/* * Copyright (c) 2024 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "fileaccessextstub_fuzzer.h" #include #include #include "accesstoken_kit.h" #include "extension_base.h" #include "extension_context.h" #include "file_access_ext_stub.h" #include "file_access_ext_stub_impl.h" #include "fileaccessextabilitymock.h" #include "message_parcel.h" namespace OHOS { using namespace std; using namespace FileAccessFwk; using namespace AbilityRuntime; template T TypeCast(const uint8_t *data, int *pos = nullptr) { if (pos) { *pos += sizeof(T); } return *(reinterpret_cast(data)); } bool OnRemoteRequestFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { if (data == nullptr || size < sizeof(uint32_t)) { return true; } uint32_t code = TypeCast(data); MessageParcel msg; msg.WriteInterfaceToken(FileAccessExtStub::GetDescriptor()); MessageParcel reply; MessageOption option; fileAccessExtStub->OnRemoteRequest(code, msg, reply, option); return true; } bool CmdOpenFileFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { if (data == nullptr || size < sizeof(int32_t)) { return true; } MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size - sizeof(int32_t))); msg.WriteInt32(TypeCast(data)); fileAccessExtStub->CmdOpenFile(msg, reply); return true; } bool CmdCreateFileFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; int pos = size >> 1; msg.WriteString(string(reinterpret_cast(data), pos)); msg.WriteString(string(reinterpret_cast(data + pos), size - pos)); fileAccessExtStub->CmdCreateFile(msg, reply); return true; } bool CmdMkdirFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; int pos = size >> 1; msg.WriteString(string(reinterpret_cast(data), pos)); msg.WriteString(string(reinterpret_cast(data + pos), size - pos)); fileAccessExtStub->CmdMkdir(msg, reply); return true; } bool CmdDeleteFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size)); fileAccessExtStub->CmdDelete(msg, reply); return true; } bool CmdMoveFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; int pos = size >> 1; msg.WriteString(string(reinterpret_cast(data), pos)); msg.WriteString(string(reinterpret_cast(data + pos), size - pos)); fileAccessExtStub->CmdMove(msg, reply); return true; } bool CmdCopyFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { if (data == nullptr || size == 0) { return true; } MessageParcel msg; MessageParcel reply; int pos = (size - 1) >> 1; msg.WriteString(string(reinterpret_cast(data + 1), pos)); msg.WriteString(string(reinterpret_cast(data + pos + 1), size - pos - 1)); msg.WriteBool(TypeCast(data)); fileAccessExtStub->CmdCopy(msg, reply); return true; } bool CmdCopyFileFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; int pos = size / 3; msg.WriteString(string(reinterpret_cast(data), pos)); msg.WriteString(string(reinterpret_cast(data + pos), pos)); msg.WriteString(string(reinterpret_cast(data + pos + pos), size - pos - pos)); fileAccessExtStub->CmdCopyFile(msg, reply); return true; } bool CmdRenameFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; int pos = size >> 1; msg.WriteString(string(reinterpret_cast(data), pos)); msg.WriteString(string(reinterpret_cast(data + pos), size - pos)); fileAccessExtStub->CmdRename(msg, reply); return true; } bool CmdListFileFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { size_t minSize = sizeof(int64_t) + sizeof(int32_t) + sizeof(int64_t) + sizeof(int64_t) + sizeof(int64_t) + sizeof(double) + sizeof(bool) + sizeof(bool); if (data == nullptr || size < minSize) { return true; } int pos = 0; int64_t offset = TypeCast(data, &pos); FileInfo fileInfo; fileInfo.mode = TypeCast(data + pos, &pos); fileInfo.size = TypeCast(data + pos, &pos); fileInfo.mtime = TypeCast(data + pos, &pos); int64_t fileSizeOver = TypeCast(data + pos, &pos); double lastModifiedAfter = TypeCast(data + pos, &pos); bool excludeMedia = TypeCast(data + pos, &pos); bool hasFilter = TypeCast(data + pos, &pos); int len = (size - pos) / 6; fileInfo.uri = string(reinterpret_cast(data + pos), len); pos += len; fileInfo.relativePath = string(reinterpret_cast(data + pos), len); pos += len; fileInfo.fileName = string(reinterpret_cast(data + pos), len); pos += len; std::vector suffix; suffix.push_back(string(reinterpret_cast(data + pos), len)); pos += len; std::vector displayName; displayName.push_back(string(reinterpret_cast(data + pos), len)); pos += len; std::vector mimeType; mimeType.push_back(string(reinterpret_cast(data + pos), len)); pos += len; FileFilter fileFilter(suffix, displayName, mimeType, fileSizeOver, lastModifiedAfter, excludeMedia, hasFilter); SharedMemoryInfo sharedMemoryInfo; MessageParcel msg; MessageParcel reply; msg.WriteParcelable(&fileInfo); msg.WriteInt64(offset); msg.WriteParcelable(&fileFilter); msg.WriteParcelable(&sharedMemoryInfo); fileAccessExtStub->CmdListFile(msg, reply); return true; } bool CmdScanFileFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { size_t minSize = sizeof(int64_t) + sizeof(int64_t) + sizeof(int32_t) + sizeof(int64_t) + sizeof(int64_t) + sizeof(int64_t) + sizeof(double) + sizeof(bool) + sizeof(bool); if (data == nullptr || size < minSize) { return true; } int pos = 0; int64_t offset = TypeCast(data, &pos); int64_t maxCount = TypeCast(data, &pos); FileInfo fileInfo; fileInfo.mode = TypeCast(data + pos, &pos); fileInfo.size = TypeCast(data + pos, &pos); fileInfo.mtime = TypeCast(data + pos, &pos); int64_t fileSizeOver = TypeCast(data + pos, &pos); double lastModifiedAfter = TypeCast(data + pos, &pos); bool excludeMedia = TypeCast(data + pos, &pos); bool hasFilter = TypeCast(data + pos, &pos); int len = (size - pos) / 6; fileInfo.uri = string(reinterpret_cast(data + pos), len); pos += len; fileInfo.relativePath = string(reinterpret_cast(data + pos), len); pos += len; fileInfo.fileName = string(reinterpret_cast(data + pos), len); pos += len; std::vector suffix; suffix.push_back(string(reinterpret_cast(data + pos), len)); pos += len; std::vector displayName; displayName.push_back(string(reinterpret_cast(data + pos), len)); pos += len; std::vector mimeType; mimeType.push_back(string(reinterpret_cast(data + pos), len)); pos += len; FileFilter fileFilter(suffix, displayName, mimeType, fileSizeOver, lastModifiedAfter, excludeMedia, hasFilter); SharedMemoryInfo sharedMemoryInfo; MessageParcel msg; MessageParcel reply; msg.WriteParcelable(&fileInfo); msg.WriteInt64(offset); msg.WriteInt64(maxCount); msg.WriteParcelable(&fileFilter); fileAccessExtStub->CmdScanFile(msg, reply); return true; } bool CmdGetRootsFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; fileAccessExtStub->CmdGetRoots(msg, reply); return true; } bool CmdQueryFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { if (data == nullptr || size < sizeof(int64_t)) { return true; } MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data + sizeof(int64_t)), size - sizeof(int64_t))); msg.WriteInt64(TypeCast(data)); fileAccessExtStub->CmdQuery(msg, reply); return true; } bool CmdGetFileInfoFromUriFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size)); fileAccessExtStub->CmdGetFileInfoFromUri(msg, reply); return true; } bool CmdGetFileInfoFromRelativePathFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size)); fileAccessExtStub->CmdGetFileInfoFromRelativePath(msg, reply); return true; } bool CmdAccessFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size)); fileAccessExtStub->CmdAccess(msg, reply); return true; } bool CmdStartWatcherFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size)); fileAccessExtStub->CmdStartWatcher(msg, reply); return true; } bool CmdStopWatcherFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; msg.WriteString(string(reinterpret_cast(data), size)); fileAccessExtStub->CmdStopWatcher(msg, reply); return true; } bool CmdMoveItemFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { if (data == nullptr || size == 0) { return true; } MessageParcel msg; MessageParcel reply; int pos = (size - 1) >> 1; msg.WriteString(string(reinterpret_cast(data + 1), pos)); msg.WriteString(string(reinterpret_cast(data + pos + 1), size - pos - 1)); msg.WriteBool(TypeCast(data)); fileAccessExtStub->CmdMoveItem(msg, reply); return true; } bool CmdMoveFileFuzzTest(shared_ptr fileAccessExtStub, const uint8_t *data, size_t size) { MessageParcel msg; MessageParcel reply; int pos = size / 3; msg.WriteString(string(reinterpret_cast(data), pos)); msg.WriteString(string(reinterpret_cast(data + pos), pos)); msg.WriteString(string(reinterpret_cast(data + pos + pos), size - pos - pos)); fileAccessExtStub->CmdMoveFile(msg, reply); return true; } } // namespace OHOS /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { auto ability = std::make_shared(); auto stub = std::make_shared(ability, nullptr); if (stub == nullptr) { return 0; } OHOS::OnRemoteRequestFuzzTest(stub, data, size); OHOS::CmdOpenFileFuzzTest(stub, data, size); OHOS::CmdCreateFileFuzzTest(stub, data, size); OHOS::CmdMkdirFuzzTest(stub, data, size); OHOS::CmdDeleteFuzzTest(stub, data, size); OHOS::CmdMoveFuzzTest(stub, data, size); OHOS::CmdCopyFuzzTest(stub, data, size); OHOS::CmdCopyFileFuzzTest(stub, data, size); OHOS::CmdRenameFuzzTest(stub, data, size); OHOS::CmdListFileFuzzTest(stub, data, size); OHOS::CmdScanFileFuzzTest(stub, data, size); OHOS::CmdGetRootsFuzzTest(stub, data, size); OHOS::CmdQueryFuzzTest(stub, data, size); OHOS::CmdGetFileInfoFromUriFuzzTest(stub, data, size); OHOS::CmdGetFileInfoFromRelativePathFuzzTest(stub, data, size); OHOS::CmdAccessFuzzTest(stub, data, size); OHOS::CmdStartWatcherFuzzTest(stub, data, size); OHOS::CmdStopWatcherFuzzTest(stub, data, size); OHOS::CmdMoveItemFuzzTest(stub, data, size); OHOS::CmdMoveFileFuzzTest(stub, data, size); return 0; }