From 89aa91bdd5459bfa6660e101e3896ba8ee87a7b7 Mon Sep 17 00:00:00 2001
From: wuyunxun <wuyunxun@h-partners.com>
Date: Thu, 31 Jul 2025 16:01:00 +0800
Subject: [PATCH 01/15] =?UTF-8?q?=E8=A1=A5=E5=85=85UT?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wuyunxun <wuyunxun@h-partners.com>
Change-Id: I272cfd36a044b3fc85807d1736c1aad4ba1440d0
---
 test/resource/ipc/ohos_test.xml               |  12 +
 .../ipc/native/src/core/source/BUILD.gn       |  13 +
 .../src/core/source/ipc_trace_unittest.cpp    | 138 +++++++++
 .../core/source/ipc_workthread_unittest.cpp   | 271 ++++++++++++++++++
 4 files changed, 434 insertions(+)
 create mode 100644 test/unittest/ipc/native/src/core/source/ipc_trace_unittest.cpp
 create mode 100644 test/unittest/ipc/native/src/core/source/ipc_workthread_unittest.cpp

diff --git a/test/resource/ipc/ohos_test.xml b/test/resource/ipc/ohos_test.xml
index a6a3f2e1..02376fd4 100644
--- a/test/resource/ipc/ohos_test.xml
+++ b/test/resource/ipc/ohos_test.xml
@@ -107,6 +107,18 @@
             <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib" src="out"/>
         </preparer>
     </target>
+    <target name="IPCTraceTest">
+        <preparer>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib64" src="out"/>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib" src="out"/>
+        </preparer>
+    </target>
+    <target name="IPCWorkThreadTest">
+        <preparer>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib64" src="out"/>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib" src="out"/>
+        </preparer>
+    </target>
     <target name="DBinderServiceStubTest">
         <preparer>
             <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib64" src="out"/>
diff --git a/test/unittest/ipc/native/src/core/source/BUILD.gn b/test/unittest/ipc/native/src/core/source/BUILD.gn
index 70e29c8d..ecc495d4 100644
--- a/test/unittest/ipc/native/src/core/source/BUILD.gn
+++ b/test/unittest/ipc/native/src/core/source/BUILD.gn
@@ -137,6 +137,17 @@ ipc_unittest("IPCFileDescriptorTest") {
   sources = [ "ipc_file_descriptor_unittest.cpp" ]
 }
 
+ipc_unittest("IPCTraceTest") {
+  sources = [
+    "$IPC_CORE_ROOT/src/core/framework/source/ipc_trace.cpp",
+    "ipc_trace_unittest.cpp",
+  ]
+}
+
+ipc_unittest("IPCWorkThreadTest") {
+  sources = [ "ipc_workthread_unittest.cpp" ]
+}
+
 ###############################################################################
 group("unittest") {
   testonly = true
@@ -156,6 +167,8 @@ group("unittest") {
     ":IremoteObjectTest",
     ":MessageParcelAddTest",
     ":ProcessSkeletonTest",
+    ":IPCTraceTest",
+    ":IPCWorkThreadTest",
   ]
 }
 ###############################################################################
diff --git a/test/unittest/ipc/native/src/core/source/ipc_trace_unittest.cpp b/test/unittest/ipc/native/src/core/source/ipc_trace_unittest.cpp
new file mode 100644
index 00000000..5de9d2b2
--- /dev/null
+++ b/test/unittest/ipc/native/src/core/source/ipc_trace_unittest.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dlfcn.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "ipc_trace.h"
+
+using namespace testing;
+using namespace testing::ext;
+using namespace OHOS;
+
+namespace OHOS {
+
+namespace {
+const std::string VALUE_TEST = "value";
+const int32_t TASK_ID_TEST = 1;
+}
+
+class IPCTraceTest : public testing::Test {
+public:
+    static void SetUpTestCase(void);
+    static void TearDownTestCase(void);
+    void SetUp();
+    void TearDown();
+};
+
+void IPCTraceTest::SetUpTestCase()
+{
+}
+
+void IPCTraceTest::TearDownTestCase()
+{
+}
+
+void IPCTraceTest::SetUp()
+{
+}
+
+void IPCTraceTest::TearDown()
+{
+}
+
+/**
+ * @tc.name: IsEnabled001
+ * @tc.desc: Verify the IsEnabled function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCTraceTest, IsEnabled001, TestSize.Level1)
+{
+    IPCTrace &instance = IPCTrace::GetInstance();
+    instance.isTagEnabledFunc_ = nullptr;
+    EXPECT_FALSE(instance.IsEnabled());
+}
+
+/**
+ * @tc.name: Start001
+ * @tc.desc: Verify the Start function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCTraceTest, Start001, TestSize.Level1)
+{
+    IPCTrace &instance = IPCTrace::GetInstance();
+    EXPECT_NE(instance.startFunc_, nullptr);
+    instance.startFunc_ = nullptr;
+    instance.Start(VALUE_TEST);
+    EXPECT_EQ(instance.startFunc_, nullptr);
+}
+
+/**
+ * @tc.name: Finish001
+ * @tc.desc: Verify the Finish function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCTraceTest, Finish001, TestSize.Level1)
+{
+    IPCTrace &instance = IPCTrace::GetInstance();
+    EXPECT_NE(instance.finishFunc_, nullptr);
+    instance.finishFunc_ = nullptr;
+    instance.Finish();
+    EXPECT_EQ(instance.finishFunc_, nullptr);
+}
+
+/**
+ * @tc.name: StartAsync001
+ * @tc.desc: Verify the StartAsync function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCTraceTest, StartAsync001, TestSize.Level1)
+{
+    IPCTrace &instance = IPCTrace::GetInstance();
+    EXPECT_NE(instance.startAsyncFunc_, nullptr);
+    instance.startAsyncFunc_ = nullptr;
+    instance.StartAsync(VALUE_TEST, TASK_ID_TEST);
+    EXPECT_EQ(instance.startAsyncFunc_, nullptr);
+}
+
+/**
+ * @tc.name: FinishAsync001
+ * @tc.desc: Verify the FinishAsync function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCTraceTest, FinishAsync001, TestSize.Level1)
+{
+    IPCTrace &instance = IPCTrace::GetInstance();
+    EXPECT_NE(instance.finishAsyncFunc_, nullptr);
+    instance.finishAsyncFunc_ = nullptr;
+    instance.FinishAsync(VALUE_TEST, TASK_ID_TEST);
+    EXPECT_EQ(instance.finishAsyncFunc_, nullptr);
+}
+
+/**
+ * @tc.name: Unload001
+ * @tc.desc: Verify the Unload function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCTraceTest, Unload001, TestSize.Level1)
+{
+    IPCTrace &instance = IPCTrace::GetInstance();
+    EXPECT_NE(instance.traceSoHandler_, nullptr);
+    dlclose(instance.traceSoHandler_);
+    instance.Unload();
+    EXPECT_EQ(instance.traceSoHandler_, nullptr);
+}
+} // namespace OHOS
\ No newline at end of file
diff --git a/test/unittest/ipc/native/src/core/source/ipc_workthread_unittest.cpp b/test/unittest/ipc/native/src/core/source/ipc_workthread_unittest.cpp
new file mode 100644
index 00000000..21f7bbc0
--- /dev/null
+++ b/test/unittest/ipc/native/src/core/source/ipc_workthread_unittest.cpp
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "dbinder_databus_invoker.h"
+#include "ipc_workthread.h"
+
+using namespace testing;
+using namespace testing::ext;
+using namespace OHOS;
+
+namespace OHOS {
+
+namespace {
+const std::string THREAD_NAME = "test_thread";
+}
+
+struct IPCWorkThreadParam {
+public:
+    int proto;
+    int policy;
+    int index;
+};
+
+class IPCWorkThreadTest : public testing::Test {
+public:
+    static void SetUpTestCase(void);
+    static void TearDownTestCase(void);
+    void SetUp();
+    void TearDown();
+};
+
+void IPCWorkThreadTest::SetUpTestCase()
+{
+}
+
+void IPCWorkThreadTest::TearDownTestCase()
+{
+}
+
+void IPCWorkThreadTest::SetUp()
+{
+}
+
+void IPCWorkThreadTest::TearDown()
+{
+}
+
+class IPCWorkThreadInterface {
+public:
+    IPCWorkThreadInterface() {};
+    virtual ~IPCWorkThreadInterface() {};
+
+    virtual IRemoteInvoker *GetRemoteInvoker(int proto) = 0;
+    virtual ProcessSkeleton *GetInstance() = 0;
+    virtual void JoinProcessThread(bool initiative) = 0;
+    virtual int pthread_create(pthread_t *thread,
+                               const pthread_attr_t *attr,
+                               void *(*start_routine)(void *),
+                               void *arg) = 0;
+    virtual int pthread_detach(pthread_t thread) = 0;
+};
+
+class IPCWorkThreadInterfaceMock : public IPCWorkThreadInterface {
+public:
+    IPCWorkThreadInterfaceMock();
+    ~IPCWorkThreadInterfaceMock() override;
+
+    MOCK_METHOD1(GetRemoteInvoker, IRemoteInvoker *(int));
+    MOCK_METHOD0(GetInstance, ProcessSkeleton *());
+    MOCK_METHOD1(JoinProcessThread, void(bool));
+    MOCK_METHOD4(pthread_create, int(pthread_t *, const pthread_attr_t *, void *(*)(void *), void *));
+    MOCK_METHOD1(pthread_detach, int(pthread_t));
+};
+
+static void *g_interface = nullptr;
+
+IPCWorkThreadInterfaceMock::IPCWorkThreadInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+IPCWorkThreadInterfaceMock::~IPCWorkThreadInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static IPCWorkThreadInterface *GetIPCWorkThreadInterface()
+{
+    return reinterpret_cast<IPCWorkThreadInterface *>(g_interface);
+}
+
+extern "C" {
+IRemoteInvoker *IPCThreadSkeleton::GetRemoteInvoker(int proto)
+{
+    auto interface = GetIPCWorkThreadInterface();
+    if (interface == nullptr) {
+        return nullptr;
+    }
+    return interface->GetRemoteInvoker(proto);
+}
+
+ProcessSkeleton *ProcessSkeleton::GetInstance()
+{
+    auto interface = GetIPCWorkThreadInterface();
+    if (interface == nullptr) {
+        return nullptr;
+    }
+    return interface->GetInstance();
+}
+
+void DBinderDatabusInvoker::JoinProcessThread(bool initiative)
+{
+    auto interface = GetIPCWorkThreadInterface();
+    if (interface == nullptr) {
+        return;
+    }
+    interface->JoinProcessThread(initiative);
+}
+
+int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start_routine)(void *), void *arg)
+{
+    auto interface = GetIPCWorkThreadInterface();
+    if (interface == nullptr) {
+        return -1;
+    }
+    return interface->pthread_create(thread, attr, start_routine, arg);
+}
+
+int pthread_detach(pthread_t thread)
+{
+    auto interface = GetIPCWorkThreadInterface();
+    if (interface == nullptr) {
+        return -1;
+    }
+    return interface->pthread_detach(thread);
+}
+}
+
+/**
+ * @tc.name: JoinThread001
+ * @tc.desc: Verify the JoinThread function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, JoinThread001, TestSize.Level1)
+{
+    int proto = 1;
+    int policy = IPCWorkThread::PROCESS_ACTIVE + 1;
+    IPCWorkThread workThread(THREAD_NAME);
+    NiceMock<IPCWorkThreadInterfaceMock> mock;
+    DBinderDatabusInvoker *invoker = new (std::nothrow) DBinderDatabusInvoker();
+    EXPECT_NE(invoker, nullptr);
+    EXPECT_CALL(mock, GetRemoteInvoker(proto)).Times(1).WillOnce(Return(invoker));
+    workThread.JoinThread(proto, policy);
+    delete invoker;
+}
+
+/**
+ * @tc.name: JoinThread002
+ * @tc.desc: Verify the JoinThread function
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, JoinThread002, TestSize.Level1)
+{
+    int proto = 1;
+    int policy = IPCWorkThread::PROCESS_ACTIVE;
+    IPCWorkThread workThread(THREAD_NAME);
+    NiceMock<IPCWorkThreadInterfaceMock> mock;
+    DBinderDatabusInvoker *invoker = new (std::nothrow) DBinderDatabusInvoker();
+    EXPECT_NE(invoker, nullptr);
+    EXPECT_CALL(mock, GetRemoteInvoker(_)).Times(1).WillOnce(Return(invoker));
+    EXPECT_CALL(mock, JoinProcessThread(true)).Times(1);
+    workThread.JoinThread(proto, policy);
+    delete invoker;
+}
+
+/**
+ * @tc.name: ThreadHandler001
+ * @tc.desc: Verify the ThreadHandler function return nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, ThreadHandler001, TestSize.Level1)
+{
+    IPCWorkThread workThread(THREAD_NAME);
+    EXPECT_EQ(workThread.ThreadHandler(nullptr), nullptr);
+}
+
+/**
+ * @tc.name: ThreadHandler002
+ * @tc.desc: Verify the ThreadHandler function when process is nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, ThreadHandler002, TestSize.Level1)
+{
+    auto param = new (std::nothrow) IPCWorkThreadParam();
+    EXPECT_NE(param, nullptr);
+    IPCWorkThread workThread(THREAD_NAME);
+    NiceMock<IPCWorkThreadInterfaceMock> mock;
+    EXPECT_CALL(mock, GetInstance()).Times(1).WillOnce(Return(nullptr));
+    EXPECT_EQ(workThread.ThreadHandler(param), nullptr);
+}
+
+/**
+ * @tc.name: Start001
+ * @tc.desc: Verify the Start function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, Start001, TestSize.Level1)
+{
+    int policy = 0;
+    int proto = 0;
+    int threadIndex = 0;
+    NiceMock<IPCWorkThreadInterfaceMock> mock;
+    EXPECT_CALL(mock, GetInstance()).Times(1).WillOnce(Return(nullptr));
+    IPCWorkThread workThread(THREAD_NAME);
+    EXPECT_FALSE(workThread.Start(policy, proto, threadIndex));
+}
+
+/**
+ * @tc.name: Start002
+ * @tc.desc: Verify the Start function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, Start002, TestSize.Level1)
+{
+    int policy = 0;
+    int proto = 0;
+    int threadIndex = 0;
+    NiceMock<IPCWorkThreadInterfaceMock> mock;
+    std::shared_ptr<ProcessSkeleton> process = std::make_shared<ProcessSkeleton>();
+    EXPECT_NE(process, nullptr);
+    EXPECT_CALL(mock, GetInstance()).Times(1).WillOnce(Return(process.get()));
+    EXPECT_CALL(mock, pthread_create).Times(1).WillOnce(Return(-1));
+    IPCWorkThread workThread(THREAD_NAME);
+    EXPECT_FALSE(workThread.Start(policy, proto, threadIndex));
+}
+
+/**
+ * @tc.name: Start003
+ * @tc.desc: Verify the Start function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(IPCWorkThreadTest, Start003, TestSize.Level1)
+{
+    int policy = 0;
+    int proto = 0;
+    int threadIndex = 0;
+    NiceMock<IPCWorkThreadInterfaceMock> mock;
+    std::shared_ptr<ProcessSkeleton> process = std::make_shared<ProcessSkeleton>();
+    EXPECT_NE(process, nullptr);
+    EXPECT_CALL(mock, GetInstance()).Times(1).WillOnce(Return(process.get()));
+    EXPECT_CALL(mock, pthread_create).Times(1).WillOnce(Return(0));
+    EXPECT_CALL(mock, pthread_detach).Times(1).WillOnce(Return(-1));
+    IPCWorkThread workThread(THREAD_NAME);
+    EXPECT_FALSE(workThread.Start(policy, proto, threadIndex));
+}
+} // namespace OHOS
\ No newline at end of file
-- 
Gitee


From 06e652d0545f948c341bf23b976d6e066d733698 Mon Sep 17 00:00:00 2001
From: fanzhe <fanzhe001@chinasoftinc.com>
Date: Fri, 15 Aug 2025 14:33:36 +0800
Subject: [PATCH 02/15] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E6=B3=A8=E9=87=8A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: fanzhe <fanzhe001@chinasoftinc.com>
Change-Id: Ie2f4222bbe7fd7b08d3b4803c47da3f4f0778e5a
---
 dbinder/dbinder_service/src/dbinder_service.cpp        |  6 ++++++
 dbinder/dbinder_service/src/dbinder_service_stub.cpp   |  4 ++++
 .../src/socket/dbinder_remote_listener.cpp             |  2 ++
 ipc/native/c/rpc/src/rpc_feature_set.c                 |  4 ++++
 .../core/dbinder/source/databus_socket_listener.cpp    |  2 ++
 .../src/core/dbinder/source/dbinder_softbus_client.cpp |  2 ++
 .../src/core/framework/source/ipc_object_proxy.cpp     | 10 ++++++++--
 .../src/core/framework/source/ipc_object_stub.cpp      |  2 ++
 .../src/core/framework/source/ipc_process_skeleton.cpp |  4 ++++
 ipc/native/src/core/framework/source/ipc_skeleton.cpp  |  2 ++
 .../src/core/framework/source/ipc_thread_pool.cpp      |  2 ++
 .../src/core/framework/source/iremote_broker.cpp       |  2 ++
 .../src/core/framework/source/message_parcel.cpp       |  2 ++
 .../src/core/framework/source/process_skeleton.cpp     |  2 ++
 ipc/native/src/core/invoker/source/binder_invoker.cpp  |  6 ++++++
 ipc/native/src/core/invoker/source/invoker_rawdata.cpp |  4 ++++
 16 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/dbinder/dbinder_service/src/dbinder_service.cpp b/dbinder/dbinder_service/src/dbinder_service.cpp
index 3104b9ca..d5488cbd 100644
--- a/dbinder/dbinder_service/src/dbinder_service.cpp
+++ b/dbinder/dbinder_service/src/dbinder_service.cpp
@@ -97,6 +97,7 @@ bool DBinderService::StartDBinderService(std::shared_ptr<RpcSystemAbilityCallbac
     return true;
 }
 
+// LCOV_EXCL_START
 bool DBinderService::StartRemoteListener()
 {
     if (remoteListener_ != nullptr) {
@@ -118,6 +119,7 @@ bool DBinderService::StartRemoteListener()
     DBINDER_LOGI(LOG_LABEL, "start remote listener ok");
     return true;
 }
+// LCOV_EXCL_STOP
 
 // LCOV_EXCL_START
 bool DBinderService::ReStartRemoteListener()
@@ -620,11 +622,13 @@ bool DBinderService::CheckSystemAbilityId(int32_t systemAbilityId)
     return systemAbilityId >= FIRST_SYS_ABILITY_ID && systemAbilityId <= LAST_SYS_ABILITY_ID;
 }
 
+// LCOV_EXCL_START
 uint16_t DBinderService::AllocFreeSocketPort()
 {
     /* alloc port by system */
     return 0;
 }
+// LCOV_EXCL_STOP
 
 bool DBinderService::IsSameLoadSaItem(const std::string& srcNetworkId, int32_t systemAbilityId,
     std::shared_ptr<DHandleEntryTxRx> loadSaItem)
@@ -1458,10 +1462,12 @@ std::set<std::u16string> DBinderService::FindServicesByDeviceID(const std::strin
     return serviceNames;
 }
 
+// LCOV_EXCL_START
 uint32_t DBinderService::GetRemoteTransType()
 {
     return IRemoteObject::DATABUS_TYPE;
 }
+// LCOV_EXCL_STOP
 
 std::string DBinderService::ConvertToSecureDeviceID(const std::string &str)
 {
diff --git a/dbinder/dbinder_service/src/dbinder_service_stub.cpp b/dbinder/dbinder_service/src/dbinder_service_stub.cpp
index ef4f0c2c..11927a92 100644
--- a/dbinder/dbinder_service/src/dbinder_service_stub.cpp
+++ b/dbinder/dbinder_service/src/dbinder_service_stub.cpp
@@ -65,10 +65,12 @@ const std::string &DBinderServiceStub::GetDeviceID()
     return deviceID_;
 }
 
+// LCOV_EXCL_START
 binder_uintptr_t DBinderServiceStub::GetBinderObject() const
 {
     return binderObject_;
 }
+// LCOV_EXCL_STOP
 
 uint32_t DBinderServiceStub::GetPeerPid()
 {
@@ -361,6 +363,7 @@ int DBinderServiceStub::SaveDBinderData(const std::string &localBusName)
     return ERR_NONE;
 }
 
+// LCOV_EXCL_START
 bool DBinderServiceStub::CheckSessionObjectValidity()
 {
     sptr<DBinderService> dBinderService = DBinderService::GetInstance();
@@ -383,6 +386,7 @@ bool DBinderServiceStub::CheckSessionObjectValidity()
     }
     return true;
 }
+// LCOV_EXCL_STOP
 
 int DBinderServiceStub::GetAndSaveDBinderData(pid_t pid, uid_t uid)
 {
diff --git a/dbinder/dbinder_service/src/socket/dbinder_remote_listener.cpp b/dbinder/dbinder_service/src/socket/dbinder_remote_listener.cpp
index 45196ea3..7a624077 100644
--- a/dbinder/dbinder_service/src/socket/dbinder_remote_listener.cpp
+++ b/dbinder/dbinder_service/src/socket/dbinder_remote_listener.cpp
@@ -222,6 +222,7 @@ bool DBinderRemoteListener::StartListener()
 }
 // LCOV_EXCL_STOP
 
+// LCOV_EXCL_START
 bool DBinderRemoteListener::StopListener()
 {
     ClearDeviceLock();
@@ -235,6 +236,7 @@ bool DBinderRemoteListener::StopListener()
     DBinderSoftbusClient::GetInstance().Shutdown(listenSocketId_);
     return true;
 }
+// LCOV_EXCL_STOP
 
 std::shared_ptr<DeviceLock> DBinderRemoteListener::QueryOrNewDeviceLock(const std::string &networkId)
 {
diff --git a/ipc/native/c/rpc/src/rpc_feature_set.c b/ipc/native/c/rpc/src/rpc_feature_set.c
index 84f5838b..a670af85 100644
--- a/ipc/native/c/rpc/src/rpc_feature_set.c
+++ b/ipc/native/c/rpc/src/rpc_feature_set.c
@@ -40,10 +40,12 @@ static uint32_t GetFeatureATTag(void)
     return RPC_ACCESS_TOKEN_TAG;
 }
 
+// LCOV_EXCL_START
 uint32_t GetLocalRpcFeature(void)
 {
     return RPC_FEATURE_FLAG;
 }
+// LCOV_EXCL_STOP
 
 uint32_t GetRpcFeatureAck(void)
 {
@@ -60,10 +62,12 @@ bool IsFeatureAck(uint32_t featureSet)
     return (featureSet & RPC_FEATURE_ACK) > 0;
 }
 
+// LCOV_EXCL_START
 uint32_t GetTokenIdSize(void)
 {
     return TOKEN_ID_SIZE;
 }
+// LCOV_EXCL_STOP
 
 uint32_t GetFeatureSize(void)
 {
diff --git a/ipc/native/src/core/dbinder/source/databus_socket_listener.cpp b/ipc/native/src/core/dbinder/source/databus_socket_listener.cpp
index 620abfac..7a01e036 100644
--- a/ipc/native/src/core/dbinder/source/databus_socket_listener.cpp
+++ b/ipc/native/src/core/dbinder/source/databus_socket_listener.cpp
@@ -263,6 +263,7 @@ void DatabusSocketListener::EraseDeviceLock(DBinderSocketInfo info)
     }
 }
 
+// LCOV_EXCL_START
 void DatabusSocketListener::RemoveSessionName(void)
 {
     IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
@@ -272,6 +273,7 @@ void DatabusSocketListener::RemoveSessionName(void)
     }
     current->RemoveSoftbusServer();
 }
+// LCOV_EXCL_STOP
 
 bool DatabusSocketListener::GetPidAndUidFromServiceName(const std::string &serviceName, int32_t &pid, int32_t &uid)
 {
diff --git a/ipc/native/src/core/dbinder/source/dbinder_softbus_client.cpp b/ipc/native/src/core/dbinder/source/dbinder_softbus_client.cpp
index 01da705b..1911756e 100644
--- a/ipc/native/src/core/dbinder/source/dbinder_softbus_client.cpp
+++ b/ipc/native/src/core/dbinder/source/dbinder_softbus_client.cpp
@@ -43,6 +43,7 @@ DBinderSoftbusClient::~DBinderSoftbusClient()
     ZLOGI(LOG_LABEL, "destroy");
 }
 
+// LCOV_EXCL_START
 bool DBinderSoftbusClient::OpenSoftbusClientSo()
 {
     CHECK_INSTANCE_EXIT_WITH_RETVAL(exitFlag_, false);
@@ -63,6 +64,7 @@ bool DBinderSoftbusClient::OpenSoftbusClientSo()
 
     return true;
 }
+// LCOV_EXCL_STOP
 
 int32_t DBinderSoftbusClient::DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName)
 {
diff --git a/ipc/native/src/core/framework/source/ipc_object_proxy.cpp b/ipc/native/src/core/framework/source/ipc_object_proxy.cpp
index 96427d32..ca4f832a 100644
--- a/ipc/native/src/core/framework/source/ipc_object_proxy.cpp
+++ b/ipc/native/src/core/framework/source/ipc_object_proxy.cpp
@@ -646,6 +646,7 @@ int IPCObjectProxy::InvokeListenThread(MessageParcel &data, MessageParcel &reply
     return SendRequestInner(false, INVOKE_LISTEN_THREAD, data, reply, option);
 }
 
+// LCOV_EXCL_START
 uint32_t IPCObjectProxy::GetStrongRefCountForStub()
 {
     BinderInvoker *invoker = reinterpret_cast<BinderInvoker *>(IPCThreadSkeleton::GetDefaultInvoker());
@@ -655,21 +656,26 @@ uint32_t IPCObjectProxy::GetStrongRefCountForStub()
     }
     return invoker->GetStrongRefCountForStub(handle_);
 }
+// LCOV_EXCL_STOP
 
 #ifdef OHOS_PLATFORM
+// LCOV_EXCL_START
 bool IPCObjectProxy::CanPromote()
 {
     return (GetSptrRefCount() > 0);
 }
+// LCOV_EXCL_STOP
 #endif
 
 #ifndef CONFIG_IPC_SINGLE
+// LCOV_EXCL_START
 int IPCObjectProxy::UpdateProto()
 {
     int proto = GetProtoInfo();
     SetProto(proto);
     return proto;
 }
+// LCOV_EXCL_STOP
 
 bool IPCObjectProxy::UpdateProto(const void *dbinderData)
 {
@@ -967,7 +973,6 @@ int IPCObjectProxy::GetDBinderNegotiationData(int handle, MessageParcel &reply,
     return ERR_NONE;
 }
 
