1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "extensionrecordmanagera_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 
21 #define private public
22 #define protected public
23 #include "extension_record_manager.h"
24 #undef protected
25 #undef private
26 
27 #include "ability_record.h"
28 #include "extension_record.h"
29 #include "extension_record_factory.h"
30 
31 using namespace OHOS::AAFwk;
32 using namespace OHOS::AppExecFwk;
33 using namespace OHOS::AbilityRuntime;
34 
35 namespace OHOS {
36 namespace {
37 constexpr int INPUT_ZERO = 0;
38 constexpr int INPUT_ONE = 1;
39 constexpr int INPUT_THREE = 3;
40 constexpr size_t FOO_MAX_LEN = 1024;
41 constexpr size_t U32_AT_SIZE = 4;
42 constexpr uint8_t ENABLE = 2;
43 constexpr size_t OFFSET_ZERO = 24;
44 constexpr size_t OFFSET_ONE = 16;
45 constexpr size_t OFFSET_TWO = 8;
46 }
47 
GetU32Data(const char * ptr)48 uint32_t GetU32Data(const char* ptr)
49 {
50     // convert fuzz input data to an integer
51     return (ptr[INPUT_ZERO] << OFFSET_ZERO) | (ptr[INPUT_ONE] << OFFSET_ONE) | (ptr[ENABLE] << OFFSET_TWO) |
52         ptr[INPUT_THREE];
53 }
54 
GetFuzzAbilityToken()55 sptr<Token> GetFuzzAbilityToken()
56 {
57     sptr<Token> token = nullptr;
58     AbilityRequest abilityRequest;
59     abilityRequest.appInfo.bundleName = "com.example.fuzzTest";
60     abilityRequest.abilityInfo.name = "MainAbility";
61     abilityRequest.abilityInfo.type = AbilityType::DATA;
62     std::shared_ptr<AbilityRecord> abilityRecord = AbilityRecord::CreateAbilityRecord(abilityRequest);
63     if (abilityRecord) {
64         token = abilityRecord->GetToken();
65     }
66     return token;
67 }
68 
FuzztestExtensionRecordManagerFunc1(std::shared_ptr<ExtensionRecordManager> mgr,bool boolParam,const std::string & stringParam,int32_t int32Param)69 void FuzztestExtensionRecordManagerFunc1(std::shared_ptr<ExtensionRecordManager> mgr, bool boolParam,
70     const std::string &stringParam, int32_t int32Param)
71 {
72     Want want;
73     AppExecFwk::AbilityInfo abilityInfo;
74     AppExecFwk::ApplicationInfo applicationInfo;
75     std::shared_ptr<AbilityRecord> abilityRecord =
76         std::make_shared<AbilityRecord>(want, abilityInfo, applicationInfo);
77     std::shared_ptr<ExtensionRecord> record = std::make_shared<ExtensionRecord>(abilityRecord);
78     mgr->GenerateExtensionRecordId(int32Param);
79     mgr->AddExtensionRecord(int32Param, record);
80     mgr->RemoveExtensionRecord(int32Param);
81     mgr->AddExtensionRecordToTerminatedList(int32Param);
82     mgr->AddExtensionRecordToTerminatedList(1); // 1 means valid id, construct exist recordId
83     mgr->AddExtensionRecord(1, record); // 1 means valid id
84     std::shared_ptr<ExtensionRecord> extensionRecord = std::make_shared<ExtensionRecord>(abilityRecord);
85     mgr->GetExtensionRecord(1, stringParam, extensionRecord, boolParam);  // 1 means valid id
86     mgr->GetExtensionRecord(int32Param, stringParam, extensionRecord, boolParam);
87     mgr->IsBelongToManager(abilityInfo);
88     std::vector<std::string> extensionList;
89     mgr->GetActiveUIExtensionList(int32Param, extensionList);
90     mgr->GetActiveUIExtensionList(stringParam, extensionList);
91     mgr->GetAbilityRecordBySessionInfo(nullptr);
92     sptr<AAFwk::SessionInfo> sessionInfo = new (std::nothrow) SessionInfo();
93     sessionInfo->uiExtensionComponentId = int32Param;
94     mgr->AddExtensionRecord(int32Param, nullptr);
95     record->abilityRecord_ = abilityRecord;
96     mgr->AddExtensionRecord(int32Param, record);
97     record->abilityRecord_->sessionInfo_ = sessionInfo;
98     mgr->GetAbilityRecordBySessionInfo(sessionInfo);
99     mgr->extensionRecords_.clear();
100     mgr->GetAbilityRecordBySessionInfo(sessionInfo);
101 }
102 
FuzztestExtensionRecordManagerFunc2(std::shared_ptr<ExtensionRecordManager> mgr,bool boolParam,const std::string & stringParam,int32_t int32Param)103 void FuzztestExtensionRecordManagerFunc2(std::shared_ptr<ExtensionRecordManager> mgr, bool boolParam,
104     const std::string &stringParam, int32_t int32Param)
105 {
106     Want want;
107     AppExecFwk::AbilityInfo abilityInfo;
108     AppExecFwk::ApplicationInfo applicationInfo;
109     std::shared_ptr<AbilityRecord> abilityRecord = std::make_shared<AbilityRecord>(want, abilityInfo, applicationInfo);
110     std::shared_ptr<ExtensionRecord> record = std::make_shared<ExtensionRecord>(abilityRecord);
111     AAFwk::AbilityRequest abilityRequest;
112     sptr<AAFwk::SessionInfo> sessionInfo = new (std::nothrow) SessionInfo();
113     sessionInfo->uiExtensionComponentId = int32Param;
114     mgr->AddExtensionRecord(int32Param, nullptr);
115     record->abilityRecord_ = abilityRecord;
116     mgr->AddExtensionRecord(int32Param, record);
117     record->abilityRecord_->sessionInfo_ = sessionInfo;
118     mgr->IsHostSpecifiedProcessValid(abilityRequest, record, stringParam);
119 
120     record->processMode_ = PROCESS_MODE_INSTANCE;
121     mgr->UpdateProcessName(abilityRequest, record);
122     record->processMode_ = PROCESS_MODE_TYPE;
123     mgr->UpdateProcessName(abilityRequest, record);
124     record->processMode_ = PROCESS_MODE_HOST_SPECIFIED;
125     mgr->UpdateProcessName(abilityRequest, record);
126     std::string bundleName = "bundleName";
127     mgr->GetHostBundleNameForExtensionId(1, bundleName); // 1 means id
128     mgr->AddExtensionRecord(1, record); // 1 means id
129     mgr->GetHostBundleNameForExtensionId(1, bundleName); // 1 means id, exist.
