1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "sessioninterface_fuzzer.h"
17 
18 #include <iremote_broker.h>
19 
20 #include "ability_context_impl.h"
21 #include "session_manager.h"
22 #include "window_manager_hilog.h"
23 #include "window_scene_session_impl.h"
24 #include "zidl/session_ipc_interface_code.h"
25 #include "zidl/session_proxy.h"
26 #include "data_source.h"
27 
28 namespace OHOS::Rosen {
29 namespace {
30 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "SessionInterfaceFuzzTest"};
31 }
32 
33 static std::shared_ptr<AbilityRuntime::AbilityContext> abilityContext =
34     std::make_shared<AbilityRuntime::AbilityContextImpl>();
35 static sptr<WindowSessionImpl> savedWindow;
36 
GetProxy()37 std::pair<sptr<ISession>, sptr<IRemoteObject>> GetProxy()
38 {
39     if (savedWindow) {
40         savedWindow->Destroy();
41         savedWindow = nullptr;
42     }
43 
44     sptr<WindowOption> option = new WindowOption();
45     option->SetWindowName("SessionInterfaceFuzzTest");
46     option->SetWindowType(WindowType::WINDOW_TYPE_WALLPAPER);
47 
48     sptr<WindowSessionImpl> window = new WindowSceneSessionImpl(option);
49     WMError err = window->Create(abilityContext, nullptr);
50     if (err != WMError::WM_OK) {
51         WLOGFE("Failed to create window: %{public}d", static_cast<int>(err));
52         return {nullptr, nullptr};
53     }
54 
55     auto session = window->GetHostSession();
56     if (!session) {
57         WLOGFE("Session is nullptr");
58         return {nullptr, nullptr};
59     }
60 
61     sptr<SessionProxy> proxy = new SessionProxy(session->AsObject());
62     savedWindow = window;
63 
64     WLOGFD("GetProxy success");
65 
66     return {proxy, session->AsObject()};
67 }
68 
69 template<class T>
UnmarshallingDataTo(const uint8_t* data, size_t size)70 T* UnmarshallingDataTo(const uint8_t* data, size_t size)
71 {
72     MessageParcel parcel;
73     if (data) {
74         parcel.WriteBuffer(data, size);
75     }
76     return T::Unmarshalling(parcel);
77 }
78 
IPCFuzzTest(const uint8_t* data, size_t size)79 void IPCFuzzTest(const uint8_t* data, size_t size)
80 {
81     auto [proxy, remoteObject] = GetProxy();
82     if (!proxy || !remoteObject) {
83         return;
84     }
85 
86     DataSource source(data, size);
87     uint32_t code = source.GetObject<uint32_t>();
88     int flags = source.GetObject<int>();
89     int waitTime = source.GetObject<int>();
90 
91     MessageParcel sendData;
92     MessageParcel reply;
93     MessageOption option(flags, waitTime);
94     auto rawSize = source.size_ - source.pos_;
95     auto buf = source.GetRaw(rawSize);
96     if (buf) {
97         sendData.WriteBuffer(buf, rawSize);
98     }
99     remoteObject->SendRequest(code, sendData, reply, option);
100 }
101 
IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply, MessageOption& option)102 void IPCSpecificInterfaceFuzzTest1(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
103     MessageOption& option)
104 {
105     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_CONNECT),
106         sendData, reply, option);
107     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_FOREGROUND),
108         sendData, reply, option);
109     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_BACKGROUND),
110         sendData, reply, option);
111     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_DISCONNECT),
112         sendData, reply, option);
113     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SESSION_EVENT),
114         sendData, reply, option);
115     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SYSTEM_SESSION_EVENT),
116         sendData, reply, option);
117     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_SESSION_RECT),
118         sendData, reply, option);
119     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_RAISE_TO_APP_TOP),
120         sendData, reply, option);
121     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_BACKPRESSED),
122         sendData, reply, option);
123     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_MARK_PROCESSED),
124         sendData, reply, option);
125     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_MAXIMIZE_MODE),
126         sendData, reply, option);
127     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_GET_MAXIMIZE_MODE),
128         sendData, reply, option);
129 }
130 
IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply, MessageOption& option)131 void IPCSpecificInterfaceFuzzTest2(sptr<IRemoteObject> proxy, MessageParcel& sendData, MessageParcel& reply,
132     MessageOption& option)
133 {
134     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_NEED_AVOID),
135         sendData, reply, option);
136     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_GET_AVOID_AREA),
137         sendData, reply, option);
138     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_SET_ASPECT_RATIO),
139         sendData, reply, option);
140     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_WINDOW_ANIMATION_FLAG),
141         sendData, reply, option);
142     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_UPDATE_CUSTOM_ANIMATION),
143         sendData, reply, option);
144     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_RAISE_ABOVE_TARGET),
145         sendData, reply, option);
146     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_ACTIVE_PENDING_SESSION),
