1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "accessibleabilitymanagerservicestub_fuzzer.h"
17 
18 #include "accessibility_ipc_interface_code.h"
19 #include "accessible_ability_manager_service_stub.h"
20 #include "securec.h"
21 
22 namespace OHOS {
23 namespace Accessibility {
24 namespace {
25 constexpr size_t FOO_MAX_LEN = 1024;
26 constexpr size_t U32_AT_SIZE = 4;
27 constexpr size_t BASE_CODE = 800;
28 constexpr size_t MESSAGE_SIZE = 66;
29 constexpr size_t FUZZ_NUM1 = 1;
30 constexpr size_t FUZZ_NUM2 = 2;
31 constexpr size_t FUZZ_NUM3 = 3;
32 constexpr size_t FUZZ_NUM8 = 8;
33 constexpr size_t FUZZ_NUM16 = 16;
34 constexpr size_t FUZZ_NUM24 = 24;
35 constexpr uint8_t DEVISOR_TWO = 2;
36 } // namespace
37 
38 class AccessibleAbilityManagerServiceStubFuzzTest : public AccessibleAbilityManagerServiceStub {
39 public:
40     AccessibleAbilityManagerServiceStubFuzzTest() = default;
41     ~AccessibleAbilityManagerServiceStubFuzzTest() = default;
42 
43     RetError SendEvent(const AccessibilityEventInfo &uiEvent, const int32_t flag) override
44     {
45         return RET_OK;
46     }
47 
48     uint32_t RegisterStateObserver(const sptr<IAccessibleAbilityManagerStateObserver> &callback) override
49     {
50         return 0;
51     }
52 
53     uint32_t RegisterCaptionObserver(const sptr<IAccessibleAbilityManagerCaptionObserver> &callback) override
54     {
55         return 0;
56     }
57 
58     void RegisterEnableAbilityListsObserver(const sptr<IAccessibilityEnableAbilityListsObserver> &observer) override
59     {
60     }
61 
62     RetError GetAbilityList(
63         const uint32_t abilityTypes, const int32_t stateType, std::vector<AccessibilityAbilityInfo> &infos) override
64     {
65         return RET_OK;
66     }
67 
68     RetError RegisterElementOperator(
69         const int32_t windowId, const sptr<IAccessibilityElementOperator> &operation, bool isApp = false) override
70     {
71         return RET_OK;
72     }
73 
74     RetError RegisterElementOperator(
75         Registration parameter, const sptr<IAccessibilityElementOperator> &operation, bool isApp = false) override
76     {
77         return RET_OK;
78     }
79 
80     RetError DeregisterElementOperator(const int32_t windowId) override
81     {
82         return RET_OK;
83     }
84 
85     RetError DeregisterElementOperator(const int32_t windowId, const int32_t treeId) override
86     {
87         return RET_OK;
88     }
89 
90     RetError GetCaptionProperty(AccessibilityConfig::CaptionProperty &caption) override
91     {
92         return RET_OK;
93     }
94     bool GetEnabledState() override
95     {
96         return true;
97     }
98     RetError GetCaptionState(bool &state) override
99     {
100         return RET_OK;
101     }
102     bool GetTouchGuideState() override
103     {
104         return true;
105     }
106     bool GetGestureState() override
107     {
108         return true;
109     }
110     bool GetKeyEventObserverState() override
111     {
112         return true;
113     }
114 
115     RetError SetCaptionProperty(const AccessibilityConfig::CaptionProperty &caption) override
116     {
117         return RET_OK;
118     }
119     RetError SetCaptionState(const bool state) override
120     {
121         return RET_OK;
122     }
123 
124     RetError EnableAbility(const std::string &name, const uint32_t capabilities) override
125     {
126         return RET_OK;
127     }
128     RetError GetEnabledAbilities(std::vector<std::string> &enabledAbilities) override
129     {
130         return RET_OK;
131     }
132     RetError DisableAbility(const std::string &name) override
133     {
134         return RET_OK;
135     }
136     int32_t GetActiveWindow() override
137     {
