1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "displaymanageripc_fuzzer.h"
17 
18 #include <iremote_broker.h>
19 #include <iservice_registry.h>
20 #include <securec.h>
21 #include <system_ability_definition.h>
22 
23 #include "display_manager_interface.h"
24 #include "display_manager_proxy.h"
25 #include "window_manager_hilog.h"
26 
27 namespace OHOS ::Rosen {
28 namespace {
29 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "DisplayManagerIPC_Fuzzer"};
30 }
31 template<class T>
GetObject(T & object,const uint8_t * data,size_t size)32 size_t GetObject(T &object, const uint8_t *data, size_t size)
33 {
34     size_t objectSize = sizeof(object);
35     if (objectSize > size) {
36         return 0;
37     }
38     return memcpy_s(&object, objectSize, data, objectSize) == EOK ? objectSize : 0;
39 }
40 
GetProxy()41 std::pair<sptr<IDisplayManager>, sptr<IRemoteObject>> GetProxy()
42 {
43     sptr<ISystemAbilityManager> systemAbilityManager =
44         SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
45     if (!systemAbilityManager) {
46         WLOGFE("Failed to get system ability mgr.");
47         return { nullptr, nullptr };
48     }
49     sptr<IRemoteObject> remoteObject = systemAbilityManager->GetSystemAbility(DISPLAY_MANAGER_SERVICE_SA_ID);
50     if (!remoteObject) {
51         WLOGFE("Failed to get display manager service.");
52         return { nullptr, nullptr };
53     }
54     sptr<IDisplayManager> displayManagerServiceProxy = iface_cast<IDisplayManager>(remoteObject);
55     if ((!displayManagerServiceProxy) || (!displayManagerServiceProxy->AsObject())) {
56         WLOGFE("Failed to get system display manager services");
57         return { nullptr, nullptr };
58     }
59     return { displayManagerServiceProxy, remoteObject };
60 }
61 
IPCFuzzTest(const uint8_t * data,size_t size)62 bool IPCFuzzTest(const uint8_t* data, size_t size)
63 {
64     uint32_t code;
65     int flags, waitTime;
66     if (data == nullptr || size < sizeof(code) + sizeof(flags) + sizeof(waitTime)) {
67         return false;
68     }
69     auto proxy = GetProxy();
70     if (proxy.first == nullptr || proxy.second == nullptr) {
71         return false;
72     }
73     size_t startPos = 0;
74     startPos += GetObject<uint32_t>(code, data + startPos, size - startPos);
75     startPos += GetObject<int>(flags, data + startPos, size - startPos);
76     startPos += GetObject<int>(waitTime, data + startPos, size - startPos);
77     MessageParcel sendData;
78     MessageParcel reply;
79     MessageOption option(flags, waitTime);
80     uint32_t dataSize = (size - startPos) > 1024 * 1024 ? 1024 * 1024 : (size - startPos);
81     sendData.WriteBuffer(data + startPos, dataSize);
82     proxy.second->SendRequest(code, sendData, reply, option);
83     return true;
84 }
85 
IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)86 void IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
87     MessageOption& option)
88 {
89     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_DEFAULT_DISPLAY_INFO),
90         sendData, reply, option);
91     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_DISPLAY_BY_ID),
92         sendData, reply, option);
93     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_DISPLAY_BY_SCREEN),
94         sendData, reply, option);
95     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_DISPLAY_SNAPSHOT),
96         sendData, reply, option);
97     proxy->SendRequest(
98         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_REGISTER_DISPLAY_MANAGER_AGENT),
99         sendData, reply, option);
100     proxy->SendRequest(
101         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_UNREGISTER_DISPLAY_MANAGER_AGENT),
102         sendData, reply, option);
103     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_WAKE_UP_BEGIN),
104         sendData, reply, option);
105     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_WAKE_UP_END),
106         sendData, reply, option);
107     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SUSPEND_BEGIN),
108         sendData, reply, option);
109     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SUSPEND_END),
110         sendData, reply, option);
111     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_SCREEN_POWER_FOR_ALL),
112         sendData, reply, option);
113     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_DISPLAY_STATE),
114         sendData, reply, option);
115     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_DISPLAY_STATE),
116         sendData, reply, option);
117     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_ALL_DISPLAYIDS),
118         sendData, reply, option);
119     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_SCREEN_POWER),
120         sendData, reply, option);
121     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_DISPLAY_STATE),
122         sendData, reply, option);
123     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_DISPLAY_STATE),