130     mgr->GetHostBundleNameForExtensionId(int32Param, bundleName); // 1 means id, exist.
131     abilityRecord->SetUIExtensionAbilityId(-1);
132     mgr->AddExtensionRecord(1, record); // 1 means id
133     abilityRecord->SetUIExtensionAbilityId(1);
134     mgr->AddPreloadUIExtensionRecord(abilityRecord);
135     ExtensionRecordManager::PreLoadUIExtensionMapKey key;
136     mgr->RemoveAllPreloadUIExtensionRecord(key); // called
137     mgr->IsPreloadExtensionRecord(abilityRequest, stringParam, record, boolParam);  // called
138     mgr->RemovePreloadUIExtensionRecordById(key, int32Param);  // called
139     mgr->RemovePreloadUIExtensionRecord(key);  // called
140     mgr->GetOrCreateExtensionRecordInner(abilityRequest, stringParam, record, boolParam);  // called
141     mgr->StartAbility(abilityRequest); // called
142     mgr->IsFocused(int32Param, nullptr, nullptr); // called
143     mgr->AddExtensionRecord(0, record); // 1 means id
144     mgr->GetRootCallerTokenLocked(int32Param, abilityRecord);
145     mgr->CreateExtensionRecord(abilityRequest, stringParam, record, int32Param);
146     mgr->GetUIExtensionRootHostInfo(nullptr);
147     sptr<Token> token = GetFuzzAbilityToken();
148     mgr->GetUIExtensionRootHostInfo(token);
149     std::list<sptr<IRemoteObject>> callerList;
150     mgr->GetCallerTokenList(abilityRecord, callerList);
151     mgr->extensionRecords_.clear();
152 }
153 
FuzztestExtensionRecordManagerFunc3(std::shared_ptr<ExtensionRecordManager> mgr,bool boolParam,const std::string & stringParam,int32_t int32Param)154 void FuzztestExtensionRecordManagerFunc3(std::shared_ptr<ExtensionRecordManager> mgr, bool boolParam,
155     const std::string &stringParam, int32_t int32Param)
156 {
157     Want want;
158     AppExecFwk::AbilityInfo abilityInfo;
159     AppExecFwk::ApplicationInfo applicationInfo;
160     std::shared_ptr<AbilityRecord> abilityRecord = std::make_shared<AbilityRecord>(want, abilityInfo, applicationInfo);
161     std::shared_ptr<ExtensionRecord> record = std::make_shared<ExtensionRecord>(abilityRecord);
162     AAFwk::AbilityRequest abilityRequest;
163     UIExtensionSessionInfo uiExtensionSessionInfo;
164     mgr->GetUIExtensionSessionInfo(nullptr, uiExtensionSessionInfo);
165     mgr->AddExtensionRecord(0, record);
166     mgr->AddExtensionRecord(1, record); // 1 means id
167     mgr->LoadTimeout(int32Param); // called
168     mgr->ForegroundTimeout(int32Param); // called
169     mgr->BackgroundTimeout(int32Param); // called
170     mgr->TerminateTimeout(int32Param); // called
171 }
172 
DoSomethingInterestingWithMyAPI(const char * data,size_t size)173 bool DoSomethingInterestingWithMyAPI(const char* data, size_t size)
174 {
175     bool boolParam = *data % ENABLE;
176     std::string stringParam(data, size);
177     int32_t int32Param = static_cast<int32_t>(GetU32Data(data));
178     std::shared_ptr<ExtensionRecordManager> mgr = std::make_shared<ExtensionRecordManager>(100); // 100 mainUserId
179     FuzztestExtensionRecordManagerFunc1(mgr, boolParam, stringParam, int32Param);
180     FuzztestExtensionRecordManagerFunc2(mgr, boolParam, stringParam, int32Param);
181     FuzztestExtensionRecordManagerFunc3(mgr, boolParam, stringParam, int32Param);
182     return true;
183 }
184 }
185 
186 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)187 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
188 {
189     /* Run your code on data */
190     if (data == nullptr) {
191         return 0;
192     }
193 
194     /* Validate the length of size */
195     if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) {
196         return 0;
197     }
198 
199     char* ch = static_cast<char*>(malloc(size + 1));
200     if (ch == nullptr) {
201         std::cout << "malloc failed." << std::endl;
202         return 0;
203     }
204 
205     (void)memset_s(ch, size + 1, 0x00, size + 1);
206     if (memcpy_s(ch, size, data, size) != EOK) {
207         std::cout << "copy failed." << std::endl;
208         free(ch);
209         ch = nullptr;
210         return 0;
211     }
212 
213     OHOS::DoSomethingInterestingWithMyAPI(ch, size);
214     free(ch);
215     ch = nullptr;
216     return 0;
217 }
218 
219