1eace7efcSopenharmony_ci/*
2eace7efcSopenharmony_ci * Copyright (c) 2024 Huawei Device Co., Ltd.
3eace7efcSopenharmony_ci * Licensed under the Apache License, Version 2.0 (the "License");
4eace7efcSopenharmony_ci * you may not use this file except in compliance with the License.
5eace7efcSopenharmony_ci * You may obtain a copy of the License at
6eace7efcSopenharmony_ci *
7eace7efcSopenharmony_ci *     http://www.apache.org/licenses/LICENSE-2.0
8eace7efcSopenharmony_ci *
9eace7efcSopenharmony_ci * Unless required by applicable law or agreed to in writing, software
10eace7efcSopenharmony_ci * distributed under the License is distributed on an "AS IS" BASIS,
11eace7efcSopenharmony_ci * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12eace7efcSopenharmony_ci * See the License for the specific language governing permissions and
13eace7efcSopenharmony_ci * limitations under the License.
14eace7efcSopenharmony_ci */
15eace7efcSopenharmony_ci
16eace7efcSopenharmony_ci#include "abilityautostartupservicea_fuzzer.h"
17eace7efcSopenharmony_ci
18eace7efcSopenharmony_ci#include <cstddef>
19eace7efcSopenharmony_ci#include <cstdint>
20eace7efcSopenharmony_ci
21eace7efcSopenharmony_ci#define private public
22eace7efcSopenharmony_ci#define protected public
23eace7efcSopenharmony_ci#include "ability_auto_startup_service.h"
24eace7efcSopenharmony_ci#undef protected
25eace7efcSopenharmony_ci#undef private
26eace7efcSopenharmony_ci
27eace7efcSopenharmony_ci#include "ability_record.h"
28eace7efcSopenharmony_ci
29eace7efcSopenharmony_ciusing namespace OHOS::AAFwk;
30eace7efcSopenharmony_ciusing namespace OHOS::AppExecFwk;
31eace7efcSopenharmony_ciusing namespace OHOS::AbilityRuntime;
32eace7efcSopenharmony_ci
33eace7efcSopenharmony_cinamespace OHOS {
34eace7efcSopenharmony_cinamespace {
35eace7efcSopenharmony_ciconstexpr int INPUT_ZERO = 0;
36eace7efcSopenharmony_ciconstexpr int INPUT_ONE = 1;
37eace7efcSopenharmony_ciconstexpr int INPUT_THREE = 3;
38eace7efcSopenharmony_ciconstexpr size_t FOO_MAX_LEN = 1024;
39eace7efcSopenharmony_ciconstexpr size_t U32_AT_SIZE = 4;
40eace7efcSopenharmony_ciconstexpr uint8_t ENABLE = 2;
41eace7efcSopenharmony_ciconstexpr size_t OFFSET_ZERO = 24;
42eace7efcSopenharmony_ciconstexpr size_t OFFSET_ONE = 16;
43eace7efcSopenharmony_ciconstexpr size_t OFFSET_TWO = 8;
44eace7efcSopenharmony_ci}
45eace7efcSopenharmony_ci
46eace7efcSopenharmony_ciuint32_t GetU32Data(const char* ptr)
47eace7efcSopenharmony_ci{
48eace7efcSopenharmony_ci    // convert fuzz input data to an integer
49eace7efcSopenharmony_ci    return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
50eace7efcSopenharmony_ci        ptr[INPUT_THREE];
51eace7efcSopenharmony_ci}
52eace7efcSopenharmony_ci
53eace7efcSopenharmony_cisptr<Token> GetFuzzAbilityToken()
54eace7efcSopenharmony_ci{
55eace7efcSopenharmony_ci    sptr<Token> token = nullptr;
56eace7efcSopenharmony_ci    AbilityRequest abilityRequest;
57eace7efcSopenharmony_ci    abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
58eace7efcSopenharmony_ci    abilityRequest.abilityInfo.name = "MainAbility";
59eace7efcSopenharmony_ci    abilityRequest.abilityInfo.type = AbilityType::DATA;
60eace7efcSopenharmony_ci    std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
61eace7efcSopenharmony_ci    if (abilityRecord) {
62eace7efcSopenharmony_ci        token = abilityRecord->GetToken();
63eace7efcSopenharmony_ci    }
64eace7efcSopenharmony_ci    return token;
65eace7efcSopenharmony_ci}
66eace7efcSopenharmony_ci
67eace7efcSopenharmony_civoid AbilityStartupServiceFuzztest(bool boolParam, std::string &stringParam, int32_t int32Param)
68eace7efcSopenharmony_ci{
69eace7efcSopenharmony_ci    std::shared_ptr<AbilityAutoStartupService> service = std::make_shared<AbilityAutoStartupService>();
70eace7efcSopenharmony_ci    sptr<IRemoteObject> token1 = GetFuzzAbilityToken();
71eace7efcSopenharmony_ci    service->RegisterAutoStartupSystemCallback(token1); // branch
72eace7efcSopenharmony_ci    service->RegisterAutoStartupSystemCallback(token1); // branch duplicate regist
73eace7efcSopenharmony_ci    service->UnregisterAutoStartupSystemCallback(token1); // branch
74eace7efcSopenharmony_ci    sptr<IRemoteObject> token2 = GetFuzzAbilityToken();
75eace7efcSopenharmony_ci    service->UnregisterAutoStartupSystemCallback(token2); // branch unregister not exist.