-// LCOV_EXCL_START
 bool IPCObjectProxy::UpdateDatabusClientSession(int handle, MessageParcel &reply)
 {
     DBinderNegotiationData dbinderData;
@@ -976,7 +981,6 @@ bool IPCObjectProxy::UpdateDatabusClientSession(int handle, MessageParcel &reply
     }
     return MakeDBinderTransSession(dbinderData);
 }
-// LCOV_EXCL_STOP
 
 int IPCObjectProxy::GetDBinderNegotiationData(DBinderNegotiationData &dbinderData)
 {
@@ -1133,6 +1137,7 @@ IPCObjectProxy::DeathRecipientAddrInfo::DeathRecipientAddrInfo(const sptr<DeathR
     soPath_ = GetNewSoPath();
 }
 
+// LCOV_EXCL_START
 std::string IPCObjectProxy::DeathRecipientAddrInfo::GetNewSoPath()
 {
     if (soFuncAddr_ == nullptr) {
@@ -1148,6 +1153,7 @@ std::string IPCObjectProxy::DeathRecipientAddrInfo::GetNewSoPath()
     }
     return info.dli_fname;
 }
+// LCOV_EXCL_STOP
 
 bool IPCObjectProxy::DeathRecipientAddrInfo::IsDlclosed()
 {
diff --git a/ipc/native/src/core/framework/source/ipc_object_stub.cpp b/ipc/native/src/core/framework/source/ipc_object_stub.cpp
index 392ffdca..b67e56b4 100644
--- a/ipc/native/src/core/framework/source/ipc_object_stub.cpp
+++ b/ipc/native/src/core/framework/source/ipc_object_stub.cpp
@@ -89,6 +89,7 @@ IPCObjectStub::IPCObjectStub(std::u16string descriptor, bool serialInvokeFlag)
     current->AttachValidObject(this, descriptor_);
 }
 
+// LCOV_EXCL_START
 IPCObjectStub::~IPCObjectStub()
 {
 #ifdef ENABLE_IPC_TRACE
@@ -104,6 +105,7 @@ IPCObjectStub::~IPCObjectStub()
     }
     current->DetachValidObject(this);
 }
+// LCOV_EXCL_STOP
 
 bool IPCObjectStub::IsDeviceIdIllegal(const std::string &deviceID)
 {
diff --git a/ipc/native/src/core/framework/source/ipc_process_skeleton.cpp b/ipc/native/src/core/framework/source/ipc_process_skeleton.cpp
index fe127021..39441830 100644
--- a/ipc/native/src/core/framework/source/ipc_process_skeleton.cpp
+++ b/ipc/native/src/core/framework/source/ipc_process_skeleton.cpp
@@ -789,6 +789,7 @@ std::thread::id IPCProcessSkeleton::GetIdleDataThread()
     return threadId;
 }
 
+// LCOV_EXCL_START
 int IPCProcessSkeleton::GetSocketIdleThreadNum() const
 {
     CHECK_INSTANCE_EXIT_WITH_RETVAL(exitFlag_, 0);
@@ -798,6 +799,7 @@ int IPCProcessSkeleton::GetSocketIdleThreadNum() const
 
     return 0;
 }
+// LCOV_EXCL_STOP
 
 // LCOV_EXCL_START
 int IPCProcessSkeleton::GetSocketTotalThreadNum() const
@@ -874,6 +876,7 @@ void IPCProcessSkeleton::AddDataThreadInWait(const std::thread::id &threadId)
     DeleteDataThreadFromIdle(threadId);
 }
 
+// LCOV_EXCL_START
 uint64_t IPCProcessSkeleton::GetSeqNumber()
 {
     CHECK_INSTANCE_EXIT_WITH_RETVAL(exitFlag_, 0);
@@ -884,6 +887,7 @@ uint64_t IPCProcessSkeleton::GetSeqNumber()
     seqNumber_++;
     return seqNumber_;
 }
+// LCOV_EXCL_STOP
 
 std::shared_ptr<ThreadMessageInfo> IPCProcessSkeleton::QueryThreadBySeqNumber(uint64_t seqNumber)
 {
diff --git a/ipc/native/src/core/framework/source/ipc_skeleton.cpp b/ipc/native/src/core/framework/source/ipc_skeleton.cpp
index 92375322..7948b69c 100644
--- a/ipc/native/src/core/framework/source/ipc_skeleton.cpp
+++ b/ipc/native/src/core/framework/source/ipc_skeleton.cpp
@@ -38,6 +38,7 @@ namespace OHOS {
 using namespace IPC_SINGLE;
 #endif
 
+// LCOV_EXCL_START
 static std::string GetSid()
 {
     char *con = nullptr;
@@ -49,6 +50,7 @@ static std::string GetSid()
     freecon(con);
     return context;
 }
+// LCOV_EXCL_STOP
 
 // LCOV_EXCL_START
 void IPCSkeleton::JoinWorkThread()
diff --git a/ipc/native/src/core/framework/source/ipc_thread_pool.cpp b/ipc/native/src/core/framework/source/ipc_thread_pool.cpp
index d1bc7e92..792aa764 100644
--- a/ipc/native/src/core/framework/source/ipc_thread_pool.cpp
+++ b/ipc/native/src/core/framework/source/ipc_thread_pool.cpp
@@ -33,6 +33,7 @@ static void *g_selfSoHandler = nullptr;
 static constexpr int32_t IDLE_SPAWN_ACTIVE_NUM = 1;
 
 // this func is called when ipc_single and ipc_core before loading
+// LCOV_EXCL_START
 extern "C" __attribute__((constructor)) void InitIpcSo()
 {
     if (g_selfSoHandler == nullptr) {
@@ -52,6 +53,7 @@ extern "C" __attribute__((constructor)) void InitIpcSo()
         }
     }
 }
+// LCOV_EXCL_STOP
 
 IPCWorkThreadPool::IPCWorkThreadPool(int maxThreadNum)
     : threadSequence_(0), maxThreadNum_(maxThreadNum + maxThreadNum),
diff --git a/ipc/native/src/core/framework/source/iremote_broker.cpp b/ipc/native/src/core/framework/source/iremote_broker.cpp
index 6327446f..76be8f42 100644
--- a/ipc/native/src/core/framework/source/iremote_broker.cpp
+++ b/ipc/native/src/core/framework/source/iremote_broker.cpp
@@ -38,6 +38,7 @@ BrokerRegistration &BrokerRegistration::Get()
     return instance;
 }
 
+// LCOV_EXCL_START
 BrokerRegistration::~BrokerRegistration()
 {
     std::lock_guard<std::mutex> lockGuard(creatorMutex_);
@@ -47,6 +48,7 @@ BrokerRegistration::~BrokerRegistration()
         object->isSoUnloaded = true;
     }
 }
+// LCOV_EXCL_STOP
 
 bool BrokerRegistration::Register(const std::u16string &descriptor, const Constructor &creator,
     const BrokerDelegatorBase *object)
diff --git a/ipc/native/src/core/framework/source/message_parcel.cpp b/ipc/native/src/core/framework/source/message_parcel.cpp
index 5faaa46d..6d46f7d0 100644
--- a/ipc/native/src/core/framework/source/message_parcel.cpp
+++ b/ipc/native/src/core/framework/source/message_parcel.cpp
@@ -645,8 +645,10 @@ void MessageParcel::PrintBuffer(const char *funcName, const size_t lineNum)
         ProcessSkeleton::ConvertAddr(this), format.c_str());
 }
 
+// LCOV_EXCL_START
 bool MessageParcel::IsOwner()
 {
     return isOwner_;
 }
+// LCOV_EXCL_STOP
 } // namespace OHOS
diff --git a/ipc/native/src/core/framework/source/process_skeleton.cpp b/ipc/native/src/core/framework/source/process_skeleton.cpp
index f7fc8b5f..e6f3d6ab 100644
--- a/ipc/native/src/core/framework/source/process_skeleton.cpp
+++ b/ipc/native/src/core/framework/source/process_skeleton.cpp
@@ -481,6 +481,7 @@ void ProcessSkeleton::DecreaseThreadCount()
     }
 }
 
+// LCOV_EXCL_START
 void ProcessSkeleton::NotifyChildThreadStop()
 {
     // set child thread exit flag
@@ -503,4 +504,5 @@ void ProcessSkeleton::NotifyChildThreadStop()
     }
     ZLOGD(LOG_LABEL, "wait finished, all child thread have exited");
 }
+// LCOV_EXCL_STOP
 } // namespace OHOS
\ No newline at end of file
diff --git a/ipc/native/src/core/invoker/source/binder_invoker.cpp b/ipc/native/src/core/invoker/source/binder_invoker.cpp
index 1da92858..df701131 100644
--- a/ipc/native/src/core/invoker/source/binder_invoker.cpp
+++ b/ipc/native/src/core/invoker/source/binder_invoker.cpp
@@ -874,6 +874,7 @@ void BinderInvoker::OnRemoveRecipientDone()
 }
 // LCOV_EXCL_STOP
 
+// LCOV_EXCL_START
 void BinderInvoker::OnSpawnThread()
 {
     IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
@@ -883,6 +884,7 @@ void BinderInvoker::OnSpawnThread()
     }
     current->SpawnThread();
 }
+// LCOV_EXCL_STOP
 
 void BinderInvoker::OnTransaction(uint32_t cmd, int32_t &error)
 {
@@ -1406,6 +1408,7 @@ uint64_t BinderInvoker::GetSelfTokenID() const
 }
 // LCOV_EXCL_STOP
 
+// LCOV_EXCL_START
 uint64_t BinderInvoker::GetSelfFirstCallerTokenID() const
 {
     if ((binderConnector_ == nullptr) || (!binderConnector_->IsDriverAlive())) {
@@ -1414,6 +1417,7 @@ uint64_t BinderInvoker::GetSelfFirstCallerTokenID() const
     uint64_t selfFirstCallerTokenId = binderConnector_->GetSelfFirstCallerTokenID();
     return (selfFirstCallerTokenId == 0) ? static_cast<uint32_t>(getuid()) : selfFirstCallerTokenId;
 }
+// LCOV_EXCL_STOP
 
 uint32_t BinderInvoker::GetStatus()
 {
@@ -1728,6 +1732,7 @@ bool BinderInvoker::IsSendRequesting()
 }
 // LCOV_EXCL_STOP
 
+// LCOV_EXCL_START
 void BinderInvoker::ProcDeferredDecRefs()
 {
     if (input_.GetReadableBytes() > 0) {
@@ -1762,6 +1767,7 @@ void BinderInvoker::ProcDeferredDecRefs()
         decStrongRefs_.clear();
     }
 }
+// LCOV_EXCL_STOP
 
 bool BinderInvoker::GetUint64ValueByStrSlice(const std::string &str, size_t offset, size_t length, uint64_t &value)
 {
diff --git a/ipc/native/src/core/invoker/source/invoker_rawdata.cpp b/ipc/native/src/core/invoker/source/invoker_rawdata.cpp
index 9933c858..c9b55be6 100644
--- a/ipc/native/src/core/invoker/source/invoker_rawdata.cpp
+++ b/ipc/native/src/core/invoker/source/invoker_rawdata.cpp
@@ -40,13 +40,17 @@ InvokerRawData::~InvokerRawData()
     data_ = nullptr;
 }
 
+// LCOV_EXCL_START
 std::shared_ptr<char> InvokerRawData::GetData() const
 {
     return data_;
 }
+// LCOV_EXCL_STOP
 
+// LCOV_EXCL_START
 size_t InvokerRawData::GetSize() const
 {
     return size_;
 }
+// LCOV_EXCL_STOP
 } // namespace OHOS
\ No newline at end of file
-- 
Gitee


From f5124e331f20cf0e54f1e6e4ef0b4dba5b20faf1 Mon Sep 17 00:00:00 2001
From: al9503 <houwenlong001@chinasoftinc.com>
Date: Fri, 8 Aug 2025 15:36:34 +0800
Subject: [PATCH 03/15] =?UTF-8?q?=E8=A1=A5=E5=85=85fuzz?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: al9503 <houwenlong001@chinasoftinc.com>
Change-Id: Ieaacc38cd73321341c00c3ef46b9deee0e53303e
---
 test/fuzztest/BUILD.gn                        |   1 +
 .../databussocketlistener_fuzzer.cpp          |  39 +-
 .../dbinderdatabusinvoker_fuzzer.cpp          | 524 ++++++++++++++++++
 .../databussocketlistenermock_fuzzer/BUILD.gn |  35 ++
 .../corpus/init                               |  16 +
 .../databussocketlistenermock_fuzzer.cpp      | 298 ++++++++++
 .../databussocketlistenermock_fuzzer.h        |  29 +
 .../project.xml                               |  25 +
 8 files changed, 966 insertions(+), 1 deletion(-)
 create mode 100644 test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.h
 create mode 100644 test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/project.xml

diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn
index 24fa5ec7..f072c394 100644
--- a/test/fuzztest/BUILD.gn
+++ b/test/fuzztest/BUILD.gn
@@ -21,6 +21,7 @@ group("fuzztest") {
     "ipc/native/src/core/binderinvokernew_fuzzer:BinderInvokerNewFuzzTest",
     "ipc/native/src/core/bufferobject_fuzzer:BufferObjectFuzzTest",
     "ipc/native/src/core/databussocketlistener_fuzzer:DataBusSocketListenerFuzzTest",
+    "ipc/native/src/mock/databussocketlistenermock_fuzzer:DataBusSocketListenerMockFuzzTest",
     "ipc/native/src/core/dbindercallbackstub_fuzzer:DBinderCallBackStubFuzzTest",
     "ipc/native/src/core/dbinderdatabusinvoker_fuzzer:DBinderDatabusInvokerFuzzTest",
     "ipc/native/src/core/dbindergrantpermission_fuzzer:DBinderGrantPermissionFuzzTest",
diff --git a/test/fuzztest/ipc/native/src/core/databussocketlistener_fuzzer/databussocketlistener_fuzzer.cpp b/test/fuzztest/ipc/native/src/core/databussocketlistener_fuzzer/databussocketlistener_fuzzer.cpp
index 6f310c74..4c891ac9 100644
--- a/test/fuzztest/ipc/native/src/core/databussocketlistener_fuzzer/databussocketlistener_fuzzer.cpp
+++ b/test/fuzztest/ipc/native/src/core/databussocketlistener_fuzzer/databussocketlistener_fuzzer.cpp
@@ -14,7 +14,7 @@
  */
 
 #include "databussocketlistener_fuzzer.h"
-
+#include <fuzzer/FuzzedDataProvider.h>
 #define private public
 #define protected public
 #include "databus_socket_listener.h"
@@ -25,6 +25,7 @@
 using OHOS::DatabusSocketListener;
 
 namespace OHOS {
+static constexpr size_t STR_MAX_LEN = 100;
 static std::string TEST_SOCKET_NAME = "DBinder1_1";
 static std::string TEST_SOCKET_PEER_NAME = "DBinderService";
 static std::string TEST_SOCKET_PEER_NETWORKID = "wad213hkad213jh123jk213j1h2312h3jk12dadadeawd721hledhjlad22djhla";
@@ -240,6 +241,38 @@ static void EraseDeviceLockFuzzTest(const uint8_t *data, size_t size)
     listener->EraseDeviceLock(info3);
     listener->RemoveSessionName();
 }
+
+static void ClientOnBindFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    std::string name = provider.ConsumeRandomLengthString(STR_MAX_LEN);
+    std::string networkId = provider.ConsumeRandomLengthString(STR_MAX_LEN);
+    std::string pkgName = provider.ConsumeRandomLengthString(STR_MAX_LEN);
+    int32_t dataType = provider.ConsumeIntegral<int32_t>();
+    PeerSocketInfo info = {
+        .name = const_cast<char *>(name.c_str()),
+        .networkId = const_cast<char *>(networkId.c_str()),
+        .pkgName = const_cast<char *>(pkgName.c_str()),
+        .dataType = static_cast<TransDataType>(dataType),
+    };
+    listener->ClientOnBind(socketId, info);
+}
+
+static void GetPidAndUidFromServiceNameFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    std::string serviceName = provider.ConsumeRandomLengthString(STR_MAX_LEN);
+    int32_t pid = provider.ConsumeIntegral<int32_t>();
+    int32_t uid = provider.ConsumeIntegral<int32_t>();
+    listener->GetPidAndUidFromServiceName(serviceName, pid, uid);
+}
 } // namespace OHOS
 
 /* Fuzzer entry point */
@@ -256,5 +289,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::CreateClientSocketFuzzTest(data, size);
     OHOS::ShutdownSocketFuzzTest(data, size);
     OHOS::EraseDeviceLockFuzzTest(data, size);
+
+    FuzzedDataProvider provider(data, size);
+    OHOS::ClientOnBindFuzzTest(provider);
+    OHOS::GetPidAndUidFromServiceNameFuzzTest(provider);
     return 0;
 }
diff --git a/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp b/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp
index 82aeb79f..4f22d01e 100644
--- a/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp
+++ b/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp
@@ -14,6 +14,7 @@
  */
 
 #include "dbinderdatabusinvoker_fuzzer.h"
+#include <fuzzer/FuzzedDataProvider.h>
 #define private public
 #define protected public
 #include "dbinder_base_invoker_process.h"
@@ -25,6 +26,9 @@
 using OHOS::DatabusSocketListener;
 
 namespace OHOS {
+
+static constexpr size_t MAX_STR_LEN = 100;
+
 static void AcquireHandleFuzzTest(const uint8_t *data, size_t size)
 {
     if (data == nullptr || size < sizeof(int32_t)) {
@@ -458,6 +462,498 @@ static void CheckTransactionDataFuzzTest(const uint8_t *data, size_t size)
     (void)invoker.CheckTransactionData(tr);
     delete tr;
 }
+
+dbinder_transaction_data CreateDbinderTransactionData(FuzzedDataProvider &provider)
+{
+    dbinder_transaction_data data;
+    data.sizeOfSelf = sizeof(dbinder_transaction_data);
+    data.magic = provider.ConsumeIntegral<__u32>();
+    data.version = provider.ConsumeIntegral<__u32>();
+    data.cmd = provider.ConsumeIntegral<int>();
+    data.code = provider.ConsumeIntegral<__u32>();
+    data.flags = provider.ConsumeIntegral<__u32>();
+    data.cookie = provider.ConsumeIntegral<__u64>();
+    data.seqNumber = provider.ConsumeIntegral<__u64>();
+    data.buffer_size = provider.ConsumeIntegral<binder_size_t>();
+    data.offsets_size = provider.ConsumeIntegral<binder_size_t>();
+    data.offsets = provider.ConsumeIntegral<binder_uintptr_t>();
+    return data;
+}
+
+std::shared_ptr<DBinderSessionObject> CreateDBinderSessionObject(FuzzedDataProvider &provider)
+{
+    std::string serviceName = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    std::string serverDeviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    uint64_t stubIndex = provider.ConsumeIntegral<uint64_t>();
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+    return std::make_shared<DBinderSessionObject>(serviceName, serverDeviceId, stubIndex, nullptr, tokenId);
+}
+
+void GetSessionForProxyFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> session = CreateDBinderSessionObject(provider);
+    sptr<IPCObjectProxy> ipcProxy = sptr<IPCObjectProxy>::MakeSptr(handle);
+    if (session == nullptr || ipcProxy == nullptr) {
+        return;
+    }
+    std::string localDeviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    DBinderDatabusInvoker invoker;
+    invoker.GetSessionForProxy(ipcProxy, session, localDeviceId);
+}
+
+void QueryClientSessionObjectFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t databusHandle = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.QueryClientSessionObject(databusHandle);
+}
+
+void QueryServerSessionObjectFuzzTest(FuzzedDataProvider &provider)
+{
+    IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
+    if (current == nullptr) {
+        return;
+    }
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> object = CreateDBinderSessionObject(provider);
+    if (object == nullptr) {
+        return;
+    }
+    current->ProxyAttachDBinderSession(handle, object);
+    DBinderDatabusInvoker invoker;
+    invoker.QueryServerSessionObject(handle);
+}
+
+void OnReceiveNewConnectionFuzzTest(FuzzedDataProvider &provider)
+{
+    IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
+    if (current == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    int peerPid = provider.ConsumeIntegral<int>();
+    int peerUid = provider.ConsumeIntegral<int>();
+    std::string peerName = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    int32_t tokenId = provider.ConsumeIntegral<int32_t>();
+    std::string deviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    sptr<IPCObjectStub> stub = sptr<IPCObjectStub>::MakeSptr();
+    if (stub == nullptr) {
+        return;
+    }
+    current->AttachCommAuthInfo(stub.GetRefPtr(), peerPid, peerUid, tokenId, deviceId);
+    DBinderDatabusInvoker invoker;
+    invoker.OnReceiveNewConnection(socketId, peerPid, peerUid, peerName, deviceId);
+}
+
+void OnRawDataAvailableFuzzTest(FuzzedDataProvider &provider)
+{
+    size_t bytesSize = provider.ConsumeIntegralInRange<size_t>(0, MAX_RAWDATA_SIZE);
+    std::vector<char> bytes = provider.ConsumeBytes<char>(bytesSize);
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    uint64_t seqNumber = provider.ConsumeIntegral<uint64_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.OnRawDataAvailable(socketId, seqNumber, bytes.data(), bytes.size());
+}
+
+void OnSendMessageFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DBinderSessionObject> sessionOfPeer = CreateDBinderSessionObject(provider);
+    if (sessionOfPeer == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.OnSendMessage(nullptr);
+    invoker.OnSendMessage(sessionOfPeer);
+}
+
+void SendDataFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<BufferObject> sessionBuff = std::make_shared<BufferObject>();
+    if (sessionBuff == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.SendData(sessionBuff, socketId);
+}
+
+void OnSendRawDataFuzzTest(FuzzedDataProvider &provider)
+{
+    size_t bytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(bytesSize);
+    std::shared_ptr<DBinderSessionObject> session = CreateDBinderSessionObject(provider);
+    if (session == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    session->SetSocketId(socketId);
+    DBinderDatabusInvoker invoker;
+    invoker.OnSendRawData(nullptr, bytes.data(), bytes.size());
+    invoker.OnSendRawData(session, bytes.data(), bytes.size());
+}
+
+void FlattenSessionFuzzTest(FuzzedDataProvider &provider)
+{
+    FlatDBinderSession flatSession;
+    std::shared_ptr<DBinderSessionObject> connectSession = CreateDBinderSessionObject(provider);
+    if (connectSession == nullptr) {
+        return;
+    }
+    std::string deviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    connectSession->SetDeviceId(deviceId);
+    uint32_t binderVersion = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.FlattenSession(reinterpret_cast<unsigned char *>(&flatSession), connectSession, binderVersion);
+}
+
+void UnFlattenSessionFuzzTest(FuzzedDataProvider &provider)
+{
+    FlatDBinderSession flatSession;
+    flatSession.stubIndex = provider.ConsumeIntegral<uint64_t>();
+    flatSession.version = provider.ConsumeIntegral<uint16_t>();
+    flatSession.magic = provider.ConsumeIntegral<uint32_t>();
+    flatSession.tokenId = provider.ConsumeIntegral<uint32_t>();
+    uint32_t binderVersion = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.UnFlattenSession(reinterpret_cast<unsigned char *>(&flatSession), binderVersion);
+}
+
+void UpdateClientSessionFuzzTest(FuzzedDataProvider &provider)
+{
+    IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
+    if (current == nullptr) {
+        return;
+    }
+    current->sessionName_ = provider.ConsumeRandomLengthString();
+    std::shared_ptr<DBinderSessionObject> sessionObject = CreateDBinderSessionObject(provider);
+    if (sessionObject == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.UpdateClientSession(sessionObject);
+}
+
+void OnDatabusSessionClientSideClosedFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.OnDatabusSessionClientSideClosed(socketId);
+}
+
+void OnDatabusSessionServerSideClosedFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.OnDatabusSessionServerSideClosed(socketId);
+}
+
+void QueryHandleBySessionFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DBinderSessionObject> session = CreateDBinderSessionObject(provider);
+    if (session == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.QueryHandleBySession(session);
+}
+
+void SetClientFdFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t fd = provider.ConsumeIntegral<int32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.SetClientFd(fd);
+}
+
+void SetCallerDeviceIDFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string deviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    DBinderDatabusInvoker invoker;
+    invoker.SetCallerDeviceID(deviceId);
+}
+
+void SetCallerTokenIDFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.SetCallerTokenID(tokenId);
+}
+
+void CheckAndSetCallerInfoFuzzTest(FuzzedDataProvider &provider)
+{
+    IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
+    if (current == nullptr) {
+        return;
+    }
+    uint32_t socketId = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> object = CreateDBinderSessionObject(provider);
+    if (object == nullptr) {
+        return;
+    }
+    uint64_t stubIndex = object->GetStubIndex();
+    DBinderDatabusInvoker invoker;
+    invoker.CheckAndSetCallerInfo(socketId, stubIndex);
+    current->StubAttachDBinderSession(socketId, object);
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t tokenId = object->GetTokenId();
+    std::string deviceId = object->GetDeviceId();
+    int32_t listenFd = provider.ConsumeIntegral<int32_t>();
+    current->AttachAppInfoToStubIndex(pid, uid, tokenId, deviceId, stubIndex, listenFd);
+    invoker.CheckAndSetCallerInfo(socketId, stubIndex);
+}
+
+void SetCallerInfoFuzzTest(FuzzedDataProvider &provider)
+{
+    DBinderDatabusInvoker::DBinderBaseInvoker::DBinderCallerInfo callerInfo;
+    callerInfo.callerPid = provider.ConsumeIntegral<pid_t>();
+    callerInfo.callerUid = provider.ConsumeIntegral<pid_t>();
+    callerInfo.clientFd = provider.ConsumeIntegral<int32_t>();
+    callerInfo.callerTokenID = provider.ConsumeIntegral<uint64_t>();
+    callerInfo.firstTokenID = provider.ConsumeIntegral<uint64_t>();
+    callerInfo.callerDeviceID = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    DBinderDatabusInvoker invoker;
+    invoker.SetCallerInfo(callerInfo);
+}
+
+void ConnectRemoteObject2SessionFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    sptr<IPCObjectProxy> object = sptr<IPCObjectProxy>::MakeSptr(handle);
+    if (object == nullptr) {
+        return;
+    }
+    uint64_t stubIndex = provider.ConsumeIntegral<uint64_t>();
+    std::shared_ptr<DBinderSessionObject> sessionObject = CreateDBinderSessionObject(provider);
+    if (sessionObject == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.ConnectRemoteObject2Session(object.GetRefPtr(), stubIndex, nullptr);
+    invoker.ConnectRemoteObject2Session(object.GetRefPtr(), stubIndex, sessionObject);
+}
+
+void FlushCommandsFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    sptr<IPCObjectProxy> object = sptr<IPCObjectProxy>::MakeSptr(handle);
+    if (object == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.FlushCommands(nullptr);
+    invoker.FlushCommands(object.GetRefPtr());
+}
+
+void HasRawDataPackageFuzzTest(FuzzedDataProvider &provider)
+{
+    dbinder_transaction_data data = CreateDbinderTransactionData(provider);
+    DBinderDatabusInvoker invoker;
+    invoker.HasRawDataPackage(reinterpret_cast<const char *>(&data), sizeof(dbinder_transaction_data));
+}
+
+void HasCompletePackageFuzzTest(FuzzedDataProvider &provider)
+{
+    dbinder_transaction_data data = CreateDbinderTransactionData(provider);
+    uint32_t readCursor = 0;
+    DBinderDatabusInvoker invoker;
+    invoker.HasCompletePackage(reinterpret_cast<const char *>(&data), readCursor, sizeof(dbinder_transaction_data));
+}
+
+void NewSessionOfBinderProxyFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> session = CreateDBinderSessionObject(provider);
+    if (session == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.NewSessionOfBinderProxy(handle, nullptr);
+    invoker.NewSessionOfBinderProxy(handle, session);
+}
+
+void MakeDefaultServerSessionObjectFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DBinderSessionObject> sessionObject = CreateDBinderSessionObject(provider);
+    if (sessionObject == nullptr) {
+        return;
+    }
+    uint64_t stubIndex = sessionObject->GetStubIndex();
+    DBinderDatabusInvoker invoker;
+    invoker.MakeDefaultServerSessionObject(stubIndex, sessionObject);
+}
+
+void SetCallingIdentityFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string identity = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    bool flag = provider.ConsumeBool();
+    DBinderDatabusInvoker invoker;
+    invoker.SetCallingIdentity(identity, flag);
+}
+
+void CreateServerSessionObjectFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string serviceName = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    std::string serverDeviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    uint64_t stubIndex = provider.ConsumeIntegral<uint64_t>();
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> dbinderSession =
+        std::make_shared<DBinderSessionObject>(serviceName, serverDeviceId, stubIndex, nullptr, tokenId);
+    if (dbinderSession == nullptr) {
+        return;
+    }
+    binder_uintptr_t binder = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    DBinderDatabusInvoker invoker;
+    invoker.CreateServerSessionObject(binder, dbinderSession);
+}
+
+void MakeStubIndexByRemoteObjectFuzzTest(FuzzedDataProvider &provider)
+{
+    int handle = provider.ConsumeIntegral<int>();
+    int proto = provider.ConsumeIntegral<int>();
+    sptr<IRemoteObject> obj = new (std::nothrow) IPCObjectProxy(handle, u"proxyTest", proto);
+    if (obj == nullptr) {
+        return;
+    }
+    DBinderDatabusInvoker invoker;
+    invoker.MakeStubIndexByRemoteObject(obj.GetRefPtr());
+}
+
+void GetCallerInfoFuzzTest(FuzzedDataProvider &provider)
+{
+    DBinderDatabusInvoker::DBinderBaseInvoker::DBinderCallerInfo callerInfo;
+    callerInfo.callerPid = provider.ConsumeIntegral<pid_t>();
+    callerInfo.callerUid = provider.ConsumeIntegral<pid_t>();
+    callerInfo.clientFd = provider.ConsumeIntegral<int32_t>();
+    callerInfo.callerTokenID = provider.ConsumeIntegral<uint64_t>();
+    callerInfo.firstTokenID = provider.ConsumeIntegral<uint64_t>();
+    callerInfo.callerDeviceID = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    DBinderDatabusInvoker invoker;
+    invoker.GetCallerInfo(callerInfo);
+}
+
+void SetCallerPidFuzzTest(FuzzedDataProvider &provider)
+{
+    pid_t pid = provider.ConsumeIntegral<pid_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.SetCallerPid(pid);
+}
+
+void SetCallerUidFuzzTest(FuzzedDataProvider &provider)
+{
+    pid_t uid = provider.ConsumeIntegral<pid_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.SetCallerUid(uid);
+}
+
+void SetStatusFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t status = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.SetStatus(status);
+}
+
+void WriteFileDescriptorFuzzTest(FuzzedDataProvider &provider)
+{
+    Parcel parcel;
+    int fd = provider.ConsumeIntegral<int>();
+    bool takeOwnership = provider.ConsumeBool();
+    DBinderDatabusInvoker invoker;
+    invoker.WriteFileDescriptor(parcel, fd, takeOwnership);
+}
+
+void QuerySessionOfBinderProxyFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string serviceName = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    std::string serverDeviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    uint64_t stubIndex = provider.ConsumeIntegral<uint64_t>();
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> dbinderSession =
+        std::make_shared<DBinderSessionObject>(serviceName, serverDeviceId, stubIndex, nullptr, tokenId);
+    if (dbinderSession == nullptr) {
+        return;
+    }
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.QuerySessionOfBinderProxy(handle, dbinderSession);
+}
+
+void AuthSession2ProxyFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string serviceName = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    std::string serverDeviceId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    uint64_t stubIndex = provider.ConsumeIntegral<uint64_t>();
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+    std::shared_ptr<DBinderSessionObject> dbinderSession =
+        std::make_shared<DBinderSessionObject>(serviceName, serverDeviceId, stubIndex, nullptr, tokenId);
+    if (dbinderSession == nullptr) {
+        return;
+    }
+    uint32_t handle = provider.ConsumeIntegral<uint32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.AuthSession2Proxy(handle, nullptr);
+    invoker.AuthSession2Proxy(handle, dbinderSession);
+}
+
+void OnMessageAvailableFuzzTest(FuzzedDataProvider &provider)
+{
+    dbinder_transaction_data data;
+    data.magic = provider.ConsumeIntegral<uint32_t>();
+    data.cmd = provider.ConsumeIntegral<int>();
+    data.sizeOfSelf = sizeof(dbinder_transaction_data);
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.OnMessageAvailable(socketId, reinterpret_cast<const char *>(&data), sizeof(dbinder_transaction_data));
+}
+
+void HasRawDataPackageFuzzTest001(FuzzedDataProvider &provider)
+{
+    dbinder_transaction_data data;
+    data.magic = DBINDER_MAGICWORD;
+    data.cmd = BC_SEND_RAWDATA;
+    data.sizeOfSelf = provider.ConsumeIntegral<uint32_t>();
+    ssize_t len = provider.ConsumeIntegral<ssize_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.HasRawDataPackage(reinterpret_cast<const char *>(&data), len);
+
+    data.sizeOfSelf = sizeof(dbinder_transaction_data);
+    invoker.HasRawDataPackage(reinterpret_cast<const char *>(&data), sizeof(dbinder_transaction_data));
+}
+
+void HasCompletePackageFuzzTest001(FuzzedDataProvider &provider)
+{
+    dbinder_transaction_data data;
+    data.magic = DBINDER_MAGICWORD;
+    data.sizeOfSelf = provider.ConsumeIntegral<uint32_t>();
+    data.buffer_size = provider.ConsumeIntegral<binder_size_t>();
+    data.offsets = provider.ConsumeIntegral<binder_uintptr_t>();
+    data.flags = provider.ConsumeIntegral<uint32_t>();
+    data.offsets_size = provider.ConsumeIntegral<binder_size_t>();
+    uint32_t readCursor = 0;
+    ssize_t len = provider.ConsumeIntegral<ssize_t>();
+    DBinderDatabusInvoker invoker;
+    invoker.HasCompletePackage(reinterpret_cast<const char *>(&data), readCursor, sizeof(len));
+
+    data.sizeOfSelf = sizeof(dbinder_transaction_data);
+    invoker.HasCompletePackage(reinterpret_cast<const char *>(&data), readCursor, sizeof(dbinder_transaction_data));
+}
+
+void DBinderDatabusInvokerTwoFuzzTest(FuzzedDataProvider &provider)
+{
+    OHOS::SetCallingIdentityFuzzTest(provider);
+    OHOS::CreateServerSessionObjectFuzzTest(provider);
+    OHOS::MakeStubIndexByRemoteObjectFuzzTest(provider);
+    OHOS::GetCallerInfoFuzzTest(provider);
+    OHOS::SetCallerPidFuzzTest(provider);
+    OHOS::SetCallerUidFuzzTest(provider);
+    OHOS::SetStatusFuzzTest(provider);
+    OHOS::WriteFileDescriptorFuzzTest(provider);
+    OHOS::QuerySessionOfBinderProxyFuzzTest(provider);
+    OHOS::AuthSession2ProxyFuzzTest(provider);
+    OHOS::OnMessageAvailableFuzzTest(provider);
+    OHOS::HasRawDataPackageFuzzTest001(provider);
+    OHOS::HasCompletePackageFuzzTest001(provider);
+}
 } // namespace OHOS
 
