1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "cacheprocessmanagera_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 
21 #define private public
22 #define protected public
23 #include "cache_process_manager.h"
24 #include "ability_record.h"
25 #undef protected
26 #undef private
27 
28 #include "app_mgr_service_inner.h"
29 
30 using namespace OHOS::AAFwk;
31 using namespace OHOS::AppExecFwk;
32 using namespace OHOS::AbilityRuntime;
33 
34 namespace OHOS {
35 namespace {
36 constexpr int INPUT_ZERO = 0;
37 constexpr int INPUT_ONE = 1;
38 constexpr int INPUT_THREE = 3;
39 constexpr size_t FOO_MAX_LEN = 1024;
40 constexpr size_t U32_AT_SIZE = 4;
41 constexpr uint8_t ENABLE = 2;
42 constexpr size_t OFFSET_ZERO = 24;
43 constexpr size_t OFFSET_ONE = 16;
44 constexpr size_t OFFSET_TWO = 8;
45 }
46 
GetU32Data(const char* ptr)47 uint32_t GetU32Data(const char* ptr)
48 {
49     // convert fuzz input data to an integer
50     return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
51         ptr[INPUT_THREE];
52 }
53 
GetFuzzAbilityToken()54 sptr<Token> GetFuzzAbilityToken()
55 {
56     sptr<Token> token = nullptr;
57     AbilityRequest abilityRequest;
58     abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
59     abilityRequest.abilityInfo.name = "MainAbility";
60     abilityRequest.abilityInfo.type = AbilityType::DATA;
61     std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
62     if (abilityRecord) {
63         token = abilityRecord->GetToken();
64     }
65     return token;
66 }
67 
CacheProcessManagerFuzztestFunc1(bool boolParam, std::string &stringParam, int32_t int32Param)68 void CacheProcessManagerFuzztestFunc1(bool boolParam, std::string &stringParam, int32_t int32Param)
69 {
70     std::shared_ptr<CacheProcessManager> mgr = std::make_shared<CacheProcessManager>();
71     std::shared_ptr<AppMgrServiceInner> serviceInner1;
72     mgr->SetAppMgr(serviceInner1); // null mgr
73     mgr->RefreshCacheNum(); // called.
74     mgr->QueryEnableProcessCache(); // called.
75     mgr->maxProcCacheNum_ = 0;
76     mgr->PenddingCacheProcess(nullptr); // called.
77     mgr->maxProcCacheNum_ = int32Param;
78 
79     std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
80     std::shared_ptr<AppRunningRecord> appRecord1 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
81     mgr->PenddingCacheProcess(nullptr); // nullptr
82     appRecord1->isKeepAliveRdb_ = true;
83     appRecord1->isKeepAliveBundle_ = true;
84     appRecord1->isSingleton_ = true;
85     appRecord1->isMainProcess_ = true;
86     mgr->PenddingCacheProcess(appRecord1); // keepalive
87     std::shared_ptr<AppRunningRecord> appRecord2 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
88     mgr->PenddingCacheProcess(appRecord2); // not alive
89 
90     mgr->maxProcCacheNum_ = 0;
91     mgr->CheckAndCacheProcess(nullptr); // nullptr
92     mgr->maxProcCacheNum_ = int32Param;
93     mgr->CheckAndCacheProcess(appRecord2); // not cached
94     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
95     mgr->CheckAndCacheProcess(appRecord2); // cached
96 
97     mgr->CheckAndNotifyCachedState(nullptr);
98     std::shared_ptr<AppMgrServiceInner> serviceInner = std::make_shared<AppMgrServiceInner>();
99     mgr->SetAppMgr(serviceInner);
100     mgr->CheckAndNotifyCachedState(appRecord2); // appMgr not null
101 }
102 
CacheProcessManagerFuzztestFunc2(bool boolParam, std::string &stringParam, int32_t int32Param)103 void CacheProcessManagerFuzztestFunc2(bool boolParam, std::string &stringParam, int32_t int32Param)
104 {
105     std::shared_ptr<CacheProcessManager> mgr = std::make_shared<CacheProcessManager>();
106     std::shared_ptr<AppMgrServiceInner> serviceInner1;
107     mgr->SetAppMgr(serviceInner1);
108     mgr->IsCachedProcess(nullptr); // called.
109     std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
110     std::shared_ptr<AppRunningRecord> appRecord2 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
111     mgr->IsCachedProcess(appRecord2); // not cached called.
112     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
113     mgr->IsCachedProcess(appRecord2); // cached called.
114     mgr->cachedAppRecordQueue_.clear(); // clear
115 
116     mgr->maxProcCacheNum_ = int32Param;
117     mgr->OnProcessKilled(nullptr); // nullptr called.
118     mgr->OnProcessKilled(appRecord2); // not cached called.
119     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
120     mgr->OnProcessKilled(appRecord2); // cached called.
