
70 {
71 g_paramBool = GetData<bool>();
72 g_paramInt32 = GetData<int32_t>();
73 g_paramUint32 = GetData<uint32_t>();
74 g_paramUint64 = GetData<uint64_t>();
75 std::string strParam((const char *) g_baseFuzzData + g_baseFuzzPos, g_baseFuzzSize - g_baseFuzzPos);
76 g_paramString = strParam;
77 }
78
CoverageHandleIsStrategyEnabled()79 void CoverageHandleIsStrategyEnabled()
80 {
81 MessageParcel datas;
82 MessageParcel reply;
83 MessageOption option = {MessageOption::TF_SYNC};
84 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
85 static_cast<uint32_t>(IStandbyInterfaceCode::IS_STRATEGY_ENABLED),
86 datas, reply, option);
87 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
88 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
89 static_cast<uint32_t>(IStandbyInterfaceCode::IS_STRATEGY_ENABLED),
90 datas, reply, option);
91 datas.WriteString(g_paramString);
92 datas.RewindRead(0);
93 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
94 static_cast<uint32_t>(IStandbyInterfaceCode::IS_STRATEGY_ENABLED),
95 datas, reply, option);
96 }
97
CoverageHandleReportWorkSchedulerStatus()98 void CoverageHandleReportWorkSchedulerStatus()
99 {
100 MessageParcel datas;
101 MessageParcel reply;
102 MessageOption option = {MessageOption::TF_SYNC};
103 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
104 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
105 static_cast<uint32_t>(IStandbyInterfaceCode::REPORT_WORK_SCHEDULER_STATUS),
106 datas, reply, option);
107 datas.WriteBool(g_paramBool);
108 datas.WriteInt32(g_paramInt32);
109 datas.WriteString(g_paramString);
110 datas.RewindRead(0);
111 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
112 static_cast<uint32_t>(IStandbyInterfaceCode::REPORT_WORK_SCHEDULER_STATUS),
113 datas, reply, option);
114 }
115
CoverageHandleGetAllowList()116 void CoverageHandleGetAllowList()
117 {
118 MessageParcel datas;
119 MessageParcel reply;
120 MessageOption option = {MessageOption::TF_SYNC};
121 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
122 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
123 static_cast<uint32_t>(IStandbyInterfaceCode::GET_ALLOW_LIST),
124 datas, reply, option);
125 datas.WriteUint32(g_paramUint32);
126 datas.WriteUint32(g_paramUint32);
127 datas.RewindRead(0);
128 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
129 static_cast<uint32_t>(IStandbyInterfaceCode::GET_ALLOW_LIST),
130 datas, reply, option);
131 }
132
CoverageHandleSubscribeStandbyCallback()133 void CoverageHandleSubscribeStandbyCallback()
134 {
135 MessageParcel datas;
136 MessageParcel reply;
137 MessageOption option;
138 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
139 datas.WriteRemoteObject(subscriber->AsObject());
140 datas.WriteString(g_paramString);
141 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
142 static_cast<uint32_t>(IStandbyInterfaceCode::SUBSCRIBE_STANDBY_CALLBACK),
143 datas, reply, option);
144 }
145
CoverageHandleUnSubscribeStandbyCallback()146 void CoverageHandleUnSubscribeStandbyCallback()
147 {
148 MessageParcel datas;
149 MessageParcel reply;
150 MessageOption option;
151 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
152 datas.WriteRemoteObject(subscriber->AsObject());
153 datas.WriteString(g_paramString);
154 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
155 static_cast<uint32_t>(IStandbyInterfaceCode::UNSUBSCRIBE_STANDBY_CALLBACK),
156 datas, reply, option);
157 }
158
CoverageHandleApplyAllowResource()159 void CoverageHandleApplyAllowResource()
160 {
161 MessageParcel datas;
162 MessageParcel reply;
163 MessageOption option;
164 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
165 resourceRequest->Marshalling(datas);
166 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
167 static_cast<uint32_t>(IStandbyInterfaceCode::APPLY_ALLOW_RESOURCE),
168 datas, reply, option);
169 }
170
CoverageUnHandleApplyAllowResource()171 void CoverageUnHandleApplyAllowResource()
172 {
173 MessageParcel datas;
174 MessageParcel reply;
175 MessageOption option;
176 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
177 resourceRequest->Marshalling(datas);
178 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
179 static_cast<uint32_t>(IStandbyInterfaceCode::UNAPPLY_ALLOW_RESOURCE),
180 datas, reply, option);
181 }
182
CoverageHandleCommonEvent()183 void CoverageHandleCommonEvent()
184 {
185 MessageParcel datas;
186 MessageParcel reply;
187 MessageOption option;
188 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
189 datas.WriteUint32(g_paramUint32);
190 datas.WriteInt64(g_paramUint64);
191 datas.WriteString(g_paramString);
192 datas.RewindRead(0);
193 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
194 static_cast<uint32_t>(IStandbyInterfaceCode::HANDLE_EVENT),
195 datas, reply, option);
196 }
197
CoverageHandleSetNatInterval()198 void CoverageHandleSetNatInterval()
199 {
200 MessageParcel datas;
201 MessageParcel reply;
202 MessageOption option;
203 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
204 datas.WriteUint32(g_paramUint32);
205 datas.WriteBool(g_paramBool);
206 datas.WriteUint32(g_paramUint32);
207 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(
208 static_cast<uint32_t>(IStandbyInterfaceCode::SET_NAT_INTERVAL),
209 datas, reply, option);
210 }
211
PreciseCoverage()212 void PreciseCoverage()
213 {
214 CoverageHandleIsStrategyEnabled();
215 CoverageHandleReportWorkSchedulerStatus();
216 CoverageHandleGetAllowList();
217 CoverageHandleSubscribeStandbyCallback();
218 CoverageHandleUnSubscribeStandbyCallback();
219 CoverageHandleApplyAllowResource();
220 CoverageUnHandleApplyAllowResource();
221 CoverageHandleCommonEvent();
222 CoverageHandleSetNatInterval();
223 if (g_initFlag) {
224 return;
225 }
226 g_initFlag = true;
227 #ifdef DEVICE_STANDBY_ACCESS_TOKEN_ENABLE
228 auto tokenId = Security::AccessToken::AccessTokenKit::GetNativeTokenId(RSS_NAME);
229 SetSelfTokenID(tokenId);
230 #endif
231 }
232
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)233 bool DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
234 {
235 g_baseFuzzData = data;
236 g_baseFuzzSize = size;
237 g_baseFuzzPos = 0;
238 PreciseCoverage();
239 for (uint32_t i = 0; i < MAX_CODE; i++) {
240 MessageParcel datas;
241 datas.WriteInterfaceToken(DEVICE_STANDBY_TOKEN);
242 datas.WriteString(g_paramString);
243 datas.WriteUint32(g_paramUint32);
244 datas.WriteUint32(g_paramUint32);
245 datas.WriteBuffer(data, size);
246 datas.RewindRead(0);
247 MessageParcel reply;
248 MessageOption option;
249 DelayedSingleton<StandbyService>::GetInstance()->OnRemoteRequest(i, datas, reply, option);
250 }
251 return true;
252 }
253 } // namespace DevStandbyMgr
254 } // namespace OHOS
255
256 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)257 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
258 {
259 /* Run your code on data */
260 if (data == nullptr) {
261 return 0;
262 }
263
264 if (size < OHOS::DevStandbyMgr::U32_AT_SIZE) {
265 return 0;
266 }
267 OHOS::DevStandbyMgr::DoSomethingInterestingWithMyAPI(data, size);
268 return 0;
269 }
270