 /* Fuzzer entry point */
@@ -483,5 +979,33 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::MakeThreadProcessInfoFuzzTest(data, size);
     OHOS::ProcessTransactionFuzzTest(data, size);
     OHOS::CheckTransactionDataFuzzTest(data, size);
+
+    FuzzedDataProvider provider(data, size);
+    OHOS::GetSessionForProxyFuzzTest(provider);
+    OHOS::QueryClientSessionObjectFuzzTest(provider);
+    OHOS::QueryServerSessionObjectFuzzTest(provider);
+    OHOS::OnReceiveNewConnectionFuzzTest(provider);
+    OHOS::OnRawDataAvailableFuzzTest(provider);
+    OHOS::OnSendMessageFuzzTest(provider);
+    OHOS::SendDataFuzzTest(provider);
+    OHOS::OnSendRawDataFuzzTest(provider);
+    OHOS::FlattenSessionFuzzTest(provider);
+    OHOS::UnFlattenSessionFuzzTest(provider);
+    OHOS::UpdateClientSessionFuzzTest(provider);
+    OHOS::OnDatabusSessionClientSideClosedFuzzTest(provider);
+    OHOS::OnDatabusSessionServerSideClosedFuzzTest(provider);
+    OHOS::QueryHandleBySessionFuzzTest(provider);
+    OHOS::SetClientFdFuzzTest(provider);
+    OHOS::SetCallerDeviceIDFuzzTest(provider);
+    OHOS::SetCallerTokenIDFuzzTest(provider);
+    OHOS::CheckAndSetCallerInfoFuzzTest(provider);
+    OHOS::SetCallerInfoFuzzTest(provider);
+    OHOS::ConnectRemoteObject2SessionFuzzTest(provider);
+    OHOS::FlushCommandsFuzzTest(provider);
+    OHOS::HasRawDataPackageFuzzTest(provider);
+    OHOS::HasCompletePackageFuzzTest(provider);
+    OHOS::NewSessionOfBinderProxyFuzzTest(provider);
+    OHOS::MakeDefaultServerSessionObjectFuzzTest(provider);
+    OHOS::DBinderDatabusInvokerTwoFuzzTest(provider);
     return 0;
 }
diff --git a/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/BUILD.gn
new file mode 100644
index 00000000..bd384bb9
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/BUILD.gn
@@ -0,0 +1,35 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DataBusSocketListenerMockFuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../databussocketlistenermock_fuzzer"
+
+  include_dirs = [ "../../../../../../../utils/include" ]
+
+  sources = [ "databussocketlistenermock_fuzzer.cpp" ]
+
+  deps = [ "../../../../../../../interfaces/innerkits/ipc_single:ipc_single_test" ]
+
+  external_deps = [
+    "c_utils:utils",
+    "hilog:libhilog",
+    "googletest:gmock",
+    "googletest:gtest",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.cpp
new file mode 100644
index 00000000..ec4de3ff
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "databussocketlistenermock_fuzzer.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include "databus_socket_listener.h"
+#include "dbinder_softbus_client.h"
+#include "ipc_process_skeleton.h"
+#include "ipc_thread_skeleton.h"
+#include "string_ex.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+const static size_t MAX_STRING_PARAM_LEN = 100;
+
+class DataBusSocketListenerInterface {
+public:
+    DataBusSocketListenerInterface() {};
+    virtual ~DataBusSocketListenerInterface() {};
+
+    virtual int32_t Socket(SocketInfo info) = 0;
+    virtual int32_t Listen(int32_t socket, const QosTV qos[], uint32_t qosCount,
+        const ISocketListener *listener) = 0;
+    virtual IPCProcessSkeleton *GetCurrent();
+    virtual int32_t Bind(int32_t socket, const QosTV qos[], uint32_t qosCount,
+        const ISocketListener *listener) = 0;
+    virtual IRemoteInvoker *GetRemoteInvoker(int proto);
+};
+
+class DataBusSocketListenerInterfaceMock : public DataBusSocketListenerInterface {
+public:
+    DataBusSocketListenerInterfaceMock();
+    ~DataBusSocketListenerInterfaceMock() override;
+    MOCK_METHOD1(Socket, int32_t(SocketInfo));
+    MOCK_METHOD4(Listen, int32_t(int32_t, const QosTV*, uint32_t, const ISocketListener *));
+    MOCK_METHOD0(GetCurrent, IPCProcessSkeleton*());
+    MOCK_METHOD4(Bind, int32_t(int32_t, const QosTV*, uint32_t, const ISocketListener *));
+    MOCK_METHOD1(GetRemoteInvoker, IRemoteInvoker *(int));
+};
+
+static void *g_interface = nullptr;
+
+DataBusSocketListenerInterfaceMock::DataBusSocketListenerInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DataBusSocketListenerInterfaceMock::~DataBusSocketListenerInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DataBusSocketListenerInterface *GetDataBusSocketListenerInterface()
+{
+    return reinterpret_cast<DataBusSocketListenerInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    int32_t DBinderSoftbusClient::Socket(SocketInfo info)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDataBusSocketListenerInterface()->Socket(info);
+    }
+
+    int32_t DBinderSoftbusClient::Listen(
+        int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDataBusSocketListenerInterface()->Listen(socket, qos, qosCount, listener);
+    }
+
+    IPCProcessSkeleton *IPCProcessSkeleton::GetCurrent()
+    {
+        if (g_interface == nullptr) {
+            return nullptr;
+        }
+        return GetDataBusSocketListenerInterface()->GetCurrent();
+    }
+
+    int32_t DBinderSoftbusClient::Bind(int32_t socket, const QosTV qos[], uint32_t qosCount,
+        const ISocketListener *listener)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDataBusSocketListenerInterface()->Bind(socket, qos, qosCount, listener);
+    }
+
+    IRemoteInvoker *IPCThreadSkeleton::GetRemoteInvoker(int proto)
+    {
+        if (g_interface == nullptr) {
+            return nullptr;
+        }
+        return GetDataBusSocketListenerInterface()->GetRemoteInvoker(proto);
+    }
+}
+
+static void CreateClientSocketFuzzTest001(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    std::string ownName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string peerName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    listener->CreateClientSocket(ownName, peerName, networkId);
+
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mockClient, Bind).WillRepeatedly(testing::Return(-1));
+    listener->CreateClientSocket(ownName, peerName, networkId);
+}
+
+static void CreateClientSocketFuzzTest002(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    std::string ownName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string peerName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mockClient, Bind).WillRepeatedly(testing::Return(0));
+    listener->CreateClientSocket(ownName, peerName, networkId);
+}
+
+static void StartServerListenerFuzzTest001(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    std::string ownName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    listener->StartServerListener(ownName);
+
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mockClient, Listen).WillRepeatedly(testing::Return(-1));
+    listener->StartServerListener(ownName);
+}
+
+static void StartServerListenerFuzzTest002(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    std::string ownName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mockClient, Listen).WillRepeatedly(testing::Return(0));
+    listener->StartServerListener(ownName);
+}
+
+static void RemoveSessionNameFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, GetCurrent).WillRepeatedly(testing::Return(nullptr));
+    listener->RemoveSessionName();
+}
+
+static void ShutdownSocketFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    std::string ownName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string peerName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mockClient, Bind).WillRepeatedly(testing::Return(0));
+    listener->CreateClientSocket(ownName, peerName, networkId);
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    socketId = socketId == 1 ? 0 : socketId;
+    listener->ShutdownSocket(socketId);
+    socketId = 1;
+    listener->ShutdownSocket(socketId);
+}
+
+static void ClientOnShutdownFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    int32_t reason = provider.ConsumeIntegral<int32_t>();
+    std::string ownName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string peerName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mockClient, Bind).WillRepeatedly(testing::Return(0));
+    listener->CreateClientSocket(ownName, peerName, networkId);
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    socketId = socketId == 1 ? 0 : socketId;
+    listener->ClientOnShutdown(socketId, static_cast<ShutdownReason>(reason));
+    socketId = 1;
+    listener->ClientOnShutdown(socketId, static_cast<ShutdownReason>(reason));
+}
+
+static void ServerOnBindFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    std::string name = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string pkgName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    int32_t dataType = provider.ConsumeIntegral<int32_t>();
+    PeerSocketInfo info = {
+        .name = const_cast<char *>(name.c_str()),
+        .networkId = const_cast<char *>(networkId.c_str()),
+        .pkgName = const_cast<char *>(pkgName.c_str()),
+        .dataType = static_cast<TransDataType>(dataType),
+    };
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, GetRemoteInvoker).WillRepeatedly(testing::Return(nullptr));
+    listener->ServerOnBind(socketId, info);
+}
+
+static void ServerOnShutdownFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    int32_t reason = provider.ConsumeIntegral<int32_t>();
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, GetRemoteInvoker).WillRepeatedly(testing::Return(nullptr));
+    listener->ServerOnShutdown(socketId, static_cast<ShutdownReason>(reason));
+}
+
+static void OnBytesReceivedFuzzTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<DatabusSocketListener> listener = DelayedSingleton<DatabusSocketListener>::GetInstance();
+    if (listener == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    std::string recivedData = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    uint32_t recivedLen = recivedData.size();
+    NiceMock<DataBusSocketListenerInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, GetRemoteInvoker).WillRepeatedly(testing::Return(nullptr));
+    listener->OnBytesReceived(socketId, static_cast<const void*>(recivedData.c_str()), recivedLen);
+}
+}
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::CreateClientSocketFuzzTest001(provider);
+    OHOS::CreateClientSocketFuzzTest002(provider);
+    OHOS::StartServerListenerFuzzTest001(provider);
+    OHOS::StartServerListenerFuzzTest002(provider);
+    OHOS::RemoveSessionNameFuzzTest(provider);
+    OHOS::ShutdownSocketFuzzTest(provider);
+    OHOS::ClientOnShutdownFuzzTest(provider);
+    OHOS::ServerOnBindFuzzTest(provider);
+    OHOS::ServerOnShutdownFuzzTest(provider);
+    OHOS::OnBytesReceivedFuzzTest(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.h b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.h
new file mode 100644
index 00000000..e5b8f2d6
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/databussocketlistenermock_fuzzer.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef DATABUSSOCKETLISTENERMOCK_FUZZER_H
+#define DATABUSSOCKETLISTENERMOCK_FUZZER_H
+
+#include <climits>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <fcntl.h>
+#include <unistd.h>
+#include <cstddef>
+
+#define FUZZ_PROJECT_NAME "databussocketlistenermock_fuzzer"
+
+#endif // DATABUSSOCKETLISTENERMOCK_FUZZER_H
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/databussocketlistenermock_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
-- 
Gitee


From 22bb5e4609f5ec5d68335217b014b0b99f869c5c Mon Sep 17 00:00:00 2001
From: wuyunxun <wuyunxun@h-partners.com>
Date: Tue, 12 Aug 2025 11:00:59 +0800
Subject: [PATCH 04/15] =?UTF-8?q?dbinder=5Fremote=5Flistener=E8=A1=A5?=
 =?UTF-8?q?=E5=85=85fuzz?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wuyunxun <wuyunxun@h-partners.com>
Change-Id: I47a2878544765cee642493ee625851c3f9d8d286
---
 test/fuzztest/BUILD.gn                        |   1 +
 .../dbinderremotelistenermock_fuzzer/BUILD.gn |  35 ++++
 .../corpus/init                               |  16 ++
 .../dbinderremotelistenermock_fuzzer.cpp      | 170 ++++++++++++++++++
 .../dbinderremotelistenermock_fuzzer.h        |  20 +++
 .../project.xml                               |  25 +++
 6 files changed, 267 insertions(+)
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.h
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/project.xml

diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn
index 6fd3ebe1..f898d3f3 100644
--- a/test/fuzztest/BUILD.gn
+++ b/test/fuzztest/BUILD.gn
@@ -63,6 +63,7 @@ group("fuzztest") {
     "ipc/native/src/core/processskeleton_fuzzer:ProcessSkeletonFuzzTest",
     "ipc/native/src/core/hitraceinvoker_fuzzer:HitraceInvokerFuzzTest",
     "ipc/native/src/mock/acquirehandle_fuzzer:AcquireHandleFuzzTest",
+    "ipc/native/src/mock/dbinderremotelistenermock_fuzzer:DBinderRemoteListenerMockFuzzTest",
     "dbinder/dbinder_service/src/dbinderservicenew_fuzzer:DBinderServiceNewFuzzTest",
     "dbinder/dbinder_service/src/socket/dbinderremotelistener_fuzzer:DBinderRemoteListenerFuzzTest",
     "dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer:DBinderServiceMockFuzzTest",
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/BUILD.gn
new file mode 100644
index 00000000..ad9f42e5
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/BUILD.gn
@@ -0,0 +1,35 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderRemoteListenerMockFuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbinderremotelistenermock_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+  sources = [ "dbinderremotelistenermock_fuzzer.cpp" ]
+  external_deps = [
+    "c_utils:utils",
+    "hilog:libhilog",
+    "ipc:libdbinder",
+    "ipc:ipc_core",
+    "googletest:gmock",
+    "googletest:gtest",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.cpp
new file mode 100644
index 00000000..de9c4b3a
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.cpp
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderremotelistenermock_fuzzer.h"
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+
+static constexpr size_t MAX_STR_LEN = 100;
+
+class DBinderRemoteListenerInterface {
+public:
+    DBinderRemoteListenerInterface() {};
+    virtual ~DBinderRemoteListenerInterface() {};
+
+    virtual int32_t Socket(SocketInfo info) = 0;
+    virtual int32_t Bind(int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener) = 0;
+    virtual int32_t SendBytes(int32_t socket, const void *data, uint32_t len) = 0;
+};
+
+class DBinderRemoteListenerInterfaceMock : public DBinderRemoteListenerInterface {
+public:
+    DBinderRemoteListenerInterfaceMock();
+    ~DBinderRemoteListenerInterfaceMock() override;
+
+    MOCK_METHOD(int32_t, Socket, (SocketInfo info), (override));
+    MOCK_METHOD(int32_t, Bind, (int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener),
+                (override));
+    MOCK_METHOD(int32_t, SendBytes, (int32_t socket, const void *data, uint32_t len), (override));
+};
+
+static void *g_interface = nullptr;
+
+DBinderRemoteListenerInterfaceMock::DBinderRemoteListenerInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DBinderRemoteListenerInterfaceMock::~DBinderRemoteListenerInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DBinderRemoteListenerInterface *GetDBinderRemoteListenerInterface()
+{
+    return reinterpret_cast<DBinderRemoteListenerInterface *>(g_interface);
+}
+
+extern "C" {
+int32_t DBinderSoftbusClient::Socket(SocketInfo info)
+{
+    if (g_interface == nullptr) {
+        return SOFTBUS_OK;
+    }
+    return GetDBinderRemoteListenerInterface()->Socket(info);
+}
+
+int32_t DBinderSoftbusClient::Bind(int32_t socket, const QosTV qos[], uint32_t qosCount,
+    const ISocketListener *listener)
+{
+    if (g_interface == nullptr) {
+        return 0;
+    }
+    return GetDBinderRemoteListenerInterface()->Bind(socket, qos, qosCount, listener);
+}
+
+int32_t DBinderSoftbusClient::SendBytes(int32_t socket, const void *data, uint32_t len)
+{
+    if (g_interface == nullptr) {
+        return 0;
+    }
+    return GetDBinderRemoteListenerInterface()->SendBytes(socket, data, len);
+}
+}
+
+void CreateClientSocketFuzzTest001(FuzzedDataProvider &provider)
+{
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    auto dBinderRemoteListener = std::make_shared<DBinderRemoteListener>();
+    if (dBinderRemoteListener == nullptr) {
+        return;
+    }
+    NiceMock<DBinderRemoteListenerInterfaceMock> mock;
+    EXPECT_CALL(mock, Socket).WillRepeatedly(Return(1));
+    EXPECT_CALL(mock, Bind).WillRepeatedly(Return(0));
+    dBinderRemoteListener->CreateClientSocket(networkId);
+}
+
+void CreateClientSocketFuzzTest002(FuzzedDataProvider &provider)
+{
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    auto dBinderRemoteListener = std::make_shared<DBinderRemoteListener>();
+    if (dBinderRemoteListener == nullptr) {
+        return;
+    }
+    NiceMock<DBinderRemoteListenerInterfaceMock> mock;
+    EXPECT_CALL(mock, Socket).WillRepeatedly(Return(1));
+    EXPECT_CALL(mock, Bind).WillRepeatedly(Return(-1));
+    dBinderRemoteListener->CreateClientSocket(networkId);
+}
+
+void SendDataToRemoteFuzzTest001(FuzzedDataProvider &provider)
+{
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    DHandleEntryTxRx msg;
+    auto dBinderRemoteListener = std::make_shared<DBinderRemoteListener>();
+    if (dBinderRemoteListener == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    if (socketId <= 0) {
+        return;
+    }
+    dBinderRemoteListener->clientSocketInfos_[networkId] = socketId;
+    NiceMock<DBinderRemoteListenerInterfaceMock> mock;
+    EXPECT_CALL(mock, SendBytes).WillRepeatedly(Return(0));
+    dBinderRemoteListener->SendDataToRemote(networkId, &msg);
+}
+
+void SendDataToRemoteFuzzTest002(FuzzedDataProvider &provider)
+{
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STR_LEN);
+    DHandleEntryTxRx msg;
+    auto dBinderRemoteListener = std::make_shared<DBinderRemoteListener>();
+    if (dBinderRemoteListener == nullptr) {
+        return;
+    }
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    if (socketId <= 0) {
+        return;
+    }
+    dBinderRemoteListener->clientSocketInfos_[networkId] = socketId;
+    NiceMock<DBinderRemoteListenerInterfaceMock> mock;
+    EXPECT_CALL(mock, SendBytes).WillRepeatedly(Return(-1));
+    dBinderRemoteListener->SendDataToRemote(networkId, &msg);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::CreateClientSocketFuzzTest001(provider);
+    OHOS::CreateClientSocketFuzzTest002(provider);
+    OHOS::SendDataToRemoteFuzzTest001(provider);
+    OHOS::SendDataToRemoteFuzzTest002(provider);
+    return 0;
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.h b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.h
new file mode 100644
index 00000000..ce793f0e
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/dbinderremotelistenermock_fuzzer.h
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef DBINDERREMOTELISTENER_MOCK_FUZZER_H
+#define DBINDERREMOTELISTENER_MOCK_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "dbinderremotelistenermock_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderremotelistenermock_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
-- 
Gitee