124         sendData, reply, option);
125     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_ALL_DISPLAYIDS),
126         sendData, reply, option);
127     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_NOTIFY_DISPLAY_EVENT),
128         sendData, reply, option);
129     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_NOTIFY_DISPLAY_EVENT),
130         sendData, reply, option);
131     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_ALL_DISPLAYIDS),
132         sendData, reply, option);
133     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_NOTIFY_DISPLAY_EVENT),
134         sendData, reply, option);
135     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_FREEZE_EVENT),
136         sendData, reply, option);
137 }
138 
IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option,sptr<IDisplayManager> manager)139 void IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
140     MessageOption& option, sptr<IDisplayManager> manager)
141 {
142     int flags = option.GetFlags();
143     option.SetFlags(MessageOption::TF_SYNC);
144     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_CREATE_VIRTUAL_SCREEN),
145         sendData, reply, option);
146     manager->DestroyVirtualScreen(static_cast<ScreenId>(reply.ReadUint64()));
147     option.SetFlags(flags);
148     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_DESTROY_VIRTUAL_SCREEN),
149         sendData, reply, option);
150     proxy->SendRequest(
151         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_SCREEN_SURFACE),
152         sendData, reply, option);
153     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_SCREEN_INFO_BY_ID),
154         sendData, reply, option);
155     proxy->SendRequest(
156         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_SCREEN_GROUP_INFO_BY_ID),
157         sendData, reply, option);
158     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_SCREEN_ACTIVE_MODE),
159         sendData, reply, option);
160     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_GET_ALL_SCREEN_INFOS),
161         sendData, reply, option);
162     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_ORIENTATION),
163         sendData, reply, option);
164     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SET_VIRTUAL_PIXEL_RATIO),
165         sendData, reply, option);
166     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_MIRROR),
167         sendData, reply, option);
168     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_MAKE_EXPAND),
169         sendData, reply, option);
170     proxy->SendRequest(
171         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_REMOVE_VIRTUAL_SCREEN_FROM_SCREEN_GROUP),
172         sendData, reply, option);
173     proxy->SendRequest(
174         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_GET_SUPPORTED_COLOR_GAMUTS),
175         sendData, reply, option);
176     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_GET_COLOR_GAMUT),
177         sendData, reply, option);
178     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_SET_COLOR_GAMUT),
179         sendData, reply, option);
180     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_GET_GAMUT_MAP),
181         sendData, reply, option);
182     proxy->SendRequest(static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_SET_GAMUT_MAP),
183         sendData, reply, option);
184     proxy->SendRequest(
185         static_cast<uint32_t>(DisplayManagerMessage::TRANS_ID_SCREEN_SET_COLOR_TRANSFORM),
186         sendData, reply, option);
187 }
188 
IPCInterfaceFuzzTest(const uint8_t * data,size_t size)189 bool IPCInterfaceFuzzTest(const uint8_t* data, size_t size)
190 {
191     int flags, waitTime;
192     if (data == nullptr || size < sizeof(flags) + sizeof(waitTime)) {
193         return false;
194     }
195     auto proxy = GetProxy();
196     if (proxy.first == nullptr || proxy.second == nullptr) {
197         return false;
198     }
199     size_t startPos = 0;
200     startPos += GetObject<int>(flags, data + startPos, size - startPos);
201     startPos += GetObject<int>(waitTime, data + startPos, size - startPos);
202     MessageParcel sendData;
203     MessageParcel reply;
204     MessageOption option(flags, waitTime);
205     sendData.WriteInterfaceToken(proxy.first->GetDescriptor());
206     uint32_t dataSize = (size - startPos) > 1024 * 1024 ? 1024 * 1024 : (size - startPos);
207     sendData.WriteBuffer(data + startPos, dataSize);
208     IPCSpecificInterfaceFuzzTest1(proxy.second, sendData, reply, option);
209     IPCSpecificInterfaceFuzzTest2(proxy.second, sendData, reply, option, proxy.first);
210     return true;
211 }
212 } // namespace.OHOS::Rosen
213 
214 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)215 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
216 {
217     /* Run your code on data */
218     OHOS::Rosen::IPCFuzzTest(data, size);
219     OHOS::Rosen::IPCInterfaceFuzzTest(data, size);
220     return 0;
221 }
222 
223