121     mgr->cachedAppRecordQueue_.clear(); // clear
122 
123     mgr->maxProcCacheNum_ = int32Param;
124     mgr->ReuseCachedProcess(nullptr);
125     mgr->ReuseCachedProcess(appRecord2); // not cached
126     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
127     mgr->ReuseCachedProcess(appRecord2); // cached
128     mgr->cachedAppRecordQueue_.clear(); // clear
129 
130     std::shared_ptr<AppMgrServiceInner> serviceInner = std::make_shared<AppMgrServiceInner>();
131     mgr->SetAppMgr(serviceInner); // appInner not null
132     mgr->cachedAppRecordQueue_.emplace_back(appRecord2);
133     mgr->ReuseCachedProcess(appRecord2); // cached
134 
135     mgr->IsAppSupportProcessCache(nullptr); // null ptr check
136     std::shared_ptr<AppRunningRecord> appRecord3 = std::make_shared<AppRunningRecord>(nullptr, int32Param, stringParam);
137     mgr->IsAppSupportProcessCache(appRecord3); // null appInfo
138     mgr->srvExtRecords.emplace(appRecord2);
139     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null
140     mgr->srvExtRecords.clear();
141 
142     appRecord2->SetAttachedToStatusBar(true);
143     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null &attached true
144     appRecord2->SetAttachedToStatusBar(false);
145     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null &attached false
146     appRecord2->isKeepAliveRdb_ = true;
147     appRecord2->isKeepAliveBundle_ = true;
148     appRecord2->isSingleton_ = true;
149     appRecord2->isMainProcess_ = true;
150     mgr->IsAppSupportProcessCache(appRecord2); // appInfo not null &attached false & keepalive called
151 }
152 
CacheProcessManagerFuzztestFunc3(bool boolParam, std::string &stringParam, int32_t int32Param)153 void CacheProcessManagerFuzztestFunc3(bool boolParam, std::string &stringParam, int32_t int32Param)
154 {
155     std::shared_ptr<CacheProcessManager> mgr = std::make_shared<CacheProcessManager>();
156     std::shared_ptr<AppMgrServiceInner> serviceInner1;
157     mgr->SetAppMgr(serviceInner1);
158     mgr->IsAppSupportProcessCacheInnerFirst(nullptr); // nullptr
159     std::shared_ptr<ApplicationInfo> appInfo = std::make_shared<ApplicationInfo>();
160     std::shared_ptr<AppRunningRecord> appRecord1 = std::make_shared<AppRunningRecord>(appInfo, int32Param, stringParam);
161     mgr->shouldCheckSupport = true;
162     appRecord1->procCacheSupportState_ = SupportProcessCacheState::UNSPECIFIED;
163     mgr->IsAppSupportProcessCacheInnerFirst(appRecord1); // case CacheState UNSPECIFIED
164     appRecord1->procCacheSupportState_ = SupportProcessCacheState::SUPPORT;
165     mgr->IsAppSupportProcessCacheInnerFirst(appRecord1); // case CacheState SUPPORT
166     appRecord1->procCacheSupportState_ = SupportProcessCacheState::NOT_SUPPORT;
167     mgr->IsAppSupportProcessCacheInnerFirst(appRecord1); // case CacheState SUPPORT
168     int32_t num = static_cast<int32_t>(SupportProcessCacheState::NOT_SUPPORT) + 1;
169     appRecord1->procCacheSupportState_ = static_cast<SupportProcessCacheState>(num);
170     mgr->IsAppSupportProcessCacheInnerFirst(appRecord1); // case CacheState default branch
171 
172     mgr->shouldCheckSupport = false;
173     appRecord1->procCacheSupportState_ = SupportProcessCacheState::UNSPECIFIED;
174     mgr->IsAppSupportProcessCacheInnerFirst(appRecord1); // case CacheState UNSPECIFIED
175 
176     mgr->IsAppShouldCache(nullptr); // called.
177     mgr->maxProcCacheNum_ = int32Param;
178     mgr->IsAppShouldCache(appRecord1); // not ccached called.
179     mgr->cachedAppRecordQueue_.emplace_back(appRecord1);
180     mgr->IsAppShouldCache(appRecord1); //ccached called.
181 
182     mgr->IsAppAbilitiesEmpty(nullptr); // called
183     mgr->IsAppAbilitiesEmpty(appRecord1); // called
184 }
185 
DoSomethingInterestingWithMyAPI(const char* data, size_t size)186 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
187 {
188     bool boolParam = *data % ENABLE;
189     std::string stringParam(data, size);
190     int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
191     CacheProcessManagerFuzztestFunc1(boolParam, stringParam, int32Param);
192     CacheProcessManagerFuzztestFunc2(boolParam, stringParam, int32Param);
193     CacheProcessManagerFuzztestFunc3(boolParam, stringParam, int32Param);
194     return true;
195 }
196 }
197 
198 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)199 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
200 {
201     /* Run your code on data */
202     if (data == nullptr) {
203         return 0;
204     }
205 
206     /* Validate the length of size */
207     if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
208         return 0;
209     }
210 
211     char* ch = (char*)malloc(size + 1);
212     if (ch == nullptr) {
213         std::cout << "malloc failed." << std::endl;
214         return 0;
215     }
216 
217     (void)memset_s(ch, size + 1, 0x00, size + 1);
218     if (memcpy_s(ch, size, data, size) != EOK) {
219         std::cout << "copy failed." << std::endl;
220         free(ch);
221         ch = nullptr;
222         return 0;
223     }
224 
225     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
226     free(ch);
227     ch = nullptr;
228     return 0;
229 }
230 
231