From 12b5c806b3fc77f7a8cd7e6e75c24ec7a03db9aa Mon Sep 17 00:00:00 2001
From: al9503 <houwenlong001@chinasoftinc.com>
Date: Sat, 9 Aug 2025 15:23:28 +0800
Subject: [PATCH 05/15] =?UTF-8?q?ipc=E8=A1=A5=E5=85=85FUZZ?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: al9503 <houwenlong001@chinasoftinc.com>
Change-Id: I4bb02c5af6ab7c8cc1b6d6297e1d83c341c1e67f
---
 test/fuzztest/BUILD.gn                        |   1 +
 .../ipcobjectstub_fuzzer.cpp                  |  18 ++
 .../dbindersoftbusclientmock_fuzzer/BUILD.gn  |  33 +++
 .../corpus/init                               |  16 ++
 .../dbindersoftbusclientmock_fuzzer.cpp       | 210 ++++++++++++++++++
 .../dbindersoftbusclientmock_fuzzer.h         |  21 ++
 .../project.xml                               |  25 +++
 7 files changed, 324 insertions(+)
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.h
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/project.xml

diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn
index 24fa5ec7..3d7e6cd5 100644
--- a/test/fuzztest/BUILD.gn
+++ b/test/fuzztest/BUILD.gn
@@ -27,6 +27,7 @@ group("fuzztest") {
     "ipc/native/src/core/dbinderremovepermission_fuzzer:DBinderRemovePermissionFuzzTest",
     "ipc/native/src/core/dbindersessionobject_fuzzer:DBinderSessionObjectFuzzTest",
     "ipc/native/src/core/dbindersoftbusclient_fuzzer:DBinderSoftbusClientFuzzTest",
+    "ipc/native/src/mock/dbindersoftbusclientmock_fuzzer:DBinderSoftbusClientMockFuzzTest",
     "ipc/native/src/core/dbinderservicestub_fuzzer:DBinderServiceStubFuzzTest",
     "ipc/native/src/core/getlocalnodedeviceid_fuzzer:GetLocalNodeDeviceIdFuzzTest",
     "ipc/native/src/core/invokerfactory_fuzzer:InvokerFactoryFuzzTest",
diff --git a/test/fuzztest/ipc/native/src/core/ipcobjectstub_fuzzer/ipcobjectstub_fuzzer.cpp b/test/fuzztest/ipc/native/src/core/ipcobjectstub_fuzzer/ipcobjectstub_fuzzer.cpp
index 8fa06475..6c7df7ad 100644
--- a/test/fuzztest/ipc/native/src/core/ipcobjectstub_fuzzer/ipcobjectstub_fuzzer.cpp
+++ b/test/fuzztest/ipc/native/src/core/ipcobjectstub_fuzzer/ipcobjectstub_fuzzer.cpp
@@ -13,6 +13,7 @@
  * limitations under the License.
  */
 
+#include <fuzzer/FuzzedDataProvider.h>
 #include "ipcobjectstub_fuzzer.h"
 #include "ipc_object_stub.h"
 #include "message_parcel.h"
@@ -182,6 +183,20 @@ void AddAuthInfoFuzzTest(const uint8_t *data, size_t size)
     IPCObjectStub ipcObjectStub;
     ipcObjectStub.AddAuthInfo(parcel, reply, code);
 }
+
+void OnRemoteDumpFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel parcel;
+    size_t bytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(bytesSize);
+    parcel.WriteBuffer(bytes.data(), bytes.size());
+    parcel.WriteFileDescriptor(-1);
+    MessageParcel reply;
+    MessageOption option;
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.OnRemoteDump(code, parcel, reply, option);
+}
 } // namespace OHOS
 
 /* Fuzzer entry point */
@@ -199,5 +214,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::NoticeServiceDieFuzzTest(data, size);
     OHOS::InvokerDataBusThreadFuzzTest(data, size);
     OHOS::AddAuthInfoFuzzTest(data, size);
+
+    FuzzedDataProvider provider(data, size);
+    OHOS::OnRemoteDumpFuzzTest(provider);
     return 0;
 }
diff --git a/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/BUILD.gn
new file mode 100644
index 00000000..a17758ea
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/BUILD.gn
@@ -0,0 +1,33 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderSoftbusClientMockFuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbindersoftbusclientmock_fuzzer"
+
+  sources = [ "dbindersoftbusclientmock_fuzzer.cpp" ]
+
+  deps = [ "../../../../../../../interfaces/innerkits/ipc_single:ipc_single_test" ]
+
+  external_deps = [
+    "c_utils:utils",
+    "hilog:libhilog",
+    "googletest:gmock",
+    "googletest:gtest",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.cpp
new file mode 100644
index 00000000..22e3f757
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.cpp
@@ -0,0 +1,210 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbindersoftbusclientmock_fuzzer.h"
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include "dbinder_softbus_client.h"
+#include "message_parcel.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+const static size_t MAX_STRING_PARAM_LEN = 100;
+
+class DbinderSoftBusClientInterface {
+public:
+    DbinderSoftBusClientInterface() {};
+    virtual ~DbinderSoftBusClientInterface() {};
+
+    virtual bool OpenSoftbusClientSo() = 0;
+};
+
+class DbinderSoftBusClientInterfaceMock : public DbinderSoftBusClientInterface {
+public:
+    DbinderSoftBusClientInterfaceMock();
+    ~DbinderSoftBusClientInterfaceMock() override;
+    MOCK_METHOD0(OpenSoftbusClientSo, bool());
+};
+
+static void *g_interface = nullptr;
+
+DbinderSoftBusClientInterfaceMock::DbinderSoftBusClientInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DbinderSoftBusClientInterfaceMock::~DbinderSoftBusClientInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DbinderSoftBusClientInterface *GetDbinderSoftBusClientInterface()
+{
+    return reinterpret_cast<DbinderSoftBusClientInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    bool DBinderSoftbusClient::OpenSoftbusClientSo()
+    {
+        DbinderSoftBusClientInterface* interface = GetDbinderSoftBusClientInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->OpenSoftbusClientSo();
+    }
+}
+
+static void DBinderGrantPermissionFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t uid = provider.ConsumeIntegral<int32_t>();
+    int32_t pid = provider.ConsumeIntegral<int32_t>();
+    std::string socketName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().DBinderGrantPermission(uid, pid, socketName);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().DBinderGrantPermission(uid, pid, socketName);
+}
+
+static void DBinderRemovePermissionFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string socketName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().DBinderRemovePermission(socketName);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().DBinderRemovePermission(socketName);
+}
+
+static void GetLocalNodeDeviceIdFuzzTest(FuzzedDataProvider &provider)
+{
+    std::string pkgName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string devId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().GetLocalNodeDeviceId(pkgName, devId);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().GetLocalNodeDeviceId(pkgName, devId);
+}
+
+static void SocketFuzzTest(FuzzedDataProvider &provider)
+{
+    SocketInfo info;
+    std::string name = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string peerNetworkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string pkgName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string peerName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    info.name = const_cast<char *>(name.c_str());
+    info.peerNetworkId = const_cast<char *>(peerNetworkId.c_str());
+    info.pkgName = const_cast<char *>(pkgName.c_str());
+    info.dataType = DATA_TYPE_MESSAGE;
+    info.peerName = const_cast<char *>(peerName.c_str());
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().Socket(info);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().Socket(info);
+}
+
+static void ListenFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    int32_t qosType = provider.ConsumeIntegralInRange<int32_t>(0, static_cast<int>(QOS_TYPE_BUTT));
+    int32_t value = provider.ConsumeIntegral<int32_t>();
+    QosTV qos[1] = {{static_cast<QosType>(qosType), value}};
+    ISocketListener serverListener{};
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().Listen(socketId, qos, sizeof(qos) / sizeof(qos[0]), &serverListener);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().Listen(socketId, qos, sizeof(qos) / sizeof(qos[0]), &serverListener);
+}
+
+static void BindFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    int32_t qosType = provider.ConsumeIntegralInRange<int32_t>(0, static_cast<int>(QOS_TYPE_BUTT));
+    int32_t value = provider.ConsumeIntegral<int32_t>();
+    QosTV qos[1] = {{static_cast<QosType>(qosType), value}};
+    ISocketListener serverListener{};
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().Bind(socketId, qos, sizeof(qos) / sizeof(qos[0]), &serverListener);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().Bind(socketId, qos, sizeof(qos) / sizeof(qos[0]), &serverListener);
+}
+
+static void SendBytesTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    std::string data = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().SendBytes(socketId, static_cast<const void*>(data.data()), data.size());
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().SendBytes(socketId, static_cast<const void*>(data.data()), data.size());
+}
+
+static void SendMessageTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    std::string data = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().SendMessage(socketId, static_cast<const void*>(data.data()), data.size());
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().SendMessage(socketId, static_cast<const void*>(data.data()), data.size());
+}
+
+static void ShutdownFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t socketId = provider.ConsumeIntegral<int32_t>();
+    NiceMock<DbinderSoftBusClientInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(false));
+    DBinderSoftbusClient::GetInstance().Shutdown(socketId);
+
+    EXPECT_CALL(mockClient, OpenSoftbusClientSo).WillOnce(Return(true));
+    DBinderSoftbusClient::GetInstance().Shutdown(socketId);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::DBinderGrantPermissionFuzzTest(provider);
+    OHOS::DBinderRemovePermissionFuzzTest(provider);
+    OHOS::GetLocalNodeDeviceIdFuzzTest(provider);
+    OHOS::SocketFuzzTest(provider);
+    OHOS::ListenFuzzTest(provider);
+    OHOS::BindFuzzTest(provider);
+    OHOS::SendBytesTest(provider);
+    OHOS::SendMessageTest(provider);
+    OHOS::ShutdownFuzzTest(provider);
+    return 0;
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.h b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.h
new file mode 100644
index 00000000..a270a54e
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/dbindersoftbusclientmock_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef DBINDERSOFTBUSCLIENTMOCK_FUZZER_H
+#define DBINDERSOFTBUSCLIENTMOCK_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "dbindersoftbusclientmock_fuzzer"
+
+#endif // DBINDERSOFTBUSCLIENTMOCK_FUZZER_H
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbindersoftbusclientmock_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
-- 
Gitee


From 098269191c041da08c60a5904643dc989640c1cd Mon Sep 17 00:00:00 2001
From: al9503 <houwenlong001@chinasoftinc.com>
Date: Mon, 18 Aug 2025 11:01:02 +0800
Subject: [PATCH 06/15] =?UTF-8?q?=E8=A1=A5=E5=85=85fuzz?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: al9503 <houwenlong001@chinasoftinc.com>
Change-Id: Ica844ab8ddcb5d999de2f3e7902510a6af425438
---
 test/fuzztest/BUILD.gn                        |   1 +
 .../mock/ipcobjectstubmock_fuzzer/BUILD.gn    |  37 ++
 .../mock/ipcobjectstubmock_fuzzer/corpus/init |  16 +
 .../ipcobjectstubmock_fuzzer.cpp              | 504 ++++++++++++++++++
 .../ipcobjectstubmock_fuzzer.h                |  21 +
 .../mock/ipcobjectstubmock_fuzzer/project.xml |  25 +
 6 files changed, 604 insertions(+)
 create mode 100644 test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.h
 create mode 100644 test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/project.xml

diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn
index 24fa5ec7..c70548b6 100644
--- a/test/fuzztest/BUILD.gn
+++ b/test/fuzztest/BUILD.gn
@@ -35,6 +35,7 @@ group("fuzztest") {
     "ipc/native/src/core/ipcfiledescriptorunmarshalling_fuzzer:IPCFileDescriptorUnmarshallingFuzzTest",
     "ipc/native/src/core/ipcobjectproxy_fuzzer:IPCObjectProxyFuzzTest",
     "ipc/native/src/core/ipcobjectstub_fuzzer:IPCObjectStubFuzzTest",
+    "ipc/native/src/mock/ipcobjectstubmock_fuzzer:IPCObjectStubMockFuzzTest",
     "ipc/native/src/core/ipcpayloadstatistics_fuzzer:IPCPayloadStatisticsFuzzTest",
     "ipc/native/src/core/ipcprocessskeleton_fuzzer:IPCProcessSkeletonFuzzTest",
     "ipc/native/src/core/ipcskeleton_fuzzer:IPCSkeletonFuzzTest",
diff --git a/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/BUILD.gn
new file mode 100644
index 00000000..e71b57d6
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/BUILD.gn
@@ -0,0 +1,37 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("IPCObjectStubMockFuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../ipcobjectstubmock_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+
+  sources = [ "ipcobjectstubmock_fuzzer.cpp" ]
+
+  deps = [ "../../../../../../../interfaces/innerkits/ipc_single:ipc_single_test" ]
+
+  external_deps = [
+    "c_utils:utils",
+    "hilog:libhilog",
+    "googletest:gmock",
+    "googletest:gtest",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.cpp
new file mode 100644
index 00000000..3b196217
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.cpp
@@ -0,0 +1,504 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include "ipcobjectstubmock_fuzzer.h"
+#include "ipc_object_stub.h"
+#include "ipc_skeleton.h"
+#include "ipc_thread_skeleton.h"
+#include "message_parcel.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+using Transaction = decltype(FIRST_CALL_TRANSACTION);
+static const std::vector<Transaction> codeList = {
+    FIRST_CALL_TRANSACTION,
+    LAST_CALL_TRANSACTION,
+    PING_TRANSACTION,
+    DUMP_TRANSACTION,
+    SHELL_COMMAND_TRANSACTION,
+    INTERFACE_TRANSACTION,
+    SYSPROPS_TRANSACTION,
+    SYNCHRONIZE_REFERENCE,
+    INVOKE_LISTEN_THREAD,
+    GET_PID_UID,
+    GET_PROTO_INFO,
+    GET_SESSION_NAME,
+    GET_SESSION_NAME_PID_UID,
+    GET_GRANTED_SESSION_NAME,
+    REMOVE_SESSION_NAME,
+    CLEAR_DBINDER_SERVICE_STATE,
+    DBINDER_OBITUARY_TRANSACTION,
+    DBINDER_INCREFS_TRANSACTION,
+    DBINDER_DECREFS_TRANSACTION,
+    DBINDER_ADD_COMMAUTH,
+    TRANS_SYNC,
+    TRANS_ASYNC,
+};
+
+class IPCObjectStubInterface {
+public:
+    IPCObjectStubInterface() {};
+    virtual ~IPCObjectStubInterface() {};
+
+    virtual bool WriteInt32(int32_t value) = 0;
+    virtual bool WriteString16(const std::u16string &value) = 0;
+    virtual bool WriteString(const std::string &value) = 0;
+    virtual bool IsLocalCalling() = 0;
+    virtual bool IsSamgrCall() = 0;
+    virtual bool WriteUint32(uint32_t value) = 0;
+    virtual std::string CreateSessionName(int uid, int pid) = 0;
+    virtual std::string GetSessionName() = 0;
+};
+
+class IPCObjectStubInterfaceMock : public IPCObjectStubInterface {
+public:
+    IPCObjectStubInterfaceMock();
+    ~IPCObjectStubInterfaceMock() override;
+    MOCK_METHOD1(WriteInt32, bool(int32_t value));
+    MOCK_METHOD1(WriteString16, bool(const std::u16string &value));
+    MOCK_METHOD1(WriteString, bool(const std::string &value));
+    MOCK_METHOD0(IsLocalCalling, bool());
+    MOCK_METHOD0(IsSamgrCall, bool());
+    MOCK_METHOD1(WriteUint32, bool(uint32_t value));
+    MOCK_METHOD2(CreateSessionName, std::string(int uid, int pid));
+    MOCK_METHOD0(GetSessionName, std::string());
+};
+
+static void *g_interface = nullptr;
+
+IPCObjectStubInterfaceMock::IPCObjectStubInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+IPCObjectStubInterfaceMock::~IPCObjectStubInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static IPCObjectStubInterface *GetIPCObjectStubInterface()
+{
+    return reinterpret_cast<IPCObjectStubInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    bool Parcel::WriteInt32(int32_t value)
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->WriteInt32(value);
+    }
+
+    bool Parcel::WriteString16(const std::u16string &value)
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->WriteString16(value);
+    }
+
+    bool Parcel::WriteString(const std::string &value)
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->WriteString(value);
+    }
+
+    bool IPCSkeleton::IsLocalCalling()
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->IsLocalCalling();
+    }
+
+    bool IPCObjectStub::IsSamgrCall()
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->IsSamgrCall();
+    }
+
+    bool Parcel::WriteUint32(uint32_t value)
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->WriteUint32(value);
+    }
+
+    std::string IPCObjectStub::CreateSessionName(int uid, int pid)
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return "";
+        }
+        return interface->CreateSessionName(uid, pid);
+    }
+
+    std::string IPCObjectStub::GetSessionName()
+    {
+        IPCObjectStubInterface* interface = GetIPCObjectStubInterface();
+        if (interface == nullptr) {
+            return "";
+        }
+        return interface->GetSessionName();
+    }
+}
+
+static void DBinderPingTransactionFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    size_t bytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(bytesSize);
+    reply.WriteBuffer(bytes.data(), bytes.size());
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, WriteInt32).WillOnce(Return(0));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderPingTransaction(code, data, reply, option);
+}
+
+static void DBinderSearchDescriptorFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    size_t bytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(bytesSize);
+    reply.WriteBuffer(bytes.data(), bytes.size());
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, WriteString16).WillOnce(Return(0));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderSearchDescriptor(code, data, reply, option);
+}
+
+static void DBinderDumpTransactionFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderDumpTransaction(code, data, reply, option);
+}
+
+static void DBinderInvokeListenThreadFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderInvokeListenThread(code, data, reply, option);
+}
+
+static void DBinderIncRefsTransactionFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderIncRefsTransaction(code, data, reply, option);
+}
+
+static void DBinderDecRefsTransactionFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderDecRefsTransaction(code, data, reply, option);
+}
+
+static void DBinderAddCommAuthFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderAddCommAuth(code, data, reply, option);
+}
+
+static void DBinderGetSessionNameFuzzTest001(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetSessionName(code, data, reply, option);
+}
+
+static void DBinderGetSessionNameFuzzTest002(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(true));
+    EXPECT_CALL(mockClient, GetSessionName).WillOnce(Return(""));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetSessionName(code, data, reply, option);
+}
+
+static void DBinderGetSessionNameFuzzTest003(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillOnce(Return(true));
+    EXPECT_CALL(mockClient, GetSessionName).WillOnce(Return("sessionname"));
+    EXPECT_CALL(mockClient, WriteString).WillOnce(Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetSessionName(code, data, reply, option);
+}
+
+static void DBinderGetGrantedSessionNameFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, IsSamgrCall).WillRepeatedly(testing::Return(true));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetGrantedSessionName(code, data, reply, option);
+}
+
+static void DBinderGetSessionNameForPidUidFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, IsSamgrCall).WillRepeatedly(testing::Return(true));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetSessionNameForPidUid(code, data, reply, option);
+}
+
+static void DBinderGetPidUidFuzzTest001(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, IsSamgrCall).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetPidUid(code, data, reply, option);
+}
+
+static void DBinderGetPidUidFuzzTest002(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, IsSamgrCall).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(true));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderGetPidUid(code, data, reply, option);
+}
+
+static void DBinderRemoveSessionNameFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, IsLocalCalling).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, IsSamgrCall).WillRepeatedly(testing::Return(true));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.DBinderRemoveSessionName(code, data, reply, option);
+}
+
+static void SendRequestFuzzTest001(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    size_t dataBytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> dataBytes = provider.ConsumeBytes<uint8_t>(dataBytesSize);
+    data.WriteBuffer(dataBytes.data(), dataBytes.size());
+    MessageParcel reply;
+    size_t replyBytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> replyBytes = provider.ConsumeBytes<uint8_t>(replyBytesSize);
+    reply.WriteBuffer(replyBytes.data(), replyBytes.size());
+    MessageOption option;
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.SendRequest(code, data, reply, option);
+}
+
+static void SendRequestFuzzTest002(FuzzedDataProvider &provider)
+{
+    MessageParcel data;
+    size_t dataBytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> dataBytes = provider.ConsumeBytes<uint8_t>(dataBytesSize);
+    data.WriteBuffer(dataBytes.data(), dataBytes.size());
+    MessageParcel reply;
+    size_t replyBytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
+    std::vector<uint8_t> replyBytes = provider.ConsumeBytes<uint8_t>(replyBytesSize);
+    reply.WriteBuffer(replyBytes.data(), replyBytes.size());
+    MessageOption option;
+    uint32_t code = 0;
+    IPCObjectStub ipcObjectStub;
+    for (int i = 0; i < codeList.size(); i++) {
+        code = codeList[i];
+        ipcObjectStub.SendRequest(code, data, reply, option);
+    }
+}
+
+static void ProcessProtoFuzzTest(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(false));
+    EXPECT_CALL(mockClient, WriteString16).WillRepeatedly(testing::Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.ProcessProto(code, data, reply, option);
+}
+
+static void GetGrantedSessionNameFuzzTest001(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, CreateSessionName).WillRepeatedly(testing::Return("sessionName"));
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, WriteString).WillRepeatedly(testing::Return(true));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.GetGrantedSessionName(code, data, reply, option);
+}
+
+static void GetGrantedSessionNameFuzzTest002(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, CreateSessionName).WillRepeatedly(testing::Return("sessionName"));
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(false));
+    EXPECT_CALL(mockClient, WriteString).WillRepeatedly(testing::Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.GetGrantedSessionName(code, data, reply, option);
+}
+
+static void GetSessionNameForPidUidFuzzTest001(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, CreateSessionName).WillRepeatedly(testing::Return("sessionName"));
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mockClient, WriteString).WillRepeatedly(testing::Return(true));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.GetSessionNameForPidUid(code, data, reply, option);
+}
+
+static void GetSessionNameForPidUidFuzzTest002(FuzzedDataProvider &provider)
+{
+    uint32_t code = provider.ConsumeIntegral<uint32_t>();
+    MessageParcel data;
+    MessageParcel reply;
+    MessageOption option;
+    NiceMock<IPCObjectStubInterfaceMock> mockClient;
+    EXPECT_CALL(mockClient, CreateSessionName).WillRepeatedly(testing::Return("sessionName"));
+    EXPECT_CALL(mockClient, WriteUint32).WillRepeatedly(testing::Return(false));
+    EXPECT_CALL(mockClient, WriteString).WillRepeatedly(testing::Return(false));
+    IPCObjectStub ipcObjectStub;
+    ipcObjectStub.GetSessionNameForPidUid(code, data, reply, option);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::DBinderPingTransactionFuzzTest(provider);
+    OHOS::DBinderSearchDescriptorFuzzTest(provider);
+    OHOS::DBinderDumpTransactionFuzzTest(provider);
+    OHOS::DBinderInvokeListenThreadFuzzTest(provider);
+    OHOS::DBinderIncRefsTransactionFuzzTest(provider);
+    OHOS::DBinderDecRefsTransactionFuzzTest(provider);
+    OHOS::DBinderAddCommAuthFuzzTest(provider);
+    OHOS::DBinderGetSessionNameFuzzTest001(provider);
+    OHOS::DBinderGetSessionNameFuzzTest002(provider);
+    OHOS::DBinderGetSessionNameFuzzTest003(provider);
+    OHOS::DBinderGetGrantedSessionNameFuzzTest(provider);
+    OHOS::DBinderGetSessionNameForPidUidFuzzTest(provider);
+    OHOS::DBinderGetPidUidFuzzTest001(provider);
+    OHOS::DBinderGetPidUidFuzzTest002(provider);
+    OHOS::DBinderRemoveSessionNameFuzzTest(provider);
+    OHOS::SendRequestFuzzTest001(provider);
+    OHOS::SendRequestFuzzTest002(provider);
+    OHOS::ProcessProtoFuzzTest(provider);
+    OHOS::GetGrantedSessionNameFuzzTest001(provider);
+    OHOS::GetGrantedSessionNameFuzzTest002(provider);
+    OHOS::GetSessionNameForPidUidFuzzTest001(provider);
+    OHOS::GetSessionNameForPidUidFuzzTest002(provider);
+    return 0;
+}
diff --git a/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.h b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.h
new file mode 100644
index 00000000..895dd175
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/ipcobjectstubmock_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef IPCOBJECTSTUBMOCK_FUZZER_H
+#define IPCOBJECTSTUBMOCK_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "ipcobjectstubmock_fuzzer"
+
+#endif // IPCOBJECTSTUBMOCK_FUZZER_H
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/ipcobjectstubmock_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
-- 
Gitee


From 666289d704e0f97b7bf0f73cc57ddb91fa87fafc Mon Sep 17 00:00:00 2001
From: wuyunxun <wuyunxun@h-partners.com>
Date: Thu, 7 Aug 2025 20:44:05 +0800
Subject: [PATCH 07/15] =?UTF-8?q?DBinder=E8=A1=A5=E5=85=85UT?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wuyunxun <wuyunxun@h-partners.com>
Change-Id: I92b51c4e378415a99a5ca9a90bb86bb6a69bbb73
---
 test/resource/ipc/ohos_test.xml               |  12 ++
 .../dbinder/dbinder_service/src/BUILD.gn      |  10 +
 .../src/dbinder_death_recipient_unittest.cpp  |  71 +++++++
 .../dbinder_sa_death_recipient_unittest.cpp   |  68 +++++++
 .../src/dbinder_service_unittest.cpp          | 179 +++++++++++++++++-
 5 files changed, 335 insertions(+), 5 deletions(-)
 create mode 100644 test/unittest/dbinder/dbinder_service/src/dbinder_death_recipient_unittest.cpp
 create mode 100644 test/unittest/dbinder/dbinder_service/src/dbinder_sa_death_recipient_unittest.cpp

diff --git a/test/resource/ipc/ohos_test.xml b/test/resource/ipc/ohos_test.xml
index df7408cc..7fa6adaf 100644
--- a/test/resource/ipc/ohos_test.xml
+++ b/test/resource/ipc/ohos_test.xml
@@ -245,6 +245,18 @@
             <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib" src="out"/>
         </preparer>
     </target>
+    <target name="DBinderDeathRecipientTest">
+        <preparer>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib64" src="out"/>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib" src="out"/>
+        </preparer>
+    </target>
+    <target name="DBinderSaDeathRecipientTest">
+        <preparer>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib64" src="out"/>
+            <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib" src="out"/>
+        </preparer>
+    </target>
     <target name="RPCDbinderTest">
         <preparer>
             <option name="push" value="communication/ipc/libipc_single_test.z.so -> /system/lib64" src="out"/>
diff --git a/test/unittest/dbinder/dbinder_service/src/BUILD.gn b/test/unittest/dbinder/dbinder_service/src/BUILD.gn
index 5bf0ed06..cd1c4437 100644
--- a/test/unittest/dbinder/dbinder_service/src/BUILD.gn
+++ b/test/unittest/dbinder/dbinder_service/src/BUILD.gn
@@ -88,6 +88,14 @@ ipc_dbinder_unittest("DBinderServiceTest") {
   sources = [ "dbinder_service_unittest.cpp" ]
 }
 
