1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "sessioninterface_fuzzer.h"
17 
18 #include <iremote_broker.h>
19 
20 #include "ability_context_impl.h"
21 #include "session_manager.h"
22 #include "window_manager_hilog.h"
23 #include "window_scene_session_impl.h"
24 #include "zidl/session_ipc_interface_code.h"
25 #include "zidl/session_proxy.h"
26 #include "data_source.h"
27 
28 namespace OHOS::Rosen {
29 namespace {
30 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "SessionInterfaceFuzzTest"};
31 }
32 
33 static std::shared_ptr<AbilityRuntime::AbilityContext> abilityContext =
34     std::make_shared<AbilityRuntime::AbilityContextImpl>();
35 static sptr<WindowSessionImpl> savedWindow;
36 
GetProxy()37 std::pair<sptr<ISession>, sptr<IRemoteObject>> GetProxy()
38 {
39     if (savedWindow) {
40         savedWindow->Destroy();
41         savedWindow = nullptr;
42     }
43 
44     sptr<WindowOption> option = new WindowOption();
45     option->SetWindowName("SessionInterfaceFuzzTest");
46     option->SetWindowType(WindowType::WINDOW_TYPE_WALLPAPER);
47 
48     sptr<WindowSessionImpl> window = new WindowSceneSessionImpl(option);
49     WMError err = window->Create(abilityContext, nullptr);
50     if (err != WMError::WM_OK) {
51         WLOGFE("Failed to create window: %{public}d", static_cast<int>(err));
52         return {nullptr, nullptr};
53     }
54 
55     auto session = window->GetHostSession();
56     if (!session) {
57         WLOGFE("Session is nullptr");
58         return {nullptr, nullptr};
59     }
60 
61     sptr<SessionProxy> proxy = new SessionProxy(session->AsObject());
62     savedWindow = window;
63 
64     WLOGFD("GetProxy success");
65 
66     return {proxy, session->AsObject()};
67 }
68 
69 template<class T>
UnmarshallingDataTo(const uint8_t * data,size_t size)70 T* UnmarshallingDataTo(const uint8_t* data, size_t size)
71 {
72     MessageParcel parcel;
73     if (data) {
74         parcel.WriteBuffer(data, size);
75     }
76     return T::Unmarshalling(parcel);
77 }
78 
IPCFuzzTest(const uint8_t * data,size_t size)79 void IPCFuzzTest(const uint8_t* data, size_t size)
80 {
81     auto [proxy, remoteObject] = GetProxy();
82     if (!proxy || !remoteObject) {
83         return;
84     }
85 
86     DataSource source(data, size);
87     uint32_t code = source.GetObject<uint32_t>();
88     int flags = source.GetObject<int>();
89     int waitTime = source.GetObject<int>();
90 
91     MessageParcel sendData;
92     MessageParcel reply;
93     MessageOption option(flags, waitTime);
94     auto rawSize = source.size_ - source.pos_;
95     auto buf = source.GetRaw(rawSize);
96     if (buf) {
97         sendData.WriteBuffer(buf, rawSize);
98     }
99     remoteObject->SendRequest(code, sendData, reply, option);
100 }
101 
IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)102 void IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
103     MessageOption& option)
104 {
105     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_CONNECT),
106         sendData, reply, option);
107     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_FOREGROUND),
108         sendData, reply, option);
109     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_BACKGROUND),
110         sendData, reply, option);
111     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_DISCONNECT),
112         sendData, reply, option);
113     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SESSION_EVENT),
114         sendData, reply, option);
115     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SYNC_SESSION_EVENT),
116         sendData, reply, option);
117     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_SESSION_RECT),
118         sendData, reply, option);
119     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_RAISE_TO_APP_TOP),
120         sendData, reply, option);
121     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_BACKPRESSED),
122         sendData, reply, option);
123     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_MARK_PROCESSED),
124         sendData, reply, option);
125     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_MAXIMIZE_MODE),
126         sendData, reply, option);
127     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_GET_MAXIMIZE_MODE),
128         sendData, reply, option);
129 }
130 
IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy,MessageParcel & sendData,MessageParcel & reply,MessageOption & option)131 void IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
132     MessageOption& option)
133 {
134     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_NEED_AVOID),
135         sendData, reply, option);
136     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_GET_AVOID_AREA),
137         sendData, reply, option);
138     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_ASPECT_RATIO),
139         sendData, reply, option);
140     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_WINDOW_ANIMATION_FLAG),
141         sendData, reply, option);
142     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_CUSTOM_ANIMATION),
143         sendData, reply, option);
144     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_RAISE_ABOVE_TARGET),
145         sendData, reply, option);
146     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_ACTIVE_PENDING_SESSION),
147         sendData, reply, option);
