1/* 2 * Copyright (c) 2022 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 16#include "abilitycontext_fuzzer.h" 17 18#include <cstddef> 19#include <cstdint> 20 21#include "ability_record.h" 22#define private public 23#include "fa_ability_context.h" 24#undef private 25#include "want.h" 26#include "parcel.h" 27#include "securec.h" 28 29using namespace OHOS::AAFwk; 30using namespace OHOS::AppExecFwk; 31 32namespace OHOS { 33namespace { 34constexpr int INPUT_ZERO = 0; 35constexpr int INPUT_ONE = 1; 36constexpr int INPUT_TWO = 2; 37constexpr int INPUT_THREE = 3; 38constexpr size_t FOO_MAX_LEN = 1024; 39constexpr size_t OFFSET_ZERO = 24; 40constexpr size_t OFFSET_ONE = 16; 41constexpr size_t OFFSET_TWO = 8; 42constexpr size_t U32_AT_SIZE = 4; 43} 44uint32_t GetU32Data(const char* ptr) 45{ 46 // convert fuzz input data to an integer 47 return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[INPUT_TWO] << OFFSET_TWO) | 48 ptr[INPUT_THREE]; 49} 50sptr<Token> GetFuzzAbilityToken() 51{ 52 sptr<Token> token = nullptr; 53 54 AbilityRequest abilityRequest; 55 abilityRequest.appInfo.bundleName = "com.example.fuzzTest"; 56 abilityRequest.abilityInfo.name = "MainAbility"; 57 abilityRequest.abilityInfo.type = AbilityType::PAGE; 58 std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest); 59 if (abilityRecord) { 60 token = abilityRecord->GetToken(); 61 } 62 63 return token; 64} 65bool DoSomethingInterestingWithMyAPI(const char* data, size_t size) 66{ 67 AbilityContext abilityContext; 68 // fuzz for want 69 Parcel wantParcel; 70 Want* want = nullptr; 71 if (wantParcel.WriteBuffer(data, size)) { 72 want = Want::Unmarshalling(wantParcel); 73 if (!want) { 74 return false; 75 } 76 } 77 int requestCode = static_cast<int>(GetU32Data(data)); 78 abilityContext.StartAbility(*want, requestCode); 79 sptr<AAFwk::IAbilityConnection> conn = nullptr; 80 abilityContext.ConnectAbility(*want, conn); 81 abilityContext.StopAbility(*want); 82 std::string name(data, size); 83 int mode = static_cast<int>(GetU32Data(data)); 84 abilityContext.GetDir(name, mode); 85 std::string bundleName(data, size); 86 int flag = static_cast<int>(GetU32Data(data)); 87 int accountId = static_cast<int>(GetU32Data(data)); 88 abilityContext.CreateBundleContext(bundleName, flag, accountId); 89 std::string permission(data, size); 90 int pid = static_cast<int>(GetU32Data(data)); 91 int uid = static_cast<int>(GetU32Data(data)); 92 abilityContext.VerifyPermission(permission, pid, uid); 93 std::string permissionName(data, size); 94 std::string des(data, size); 95 abilityContext.GetPermissionDes(permissionName, des); 96 std::vector<std::string> permissions; 97 std::string fileName(data, size); 98 std::string deviceId(data, size); 99 std::string abilityName(data, size); 100 std::string moduleName(data, size); 101 abilityContext.SetCallingContext(deviceId, bundleName, abilityName, moduleName); 102 std::shared_ptr<ContextDeal> base = nullptr; 103 abilityContext.AttachBaseContext(base); 104 std::string type(data, size); 105 abilityContext.GetExternalFilesDir(type); 106 std::string url(data, size); 107 Uri uri = Uri(url); 108 abilityContext.UnauthUriPermission(permission, uri, uid); 109 int patternId = static_cast<int>(GetU32Data(data)); 110 abilityContext.SetPattern(patternId); 111 BundleInfo bundleInfo; 112 std::shared_ptr<ContextDeal> deal = nullptr; 113 abilityContext.InitResourceManager(bundleInfo, deal); 114 int resId = static_cast<int>(GetU32Data(data)); 115 abilityContext.GetString(resId); 116 abilityContext.GetStringArray(resId); 117 abilityContext.GetIntArray(resId); 118 int themeId = static_cast<int>(GetU32Data(data)); 119 abilityContext.SetTheme(themeId); 120 abilityContext.GetColor(resId); 121 abilityContext.SetColorMode(mode); 122 std::vector<AAFwk::Want> wants; 123 abilityContext.StartAbilities(wants); 124 if (want) { 125 delete want; 126 want = nullptr; 127 } 128 return (abilityContext.DisconnectAbility(conn) == 0); 129} 130} 131 132/* Fuzzer entry point */ 133extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) 134{ 135 /* Run your code on data */ 136 if (data == nullptr) { 137 std::cout << "invalid data" << std::endl; 138 return 0; 139 } 140 141 /* Validate the length of size */ 142 if (size > OHOS::FOO_MAX_LEN || size < OHOS::U32_AT_SIZE) { 143 return 0; 144 } 145 146 char* ch = (char*)malloc(size + 1); 147 if (ch == nullptr) { 148 std::cout << "malloc failed." << std::endl; 149 return 0; 150 } 151 152 (void)memset_s(ch, size + 1, 0x00, size + 1); 153 if (memcpy_s(ch, size, data, size) != EOK) { 154 std::cout << "copy failed." << std::endl; 155 free(ch); 156 ch = nullptr; 157 return 0; 158 } 159 160 OHOS::DoSomethingInterestingWithMyAPI(ch, size); 161 free(ch); 162 ch = nullptr; 163 return 0; 164} 165 166