1 /*
2 * Copyright (c) 2022-2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "perusersession_fuzzer.h"
17
18 #define private public
19 #define protected public
20 #include "peruser_session.h"
21 #undef private
22
23 #include <cstddef>
24 #include <cstdint>
25 #include <memory>
26 #include <string_ex.h>
27
28 #include "global.h"
29 #include "i_input_method_agent.h"
30 #include "i_input_method_core.h"
31 #include "input_client_proxy.h"
32 #include "input_client_stub.h"
33 #include "input_method_ability.h"
34 #include "input_method_agent_proxy.h"
35 #include "input_method_agent_stub.h"
36 #include "input_method_core_proxy.h"
37 #include "input_method_core_stub.h"
38 #include "input_method_info.h"
39 #include "input_method_property.h"
40 #include "iremote_broker.h"
41 #include "message_parcel.h"
42 #include "input_method_types.h"
43
44 using namespace OHOS::MiscServices;
45 namespace OHOS {
46 constexpr size_t THRESHOLD = 10;
47 constexpr int32_t MAIN_USER_ID = 100;
48
ConvertToUint32(const uint8_t *ptr)49 uint32_t ConvertToUint32(const uint8_t *ptr)
50 {
51 if (ptr == nullptr) {
52 return 0;
53 }
54 uint32_t bigVar = (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]);
55 return bigVar;
56 }
57
InitializeClientInfo(InputClientInfo &clientInfo)58 bool InitializeClientInfo(InputClientInfo &clientInfo)
59 {
60 sptr<IInputClient> clientStub = new (std::nothrow) InputClientStub();
61 if (clientStub == nullptr) {
62 IMSA_HILOGE("failed to create client");
63 return false;
64 }
65 sptr<InputDeathRecipient> deathRecipient = new (std::nothrow) InputDeathRecipient();
66 if (deathRecipient == nullptr) {
67 IMSA_HILOGE("failed to new deathRecipient");
68 return false;
69 }
70 clientInfo = { .userID = MAIN_USER_ID, .client = clientStub, .deathRecipient = deathRecipient };
71 return true;
72 }
73
FuzzPerUserSession(const uint8_t *rawData, size_t size)74 bool FuzzPerUserSession(const uint8_t *rawData, size_t size)
75 {
76 Property property;
77 SubProperty subProperty;
78 InputClientInfo clientInfo;
79 if (!InitializeClientInfo(clientInfo)) {
80 return false;
81 }
82 auto client = iface_cast<IInputClient>(clientInfo.client->AsObject());
83 sptr<InputMethodCoreStub> coreStub = new (std::nothrow) InputMethodCoreStub();
84 if (coreStub == nullptr) {
85 return false;
86 }
87 auto core = iface_cast<IInputMethodCore>(coreStub->AsObject());
88 sptr<InputMethodAgentStub> agentStub = new (std::nothrow) InputMethodAgentStub();
89 if (agentStub == nullptr) {
90 return false;
91 }
92 auto agent = iface_cast<IInputMethodAgent>(agentStub);
93 static std::shared_ptr<PerUserSession> userSessions = std::make_shared<PerUserSession>(MAIN_USER_ID);
94
95 userSessions->OnRegisterProxyIme(core, agent->AsObject());
96 int32_t type = 4;
97 userSessions->OnUnRegisteredProxyIme(static_cast<UnRegisteredType>(type), core);
98 userSessions->IsProxyImeEnable();
99
100 userSessions->OnPrepareInput(clientInfo);
101 userSessions->OnSetCoreAndAgent(core, agent->AsObject());
102 userSessions->OnShowCurrentInput();
103 sptr<IRemoteObject> agentObject = nullptr;
104 clientInfo.isShowKeyboard = false;
105 userSessions->OnStartInput(clientInfo, agentObject);
106 clientInfo.isShowKeyboard = true;
107 userSessions->OnStartInput(clientInfo, agentObject);
108 userSessions->NotifyImeChangeToClients(property, subProperty);
109 userSessions->OnHideCurrentInput();
110 userSessions->OnHideInput(client);
111 userSessions->OnReleaseInput(client);
112 return true;
113 }
114 } // namespace OHOS
115 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)116 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
117 {
118 if (size < OHOS::THRESHOLD) {
119 return 0;
120 }
121 /* Run your code on data */
122 OHOS::FuzzPerUserSession(data, size);
123 return 0;
124 }