+ipc_dbinder_unittest("DBinderDeathRecipientTest") {
+  sources = [ "dbinder_death_recipient_unittest.cpp" ]
+}
+
+ipc_dbinder_unittest("DBinderSaDeathRecipientTest") {
+  sources = [ "dbinder_sa_death_recipient_unittest.cpp" ]
+}
+
 ###############################################################################
 group("unittest") {
   testonly = true
@@ -95,6 +103,8 @@ group("unittest") {
     ":DBinderRemoteListenerTest",
     ":DBinderServiceStubTest",
     ":DBinderServiceTest",
+    ":DBinderDeathRecipientTest",
+    ":DBinderSaDeathRecipientTest",
   ]
 }
 ###############################################################################
diff --git a/test/unittest/dbinder/dbinder_service/src/dbinder_death_recipient_unittest.cpp b/test/unittest/dbinder/dbinder_service/src/dbinder_death_recipient_unittest.cpp
new file mode 100644
index 00000000..cceebd53
--- /dev/null
+++ b/test/unittest/dbinder/dbinder_service/src/dbinder_death_recipient_unittest.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "dbinder_death_recipient.h"
+#include "dbinder_service.h"
+
+using namespace testing;
+using namespace testing::ext;
+using namespace OHOS;
+namespace OHOS {
+class DbinderDeathRecipientTest : public testing::Test {
+public:
+    static void SetUpTestCase(void);
+    static void TearDownTestCase(void);
+    void SetUp();
+    void TearDown();
+};
+
+void DbinderDeathRecipientTest::SetUpTestCase()
+{
+}
+
+void DbinderDeathRecipientTest::TearDownTestCase()
+{
+}
+
+void DbinderDeathRecipientTest::SetUp()
+{
+}
+
+void DbinderDeathRecipientTest::TearDown()
+{
+}
+
+/**
+ * @tc.name: OnRemoteDiedTest001
+ * @tc.desc: Verify the OnRemoteDied function
+ * @tc.type: FUNC
+ */
+HWTEST_F(DbinderDeathRecipientTest, OnRemoteDiedTest001, TestSize.Level1)
+{
+    DbinderDeathRecipient dbinderDeathRecipient;
+    int handle = 1;
+    std::u16string descriptor = std::u16string();
+    sptr<IPCObjectProxy> object = sptr<IPCObjectProxy>::MakeSptr(handle, descriptor);
+    sptr<IRemoteObject::DeathRecipient> death = sptr<DbinderDeathRecipient>::MakeSptr();
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(object, nullptr);
+    ASSERT_NE(death, nullptr);
+    ASSERT_NE(dBinderService, nullptr);
+    dBinderService->AttachDeathRecipient(object, death);
+    IRemoteObject *remoteObject = object.GetRefPtr();
+    wptr<IRemoteObject> remote = remoteObject;
+    dbinderDeathRecipient.OnRemoteDied(remote);
+}
+} // namespace OHOS
\ No newline at end of file
diff --git a/test/unittest/dbinder/dbinder_service/src/dbinder_sa_death_recipient_unittest.cpp b/test/unittest/dbinder/dbinder_service/src/dbinder_sa_death_recipient_unittest.cpp
new file mode 100644
index 00000000..e6a43dac
--- /dev/null
+++ b/test/unittest/dbinder/dbinder_service/src/dbinder_sa_death_recipient_unittest.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "dbinder_sa_death_recipient.h"
+#include "dbinder_service.h"
+
+using namespace testing;
+using namespace testing::ext;
+using namespace OHOS;
+namespace OHOS {
+class DbinderSaDeathRecipientTest : public testing::Test {
+public:
+    static void SetUpTestCase(void);
+    static void TearDownTestCase(void);
+    void SetUp();
+    void TearDown();
+};
+
+void DbinderSaDeathRecipientTest::SetUpTestCase()
+{
+}
+
+void DbinderSaDeathRecipientTest::TearDownTestCase()
+{
+}
+
+void DbinderSaDeathRecipientTest::SetUp()
+{
+}
+
+void DbinderSaDeathRecipientTest::TearDown()
+{
+}
+
+/**
+ * @tc.name: OnRemoteDiedTest001
+ * @tc.desc: Verify the OnRemoteDied function
+ * @tc.type: FUNC
+ */
+HWTEST_F(DbinderSaDeathRecipientTest, OnRemoteDiedTest001, TestSize.Level1)
+{
+    binder_uintptr_t ptr = 0;
+    DbinderSaDeathRecipient dbinderSaDeathRecipient(ptr);
+    dbinderSaDeathRecipient.OnRemoteDied(nullptr);
+    int handle = 1;
+    std::u16string descriptor = std::u16string();
+    sptr<IPCObjectProxy> object = sptr<IPCObjectProxy>::MakeSptr(handle, descriptor);
+    ASSERT_NE(object, nullptr);
+    IRemoteObject *remoteObject = object.GetRefPtr();
+    wptr<IRemoteObject> remote = remoteObject;
+    dbinderSaDeathRecipient.OnRemoteDied(remote);
+}
+} // namespace OHOS
\ No newline at end of file
diff --git a/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp b/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
index eb2b7215..5ef12864 100644
--- a/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
+++ b/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
@@ -398,6 +398,34 @@ HWTEST_F(DBinderServiceTest, SendEntryToRemoteTest004, TestSize.Level1)
     EXPECT_TRUE(result);
 }
 
+/**
+ * @tc.name: SendEntryToRemoteTest005
+ * @tc.desc: Verify the SendEntryToRemote function
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, SendEntryToRemoteTest005, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    dBinderService->remoteListener_ = std::make_shared<DBinderRemoteListener>();
+    EXPECT_CALL(mock, SendDataToRemote).WillOnce(testing::Return(false));
+    std::shared_ptr<struct DHandleEntryTxRx> entry = std::make_shared<struct DHandleEntryTxRx>();
+    ASSERT_NE(entry, nullptr);
+    EXPECT_CALL(mock, CreateMessage).WillOnce(testing::Return(entry));
+    EXPECT_CALL(mock, GetLocalNodeDeviceId).WillOnce(testing::Return(SOFTBUS_CLIENT_SUCCESS));
+
+    sptr<DBinderServiceStub> dBinderServiceStub =
+        sptr<DBinderServiceStub>::MakeSptr(RANDOM_SERVICENAME, RANDOM_DEVICEID, BINDER_OBJECT);
+    ASSERT_NE(dBinderServiceStub, nullptr);
+    uint32_t seqNumber = 1;
+    uint32_t pid = PID;
+    uint32_t uid = UID;
+    bool result = dBinderService->SendEntryToRemote(dBinderServiceStub, seqNumber, pid, uid);
+    EXPECT_FALSE(result);
+}
+
 /**
  * @tc.name: InvokerRemoteDBinderTest001
  * @tc.desc: Verify the InvokerRemoteDBinder function when dBinderServiceStub is nullptr
@@ -434,15 +462,11 @@ HWTEST_F(DBinderServiceTest, InvokerRemoteDBinderTest003, TestSize.Level1)
     DBinderService dBinderService;
     sptr<DBinderServiceStub> dBinderServiceStub = new DBinderServiceStub(
         RANDOM_SERVICENAME, RANDOM_DEVICEID, BINDER_OBJECT);
-    NiceMock<DBinderServiceInterfaceMock> mock;
     std::shared_ptr<struct ThreadLockInfo> threadLockInfo = std::make_shared<struct ThreadLockInfo>();
     dBinderService.remoteListener_ = std::make_shared<DBinderRemoteListener>();
     dBinderService.AttachThreadLockInfo(PID, RANDOM_DEVICEID, threadLockInfo);
-    EXPECT_CALL(mock, SendDataToRemote).WillOnce(testing::Return(true));
     std::shared_ptr<struct DHandleEntryTxRx> entry = std::make_shared<struct DHandleEntryTxRx>();
     ASSERT_NE(entry, nullptr);
-    EXPECT_CALL(mock, CreateMessage(_, _, _, _)).WillOnce(testing::Return(entry));
-    EXPECT_CALL(mock, GetLocalNodeDeviceId).WillOnce(testing::Return(SOFTBUS_CLIENT_SUCCESS));
 
     int32_t result = dBinderService.InvokerRemoteDBinder(dBinderServiceStub, PID, PID, PID);
     EXPECT_EQ(result, DBinderErrorCode::MAKE_THREADLOCK_FAILED);
@@ -693,7 +717,7 @@ HWTEST_F(DBinderServiceTest, InvokerRemoteDBinderWhenWaitRsp001, TestSize.Level1
     int32_t ret = dBinderService->InvokerRemoteDBinderWhenWaitRsp(stub, seqNumber, pid, uid, threadLockInfo);
     EXPECT_EQ(ret, MAKE_THREADLOCK_FAILED);
 
-    dBinderService->threadLockInfo_[seqNumber] = threadLockInfo;
+    dBinderService->threadLockInfo_[seqNumber] = std::make_shared<struct ThreadLockInfo>();
     ret = dBinderService->InvokerRemoteDBinderWhenWaitRsp(stub, seqNumber, pid, uid, threadLockInfo);
     EXPECT_EQ(ret, DBINDER_OK);
 }
@@ -724,4 +748,149 @@ HWTEST_F(DBinderServiceTest, ProcessCallbackProxyInner001, TestSize.Level1)
     EXPECT_NE(proxy, nullptr);
     dBinderService->ProcessCallbackProxyInner(stub, proxy);
 }
+
+/**
+ * @tc.name: GetRemoteListenerTest001
+ * @tc.desc: Verify the GetRemoteListener function
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, GetRemoteListenerTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    dBinderService->remoteListener_ = nullptr;
+    std::shared_ptr<DBinderRemoteListener> remoteListener = dBinderService->GetRemoteListener();
+    EXPECT_EQ(remoteListener, nullptr);
+}
+
+/**
+ * @tc.name: GetInstanceTest001
+ * @tc.desc: Verify the GetInstance function return not nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, GetInstanceTest001, TestSize.Level1)
+{
+    DBinderService::instance_ = nullptr;
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+}
+
+/**
+ * @tc.name: CheckAndAmendSaIdTest001
+ * @tc.desc: Verify the CheckAndAmendSaId function
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, CheckAndAmendSaIdTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<struct DHandleEntryTxRx>();
+    ASSERT_NE(message, nullptr);
+
+    int32_t vaildId = DBinderService::FIRST_SYS_ABILITY_ID + 1;
+    int32_t invaildId = DBinderService::LAST_SYS_ABILITY_ID + 1;
+    message->stubIndex = vaildId;
+    message->binderObject = invaildId;
+    int ret = dBinderService->CheckAndAmendSaId(message);
+    EXPECT_EQ(message->binderObject, vaildId);
+    EXPECT_TRUE(ret);
+    message->stubIndex = invaildId;
+    message->binderObject = vaildId;
+    ret = dBinderService->CheckAndAmendSaId(message);
+    EXPECT_EQ(message->stubIndex, vaildId);
+    EXPECT_TRUE(ret);
+}
+
+/**
+ * @tc.name: CreateDatabusNameTest001
+ * @tc.desc: Verify the CreateDatabusName function return not empty
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, CreateDatabusNameTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    DBinderSoftbusClient &softbusClient = DBinderSoftbusClient::GetInstance();
+    softbusClient.grantPermissionFunc_ = [](int32_t uid, int32_t pid, const char *permission) -> int32_t {
+        return ERR_NONE;
+    };
+    std::string databusName = dBinderService->CreateDatabusName(UID, PID);
+    EXPECT_FALSE(databusName.empty());
+}
+
+/**
+ * @tc.name: CheckStubIndexAndSessionNameIllegalTest001
+ * @tc.desc: Verify the CheckStubIndexAndSessionNameIllegal function return true
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, CheckStubIndexAndSessionNameIllegalTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    uint64_t stubIndex = 0;
+    std::string serverSessionName = SERVICE_NAME_TEST;
+    std::string deviceId = RANDOM_DEVICEID;
+    sptr<IPCObjectProxy> proxy = sptr<IPCObjectProxy>::MakeSptr(REGISTRY_HANDLE);
+    ASSERT_NE(proxy, nullptr);
+    bool ret =
+        dBinderService->CheckStubIndexAndSessionNameIllegal(stubIndex, serverSessionName, deviceId, proxy.GetRefPtr());
+    EXPECT_TRUE(ret);
+}
+
+/**
+ * @tc.name: IsSameSessionTest001
+ * @tc.desc: Verify the IsSameSession function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, IsSameSessionTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    std::shared_ptr<struct SessionInfo> oldSession = std::make_shared<struct SessionInfo>();
+    std::shared_ptr<struct SessionInfo> newSession = std::make_shared<struct SessionInfo>();
+    ASSERT_NE(oldSession, nullptr);
+    ASSERT_NE(newSession, nullptr);
+
+    oldSession->stubIndex = 0;
+    newSession->stubIndex = 1;
+    bool ret = dBinderService->IsSameSession(oldSession, newSession);
+    EXPECT_FALSE(ret);
+}
+
+/**
+ * @tc.name: NoticeDeviceDieTest001
+ * @tc.desc: Verify the NoticeDeviceDie function return ERR_NONE
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, NoticeDeviceDieTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    dBinderService->remoteListener_ = std::make_shared<DBinderRemoteListener>();
+    std::string deviceId = RANDOM_DEVICEID;
+    int ret = dBinderService->NoticeDeviceDie(deviceId);
+    EXPECT_EQ(ret, ERR_NONE);
+}
+
+/**
+ * @tc.name: NoticeServiceDieInnerTest001
+ * @tc.desc: Verify the NoticeServiceDieInner function return DBINDER_SERVICE_INVALID_DATA_ERR
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderServiceTest, NoticeServiceDieInnerTest001, TestSize.Level1)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    ASSERT_NE(dBinderService, nullptr);
+
+    std::u16string serviceName;
+    std::string deviceId = RANDOM_DEVICEID;
+    int ret = dBinderService->NoticeServiceDieInner(serviceName, deviceId);
+    EXPECT_EQ(ret, DBINDER_SERVICE_INVALID_DATA_ERR);
+}
 }
\ No newline at end of file
-- 
Gitee


From e6a68c41d551bdb16c43c1f00b1854084df902cc Mon Sep 17 00:00:00 2001
From: fanzhe <fanzhe001@chinasoftinc.com>
Date: Tue, 19 Aug 2025 16:25:45 +0800
Subject: [PATCH 08/15] =?UTF-8?q?=E5=8E=BB=E9=99=A4=E6=B3=A8=E9=87=8A?=
 =?UTF-8?q?=E6=8E=89=E7=9A=84=E7=94=A8=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: fanzhe <fanzhe001@chinasoftinc.com>
Change-Id: I8fa84097756d377c2a047ab451e8505cd1ffaf87
---
 dbinder/test/fuzztest/BUILD.gn                |  1 -
 .../fuzztest/onbytesreceived_fuzzer/BUILD.gn  | 53 -------------------
 .../onbytesreceived_fuzzer/corpus/init        | 16 ------
 .../onbytesreceived_fuzzer.cpp                | 51 ------------------
 .../onbytesreceived_fuzzer.h                  | 28 ----------
 .../onbytesreceived_fuzzer/project.xml        | 25 ---------
 6 files changed, 174 deletions(-)
 delete mode 100644 dbinder/test/fuzztest/onbytesreceived_fuzzer/BUILD.gn
 delete mode 100644 dbinder/test/fuzztest/onbytesreceived_fuzzer/corpus/init
 delete mode 100644 dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.cpp
 delete mode 100644 dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.h
 delete mode 100644 dbinder/test/fuzztest/onbytesreceived_fuzzer/project.xml

diff --git a/dbinder/test/fuzztest/BUILD.gn b/dbinder/test/fuzztest/BUILD.gn
index c09ca513..226ae3fe 100644
--- a/dbinder/test/fuzztest/BUILD.gn
+++ b/dbinder/test/fuzztest/BUILD.gn
@@ -20,7 +20,6 @@ group("fuzztest") {
     "loadsystemabilitycomplete_fuzzer:fuzztest",
     "noticedevicedie_fuzzer:fuzztest",
     "noticeservicedie_fuzzer:fuzztest",
-    "onbytesreceived_fuzzer:fuzztest",
     "senddatatoremote_fuzzer:fuzztest",
   ]
 }
diff --git a/dbinder/test/fuzztest/onbytesreceived_fuzzer/BUILD.gn b/dbinder/test/fuzztest/onbytesreceived_fuzzer/BUILD.gn
deleted file mode 100644
index 890bb6f7..00000000
--- a/dbinder/test/fuzztest/onbytesreceived_fuzzer/BUILD.gn
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright (c) 2023-2025 Huawei Device Co., Ltd.
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#####################hydra-fuzz###################
-import("//build/config/features.gni")
-import("//build/test.gni")
-SUBSYSTEM_DIR = "../../../../"
-
-##############################fuzztest##########################################
-ohos_fuzztest("OnBytesReceivedFuzzTest") {
-  module_out_path = "ipc/ipc"
-  fuzz_config_file = "../onbytesreceived_fuzzer"
-  include_dirs = [
-    "$SUBSYSTEM_DIR/interfaces/innerkits/libdbinder/include",
-    "$SUBSYSTEM_DIR/ipc/native/src/core/dbinder/include/",
-    "$SUBSYSTEM_DIR/ipc/native/src/core/framework/include/",
-    "$SUBSYSTEM_DIR/ipc/native/src/core/invoker/include/",
-  ]
-
-  cflags = [
-    "-g",
-    "-O0",
-    "-Wno-unused-variable",
-    "-fno-omit-frame-pointer",
-  ]
-  sources = [ "onbytesreceived_fuzzer.cpp" ]
-  external_deps = [
-    "c_utils:utils",
-    "hilog:libhilog",
-    "ipc:libdbinder",
-  ]
-}
-
-###############################################################################
-group("fuzztest") {
-  testonly = true
-  deps = []
-  deps += [
-    # deps file
-    # ":OnBytesReceivedFuzzTest",
-  ]
-}
-###############################################################################
diff --git a/dbinder/test/fuzztest/onbytesreceived_fuzzer/corpus/init b/dbinder/test/fuzztest/onbytesreceived_fuzzer/corpus/init
deleted file mode 100644
index 2b595da0..00000000
--- a/dbinder/test/fuzztest/onbytesreceived_fuzzer/corpus/init
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright (c) 2023 Huawei Device Co., Ltd.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-FUZZ
\ No newline at end of file
diff --git a/dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.cpp b/dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.cpp
deleted file mode 100644
index 430e239e..00000000
--- a/dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.cpp
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (c) 2023 Huawei Device Co., Ltd.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "onbytesreceived_fuzzer.h"
-
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <securec.h>
-#include "dbinder_remote_listener.h"
-
-namespace OHOS {
-
-    bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size)
-    {
-        if (data == nullptr || size < sizeof(int32_t)) {
-            return false;
-        }
-        int32_t socketId = *(reinterpret_cast<const int32_t*>(data));
-        std::shared_ptr<DBinderRemoteListener> remoteListener =
-            std::make_shared<DBinderRemoteListener>();
-        if (remoteListener == nullptr) {
-            return false;
-        }
-
-        remoteListener->OnBytesReceived(socketId, data, size);
-
-        return true;
-    }
-}
-
-/* Fuzzer entry point */
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
-{
-    /* Run your code on data */
-    OHOS::DoSomethingInterestingWithMyAPI(data, size);
-    return 0;
-}
-
diff --git a/dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.h b/dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.h
deleted file mode 100644
index efa6ffb4..00000000
--- a/dbinder/test/fuzztest/onbytesreceived_fuzzer/onbytesreceived_fuzzer.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright (c) 2023 Huawei Device Co., Ltd.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef ONBYTESRECEIVED_FUZZER_H
-#define ONBYTESRECEIVED_FUZZER_H
-
-#include <cstdint>
-#include <unistd.h>
-#include <climits>
-#include <cstdio>
-#include <cstdlib>
-#include <fcntl.h>
-
-#define FUZZ_PROJECT_NAME "onbytesreceived_fuzzer"
-#define DATA_SIZE_MAX 256
-
-#endif
\ No newline at end of file
diff --git a/dbinder/test/fuzztest/onbytesreceived_fuzzer/project.xml b/dbinder/test/fuzztest/onbytesreceived_fuzzer/project.xml
deleted file mode 100644
index 4fdbc407..00000000
--- a/dbinder/test/fuzztest/onbytesreceived_fuzzer/project.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (c) 2023 Huawei Device Co., Ltd.
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-<fuzz_config>
-  <fuzztest>
-    <!-- maximum length of a test input -->
-    <max_len>1000</max_len>
-    <!-- maximum total time in seconds to run the fuzzer -->
-    <max_total_time>300</max_total_time>
-    <!-- memory usage limit in Mb -->
-    <rss_limit_mb>4096</rss_limit_mb>
-  </fuzztest>
-</fuzz_config>
-- 
Gitee


From eab228e71bde35d8b5d32b9b3805886310777bd0 Mon Sep 17 00:00:00 2001
From: wuyunxun <wuyunxun@h-partners.com>
Date: Wed, 6 Aug 2025 19:32:23 +0800
Subject: [PATCH 09/15] =?UTF-8?q?binder=5Finvoker=E8=A1=A5=E5=85=85fuzz?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wuyunxun <wuyunxun@h-partners.com>
Change-Id: I15ba36ea5e3cf26ec6f02d09845982f754ca748b
---
 .../binderinvokernew_fuzzer.cpp               | 199 ++++++++++++++++--
 1 file changed, 187 insertions(+), 12 deletions(-)

diff --git a/test/fuzztest/ipc/native/src/core/binderinvokernew_fuzzer/binderinvokernew_fuzzer.cpp b/test/fuzztest/ipc/native/src/core/binderinvokernew_fuzzer/binderinvokernew_fuzzer.cpp
index 8a5b8952..89196cb9 100644
--- a/test/fuzztest/ipc/native/src/core/binderinvokernew_fuzzer/binderinvokernew_fuzzer.cpp
+++ b/test/fuzztest/ipc/native/src/core/binderinvokernew_fuzzer/binderinvokernew_fuzzer.cpp
@@ -15,10 +15,47 @@
 
 #include "binderinvokernew_fuzzer.h"
 #include "binder_invoker.h"
+#include "ipc_object_proxy.h"
+#include "ipc_object_stub.h"
 #include "message_parcel.h"
+#include "string_ex.h"
 #include <fuzzer/FuzzedDataProvider.h>
 
 namespace OHOS {
+
+static constexpr size_t STR_MAX_LEN = 100;
+static constexpr pid_t INVALID_PID = -1;
+static const std::vector<uint32_t> cmdList = {
+    binder_driver_return_protocol::BR_ERROR,
+    binder_driver_return_protocol::BR_OK,
+    binder_driver_return_protocol::BR_TRANSACTION_SEC_CTX,
+    binder_driver_return_protocol::BR_TRANSACTION,
+    binder_driver_return_protocol::BR_REPLY,
+    binder_driver_return_protocol::BR_DEAD_REPLY,
+    binder_driver_return_protocol::BR_TRANSACTION_COMPLETE,
+    binder_driver_return_protocol::BR_INCREFS,
+    binder_driver_return_protocol::BR_ACQUIRE,
+    binder_driver_return_protocol::BR_RELEASE,
+    binder_driver_return_protocol::BR_DECREFS,
+    binder_driver_return_protocol::BR_ATTEMPT_ACQUIRE,
+    binder_driver_return_protocol::BR_NOOP,
+    binder_driver_return_protocol::BR_SPAWN_LOOPER,
+    binder_driver_return_protocol::BR_FINISHED,
+    binder_driver_return_protocol::BR_DEAD_BINDER,
+    binder_driver_return_protocol::BR_CLEAR_DEATH_NOTIFICATION_DONE,
+    binder_driver_return_protocol::BR_FAILED_REPLY,
+    binder_driver_return_protocol::BR_RELEASE_NODE,
+};
+static const std::vector<uint32_t> binderTypeList = {
+    BINDER_TYPE_BINDER,
+    BINDER_TYPE_WEAK_BINDER,
+    BINDER_TYPE_HANDLE,
+    BINDER_TYPE_WEAK_HANDLE,
+    BINDER_TYPE_FD,
+    BINDER_TYPE_FDA,
+    BINDER_TYPE_PTR,
+};
+
 void AcquireHandleFuzzTest(FuzzedDataProvider &provider)
 {
     int32_t handle = provider.ConsumeIntegral<int32_t>();
@@ -49,7 +86,7 @@ void AddCommAuthFuzzTest(FuzzedDataProvider &provider)
     invoker.AddCommAuth(handle, &flat);
 }
 
-void GetDBinderCallingPidUidFuzzTest(FuzzedDataProvider &provider)
+void GetDBinderCallingPidUidFuzzTest001(FuzzedDataProvider &provider)
 {
     int32_t handle = provider.ConsumeIntegral<int32_t>();
     bool isReply = provider.ConsumeBool();
@@ -60,6 +97,17 @@ void GetDBinderCallingPidUidFuzzTest(FuzzedDataProvider &provider)
     invoker.GetDBinderCallingPidUid(handle, isReply, pid, uid);
 }
 
+void GetDBinderCallingPidUidFuzzTest002(FuzzedDataProvider &provider)
+{
+    int32_t handle = provider.ConsumeIntegral<int32_t>();
+    bool isReply = provider.ConsumeBool();
+    pid_t pid = INVALID_PID;
+    uid_t uid = static_cast<uid_t>(provider.ConsumeIntegral<int32_t>());
+
+    BinderInvoker invoker;
+    invoker.GetDBinderCallingPidUid(handle, isReply, pid, uid);
+}
+
 void TranslateDBinderStubFuzzTest(FuzzedDataProvider &provider)
 {
     MessageParcel dataParcel;
@@ -154,12 +202,29 @@ void TargetStubSendRequestFuzzTest(FuzzedDataProvider &provider)
     invoker.TargetStubSendRequest(transData, dataParcel, reply, option, flagValue);
 }
 
-void OnTransactionFuzzTest(FuzzedDataProvider &provider)
+void OnTransactionFuzzTest001(FuzzedDataProvider &provider)
+{
+    uint32_t cmd = provider.ConsumeIntegral<uint32_t>();
+    int32_t error;
+
+    BinderInvoker invoker;
+    invoker.OnTransaction(cmd, error);
+}
+
+void OnTransactionFuzzTest002(FuzzedDataProvider &provider)
 {
     uint32_t cmd = provider.ConsumeIntegral<uint32_t>();
     int32_t error;
+    MessageParcel dataParcel;
 