138         return 0;
139     }
140 
141     RetError EnableUITestAbility(const sptr<IRemoteObject> &obj) override
142     {
143         return RET_OK;
144     }
145     RetError DisableUITestAbility() override
146     {
147         return RET_OK;
148     }
149 
150     RetError SetScreenMagnificationState(const bool state) override
151     {
152         return RET_OK;
153     }
154     RetError SetShortKeyState(const bool state) override
155     {
156         return RET_OK;
157     }
158     RetError SetMouseKeyState(const bool state) override
159     {
160         return RET_OK;
161     }
162     RetError SetMouseAutoClick(const int32_t time) override
163     {
164         return RET_OK;
165     }
166     RetError SetShortkeyTarget(const std::string &name) override
167     {
168         return RET_OK;
169     }
170     RetError SetShortkeyMultiTarget(const std::vector<std::string> &name) override
171     {
172         return RET_OK;
173     }
174     RetError SetHighContrastTextState(const bool state) override
175     {
176         return RET_OK;
177     }
178     RetError SetInvertColorState(const bool state) override
179     {
180         return RET_OK;
181     }
182     RetError SetAnimationOffState(const bool state) override
183     {
184         return RET_OK;
185     }
186     RetError SetAudioMonoState(const bool state) override
187     {
188         return RET_OK;
189     }
190     RetError SetDaltonizationState(const bool state) override
191     {
192         return RET_OK;
193     }
194     RetError SetDaltonizationColorFilter(const uint32_t filter) override
195     {
196         return RET_OK;
197     }
198     RetError SetContentTimeout(const uint32_t time) override
199     {
200         return RET_OK;
201     }
202     RetError SetBrightnessDiscount(const float discount) override
203     {
204         return RET_OK;
205     }
206     RetError SetAudioBalance(const float balance) override
207     {
208         return RET_OK;
209     }
210     RetError SetClickResponseTime(const uint32_t time) override
211     {
212         return RET_OK;
213     }
214     RetError SetIgnoreRepeatClickState(const bool state) override
215     {
216         return RET_OK;
217     }
218     RetError SetIgnoreRepeatClickTime(const uint32_t time) override
219     {
220         return RET_OK;
221     }
222 
223     RetError GetScreenMagnificationState(bool &state) override
224     {
225         return RET_OK;
226     }
227     RetError GetShortKeyState(bool &state) override
228     {
229         return RET_OK;
230     }
231     RetError GetMouseKeyState(bool &state) override
232     {
233         return RET_OK;
234     }
235     RetError GetMouseAutoClick(int32_t &time) override
236     {
237         return RET_OK;
238     }
239     RetError GetShortkeyTarget(std::string &name) override
240     {
241         return RET_OK;
242     }
243     RetError GetShortkeyMultiTarget(std::vector<std::string> &name) override
244     {
245         return RET_OK;
246     }
247     RetError GetHighContrastTextState(bool &state) override
248     {
249         return RET_OK;
250     }
251     RetError GetInvertColorState(bool &state) override
252     {
253         return RET_OK;
254     }
255     RetError GetAnimationOffState(bool &state) override
256     {
257         return RET_OK;
258     }
259     RetError GetAudioMonoState(bool &state) override
260     {
261         return RET_OK;
262     }
263     RetError GetDaltonizationState(bool &state) override
264     {
265         return RET_OK;
266     }
267     RetError GetDaltonizationColorFilter(uint32_t &type) override
268     {
269         return RET_OK;
270     }
271     RetError GetContentTimeout(uint32_t &timer) override
272     {
273         return RET_OK;