148     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TERMINATE),
149         sendData, reply, option);
150     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_EXCEPTION),
151         sendData, reply, option);
152     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TRANSFER_ABILITY_RESULT),
153         sendData, reply, option);
154     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TRANSFER_EXTENSION_DATA),
155         sendData, reply, option);
156     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_NOTIFY_EXTENSION_DIED),
157         sendData, reply, option);
158     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_WINDOW_RECT_AUTO_SAVE),
159         sendData, reply, option);
160 }
161 
IPCInterfaceFuzzTest(const uint8_t * data,size_t size)162 void IPCInterfaceFuzzTest(const uint8_t* data, size_t size)
163 {
164     auto [proxy, remoteObject] = GetProxy();
165     if (!proxy || !remoteObject) {
166         return;
167     }
168 
169     DataSource source(data, size);
170     int flags = source.GetObject<int>();
171     int waitTime = source.GetObject<int>();
172 
173     MessageParcel sendData;
174     MessageParcel reply;
175     MessageOption option(flags, waitTime);
176     sendData.WriteInterfaceToken(proxy->GetDescriptor());
177     auto rawSize = source.size_ - source.pos_;
178     auto buf = source.GetRaw(rawSize);
179     if (buf) {
180         sendData.WriteBuffer(buf, rawSize);
181     }
182     IPCSpecificInterfaceFuzzTest1(remoteObject, sendData, reply, option);
183     IPCSpecificInterfaceFuzzTest2(remoteObject, sendData, reply, option);
184 }
185 
ProxyInterfaceFuzzTestPart1(const uint8_t * data,size_t size)186 void ProxyInterfaceFuzzTestPart1(const uint8_t* data, size_t size)
187 {
188     auto [proxy, remoteObject] = GetProxy();
189     if (!proxy || !remoteObject) {
190         return;
191     }
192 
193     DataSource source(data, size);
194 
195     sptr<WindowSessionProperty> property = UnmarshallingDataTo<WindowSessionProperty>(data, size);
196     proxy->Foreground(property);
197     proxy->Background();
198     proxy->RaiseToAppTop();
199 
200     SessionEvent event = source.GetObject<SessionEvent>();
201     proxy->OnSessionEvent(event);
202 
203     WSRect rect = source.GetObject<WSRect>();
204     SizeChangeReason reason = source.GetObject<SizeChangeReason>();
205     proxy->UpdateSessionRect(rect, reason);
206 
207     bool needMoveToBackground = source.GetObject<bool>();
208     proxy->RequestSessionBack(needMoveToBackground);
209 }
210 
ProxyInterfaceFuzzTestPart2(const uint8_t * data,size_t size)211 void ProxyInterfaceFuzzTestPart2(const uint8_t* data, size_t size)
212 {
213     auto [proxy, remoteObject] = GetProxy();
214     if (!proxy || !remoteObject) {
215         return;
216     }
217 
218     DataSource source(data, size);
219 
220     int32_t eventId = source.GetObject<int32_t>();
221     proxy->MarkProcessed(eventId);
222 
223     MaximizeMode mode = source.GetObject<MaximizeMode>();
224     proxy->SetGlobalMaximizeMode(mode);
225     proxy->GetGlobalMaximizeMode(mode);
226 
227     bool status = source.GetObject<bool>();
228     proxy->OnNeedAvoid(status);
229 
230     AvoidAreaType type = source.GetObject<AvoidAreaType>();
231     proxy->GetAvoidAreaByType(type);
232 
233     float ratio = source.GetObject<float>();
234     proxy->SetAspectRatio(ratio);
235 
236     bool needDefaultAnimationFlag = source.GetObject<bool>();
237     proxy->UpdateWindowAnimationFlag(needDefaultAnimationFlag);
238 
239     bool isAdd = source.GetObject<bool>();
240     proxy->UpdateWindowSceneAfterCustomAnimation(isAdd);
241 }
242 
ProxyInterfaceFuzzTestPart3(const uint8_t * data,size_t size)243 void ProxyInterfaceFuzzTestPart3(const uint8_t* data, size_t size)
244 {
245     auto [proxy, remoteObject] = GetProxy();
246     if (!proxy || !remoteObject) {
247         return;
248     }
249 
250     DataSource source(data, size);
251 
252     int32_t subWindowId = source.GetObject<int32_t>();
253     proxy->RaiseAboveTarget(subWindowId);
254 
255     sptr<AAFwk::SessionInfo> sessionInfo = UnmarshallingDataTo<AAFwk::SessionInfo>(data, size);
256     proxy->PendingSessionActivation(sessionInfo);
257     proxy->TerminateSession(sessionInfo);
258     proxy->NotifySessionException(sessionInfo);
259 
260     uint32_t resultCode = source.GetObject<uint32_t>();
261     sptr<AAFwk::Want> want = UnmarshallingDataTo<AAFwk::Want>(data, size);
262     proxy->TransferAbilityResult(resultCode, *want);
263 
264     sptr<AAFwk::WantParams> wantParams = UnmarshallingDataTo<AAFwk::WantParams>(data, size);
265     proxy->TransferExtensionData(*wantParams);
266     proxy->NotifyExtensionDied();
267     int32_t errorCode = 1;
268     proxy->NotifyExtensionTimeout(errorCode);
269 }
270 
ProxyInterfaceFuzzTest(const uint8_t * data,size_t size)271 void ProxyInterfaceFuzzTest(const uint8_t* data, size_t size)
272 {
273     ProxyInterfaceFuzzTestPart1(data, size);
274     ProxyInterfaceFuzzTestPart2(data, size);
275     ProxyInterfaceFuzzTestPart3(data, size);
276 }
277 }
278 
279 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)280 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
281 {
282     /* Run your code on data */
283     OHOS::Rosen::IPCFuzzTest(data, size);
284     OHOS::Rosen::IPCInterfaceFuzzTest(data, size);
285     OHOS::Rosen::ProxyInterfaceFuzzTest(data, size);
286     return 0;
287 }
288