     BinderInvoker invoker;
+    if (cmd == static_cast<uint32_t>(BR_TRANSACTION_SEC_CTX)) {
+        binder_transaction_data_secctx trSecctx {};
+        invoker.input_.WriteBuffer(&trSecctx, sizeof(binder_transaction_data_secctx));
+    } else {
+        binder_transaction_data tr {};
+        invoker.input_.WriteBuffer(&tr, sizeof(binder_transaction_data));
+    }
     invoker.OnTransaction(cmd, error);
 }
 
@@ -175,7 +240,7 @@ void HandleReplyFuzzTest(FuzzedDataProvider &provider)
     invoker.HandleReply(&dataParcel, isStubRet);
 }
 
-void HandleCommandsInnerFuzzTest(FuzzedDataProvider &provider)
+void HandleCommandsInnerFuzzTest001(FuzzedDataProvider &provider)
 {
     uint32_t cmd = provider.ConsumeIntegral<uint32_t>();
 
@@ -183,6 +248,14 @@ void HandleCommandsInnerFuzzTest(FuzzedDataProvider &provider)
     invoker.HandleCommandsInner(cmd);
 }
 
+void HandleCommandsInnerFuzzTest002()
+{
+    for (auto cmd : cmdList) {
+        BinderInvoker invoker;
+        invoker.HandleCommandsInner(cmd);
+    }
+}
+
 void HandleCommandsFuzzTest(FuzzedDataProvider &provider)
 {
     uint32_t cmd = provider.ConsumeIntegral<uint32_t>();
@@ -197,7 +270,6 @@ void UpdateConsumedDataFuzzTest(FuzzedDataProvider &provider)
     bwr.write_consumed = provider.ConsumeIntegral<uint32_t>();
     bwr.read_consumed = provider.ConsumeIntegral<uint32_t>();
     size_t outAvail = provider.ConsumeIntegral<size_t>();
-
     BinderInvoker invoker;
     invoker.UpdateConsumedData(bwr, outAvail);
 }
@@ -272,7 +344,7 @@ void PrintParcelDataFuzzTest(FuzzedDataProvider &provider)
     size_t bytesSize = provider.ConsumeIntegralInRange<size_t>(1, 50);
     std::vector<uint8_t> bytes = provider.ConsumeBytes<uint8_t>(bytesSize);
     dataParcel.WriteBuffer(bytes.data(), bytes.size());
-    std::string parcelName = provider.ConsumeRandomLengthString();
+    std::string parcelName = provider.ConsumeRandomLengthString(STR_MAX_LEN);
 
     BinderInvoker invoker;
     invoker.PrintParcelData(dataParcel, parcelName);
@@ -280,7 +352,7 @@ void PrintParcelDataFuzzTest(FuzzedDataProvider &provider)
 
 void GetUint64ValueByStrSliceFuzzTest(FuzzedDataProvider &provider)
 {
-    std::string str = provider.ConsumeRandomLengthString();
+    std::string str = provider.ConsumeRandomLengthString(STR_MAX_LEN);
     size_t offset = provider.ConsumeIntegral<size_t>();
     size_t length = provider.ConsumeIntegralInRange<size_t>(0, std::numeric_limits<size_t>::max() - offset);
     uint64_t value;
@@ -289,9 +361,9 @@ void GetUint64ValueByStrSliceFuzzTest(FuzzedDataProvider &provider)
     invoker.GetUint64ValueByStrSlice(str, offset, length, value);
 }
 
-void GetCallerRealPidByStrFuzzTest(FuzzedDataProvider &provider)
+void GetCallerRealPidByStrFuzzTest001(FuzzedDataProvider &provider)
 {
-    std::string str = provider.ConsumeRandomLengthString();
+    std::string str = provider.ConsumeRandomLengthString(STR_MAX_LEN);
     size_t offset = provider.ConsumeIntegral<size_t>();
     size_t length = provider.ConsumeIntegralInRange<size_t>(0, std::numeric_limits<size_t>::max() - offset);
     pid_t callerRealPid;
@@ -300,6 +372,99 @@ void GetCallerRealPidByStrFuzzTest(FuzzedDataProvider &provider)
     invoker.GetCallerRealPidByStr(str, offset, length, callerRealPid);
 }
 
+void GetCallerRealPidByStrFuzzTest002(FuzzedDataProvider &provider)
+{
+    int32_t num = provider.ConsumeIntegral<int32_t>();
+    std::string identity = "<" + std::to_string(num);
+    size_t offset = provider.ConsumeIntegralInRange<size_t>(0, identity.length());
+    size_t length = provider.ConsumeIntegralInRange<size_t>(0, identity.length());
+    pid_t callerRealPid;
+
+    BinderInvoker invoker;
+    invoker.GetCallerRealPidByStr(identity, offset, length, callerRealPid);
+}
+
+void GetCallerPidAndUidByStrFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t num = provider.ConsumeIntegral<int32_t>();
+    std::string str = "<" + std::to_string(num);
+    size_t offset = provider.ConsumeIntegralInRange<size_t>(0, str.length());
+    pid_t pid = 0;
+    pid_t uid = 0;
+
+    BinderInvoker binderInvoker;
+    binderInvoker.GetCallerPidAndUidByStr(str, offset, pid, uid);
+}
+
+void SetCallingIdentityFuzzTest(FuzzedDataProvider &provider)
+{
+    BinderInvoker invoker;
+    std::string identity = invoker.ResetCallingIdentity();
+    bool flag = provider.ConsumeBool();
+    invoker.SetCallingIdentity(identity, flag);
+}
+
+void UnFlattenDBinderObjectFuzzTest001(FuzzedDataProvider &provider)
+{
+    MessageParcel dataParcel;
+    binder_buffer_object obj;
+    int index = provider.ConsumeIntegralInRange<int>(0, binderTypeList.size() - 1);
+    obj.hdr.type = binderTypeList[index];
+    obj.flags = provider.ConsumeIntegral<uint32_t>();
+    obj.length = provider.ConsumeIntegral<binder_size_t>();
+    obj.parent = provider.ConsumeIntegral<binder_size_t>();
+    obj.parent_offset = provider.ConsumeIntegral<binder_size_t>();
+    dataParcel.WriteBuffer(&obj, sizeof(binder_buffer_object));
+    dbinder_negotiation_data dbinderData;
+
+    BinderInvoker invoker;
+    invoker.UnFlattenDBinderObject(dataParcel, dbinderData);
+}
+
+void UnFlattenDBinderObjectFuzzTest002(FuzzedDataProvider &provider)
+{
+    MessageParcel dataParcel;
+    binder_buffer_object obj;
+    obj.hdr.type = BINDER_TYPE_PTR;
+    obj.flags = provider.ConsumeIntegral<uint32_t>() | BINDER_BUFFER_FLAG_HAS_DBINDER;
+    obj.length = sizeof(dbinder_negotiation_data);
+    obj.parent = provider.ConsumeIntegral<binder_size_t>();
+    obj.parent_offset = provider.ConsumeIntegral<binder_size_t>();
+    std::shared_ptr<dbinder_negotiation_data> buffer = std::make_shared<dbinder_negotiation_data>();
+    if (buffer == nullptr) {
+        return;
+    }
+    obj.buffer = reinterpret_cast<binder_uintptr_t>(buffer.get());
+    dataParcel.WriteBuffer(&obj, sizeof(binder_buffer_object));
+    dbinder_negotiation_data dbinderData;
+
+    BinderInvoker invoker;
+    invoker.UnFlattenDBinderObject(dataParcel, dbinderData);
+}
+
+void SetMaxWorkThreadFuzzTest(FuzzedDataProvider &provider)
+{
+    int32_t maxWorkThread = provider.ConsumeIntegral<int32_t>();
+
+    BinderInvoker invoker;
+    invoker.SetMaxWorkThread(maxWorkThread);
+    invoker.binderConnector_ = nullptr;
+    invoker.SetMaxWorkThread(maxWorkThread);
+}
+
+void WaitForCompletionFuzzTest(FuzzedDataProvider &provider)
+{
+    MessageParcel reply;
+
+    BinderInvoker invoker;
+    bool isDead = provider.ConsumeBool();
+    uint32_t cmd = isDead ? BR_DEAD_REPLY : BR_FAILED_REPLY;
+    invoker.input_.WriteUint32(cmd);
+    invoker.WaitForCompletion(&reply);
+    invoker.binderConnector_ = nullptr;
+    invoker.WaitForCompletion(&reply);
+}
+
 /* Fuzzer entry point */
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
@@ -308,7 +473,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::AcquireHandleFuzzTest(provider);
     OHOS::TranslateDBinderProxyFuzzTest(provider);
     OHOS::AddCommAuthFuzzTest(provider);
-    OHOS::GetDBinderCallingPidUidFuzzTest(provider);
+    OHOS::GetDBinderCallingPidUidFuzzTest001(provider);
+    OHOS::GetDBinderCallingPidUidFuzzTest002(provider);
     OHOS::TranslateDBinderStubFuzzTest(provider);
     OHOS::OnAcquireObjectFuzzTest(provider);
     OHOS::OnReleaseObjectFuzzTest(provider);
@@ -317,9 +483,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::SamgrServiceSendRequestFuzzTest(provider);
     OHOS::GeneralServiceSendRequestFuzzTest(provider);
     OHOS::TargetStubSendRequestFuzzTest(provider);
-    OHOS::OnTransactionFuzzTest(provider);
+    OHOS::OnTransactionFuzzTest001(provider);
+    OHOS::OnTransactionFuzzTest002(provider);
     OHOS::HandleReplyFuzzTest(provider);
-    OHOS::HandleCommandsInnerFuzzTest(provider);
+    OHOS::HandleCommandsInnerFuzzTest001(provider);
+    OHOS::HandleCommandsInnerFuzzTest002();
     OHOS::HandleCommandsFuzzTest(provider);
     OHOS::UpdateConsumedDataFuzzTest(provider);
     OHOS::WriteTransactionFuzzTest(provider);
@@ -329,7 +497,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::EnableIPCThreadReclaimFuzzTest(provider);
     OHOS::PrintParcelDataFuzzTest(provider);
     OHOS::GetUint64ValueByStrSliceFuzzTest(provider);
-    OHOS::GetCallerRealPidByStrFuzzTest(provider);
+    OHOS::GetCallerRealPidByStrFuzzTest001(provider);
+    OHOS::GetCallerRealPidByStrFuzzTest002(provider);
+    OHOS::GetCallerPidAndUidByStrFuzzTest(provider);
+    OHOS::UnFlattenDBinderObjectFuzzTest001(provider);
+    OHOS::UnFlattenDBinderObjectFuzzTest002(provider);
+    OHOS::SetMaxWorkThreadFuzzTest(provider);
+    OHOS::WaitForCompletionFuzzTest(provider);
+    OHOS::SetCallingIdentityFuzzTest(provider);
     return 0;
 }
 } // namespace OHOS
\ No newline at end of file
-- 
Gitee


From d4157ce2df49c2dd6da35f014c5a1225838c9ba8 Mon Sep 17 00:00:00 2001
From: yueyan <yueyan8@huawei.com>
Date: Sun, 17 Aug 2025 18:30:04 +0800
Subject: [PATCH 10/15] fix:read overflow and uaf problem of the fuzz test

Signed-off-by: yueyan <yueyan8@huawei.com>
---
 .../include/dbinder_base_invoker_define.h     |  2 +-
 .../include/dbinder_base_invoker_interface.h  | 10 +++--
 .../dbinder/include/dbinder_databus_invoker.h |  6 +--
 .../source/dbinder_databus_invoker.cpp        | 38 ++++++++++++++-----
 .../databus_socket_listener_unittest.cpp      |  6 +--
 .../dbinderservicemock_fuzzer.cpp             |  1 +
 6 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/ipc/native/src/core/dbinder/include/dbinder_base_invoker_define.h b/ipc/native/src/core/dbinder/include/dbinder_base_invoker_define.h
index 5db35b4d..157db0e7 100644
--- a/ipc/native/src/core/dbinder/include/dbinder_base_invoker_define.h
+++ b/ipc/native/src/core/dbinder/include/dbinder_base_invoker_define.h
@@ -110,7 +110,7 @@ public:
     std::mutex &GetObjectMutex();
     void PrintDBinderTransaction(const char *funcName, const char *titleName, const dbinder_transaction_data *tr);
     void PrintBuffer(const char *funcName, const char *titleName, const uint8_t *data, size_t length);
-    void PrintDBinderTransData(const dbinder_transaction_data *transData);
+    void PrintDBinderTransData(const dbinder_transaction_data *transData, uint32_t dataLen);
 
 private:
     uint32_t TranslateBinderType(flat_binder_object *binderObject, unsigned char *sessionOffset,
diff --git a/ipc/native/src/core/dbinder/include/dbinder_base_invoker_interface.h b/ipc/native/src/core/dbinder/include/dbinder_base_invoker_interface.h
index da5a4c76..7561c06a 100644
--- a/ipc/native/src/core/dbinder/include/dbinder_base_invoker_interface.h
+++ b/ipc/native/src/core/dbinder/include/dbinder_base_invoker_interface.h
@@ -218,15 +218,17 @@ template <class T> std::mutex &DBinderBaseInvoker<T>::GetObjectMutex()
 }
 
 template<class T>
-void DBinderBaseInvoker<T>::PrintDBinderTransData(const dbinder_transaction_data *transData)
+void DBinderBaseInvoker<T>::PrintDBinderTransData(const dbinder_transaction_data *transData, uint32_t dataLen)
 {
     if (transData == nullptr) {
         ZLOGW(LOG_LABEL, "transData is nullptr");
         return;
     }
-    if (transData->sizeOfSelf < sizeof(dbinder_transaction_data)) {
-        ZLOGW(LOG_LABEL, "invalid transData sizeOfSelf:%{public}u, at least:sizeOfSelf:%{public}zu",
-            transData->sizeOfSelf, sizeof(dbinder_transaction_data));
+
+    // sizeof(dbinder_transaction_data) <= sizeOfSelf <= dataLen
+    if (transData->sizeOfSelf < sizeof(dbinder_transaction_data) || transData->sizeOfSelf > dataLen) {
+        ZLOGW(LOG_LABEL, "invalid transData sizeOfSelf:%{public}u, at least:%{public}zu, at most:%{public}u",
+            transData->sizeOfSelf, sizeof(dbinder_transaction_data), dataLen);
         return;
     }
     ZLOGI(LOG_LABEL, "sizeOfSelf:%{public}u, dbinder_transaction_data:%{public}zu "
diff --git a/ipc/native/src/core/dbinder/include/dbinder_databus_invoker.h b/ipc/native/src/core/dbinder/include/dbinder_databus_invoker.h
index 07336459..01d6ce3d 100644
--- a/ipc/native/src/core/dbinder/include/dbinder_databus_invoker.h
+++ b/ipc/native/src/core/dbinder/include/dbinder_databus_invoker.h
@@ -66,7 +66,7 @@ public:
         std::string peerName, std::string networkId);
     std::string ResetCallingIdentity() override;
     bool SetCallingIdentity(std::string &identity, bool flag) override;
-    void OnMessageAvailable(int32_t socketId, const char *data, ssize_t len);
+    void OnMessageAvailable(int32_t socketId, const char *data, uint32_t len);
     bool TriggerSystemIPCThreadReclaim() override;
     bool EnableIPCThreadReclaim(bool enable) override;
 
@@ -97,8 +97,8 @@ private:
     virtual int CheckAndSetCallerInfo(int32_t socketId, uint64_t stubIndex) override;
     virtual void SetCallerInfo(DBinderCallerInfo &callerInfo) override;
     virtual void GetCallerInfo(DBinderCallerInfo &callerInfo) override;
-    uint32_t HasRawDataPackage(const char *data, ssize_t len);
-    uint32_t HasCompletePackage(const char *data, uint32_t readCursor, ssize_t len);
+    uint32_t HasRawDataPackage(const char *data, uint32_t len);
+    uint32_t HasCompletePackage(const char *data, uint32_t readCursor, uint32_t len);
     void OnRawDataAvailable(int32_t socketId, uint64_t seqNumber, const char *data, uint32_t dataSize);
     uint64_t MakeStubIndexByRemoteObject(IRemoteObject *stubObject);
     std::shared_ptr<DBinderSessionObject> MakeDefaultServerSessionObject(uint64_t stubIndex,
diff --git a/ipc/native/src/core/dbinder/source/dbinder_databus_invoker.cpp b/ipc/native/src/core/dbinder/source/dbinder_databus_invoker.cpp
index 91438fe6..990e8def 100644
--- a/ipc/native/src/core/dbinder/source/dbinder_databus_invoker.cpp
+++ b/ipc/native/src/core/dbinder/source/dbinder_databus_invoker.cpp
@@ -311,11 +311,11 @@ void DBinderDatabusInvoker::OnRawDataAvailable(int32_t socketId, uint64_t seqNum
  * when idle buffer less 1k, move need process to buffer head, then update R/W cursor
  * when idle buffer can not put a full package, also move need process package to buffer head
  */
-void DBinderDatabusInvoker::OnMessageAvailable(int32_t socketId, const char *data, ssize_t len)
+void DBinderDatabusInvoker::OnMessageAvailable(int32_t socketId, const char *data, uint32_t len)
 {
-    if (socketId <= 0 || data == nullptr || len > static_cast<ssize_t>(MAX_RAWDATA_SIZE) ||
-        len < static_cast<ssize_t>(sizeof(dbinder_transaction_data))) {
-        ZLOGE(LOG_LABEL, "wrong inputs, data length:%{public}zd(expected size:%{public}zu) "
+    if (socketId <= 0 || data == nullptr || len > static_cast<uint32_t>(MAX_RAWDATA_SIZE) ||
+        len < static_cast<uint32_t>(sizeof(dbinder_transaction_data))) {
+        ZLOGE(LOG_LABEL, "wrong inputs, data length:%{public}u(expected size:%{public}zu) "
             " socketId:%{public}d", len, sizeof(dbinder_transaction_data), socketId);
         return;
     }
@@ -1053,11 +1053,21 @@ bool DBinderDatabusInvoker::EnableIPCThreadReclaim(bool enable)
     return false;
 }
 
-uint32_t DBinderDatabusInvoker::HasRawDataPackage(const char *data, ssize_t len)
+uint32_t DBinderDatabusInvoker::HasRawDataPackage(const char *data, uint32_t len)
 {
+    if (data == nullptr) {
+        ZLOGI(LOG_LABEL, "data is null");
+        return 0;
+    }
+
+    if (len < sizeof(dbinder_transaction_data)) {
+        ZLOGI(LOG_LABEL, "invalid len:%{public}u", len);
+        return 0;
+    }
+
     const dbinder_transaction_data *tr = reinterpret_cast<const dbinder_transaction_data *>(data);
     if ((tr->magic == DBINDER_MAGICWORD) && (tr->cmd == BC_SEND_RAWDATA) &&
-        (tr->sizeOfSelf == static_cast<uint32_t>(len))) {
+        (tr->sizeOfSelf == len)) {
         if (tr->sizeOfSelf > MAX_RAWDATA_SIZE) {
             return MAX_RAWDATA_SIZE;
         }
@@ -1066,15 +1076,25 @@ uint32_t DBinderDatabusInvoker::HasRawDataPackage(const char *data, ssize_t len)
     return 0;
 }
 
-uint32_t DBinderDatabusInvoker::HasCompletePackage(const char *data, uint32_t readCursor, ssize_t len)
+uint32_t DBinderDatabusInvoker::HasCompletePackage(const char *data, uint32_t readCursor, uint32_t len)
 {
+    if (data == nullptr) {
+        ZLOGI(LOG_LABEL, "data is null");
+        return 0;
+    }
+
+    if (len <= readCursor || len - readCursor < sizeof(dbinder_transaction_data)) {
+        ZLOGI(LOG_LABEL, "invalid param, readCursor=%{public}u, len=%{public}u", readCursor, len);
+        return 0;
+    }
+
     const dbinder_transaction_data *tr = reinterpret_cast<const dbinder_transaction_data *>(data + readCursor);
     if ((tr->magic == DBINDER_MAGICWORD) &&
         (tr->sizeOfSelf <= SOCKET_MAX_BUFF_SIZE + sizeof(dbinder_transaction_data)) &&
-        (readCursor + tr->sizeOfSelf <= static_cast<uint32_t>(len)) && CheckTransactionData(tr)) {
+        (len - readCursor >= tr->sizeOfSelf) && CheckTransactionData(tr)) {
         return tr->sizeOfSelf;
     }
-    PrintDBinderTransData(tr);
+    PrintDBinderTransData(tr, len - readCursor);
     return 0;
 }
 } // namespace OHOS
diff --git a/ipc/native/test/unittest/common/databus_socket_listener_unittest.cpp b/ipc/native/test/unittest/common/databus_socket_listener_unittest.cpp
index 822d1bb9..55f93705 100644
--- a/ipc/native/test/unittest/common/databus_socket_listener_unittest.cpp
+++ b/ipc/native/test/unittest/common/databus_socket_listener_unittest.cpp
@@ -46,7 +46,7 @@ public:
         std::string peerName, std::string networkId) = 0;
     virtual void OnDatabusSessionServerSideClosed(int32_t socketId) = 0;
     virtual void OnDatabusSessionClientSideClosed(int32_t socketId) = 0;
-    virtual void OnMessageAvailable(int32_t socketId, const char *data, ssize_t len) = 0;
+    virtual void OnMessageAvailable(int32_t socketId, const char *data, uint32_t len) = 0;
     virtual IPCProcessSkeleton *GetCurrent() = 0;
     virtual sptr<IRemoteObject> GetSAMgrObject() = 0;
     virtual std::string GetDatabusName() = 0;
@@ -63,7 +63,7 @@ public:
     MOCK_METHOD5(OnReceiveNewConnection, bool(int32_t, int, int, std::string, std::string));
     MOCK_METHOD1(OnDatabusSessionServerSideClosed, void(int32_t));
     MOCK_METHOD1(OnDatabusSessionClientSideClosed, void(int32_t));
-    MOCK_METHOD3(OnMessageAvailable, void(int32_t, const char *, ssize_t));
+    MOCK_METHOD3(OnMessageAvailable, void(int32_t, const char *, uint32_t));
     MOCK_METHOD0(GetCurrent, IPCProcessSkeleton *());
     MOCK_METHOD0(GetSAMgrObject, sptr<IRemoteObject>());
     MOCK_METHOD0(GetDatabusName, std::string());
@@ -121,7 +121,7 @@ extern "C" {
     {
         return GetDatabusSocketListenerInterface()->OnDatabusSessionClientSideClosed(socketId);
     }
-    void DBinderDatabusInvoker::OnMessageAvailable(int32_t socketId, const char *data, ssize_t len)
+    void DBinderDatabusInvoker::OnMessageAvailable(int32_t socketId, const char *data, uint32_t len)
     {
         return GetDatabusSocketListenerInterface()->OnMessageAvailable(socketId, data, len);
     }
diff --git a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/dbinderservicemock_fuzzer.cpp b/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/dbinderservicemock_fuzzer.cpp
index 53ab3021..9bb8a805 100644
--- a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/dbinderservicemock_fuzzer.cpp
+++ b/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/dbinderservicemock_fuzzer.cpp
@@ -169,6 +169,7 @@ void StartDBinderServiceTest(FuzzedDataProvider &provider)
     dBinderService->StartDBinderService(callbackImpl);
     dBinderService->StartDBinderService(callbackImpl);
     dBinderService->StartRemoteListener();
+    dBinderService->StopRemoteListener();
 }
 
 void AddStubByTagTest(FuzzedDataProvider &provider)
-- 
Gitee


From 9ef35d5916ebdd34a94fbb44a5b3ee8021638bdf Mon Sep 17 00:00:00 2001
From: fanzhe <fanzhe001@chinasoftinc.com>
Date: Fri, 22 Aug 2025 11:36:38 +0800
Subject: [PATCH 11/15] fix struct ISocketListener

Signed-off-by: fanzhe <fanzhe001@chinasoftinc.com>
Change-Id: I5fecf90d04763ba1bee339e370a994b6b38d41cf
---
 dl_deps/dsoftbus_interface.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dl_deps/dsoftbus_interface.h b/dl_deps/dsoftbus_interface.h
index 89ec0a2c..42e2d12d 100644
--- a/dl_deps/dsoftbus_interface.h
+++ b/dl_deps/dsoftbus_interface.h
@@ -1229,6 +1229,7 @@ typedef struct {
     bool (*OnNegotiate)(int32_t socket, PeerSocketInfo info);
     void (*OnBytesSent)(int32_t socket, uint32_t dataSeq, int32_t errCode);
     bool (*OnNegotiate2)(int32_t socket, PeerSocketInfo info, SocketAccessInfo *peerInfo, SocketAccessInfo *localInfo);
+    void (*OnMessageSent)(int32_t socket, uint16_t dataSeq, int32_t errCode);
 } ISocketListener;
 
 #ifdef __cplusplus
-- 
Gitee


From dcf130240aeff31a12663a07ad9bc879ef93c9c5 Mon Sep 17 00:00:00 2001
From: wuyunxun <wuyunxun@h-partners.com>
Date: Wed, 30 Jul 2025 17:06:22 +0800
Subject: [PATCH 12/15] =?UTF-8?q?=E8=A1=A5=E5=85=85UT=E7=94=A8=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wuyunxun <wuyunxun@h-partners.com>
Change-Id: I8ef5db3d543ca55e5750fb6d11cf9474db2920e3
---
 .../ipc/native/src/core/source/BUILD.gn       |   1 +
 .../dbinder_softbus_client_unittest.cpp       |  71 +++++
 .../core/source/message_parcel_unittest.cpp   | 255 ++++++++++++++++++
 3 files changed, 327 insertions(+)

diff --git a/test/unittest/ipc/native/src/core/source/BUILD.gn b/test/unittest/ipc/native/src/core/source/BUILD.gn
index ecc495d4..8236f82c 100644
--- a/test/unittest/ipc/native/src/core/source/BUILD.gn
+++ b/test/unittest/ipc/native/src/core/source/BUILD.gn
@@ -27,6 +27,7 @@ template("ipc_unittest") {
       "$IPC_CORE_ROOT/src/core/dbinder/include",
       "$IPC_CORE_ROOT/src/core/framework/include",
       "$IPC_CORE_ROOT/src/core/invoker/include",
+      "$IPC_CORE_ROOT/src/core/framework/source",
       "$IPC_ROOT_PATH/interfaces/innerkits/ipc_core/include",
       "$IPC_ROOT_PATH/interfaces/innerkits/libdbinder/include",
       "$IPC_ROOT_PATH/utils/include",
diff --git a/test/unittest/ipc/native/src/core/source/dbinder_softbus_client_unittest.cpp b/test/unittest/ipc/native/src/core/source/dbinder_softbus_client_unittest.cpp
index 20eade61..c01c1ee3 100644
--- a/test/unittest/ipc/native/src/core/source/dbinder_softbus_client_unittest.cpp
+++ b/test/unittest/ipc/native/src/core/source/dbinder_softbus_client_unittest.cpp
@@ -245,6 +245,25 @@ HWTEST_F(DBinderSoftbusClientTest, ListenTest002, TestSize.Level1) {
     EXPECT_EQ(result, SOFTBUS_CLIENT_SUCCESS);
 }
 