274     }
275     RetError GetBrightnessDiscount(float &brightness) override
276     {
277         return RET_OK;
278     }
279     RetError GetAudioBalance(float &balance) override
280     {
281         return RET_OK;
282     }
283     RetError GetClickResponseTime(uint32_t &time) override
284     {
285         return RET_OK;
286     }
287     RetError GetIgnoreRepeatClickState(bool &state) override
288     {
289         return RET_OK;
290     }
291     RetError GetIgnoreRepeatClickTime(uint32_t &time) override
292     {
293         return RET_OK;
294     }
295     void GetAllConfigs(AccessibilityConfigData &configData) override
296     {
297     }
298     void GetRealWindowAndElementId(int32_t &windowId, int64_t &elementId) override
299     {
300     }
301     void GetSceneBoardInnerWinId(int32_t windowId, int64_t elementId, int32_t &innerWid) override
302     {
303     }
304     RetError GetFocusedWindowId(int32_t &focusedWindowId) override
305     {
306         return RET_OK;
307     }
308     uint32_t RegisterConfigObserver(const sptr<IAccessibleAbilityManagerConfigObserver> &callback) override
309     {
310         return 0;
311     }
312     void PostDelayUnloadTask() override
313     {
314     }
315     void RemoveRequestId(int32_t requestId) override
316     {
317     }
318     int64_t GetRootParentId(int32_t windowsId, int32_t treeId) override
319     {
320         return 0;
321     }
322     RetError GetAllTreeId(int32_t windowId, std::vector<int32_t> &treeIds) override
323     {
324         return RET_OK;
325     }
326 };
327 
GetU32Data(const uint8_t *ptr)328 uint32_t GetU32Data(const uint8_t *ptr)
329 {
330     return (ptr[0] << FUZZ_NUM24) | (ptr[FUZZ_NUM1] << FUZZ_NUM16) | (ptr[FUZZ_NUM2] << FUZZ_NUM8) | (ptr[FUZZ_NUM3]);
331 }
332 
OnRemoteRequestSvcFuzzTest(const uint8_t *data, size_t size)333 bool OnRemoteRequestSvcFuzzTest(const uint8_t *data, size_t size)
334 {
335     uint32_t code = (GetU32Data(data) % MESSAGE_SIZE) + BASE_CODE;
336     MessageParcel datas;
337     std::u16string descriptor = AccessibleAbilityManagerServiceStubFuzzTest::GetDescriptor();
338     datas.WriteInterfaceToken(descriptor);
339     datas.WriteBuffer(data, size);
340     datas.RewindRead(0);
341     MessageParcel reply;
342     MessageOption option;
343     AccessibleAbilityManagerServiceStubFuzzTest serviceStub;
344     serviceStub.OnRemoteRequest(code, datas, reply, option);
345     return true;
346 }
347 
HandleSetDaltonizationStateTest(const uint8_t *data, size_t size)348 bool HandleSetDaltonizationStateTest(const uint8_t *data, size_t size)
349 {
350     MessageParcel datas;
351     bool isSetDaltonizationState = data[0] % DEVISOR_TWO;
352     std::u16string descriptor = AccessibleAbilityManagerServiceStubFuzzTest::GetDescriptor();
353     datas.WriteInterfaceToken(descriptor);
354     datas.WriteBool(isSetDaltonizationState);
355     MessageParcel reply;
356     MessageOption option;
357     AccessibleAbilityManagerServiceStubFuzzTest serviceStub;
358 
359     serviceStub.OnRemoteRequest(
360         static_cast<uint32_t>(AccessibilityInterfaceCode::SET_DALTONIZATION_STATE), datas, reply, option);
361     return true;
362 }
363 } // namespace Accessibility
364 } // namespace OHOS
365 
366 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)367 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
368 {
369     /* Run your code on data */
370     if (data == nullptr) {
371         return 0;
372     }
373 
374     if (size < OHOS::Accessibility::U32_AT_SIZE) {
375         return 0;
376     }
377 
378     OHOS::Accessibility::OnRemoteRequestSvcFuzzTest(data, size);
379     OHOS::Accessibility::HandleSetDaltonizationStateTest(data, size);
380     return 0;
381 }