76eace7efcSopenharmony_ci
77eace7efcSopenharmony_ci    AutoStartupInfo info;
78eace7efcSopenharmony_ci    info.bundleName = "com.example.fuzzTest";
79eace7efcSopenharmony_ci    info.moduleName = "stringParam";
80eace7efcSopenharmony_ci    info.abilityName = "MainAbility";
81eace7efcSopenharmony_ci    info.appCloneIndex = int32Param;
82eace7efcSopenharmony_ci    info.accessTokenId = "accessTokenId";
83eace7efcSopenharmony_ci    info.userId = int32Param;
84eace7efcSopenharmony_ci    service->SetApplicationAutoStartup(info);
85eace7efcSopenharmony_ci    service->InnerSetApplicationAutoStartup(info);
86eace7efcSopenharmony_ci    service->CancelApplicationAutoStartup(info);
87eace7efcSopenharmony_ci
88eace7efcSopenharmony_ci    std::vector<AutoStartupInfo> vecs;
89eace7efcSopenharmony_ci    vecs.emplace_back(info);
90eace7efcSopenharmony_ci    service->QueryAllAutoStartupApplications(vecs, int32Param);
91eace7efcSopenharmony_ci    service->QueryAllAutoStartupApplicationsWithoutPermission(vecs, int32Param);
92eace7efcSopenharmony_ci    service->DeleteAutoStartupData(stringParam, int32Param);
93eace7efcSopenharmony_ci    service->CheckAutoStartupData(stringParam, int32Param);
94eace7efcSopenharmony_ci    service->ExecuteCallbacks(boolParam, info);
95eace7efcSopenharmony_ci}
96eace7efcSopenharmony_ci
97eace7efcSopenharmony_cibool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
98eace7efcSopenharmony_ci{
99eace7efcSopenharmony_ci    bool boolParam = *data % ENABLE;
100eace7efcSopenharmony_ci    std::string stringParam(data, size);
101eace7efcSopenharmony_ci    int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
102eace7efcSopenharmony_ci    AbilityStartupServiceFuzztest(boolParam, stringParam, int32Param);
103eace7efcSopenharmony_ci    return true;
104eace7efcSopenharmony_ci}
105eace7efcSopenharmony_ci}
106eace7efcSopenharmony_ci
107eace7efcSopenharmony_ci/* Fuzzer entry point */
108eace7efcSopenharmony_ciextern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
109eace7efcSopenharmony_ci{
110eace7efcSopenharmony_ci    /* Run your code on data */
111eace7efcSopenharmony_ci    if (data == nullptr) {
112eace7efcSopenharmony_ci        return 0;
113eace7efcSopenharmony_ci    }
114eace7efcSopenharmony_ci
115eace7efcSopenharmony_ci    /* Validate the length of size */
116eace7efcSopenharmony_ci    if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
117eace7efcSopenharmony_ci        return 0;
118eace7efcSopenharmony_ci    }
119eace7efcSopenharmony_ci
120eace7efcSopenharmony_ci    char* ch = (char*)malloc(size + 1);
121eace7efcSopenharmony_ci    if (ch == nullptr) {
122eace7efcSopenharmony_ci        std::cout << "malloc failed." << std::endl;
123eace7efcSopenharmony_ci        return 0;
124eace7efcSopenharmony_ci    }
125eace7efcSopenharmony_ci
126eace7efcSopenharmony_ci    (void)memset_s(ch, size + 1, 0x00, size + 1);
127eace7efcSopenharmony_ci    if (memcpy_s(ch, size, data, size) != EOK) {
128eace7efcSopenharmony_ci        std::cout << "copy failed." << std::endl;
129eace7efcSopenharmony_ci        free(ch);
130eace7efcSopenharmony_ci        ch = nullptr;
131eace7efcSopenharmony_ci        return 0;
132eace7efcSopenharmony_ci    }
133eace7efcSopenharmony_ci
134eace7efcSopenharmony_ci    OHOS::DoSomethingInterestingWithMyAPI(ch, size);
135eace7efcSopenharmony_ci    free(ch);
136eace7efcSopenharmony_ci    ch = nullptr;
137eace7efcSopenharmony_ci    return 0;
138eace7efcSopenharmony_ci}
139eace7efcSopenharmony_ci
140