+/**
+ * @tc.name: ListenTest003
+ * @tc.desc: Verify the Listen function when listenFunc_ is nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderSoftbusClientTest, ListenTest003, TestSize.Level1)
+{
+    DBinderSoftbusClient client;
+    int32_t socket = TEST_SOCKET_ID;
+    QosTV qos[1];
+    uint32_t qosCount = TEST_QOS_COUNT;
+    ISocketListener listener;
+    EXPECT_EQ(client.listenFunc_, nullptr);
+    int32_t result = client.Listen(socket, qos, qosCount, &listener);
+    EXPECT_NE(client.listenFunc_, nullptr);
+    int32_t funcResult = client.listenFunc_(socket, qos, qosCount, &listener);
+    EXPECT_EQ(result, funcResult);
+}
+
 /**
  * @tc.name: BindTest001
  * @tc.desc: Verify the Bind function when exitFlag_ is true
@@ -277,6 +296,24 @@ HWTEST_F(DBinderSoftbusClientTest, BindTest002, TestSize.Level1) {
     EXPECT_EQ(result, SOFTBUS_CLIENT_SUCCESS);
 }
 
+/**
+ * @tc.name: BindTest003
+ * @tc.desc: Verify the Bind function when bindFunc_ is nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderSoftbusClientTest, BindTest003, TestSize.Level1) {
+    DBinderSoftbusClient client;
+    int32_t socket = TEST_SOCKET_ID;
+    QosTV qos[1];
+    uint32_t qosCount = TEST_QOS_COUNT;
+    ISocketListener listener;
+    EXPECT_EQ(client.bindFunc_, nullptr);
+    int32_t result = client.Bind(socket, qos, qosCount, &listener);
+    EXPECT_NE(client.bindFunc_, nullptr);
+    int32_t funcResult = client.bindFunc_(socket, qos, qosCount, &listener);
+    EXPECT_EQ(result, funcResult);
+}
+
 /**
  * @tc.name: SendBytesTest001
  * @tc.desc: Verify the SendBytes function when exitFlag_ is true
@@ -307,6 +344,23 @@ HWTEST_F(DBinderSoftbusClientTest, SendBytesTest002, TestSize.Level1) {
     EXPECT_EQ(result, SOFTBUS_CLIENT_SUCCESS);
 }
 
+/**
+ * @tc.name: SendBytesTest003
+ * @tc.desc: Verify the SendBytes function when sendBytesFunc_ is nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderSoftbusClientTest, SendBytesTest003, TestSize.Level1) {
+    DBinderSoftbusClient client;
+    int32_t socket = TEST_SOCKET_ID;
+    void *data = nullptr;
+    uint32_t len = TEST_LEN;
+    EXPECT_EQ(client.sendBytesFunc_, nullptr);
+    int32_t result = client.SendBytes(socket, data, len);
+    EXPECT_NE(client.sendBytesFunc_, nullptr);
+    int32_t funcResult = client.sendBytesFunc_(socket, data, len);
+    EXPECT_EQ(result, funcResult);
+}
+
 /**
  * @tc.name: SendMessageTest001
  * @tc.desc: Verify the SendMessage function when exitFlag_ is true
@@ -337,6 +391,23 @@ HWTEST_F(DBinderSoftbusClientTest, SendMessageTest002, TestSize.Level1) {
     EXPECT_EQ(result, SOFTBUS_CLIENT_SUCCESS);
 }
 
+/**
+ * @tc.name: SendMessageTest003
+ * @tc.desc: Verify the SendMessage function when sendMessageFunc_ is nullptr
+ * @tc.type: FUNC
+ */
+HWTEST_F(DBinderSoftbusClientTest, SendMessageTest003, TestSize.Level1) {
+    DBinderSoftbusClient client;
+    int32_t socket = TEST_SOCKET_ID;
+    void *data = nullptr;
+    uint32_t len = TEST_LEN;
+    EXPECT_EQ(client.sendMessageFunc_, nullptr);
+    int32_t result = client.SendMessage(socket, data, len);
+    EXPECT_NE(client.sendMessageFunc_, nullptr);
+    int32_t funcResult = client.sendMessageFunc_(socket, data, len);
+    EXPECT_EQ(result, funcResult);
+}
+
 /**
  * @tc.name: ShutdownTest001
  * @tc.desc: Verify the Shutdown function when exitFlag_ is true
diff --git a/test/unittest/ipc/native/src/core/source/message_parcel_unittest.cpp b/test/unittest/ipc/native/src/core/source/message_parcel_unittest.cpp
index d534e337..286306be 100644
--- a/test/unittest/ipc/native/src/core/source/message_parcel_unittest.cpp
+++ b/test/unittest/ipc/native/src/core/source/message_parcel_unittest.cpp
@@ -18,9 +18,11 @@
 
 #include "buffer_object.h"
 #include "dbinder_session_object.h"
+#include "ipc_file_descriptor.h"
 #include "ipc_object_proxy.h"
 #include "ipc_process_skeleton.h"
 #include "message_option.h"
+#include "message_parcel.cpp"
 #include "message_parcel.h"
 #include "mock_ipc_process_skeleton.h"
 
@@ -67,6 +69,8 @@ public:
     MessageParcelInterface() {};
     virtual ~MessageParcelInterface() {};
     virtual bool WriteInt32(int32_t value) = 0;
+    virtual bool AttachDBinderCallbackStub(sptr<IRemoteObject> proxy, sptr<DBinderCallbackStub> stub) = 0;
+    virtual std::shared_ptr<DBinderSessionObject> ProxyQueryDBinderSession(uint32_t handle) = 0;
 };
 
 class MessageParcelInterfaceMock : public MessageParcelInterface {
@@ -74,6 +78,8 @@ public:
     MessageParcelInterfaceMock();
     ~MessageParcelInterfaceMock() override;
     MOCK_METHOD1(WriteInt32, bool(int32_t value));
+    MOCK_METHOD2(AttachDBinderCallbackStub, bool(sptr<IRemoteObject> proxy, sptr<DBinderCallbackStub> stub));
+    MOCK_METHOD1(ProxyQueryDBinderSession, std::shared_ptr<DBinderSessionObject>(uint32_t handle));
 };
 
 static void *g_interface = nullptr;
@@ -101,6 +107,22 @@ extern "C" {
         }
         return interface->WriteInt32(value);
     }
+    bool IPCProcessSkeleton::AttachDBinderCallbackStub(sptr<IRemoteObject> proxy, sptr<DBinderCallbackStub> stub)
+    {
+        MessageParcelInterface *interface = GetMessageParcelInterface();
+        if (interface == nullptr) {
+            return false;
+        }
+        return interface->AttachDBinderCallbackStub(proxy, stub);
+    }
+    std::shared_ptr<DBinderSessionObject> IPCProcessSkeleton::ProxyQueryDBinderSession(uint32_t handle)
+    {
+        MessageParcelInterface *interface = GetMessageParcelInterface();
+        if (interface == nullptr) {
+            return nullptr;
+        }
+        return interface->ProxyQueryDBinderSession(handle);
+    }
 }
 
 /**
@@ -146,6 +168,28 @@ HWTEST_F(MessageParcelTest, WriteDBinderProxyTest002, TestSize.Level1)
     delete instance;
 }
 
+/**
+ * @tc.name: WriteDBinderProxyTest003
+ * @tc.desc: Verify the MessageParcel::WriteDBinderProxy function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, WriteDBinderProxyTest003, TestSize.Level1)
+{
+    MessageParcel parcel;
+    IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
+    EXPECT_NE(current, nullptr);
+    sptr<IRemoteObject> object = new IPCObjectStub();
+    uint32_t handle = 3;
+    auto dbinderSessionObject =
+        std::make_shared<DBinderSessionObject>(NAME_TEST, DEVICE_TEST, NUMBER_TEST, nullptr, NUMBER_TEST);
+    EXPECT_NE(dbinderSessionObject, nullptr);
+    NiceMock<MessageParcelInterfaceMock> mock;
+    EXPECT_CALL(mock, ProxyQueryDBinderSession(handle)).WillOnce(Return(dbinderSessionObject));
+    EXPECT_CALL(mock, AttachDBinderCallbackStub(object, _)).WillOnce(Return(false));
+    auto ret = parcel.WriteDBinderProxy(object, handle, STUBINDEX_TEST);
+    EXPECT_EQ(ret, false);
+}
+
 /**
  * @tc.name: WriteRawDataTest001
  * @tc.desc: Verify the MessageParcel::WriteRawData function return true
@@ -259,4 +303,215 @@ HWTEST_F(MessageParcelTest, AppendTest002, TestSize.Level1)
     auto ret = parcel.Append(data);
     EXPECT_EQ(ret, true);
 }
+
+/**
+ * @tc.name: AppendTest003
+ * @tc.desc: Verify the MessageParcel::Append function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, AppendTest003, TestSize.Level1)
+{
+    MessageParcel data;
+    uint8_t bytes[BNUMBER_TEST] = {0};
+    data.WriteBuffer(bytes, BNUMBER_TEST);
+    data.objectCursor_ = 1;
+    binder_size_t *objectOffsets = new (std::nothrow) binder_size_t;
+    if (objectOffsets == nullptr) {
+        return;
+    }
+    data.objectOffsets_ = objectOffsets;
+    MessageParcel parcel;
+    parcel.writeCursor_ = 10;
+    auto ret = parcel.Append(data);
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: AcquireObjectTest001
+ * @tc.desc: Verify the AcquireObject function
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, AcquireObjectTest001, TestSize.Level1)
+{
+    flat_binder_object flat;
+    flat.hdr.type = BINDER_TYPE_BINDER;
+    flat.binder = 1;
+    sptr<IPCObjectStub> object = sptr<IPCObjectStub>::MakeSptr();
+    EXPECT_NE(object, nullptr);
+    flat.cookie = reinterpret_cast<binder_uintptr_t>(object.GetRefPtr());
+    AcquireObject(&flat, nullptr);
+    EXPECT_TRUE((flat.binder && flat.cookie != 0));
+}
+
+/**
+ * @tc.name: AcquireObjectTest002
+ * @tc.desc: Verify the AcquireObject function
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, AcquireObjectTest002, TestSize.Level1)
+{
+    flat_binder_object flat;
+    flat.hdr.type = BINDER_TYPE_HANDLE;
+    flat.binder = 1;
+    flat.handle = 123;
+    IPCProcessSkeleton *current = IPCProcessSkeleton::GetCurrent();
+    EXPECT_NE(current, nullptr);
+    std::u16string descriptor = current->MakeHandleDescriptor(flat.handle);
+    sptr<IRemoteObject> object = sptr<IPCObjectStub>::MakeSptr(descriptor);
+    EXPECT_NE(object, nullptr);
+    current->AttachObject(object.GetRefPtr(), false);
+    AcquireObject(&flat, nullptr);
+}
+
+/**
+ * @tc.name: UpdateDBinderDataOffsetTest001
+ * @tc.desc: Verify the MessageParcel::UpdateDBinderDataOffset function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, UpdateDBinderDataOffset001, TestSize.Level1)
+{
+    binder_buffer_object obj;
+    obj.hdr.type = BINDER_TYPE_PTR;
+    obj.length = sizeof(dbinder_negotiation_data);
+    MessageParcel parcel;
+    parcel.WriteBuffer(&obj, sizeof(obj));
+    parcel.dataSize_ = 0;
+    size_t offset = 0;
+    bool ret = parcel.UpdateDBinderDataOffset(offset);
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: WriteRemoteObjectTest001
+ * @tc.desc: Verify the MessageParcel::WriteRemoteObject function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, WriteRemoteObjectTest001, TestSize.Level1)
+{
+    MessageParcel parcel;
+    sptr<IRemoteObject> object = sptr<IPCObjectStub>::MakeSptr();
+    EXPECT_NE(object, nullptr);
+    object->refs_ = nullptr;
+    bool ret = parcel.WriteRemoteObject(object);
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: ReadRawDataTest001
+ * @tc.desc: Verify the MessageParcel::ReadRawData function
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, ReadRawDataTest001, TestSize.Level1)
+{
+    MessageParcel parcel;
+    char data[NUMBER_TEST] = {0};
+    parcel.WriteRawData(data, NUMBER_TEST);
+    auto ret = parcel.ReadRawData(NUMBER_TEST);
+    EXPECT_EQ(ret, parcel.rawData_.get());
+}
+
+/**
+ * @tc.name: WriteAshmemTest001
+ * @tc.desc: Verify the MessageParcel::WriteAshmem function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, WriteAshmemTest001, TestSize.Level1)
+{
+    MessageParcel parcel;
+    sptr<Ashmem> ashmem = new Ashmem(-1, 1024);
+    EXPECT_NE(ashmem, nullptr);
+    bool ret = parcel.WriteAshmem(ashmem);
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: ClearFileDescriptorTest001
+ * @tc.desc: Verify the MessageParcel::ClearFileDescriptor function
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, ClearFileDescriptorTest001, TestSize.Level1)
+{
+    MessageParcel parcel;
+    parcel.objectCursor_ = 1;
+    binder_size_t *objectOffsets = new (std::nothrow) binder_size_t;
+    if (objectOffsets == nullptr) {
+        return;
+    }
+    parcel.objectOffsets_ = objectOffsets;
+    parcel.dataSize_ = objectOffsets[0] + sizeof(flat_binder_object);
+    parcel.data_ = 0;
+    parcel.ClearFileDescriptor();
+}
+
+/**
+ * @tc.name: ContainFileDescriptorsTest001
+ * @tc.desc: Verify the MessageParcel::ContainFileDescriptors function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, ContainFileDescriptorsTest001, TestSize.Level1)
+{
+    MessageParcel parcel;
+    parcel.objectCursor_ = 1;
+    parcel.objectOffsets_ = nullptr;
+    bool ret = parcel.ContainFileDescriptors();
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: ContainFileDescriptorsTest002
+ * @tc.desc: Verify the MessageParcel::ContainFileDescriptors function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, ContainFileDescriptorsTest002, TestSize.Level1)
+{
+    MessageParcel parcel;
+    parcel.objectCursor_ = 1;
+    binder_size_t *objectOffsets = new (std::nothrow) binder_size_t;
+    if (objectOffsets == nullptr) {
+        return;
+    }
+    parcel.objectOffsets_ = objectOffsets;
+    parcel.dataSize_ = 0;
+    bool ret = parcel.ContainFileDescriptors();
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: ContainFileDescriptorsTest003
+ * @tc.desc: Verify the MessageParcel::ContainFileDescriptors function return false
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, ContainFileDescriptorsTest003, TestSize.Level1)
+{
+    MessageParcel parcel;
+    parcel.objectCursor_ = 1;
+    binder_size_t *objectOffsets = new (std::nothrow) binder_size_t;
+    if (objectOffsets == nullptr) {
+        return;
+    }
+    parcel.objectOffsets_ = objectOffsets;
+    parcel.dataSize_ = objectOffsets[0] + sizeof(flat_binder_object);
+    parcel.data_ = 0;
+    bool ret = parcel.ContainFileDescriptors();
+    EXPECT_EQ(ret, false);
+}
+
+/**
+ * @tc.name: PrintBufferTest001
+ * @tc.desc: Verify the MessageParcel::PrintBuffer function
+ * @tc.type: FUNC
+ */
+HWTEST_F(MessageParcelTest, PrintBufferTest001, TestSize.Level1)
+{
+    std::string funcName;
+    size_t lineNum = 100;
+    MessageParcel parcel;
+    parcel.PrintBuffer(funcName.c_str(), lineNum);
+    funcName = "PrintBufferTest001";
+    MessageParcel data;
+    uint8_t bytes[NUMBER_TEST] = {0};
+    data.WriteBuffer(bytes, NUMBER_TEST);
+    parcel.Append(data);
+    parcel.PrintBuffer(funcName.c_str(), lineNum);
+}
 }
\ No newline at end of file
-- 
Gitee


From 6ed92f7ed9d930dd60eb926002d1b6b7ecaec0de Mon Sep 17 00:00:00 2001
From: fanzhe <fanzhe001@chinasoftinc.com>
Date: Mon, 25 Aug 2025 15:53:26 +0800
Subject: [PATCH 13/15] =?UTF-8?q?=E8=A1=A5=E5=85=85FUZZ=E8=A6=86=E7=9B=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: fanzhe <fanzhe001@chinasoftinc.com>
Change-Id: I02bc216c8d8bade5e6bbc50647af5652c4207e33
---
 test/fuzztest/BUILD.gn                        |   2 +-
 .../dbinderdatabusinvoker_fuzzer.cpp          |   2 +-
 .../src/mock/dbinderservicemock/BUILD.gn      |  24 ++
 .../dbinderservicemock001_fuzzer}/BUILD.gn    |   7 +-
 .../dbinderservicemock001_fuzzer}/corpus/init |   0
 .../dbinderservicemock001_fuzzer.cpp          | 274 ++++++++++++++
 .../dbinderservicemock001_fuzzer}/project.xml |   0
 .../dbinderservicemock002_fuzzer/BUILD.gn     |  36 ++
 .../dbinderservicemock002_fuzzer/corpus/init  |  16 +
 .../dbinderservicemock002_fuzzer.cpp          | 345 ++++++++++++++++++
 .../dbinderservicemock002_fuzzer/project.xml  |  25 ++
 .../dbinderservicemock003_fuzzer/BUILD.gn     |  36 ++
 .../dbinderservicemock003_fuzzer/corpus/init  |  16 +
 .../dbinderservicemock003_fuzzer.cpp          | 273 ++++++++++++++
 .../dbinderservicemock003_fuzzer/project.xml  |  25 ++
 .../dbinderservicemock004_fuzzer/BUILD.gn     |  36 ++
 .../dbinderservicemock004_fuzzer/corpus/init  |  16 +
 .../dbinderservicemock004_fuzzer.cpp          | 290 +++++++++++++++
 .../dbinderservicemock004_fuzzer/project.xml  |  25 ++
 .../dbinderservicemock005_fuzzer/BUILD.gn     |  34 ++
 .../dbinderservicemock005_fuzzer/corpus/init  |  16 +
 .../dbinderservicemock005_fuzzer.cpp          | 158 ++++++++
 .../dbinderservicemock005_fuzzer/project.xml  |  25 ++
 .../dbinderservicemock006_fuzzer/BUILD.gn     |  34 ++
 .../dbinderservicemock006_fuzzer/corpus/init  |  16 +
 .../dbinderservicemock006_fuzzer.cpp          | 109 ++++++
 .../dbinderservicemock006_fuzzer/project.xml  |  25 ++
 .../include}/dbinderservicemock_fuzzer.h      |   0
 28 files changed, 1860 insertions(+), 5 deletions(-)
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/BUILD.gn
 rename test/fuzztest/{dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer => ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer}/BUILD.gn (84%)
 rename test/fuzztest/{dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer => ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer}/corpus/init (100%)
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/dbinderservicemock001_fuzzer.cpp
 rename test/fuzztest/{dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer => ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer}/project.xml (100%)
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/dbinderservicemock002_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/project.xml
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/dbinderservicemock003_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/project.xml
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/dbinderservicemock004_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/project.xml
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/dbinderservicemock005_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/project.xml
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/BUILD.gn
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/corpus/init
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/dbinderservicemock006_fuzzer.cpp
 create mode 100644 test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/project.xml
 rename test/fuzztest/{dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer => ipc/native/src/mock/dbinderservicemock/include}/dbinderservicemock_fuzzer.h (100%)

diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn
index 3bff21b9..8805c015 100644
--- a/test/fuzztest/BUILD.gn
+++ b/test/fuzztest/BUILD.gn
@@ -67,8 +67,8 @@ group("fuzztest") {
     "ipc/native/src/core/hitraceinvoker_fuzzer:HitraceInvokerFuzzTest",
     "ipc/native/src/mock/acquirehandle_fuzzer:AcquireHandleFuzzTest",
     "ipc/native/src/mock/dbinderremotelistenermock_fuzzer:DBinderRemoteListenerMockFuzzTest",
+    "ipc/native/src/mock/dbinderservicemock:dbinderservicemockfuzz",
     "dbinder/dbinder_service/src/dbinderservicenew_fuzzer:DBinderServiceNewFuzzTest",
     "dbinder/dbinder_service/src/socket/dbinderremotelistener_fuzzer:DBinderRemoteListenerFuzzTest",
-    "dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer:DBinderServiceMockFuzzTest",
   ]
 }
diff --git a/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp b/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp
index cc077272..0f587270 100644
--- a/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp
+++ b/test/fuzztest/ipc/native/src/core/dbinderdatabusinvoker_fuzzer/dbinderdatabusinvoker_fuzzer.cpp
@@ -625,7 +625,7 @@ void UpdateClientSessionFuzzTest(FuzzedDataProvider &provider)
     if (current == nullptr) {
         return;
     }
-    current->sessionName_ = provider.ConsumeRandomLengthString();
+    current->sessionName_ = provider.ConsumeRandomLengthString(MAX_STR_LEN);
     std::shared_ptr<DBinderSessionObject> sessionObject = CreateDBinderSessionObject(provider);
     if (sessionObject == nullptr) {
         return;
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/BUILD.gn
new file mode 100644
index 00000000..d1ff98d6
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/BUILD.gn
@@ -0,0 +1,24 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+group("dbinderservicemockfuzz") {
+  testonly = true
+  deps = [
+    "dbinderservicemock001_fuzzer:DBinderServiceMock001FuzzTest",
+    "dbinderservicemock002_fuzzer:DBinderServiceMock002FuzzTest",
+    "dbinderservicemock003_fuzzer:DBinderServiceMock003FuzzTest",
+    "dbinderservicemock004_fuzzer:DBinderServiceMock004FuzzTest",
+    "dbinderservicemock005_fuzzer:DBinderServiceMock005FuzzTest",
+    "dbinderservicemock006_fuzzer:DBinderServiceMock006FuzzTest",
+  ]
+}
diff --git a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/BUILD.gn
similarity index 84%
rename from test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/BUILD.gn
rename to test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/BUILD.gn
index d3cafff5..760643ec 100644
--- a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/BUILD.gn
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/BUILD.gn
@@ -16,14 +16,15 @@ import("//build/config/features.gni")
 import("//build/test.gni")
 