147         sendData, reply, option);
148     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TERMINATE),
149         sendData, reply, option);
150     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_EXCEPTION),
151         sendData, reply, option);
152     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TRANSFER_ABILITY_RESULT),
153         sendData, reply, option);
154     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_TRANSFER_EXTENSION_DATA),
155         sendData, reply, option);
156     proxy->SendRequest(static_cast<uint32_t>(SessionInterfaceCode::TRANS_ID_NOTIFY_EXTENSION_DIED),
157         sendData, reply, option);
158 }
159 
IPCInterfaceFuzzTest(const uint8_t* data, size_t size)160 void IPCInterfaceFuzzTest(const uint8_t* data, size_t size)
161 {
162     auto [proxy, remoteObject] = GetProxy();
163     if (!proxy || !remoteObject) {
164         return;
165     }
166 
167     DataSource source(data, size);
168     int flags = source.GetObject<int>();
169     int waitTime = source.GetObject<int>();
170 
171     MessageParcel sendData;
172     MessageParcel reply;
173     MessageOption option(flags, waitTime);
174     sendData.WriteInterfaceToken(proxy->GetDescriptor());
175     auto rawSize = source.size_ - source.pos_;
176     auto buf = source.GetRaw(rawSize);
177     if (buf) {
178         sendData.WriteBuffer(buf, rawSize);
179     }
180     IPCSpecificInterfaceFuzzTest1(remoteObject, sendData, reply, option);
181     IPCSpecificInterfaceFuzzTest2(remoteObject, sendData, reply, option);
182 }
183 
ProxyInterfaceFuzzTestPart1(const uint8_t* data, size_t size)184 void ProxyInterfaceFuzzTestPart1(const uint8_t* data, size_t size)
185 {
186     auto [proxy, remoteObject] = GetProxy();
187     if (!proxy || !remoteObject) {
188         return;
189     }
190 
191     DataSource source(data, size);
192 
193     sptr<WindowSessionProperty> property = UnmarshallingDataTo<WindowSessionProperty>(data, size);
194     proxy->Foreground(property);
195     proxy->Background();
196     proxy->RaiseToAppTop();
197 
198     SessionEvent event = source.GetObject<SessionEvent>();
199     proxy->OnSessionEvent(event);
200 
201     WSRect rect = source.GetObject<WSRect>();
202     SizeChangeReason reason = source.GetObject<SizeChangeReason>();
203     proxy->UpdateSessionRect(rect, reason);
204 
205     bool needMoveToBackground = source.GetObject<bool>();
206     proxy->RequestSessionBack(needMoveToBackground);
207 }
208 
ProxyInterfaceFuzzTestPart2(const uint8_t* data, size_t size)209 void ProxyInterfaceFuzzTestPart2(const uint8_t* data, size_t size)
210 {
211     auto [proxy, remoteObject] = GetProxy();
212     if (!proxy || !remoteObject) {
213         return;
214     }
215 
216     DataSource source(data, size);
217 
218     int32_t eventId = source.GetObject<int32_t>();
219     proxy->MarkProcessed(eventId);
220 
221     MaximizeMode mode = source.GetObject<MaximizeMode>();
222     proxy->SetGlobalMaximizeMode(mode);
223     proxy->GetGlobalMaximizeMode(mode);
224 
225     bool status = source.GetObject<bool>();
226     proxy->OnNeedAvoid(status);
227 
228     AvoidAreaType type = source.GetObject<AvoidAreaType>();
229     proxy->GetAvoidAreaByType(type);
230 
231     float ratio = source.GetObject<float>();
232     proxy->SetAspectRatio(ratio);
233 
234     bool needDefaultAnimationFlag = source.GetObject<bool>();
235     proxy->UpdateWindowAnimationFlag(needDefaultAnimationFlag);
236 
237     bool isAdd = source.GetObject<bool>();
238     proxy->UpdateWindowSceneAfterCustomAnimation(isAdd);
239 }
240 
ProxyInterfaceFuzzTestPart3(const uint8_t* data, size_t size)241 void ProxyInterfaceFuzzTestPart3(const uint8_t* data, size_t size)
242 {
243     auto [proxy, remoteObject] = GetProxy();
244     if (!proxy || !remoteObject) {
245         return;
246     }
247 
248     DataSource source(data, size);
249 
250     int32_t subWindowId = source.GetObject<int32_t>();
251     proxy->RaiseAboveTarget(subWindowId);
252 
253     sptr<AAFwk::SessionInfo> sessionInfo = UnmarshallingDataTo<AAFwk::SessionInfo>(data, size);
254     proxy->PendingSessionActivation(sessionInfo);
255     proxy->TerminateSession(sessionInfo);
256     proxy->NotifySessionException(sessionInfo);
257 
258     uint32_t resultCode = source.GetObject<uint32_t>();
259     sptr<AAFwk::Want> want = UnmarshallingDataTo<AAFwk::Want>(data, size);
260     proxy->TransferAbilityResult(resultCode, *want);
261 
262     sptr<AAFwk::WantParams> wantParams = UnmarshallingDataTo<AAFwk::WantParams>(data, size);
263     proxy->TransferExtensionData(*wantParams);
264     proxy->NotifyExtensionDied();
265     int32_t errorCode = 1;
266     proxy->NotifyExtensionTimeout(errorCode);
267 }
268 
ProxyInterfaceFuzzTest(const uint8_t* data, size_t size)269 void ProxyInterfaceFuzzTest(const uint8_t* data, size_t size)
270 {
271     ProxyInterfaceFuzzTestPart1(data, size);
272     ProxyInterfaceFuzzTestPart2(data, size);
273     ProxyInterfaceFuzzTestPart3(data, size);
274 }
275 }
276 
277 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)278 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
279 {
280     /* Run your code on data */
281     OHOS::Rosen::IPCFuzzTest(data, size);
282     OHOS::Rosen::IPCInterfaceFuzzTest(data, size);
283     OHOS::Rosen::ProxyInterfaceFuzzTest(data, size);
284     return 0;
285 }
286