 ##############################fuzztest##########################################
-ohos_fuzztest("DBinderServiceMockFuzzTest") {
+ohos_fuzztest("DBinderServiceMock001FuzzTest") {
   module_out_path = "ipc/ipc"
-  fuzz_config_file = "../dbinderservicemock_fuzzer"
+  fuzz_config_file = "../dbinderservicemock001_fuzzer"
   defines = [
     "private = public",
     "protected = public",
   ]
-  sources = [ "dbinderservicemock_fuzzer.cpp" ]
+  include_dirs = [ "../include" ]
+  sources = [ "dbinderservicemock001_fuzzer.cpp" ]
   external_deps = [
     "c_utils:utils",
     "googletest:gmock",
diff --git a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/corpus/init
similarity index 100%
rename from test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/corpus/init
rename to test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/corpus/init
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/dbinderservicemock001_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/dbinderservicemock001_fuzzer.cpp
new file mode 100644
index 00000000..8c01dcc5
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/dbinderservicemock001_fuzzer.cpp
@@ -0,0 +1,274 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderservicemock_fuzzer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <ctime>
+#include <condition_variable>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <mutex>
+#include <random>
+#include <thread>
+
+#include "dbinder_service.h"
+#include "dbinder_service_stub.h"
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+#include "string_ex.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+const static size_t MAX_STRING_PARAM_LEN = 100;
+
+class DBinderServiceInterface {
+public:
+    DBinderServiceInterface() {};
+    virtual ~DBinderServiceInterface() {};
+    virtual int32_t DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName) = 0;
+    virtual int32_t Socket(SocketInfo info) = 0;
+    virtual int32_t Listen(int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener) = 0;
+};
+
+class DBinderServiceInterfaceMock : public DBinderServiceInterface {
+public:
+    DBinderServiceInterfaceMock();
+    ~DBinderServiceInterfaceMock() override;
+    MOCK_METHOD3(DBinderGrantPermission, int32_t(int32_t uid, int32_t pid, const std::string &socketName));
+    MOCK_METHOD1(Socket, int32_t(SocketInfo));
+    MOCK_METHOD4(Listen, int32_t(int32_t, const QosTV*, uint32_t, const ISocketListener *));
+};
+
+class TestRpcSystemAbilityCallback : public RpcSystemAbilityCallback {
+public:
+    sptr<IRemoteObject> GetSystemAbilityFromRemote(int32_t systemAbilityId) override
+    {
+        return nullptr;
+    }
+
+    bool LoadSystemAbilityFromRemote(const std::string& srcNetworkId, int32_t systemAbilityId) override
+    {
+        return isLoad_;
+    }
+    bool IsDistributedSystemAbility(int32_t systemAbilityId) override
+    {
+        return isSystemAbility_;
+    }
+    void SetSystemAbility(bool value)
+    {
+        isSystemAbility_ = value;
+    }
+    void SetLoad(bool value)
+    {
+        isLoad_ = value;
+    }
+
+private:
+    bool isSystemAbility_ = true;
+    bool isLoad_ = true;
+};
+
+static void *g_interface = nullptr;
+
+DBinderServiceInterfaceMock::DBinderServiceInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DBinderServiceInterfaceMock::~DBinderServiceInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DBinderServiceInterfaceMock *GetDBinderServiceInterfaceMock()
+{
+    return reinterpret_cast<DBinderServiceInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    int32_t DBinderSoftbusClient::DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->DBinderGrantPermission(uid, pid, socketName);
+    }
+
+    int32_t DBinderSoftbusClient::Socket(SocketInfo info)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->Socket(info);
+    }
+
+    int32_t DBinderSoftbusClient::Listen(
+        int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->Listen(socket, qos, qosCount, listener);
+    }
+}
+
+void StartDBinderServiceTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::shared_ptr<RpcSystemAbilityCallback> callbackImpl = nullptr;
+    callbackImpl = std::make_shared<TestRpcSystemAbilityCallback>();
+    if (callbackImpl == nullptr) {
+        return;
+    }
+    dBinderService->StartDBinderService(callbackImpl);
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    dBinderService->StartDBinderService(callbackImpl);
+    dBinderService->StartDBinderService(callbackImpl);
+    dBinderService->StartRemoteListener();
+    dBinderService->StopRemoteListener();
+}
+
+void AddStubByTagTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string name = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    const std::u16string serviceName = Str8ToStr16(name);
+    const std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+    binder_uintptr_t binderObjectPtr = reinterpret_cast<binder_uintptr_t>(stub.GetRefPtr());
+
+    dBinderService->AddStubByTag(binderObjectPtr);
+    dBinderService->QueryStubPtr(binderObjectPtr);
+    dBinderService->AddStubByTag(binderObjectPtr);
+}
+
+void CheckBinderObjectTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string name = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    const std::u16string serviceName = Str8ToStr16(name);
+    const std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+    binder_uintptr_t binderObjectPtr = reinterpret_cast<binder_uintptr_t>(stub.GetRefPtr());
+
+    sptr<DBinderServiceStub> stub1 = nullptr;
+    dBinderService->CheckBinderObject(stub1, binderObjectPtr);
+}
+
+void FindOrNewDBinderStubTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string name = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::u16string serviceName = Str8ToStr16(name);
+    std::string device = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    bool isNew = false;
+
+    dBinderService->FindOrNewDBinderStub(serviceName, device, binderObject, pid, uid, isNew);
+    dBinderService->HasDBinderStub(binderObject);
+    dBinderService->FindDBinderStub(serviceName, device);
+    dBinderService->DeleteDBinderStub(serviceName, device, pid, uid);
+
+    dBinderService->FindOrNewDBinderStub(serviceName, device, binderObject, pid, uid, isNew);
+    dBinderService->FindOrNewDBinderStub(serviceName, device, binderObject, pid, uid, isNew);
+    dBinderService->DeleteDBinderStub(serviceName, device);
+}
+
+void OnRemoteInvokerMessageTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<DHandleEntryTxRx>();
+    if (message == nullptr || dBinderService == nullptr) {
+        return;
+    }
+
+    std::shared_ptr<TestRpcSystemAbilityCallback> callback = std::make_shared<TestRpcSystemAbilityCallback>();
+    if (callback == nullptr) {
+        return;
+    }
+
+    message->stubIndex = provider.ConsumeIntegralInRange<int32_t>(DBinderService::FIRST_SYS_ABILITY_ID,
+        DBinderService::LAST_SYS_ABILITY_ID);
+    message->binderObject = provider.ConsumeIntegralInRange<int32_t>(DBinderService::FIRST_SYS_ABILITY_ID,
+        DBinderService::LAST_SYS_ABILITY_ID);
+
+    std::string localDevID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    std::string deviceID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    auto temp = std::static_pointer_cast<OHOS::RpcSystemAbilityCallback>(callback);
+    dBinderService->mainThreadCreated_ = false;
+    bool ret = dBinderService->StartDBinderService(temp);
+    if (!ret) {
+        return;
+    }
+    dBinderService->CopyDeviceIDsToMessage(message, localDevID, deviceID);
+    dBinderService->OnRemoteInvokerMessage(message);
+
+    callback->SetSystemAbility(true);
+    dBinderService->OnRemoteInvokerMessage(message);
+
+    callback->SetLoad(true);
+    dBinderService->OnRemoteInvokerMessage(message);
+    dBinderService->StopRemoteListener();
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::StartDBinderServiceTest(provider);
+    OHOS::AddStubByTagTest(provider);
+    OHOS::CheckBinderObjectTest(provider);
+    OHOS::FindOrNewDBinderStubTest(provider);
+    OHOS::OnRemoteInvokerMessageTest(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/project.xml
similarity index 100%
rename from test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/project.xml
rename to test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock001_fuzzer/project.xml
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/BUILD.gn
new file mode 100644
index 00000000..65ad35be
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/BUILD.gn
@@ -0,0 +1,36 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderServiceMock002FuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbinderservicemock002_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+  include_dirs = [ "../include" ]
+  sources = [ "dbinderservicemock002_fuzzer.cpp" ]
+  external_deps = [
+    "c_utils:utils",
+    "googletest:gmock",
+    "googletest:gtest",
+    "hilog:libhilog",
+    "ipc:libdbinder",
+    "ipc:ipc_core",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/dbinderservicemock002_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/dbinderservicemock002_fuzzer.cpp
new file mode 100644
index 00000000..4856b3c0
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/dbinderservicemock002_fuzzer.cpp
@@ -0,0 +1,345 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderservicemock_fuzzer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <ctime>
+#include <condition_variable>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <mutex>
+#include <random>
+#include <thread>
+
+#include "dbinder_service.h"
+#include "dbinder_service_stub.h"
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+#include "string_ex.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+const std::string RANDOM_DEVICEID = "device";
+
+class DBinderServiceInterface {
+public:
+    DBinderServiceInterface() {};
+    virtual ~DBinderServiceInterface() {};
+    virtual int32_t DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName) = 0;
+    virtual int32_t Socket(SocketInfo info) = 0;
+    virtual int32_t Listen(int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener) = 0;
+    virtual bool SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg) = 0;
+    virtual int32_t GetLocalNodeDeviceId(const std::string &pkgName, std::string &devId) = 0;
+};
+
+class DBinderServiceInterfaceMock : public DBinderServiceInterface {
+public:
+    DBinderServiceInterfaceMock();
+    ~DBinderServiceInterfaceMock() override;
+    MOCK_METHOD3(DBinderGrantPermission, int32_t(int32_t uid, int32_t pid, const std::string &socketName));
+    MOCK_METHOD1(Socket, int32_t(SocketInfo));
+    MOCK_METHOD4(Listen, int32_t(int32_t, const QosTV*, uint32_t, const ISocketListener *));
+    MOCK_METHOD2(SendDataToRemote, bool(const std::string &networkId, const struct DHandleEntryTxRx *msg));
+    MOCK_METHOD2(GetLocalNodeDeviceId, int32_t(const std::string &pkgName, std::string &devId));
+};
+
+class TestRpcSystemAbilityCallback : public RpcSystemAbilityCallback {
+public:
+    sptr<IRemoteObject> GetSystemAbilityFromRemote(int32_t systemAbilityId) override
+    {
+        return nullptr;
+    }
+
+    bool LoadSystemAbilityFromRemote(const std::string& srcNetworkId, int32_t systemAbilityId) override
+    {
+        return isLoad_;
+    }
+    bool IsDistributedSystemAbility(int32_t systemAbilityId) override
+    {
+        return isSystemAbility_;
+    }
+    void SetSystemAbility(bool value)
+    {
+        isSystemAbility_ = value;
+    }
+    void SetLoad(bool value)
+    {
+        isLoad_ = value;
+    }
+
+private:
+    bool isSystemAbility_ = true;
+    bool isLoad_ = true;
+};
+
+static void *g_interface = nullptr;
+
+DBinderServiceInterfaceMock::DBinderServiceInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DBinderServiceInterfaceMock::~DBinderServiceInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DBinderServiceInterfaceMock *GetDBinderServiceInterfaceMock()
+{
+    return reinterpret_cast<DBinderServiceInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    int32_t DBinderSoftbusClient::DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->DBinderGrantPermission(uid, pid, socketName);
+    }
+
+    int32_t DBinderSoftbusClient::Socket(SocketInfo info)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->Socket(info);
+    }
+
+    int32_t DBinderSoftbusClient::Listen(
+        int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->Listen(socket, qos, qosCount, listener);
+    }
+
+    bool DBinderRemoteListener::SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg)
+    {
+        if (g_interface == nullptr) {
+            return false;
+        }
+        return GetDBinderServiceInterfaceMock()->SendDataToRemote(networkId, msg);
+    }
+
+    int32_t DBinderSoftbusClient::GetLocalNodeDeviceId(const std::string &pkgName, std::string &devId)
+    {
+        if (g_interface == nullptr) {
+            return SOFTBUS_CLIENT_SUCCESS;
+        }
+        devId = RANDOM_DEVICEID;
+
+        return GetDBinderServiceInterfaceMock()->GetLocalNodeDeviceId(pkgName, devId);
+    }
+}
+
+void InvokerRemoteDBinderTest001(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    sptr<DBinderServiceStub> stub1 = nullptr;
+    dBinderService->InvokerRemoteDBinder(stub1, seqNumber, pid, uid);
+}
+
+void InvokerRemoteDBinderTest002(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    const std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    const std::string deviceID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    bool isNew = true;
+    std::shared_ptr<struct ThreadLockInfo> threadLockInfo = std::make_shared<struct ThreadLockInfo>();
+    if (threadLockInfo == nullptr) {
+        return;
+    }
+    dBinderService->AttachThreadLockInfo(seqNumber, deviceID, threadLockInfo);
+    dBinderService->InvokerRemoteDBinder(stub, seqNumber, pid, uid, isNew);
+
+    isNew = false;
+    dBinderService->InvokerRemoteDBinder(stub, seqNumber, pid, uid, isNew);
+    int32_t time = 1;
+    stub->SetNegoStatusAndTime(NegotiationStatus::NEGO_FINISHED, time);
+    dBinderService->InvokerRemoteDBinder(stub, seqNumber, pid, uid, isNew);
+}
+
+void InvokerRemoteDBinderTest003(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    const std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    const std::string deviceID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetLocalNodeDeviceId).WillRepeatedly(testing::Return(SOFTBUS_CLIENT_SUCCESS));
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    dBinderService->StartRemoteListener();
+    EXPECT_CALL(mock, SendDataToRemote).WillRepeatedly(testing::Return(true));
+
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    bool isNew = true;
+    dBinderService->InvokerRemoteDBinder(stub, seqNumber, pid, uid, isNew);
+    std::thread t([dBinderService, seqNumber]() {
+        std::this_thread::sleep_for(std::chrono::seconds(1));
+        dBinderService->WakeupThreadByStub(seqNumber);
+    });
+    t.detach();
+    dBinderService->InvokerRemoteDBinder(stub, seqNumber, pid, uid, isNew);
+    dBinderService->StopRemoteListener();
+}
+
+void InvokerRemoteDBinderTest004(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    const std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    const std::string deviceID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetLocalNodeDeviceId).WillRepeatedly(testing::Return(SOFTBUS_CLIENT_SUCCESS));
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    dBinderService->StartRemoteListener();
+    EXPECT_CALL(mock, SendDataToRemote).WillRepeatedly(testing::Return(true));
+
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    bool isNew = true;
+    std::thread t([dBinderService, seqNumber, &stub]() {
+        std::this_thread::sleep_for(std::chrono::seconds(1));
+        dBinderService->WakeupThreadByStub(seqNumber);
+        std::shared_ptr<struct SessionInfo> session = std::make_shared<struct SessionInfo>();
+        if (session == nullptr) {
+            return;
+        }
+        dBinderService->AttachSessionObject(session, reinterpret_cast<binder_uintptr_t>(stub.GetRefPtr()));
+    });
+    t.detach();
+    dBinderService->InvokerRemoteDBinder(stub, seqNumber, pid, uid, isNew);
+    dBinderService->StopRemoteListener();
+}
+
+void LoadSystemAbilityCompleteTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct DHandleEntryTxRx> replyMessage = std::make_shared<DHandleEntryTxRx>();
+    if (replyMessage == nullptr || dBinderService == nullptr) {
+        return;
+    }
+
+    const std::string localDevID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    const std::string deviceID =  provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    int32_t systemAbilityId = provider.ConsumeIntegral<int32_t>();
+
+    int32_t handle = provider.ConsumeIntegral<int32_t>();
+    sptr<IPCObjectProxy> callbackProxy = new (std::nothrow) IPCObjectProxy(handle);
+    if (callbackProxy == nullptr) {
+        return;
+    }
+    sptr<IPCObjectProxy> callbackProxy1 = nullptr;
+    dBinderService->LoadSystemAbilityComplete(localDevID, systemAbilityId, callbackProxy1);
+
+    std::shared_ptr<TestRpcSystemAbilityCallback> callback = std::make_shared<TestRpcSystemAbilityCallback>();
+    if (callback == nullptr) {
+        return;
+    }
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    auto temp = std::static_pointer_cast<OHOS::RpcSystemAbilityCallback>(callback);
+    dBinderService->mainThreadCreated_ = false;
+    bool ret = dBinderService->StartDBinderService(temp);
+    if (!ret) {
+        return;
+    }
+
+    dBinderService->CopyDeviceIDsToMessage(replyMessage, localDevID, deviceID);
+    replyMessage->stubIndex = provider.ConsumeIntegralInRange<int32_t>(DBinderService::FIRST_SYS_ABILITY_ID,
+        DBinderService::LAST_SYS_ABILITY_ID);
+    replyMessage->binderObject = provider.ConsumeIntegralInRange<int32_t>(DBinderService::FIRST_SYS_ABILITY_ID,
+        DBinderService::LAST_SYS_ABILITY_ID);
+
+    callback->SetSystemAbility(true);
+    callback->SetLoad(true);
+    dBinderService->OnRemoteInvokerMessage(replyMessage);
+
+    dBinderService->LoadSystemAbilityComplete(localDevID, replyMessage->stubIndex, callbackProxy);
+    dBinderService->StopRemoteListener();
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::InvokerRemoteDBinderTest001(provider);
+    OHOS::InvokerRemoteDBinderTest002(provider);
+    OHOS::InvokerRemoteDBinderTest003(provider);
+    OHOS::InvokerRemoteDBinderTest004(provider);
+    OHOS::LoadSystemAbilityCompleteTest(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock002_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/BUILD.gn
new file mode 100644
index 00000000..9b39fc31
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/BUILD.gn
@@ -0,0 +1,36 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderServiceMock003FuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbinderservicemock003_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+  include_dirs = [ "../include" ]
+  sources = [ "dbinderservicemock003_fuzzer.cpp" ]
+  external_deps = [
+    "c_utils:utils",
+    "googletest:gmock",
+    "googletest:gtest",
+    "hilog:libhilog",
+    "ipc:libdbinder",
+    "ipc:ipc_core",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/dbinderservicemock003_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/dbinderservicemock003_fuzzer.cpp
new file mode 100644
index 00000000..110d9602
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/dbinderservicemock003_fuzzer.cpp
@@ -0,0 +1,273 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderservicemock_fuzzer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <ctime>
+#include <condition_variable>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <mutex>
+#include <random>
+#include <thread>
+
+#include "dbinder_service.h"
+#include "dbinder_service_stub.h"
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+#include "string_ex.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+const static size_t MAX_STRING_PARAM_LEN = 100;
+const std::string RANDOM_DEVICEID = "device";
+
+class DBinderServiceInterface {
+public:
+    DBinderServiceInterface() {};
+    virtual ~DBinderServiceInterface() {};
+
+    virtual int32_t DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName) = 0;
+    virtual int32_t Socket(SocketInfo info) = 0;
+    virtual int32_t Listen(int32_t socket, const QosTV qos[], uint32_t qosCount,
+        const ISocketListener *listener) = 0;
+    virtual bool SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg) = 0;
+    virtual int32_t GetLocalNodeDeviceId(const std::string &pkgName, std::string &devId) = 0;
+    virtual int GetSptrRefCount() = 0;
+};
+
+class DBinderServiceInterfaceMock : public DBinderServiceInterface {
+public:
+    DBinderServiceInterfaceMock();
+    ~DBinderServiceInterfaceMock() override;
+    MOCK_METHOD3(DBinderGrantPermission, int32_t(int32_t uid, int32_t pid, const std::string &socketName));
+    MOCK_METHOD1(Socket, int32_t(SocketInfo));
+    MOCK_METHOD4(Listen, int32_t(int32_t, const QosTV*, uint32_t, const ISocketListener *));
+    MOCK_METHOD2(SendDataToRemote, bool(const std::string &networkId, const struct DHandleEntryTxRx *msg));
+    MOCK_METHOD2(GetLocalNodeDeviceId, int32_t(const std::string &pkgName, std::string &devId));
+    MOCK_METHOD0(GetSptrRefCount, int());
+};
+
+static void *g_interface = nullptr;
+
+DBinderServiceInterfaceMock::DBinderServiceInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DBinderServiceInterfaceMock::~DBinderServiceInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DBinderServiceInterfaceMock *GetDBinderServiceInterfaceMock()
+{
+    return reinterpret_cast<DBinderServiceInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    int32_t DBinderSoftbusClient::DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->DBinderGrantPermission(uid, pid, socketName);
+    }
+
+    int32_t DBinderSoftbusClient::Socket(SocketInfo info)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->Socket(info);
+    }
+
+    int32_t DBinderSoftbusClient::Listen(
+        int32_t socket, const QosTV qos[], uint32_t qosCount, const ISocketListener *listener)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->Listen(socket, qos, qosCount, listener);
+    }
+
+    bool DBinderRemoteListener::SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg)
+    {
+        if (g_interface == nullptr) {
+            return false;
+        }
+        return GetDBinderServiceInterfaceMock()->SendDataToRemote(networkId, msg);
+    }
+
+    int32_t DBinderSoftbusClient::GetLocalNodeDeviceId(const std::string &pkgName, std::string &devId)
+    {
+        if (g_interface == nullptr) {
+            return SOFTBUS_CLIENT_SUCCESS;
+        }
+        devId = RANDOM_DEVICEID;
+
+        return GetDBinderServiceInterfaceMock()->GetLocalNodeDeviceId(pkgName, devId);
+    }
+
+    int RefBase::GetSptrRefCount()
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->GetSptrRefCount();
+    }
+}
+
+void SendEntryToRemoteTest001(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    const std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    const std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+
+    dBinderService->SendEntryToRemote(stub, seqNumber, pid, uid);
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetLocalNodeDeviceId).WillRepeatedly(testing::Return(SOFTBUS_CLIENT_SUCCESS));
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    dBinderService->StartRemoteListener();
+    EXPECT_CALL(mock, SendDataToRemote).WillRepeatedly(testing::Return(false));
+    dBinderService->SendEntryToRemote(stub, seqNumber, pid, uid);
+
+    EXPECT_CALL(mock, SendDataToRemote).WillRepeatedly(testing::Return(true));
+    dBinderService->SendEntryToRemote(stub, seqNumber, pid, uid);
+    dBinderService->StopRemoteListener();
+}
+
+void SendEntryToRemoteTest002(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string name = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    const std::u16string serviceName = Str8ToStr16(name);
+    const std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+
+    dBinderService->SendEntryToRemote(stub, seqNumber, pid, uid);
+}
+
+void MakeRemoteBinderTest001(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    std::string deviceID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+
+    dBinderService->MakeRemoteBinder(serviceName, deviceID, binderObject, pid, uid);
+}
+
+void MakeRemoteBinderTest002(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    const std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    std::string deviceID = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetLocalNodeDeviceId).WillRepeatedly(testing::Return(SOFTBUS_CLIENT_SUCCESS));
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, Socket).WillRepeatedly(testing::Return(1));
+    EXPECT_CALL(mock, Listen).WillRepeatedly(testing::Return(0));
+    dBinderService->StartRemoteListener();
+    EXPECT_CALL(mock, SendDataToRemote).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mock, GetSptrRefCount).WillRepeatedly(testing::Return(1));
+
+    dBinderService->MakeRemoteBinder(serviceName, deviceID, binderObject, pid, uid);
+    dBinderService->StopRemoteListener();
+}
+
+void CheckAndAmendSaIdTest(FuzzedDataProvider &provider)
+{
+    std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<DHandleEntryTxRx>();
+    if (message == nullptr) {
+        return;
+    }
+
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    message->stubIndex = provider.ConsumeIntegralInRange<int32_t>(DBinderService::FIRST_SYS_ABILITY_ID,
+        DBinderService::LAST_SYS_ABILITY_ID);
+    message->binderObject = 0;
+    dBinderService->CheckAndAmendSaId(message);
+
+    message->stubIndex = 0;
+    message->binderObject = provider.ConsumeIntegralInRange<int32_t>(DBinderService::FIRST_SYS_ABILITY_ID,
+        DBinderService::LAST_SYS_ABILITY_ID);
+    dBinderService->CheckAndAmendSaId(message);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::SendEntryToRemoteTest001(provider);
+    OHOS::SendEntryToRemoteTest002(provider);
+    OHOS::MakeRemoteBinderTest001(provider);
+    OHOS::MakeRemoteBinderTest002(provider);
+    OHOS::CheckAndAmendSaIdTest(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock003_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/BUILD.gn
new file mode 100644
index 00000000..3fdc9efe
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/BUILD.gn
@@ -0,0 +1,36 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderServiceMock004FuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbinderservicemock004_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+  include_dirs = [ "../include" ]
+  sources = [ "dbinderservicemock004_fuzzer.cpp" ]
+  external_deps = [
+    "c_utils:utils",
+    "googletest:gmock",
+    "googletest:gtest",
+    "hilog:libhilog",
+    "ipc:libdbinder",
+    "ipc:ipc_core",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/dbinderservicemock004_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/dbinderservicemock004_fuzzer.cpp
new file mode 100644
index 00000000..d3ec763e
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/dbinderservicemock004_fuzzer.cpp
@@ -0,0 +1,290 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderservicemock_fuzzer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <ctime>
+#include <condition_variable>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <mutex>
+#include <random>
+#include <thread>
+
+#include "dbinder_service.h"
+#include "dbinder_service_stub.h"
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+#include "string_ex.h"
+
+using namespace testing;
+using namespace testing::ext;
+
+namespace OHOS {
+
+class DBinderServiceInterface {
+public:
+    DBinderServiceInterface() {};
+    virtual ~DBinderServiceInterface() {};
+
+    virtual int32_t DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName) = 0;
+    virtual std::string GetSessionName() = 0;
+    virtual bool WriteString(const std::string &value) = 0;
+    virtual int InvokeListenThread(MessageParcel &data, MessageParcel &reply) = 0;
+    virtual uint64_t ReadUint64() = 0;
+    virtual const std::string ReadString() = 0;
+};
+
+class DBinderServiceInterfaceMock : public DBinderServiceInterface {
+public:
+    DBinderServiceInterfaceMock();
+    ~DBinderServiceInterfaceMock() override;
+    MOCK_METHOD3(DBinderGrantPermission, int32_t(int32_t uid, int32_t pid, const std::string &socketName));
+    MOCK_METHOD0(GetSessionName, std::string());
+    MOCK_METHOD1(WriteString, bool(const std::string &value));
+    MOCK_METHOD2(InvokeListenThread, int(MessageParcel &data, MessageParcel &reply));
+    MOCK_METHOD0(ReadUint64, uint64_t());
+    MOCK_METHOD0(ReadString, const std::string());
+};
+
+static void *g_interface = nullptr;
+
+DBinderServiceInterfaceMock::DBinderServiceInterfaceMock()
+{
+    g_interface = reinterpret_cast<void *>(this);
+}
+
+DBinderServiceInterfaceMock::~DBinderServiceInterfaceMock()
+{
+    g_interface = nullptr;
+}
+
+static DBinderServiceInterfaceMock *GetDBinderServiceInterfaceMock()
+{
+    return reinterpret_cast<DBinderServiceInterfaceMock *>(g_interface);
+}
+
+extern "C" {
+    int32_t DBinderSoftbusClient::DBinderGrantPermission(int32_t uid, int32_t pid, const std::string &socketName)
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->DBinderGrantPermission(uid, pid, socketName);
+    }
+
+    std::string IPCObjectProxy::GetSessionName()
+    {
+        if (g_interface == nullptr) {
+            return "";
+        }
+        return GetDBinderServiceInterfaceMock()->GetSessionName();
+    }
+
+    bool Parcel::WriteString(const std::string &value)
+    {
+        if (g_interface == nullptr) {
+            return false;
+        }
+        return GetDBinderServiceInterfaceMock()->WriteString(value);
+    }
+
+    int IPCObjectProxy::InvokeListenThread(MessageParcel &data, MessageParcel &reply)
+    {
+        if (g_interface == nullptr) {
+            return 0;
+        }
+        return GetDBinderServiceInterfaceMock()->InvokeListenThread(data, reply);
+    }
+
+    uint64_t Parcel::ReadUint64()
+    {
+        if (g_interface == nullptr) {
+            return -1;
+        }
+        return GetDBinderServiceInterfaceMock()->ReadUint64();
+    }
+
+    const std::string Parcel::ReadString()
+    {
+        if (g_interface == nullptr) {
+            return "";
+        }
+        return GetDBinderServiceInterfaceMock()->ReadString();
+    }
+}
+
+static void RandomString(std::string &str)
+{
+    const std::string charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    const size_t length = 250;
+
+    std::mt19937 rng(static_cast<unsigned int>(std::time(nullptr)));
+    std::uniform_int_distribution<size_t> dist(0, charset.size() - 1);
+
+    str.reserve(length);
+    for (size_t i = 0; i < length; ++i) {
+        str += charset[dist(rng)];
+    }
+}
+
+void GetDatabusNameByProxyTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    sptr<IPCObjectProxy> callbackProxy = nullptr;
+    dBinderService->GetDatabusNameByProxy(callbackProxy);
+
+    int32_t handle = provider.ConsumeIntegral<int32_t>();
+    callbackProxy = new (std::nothrow) IPCObjectProxy(handle);
+    if (callbackProxy == nullptr) {
+        return;
+    }
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetSessionName).WillRepeatedly(testing::Return(""));
+    dBinderService->GetDatabusNameByProxy(callbackProxy);
+
+    EXPECT_CALL(mock, GetSessionName).WillRepeatedly(testing::Return("abc"));
+    dBinderService->GetDatabusNameByProxy(callbackProxy);
+}
+
+void CreateDatabusNameTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    int32_t pid = provider.ConsumeIntegral<int32_t>();
+    int32_t uid = provider.ConsumeIntegral<int32_t>();
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, DBinderGrantPermission).WillRepeatedly(testing::Return(ERR_NONE));
+    dBinderService->CreateDatabusName(pid, uid);
+}
+
+void SetReplyMessageTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<DHandleEntryTxRx>();
+    if (message == nullptr || dBinderService == nullptr) {
+        return;
+    }
+    int32_t handle = provider.ConsumeIntegral<int32_t>();
+    sptr<IPCObjectProxy> proxy = new (std::nothrow) IPCObjectProxy(handle);
+    if (proxy == nullptr) {
+        return;
+    }
+    uint64_t stubIndex = provider.ConsumeIntegral<uint64_t>();
+    std::string serverSessionName = "";
+    RandomString(serverSessionName);
+    uint32_t selfTokenId = provider.ConsumeIntegral<uint32_t>();
+    message->head.version = RPC_TOKENID_SUPPORT_VERSION + 1;
+    dBinderService->SetReplyMessage(message, stubIndex, serverSessionName, selfTokenId, proxy);
+
+    message->head.version = 1;
+    dBinderService->SetReplyMessage(message, stubIndex, serverSessionName, selfTokenId, proxy);
+}
+
+void OnRemoteInvokerDataBusMessageTest001(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct DHandleEntryTxRx> replyMessage = std::make_shared<DHandleEntryTxRx>();
+    if (replyMessage == nullptr || dBinderService == nullptr) {
+        return;
+    }
+    int32_t handle = provider.ConsumeIntegral<int32_t>();
+    sptr<IPCObjectProxy> proxy = new (std::nothrow) IPCObjectProxy(handle);
+    if (proxy == nullptr) {
+        return;
+    }
+
+    std::string remoteDeviceId = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    int32_t pid = provider.ConsumeIntegral<int32_t>();
+    int32_t uid = provider.ConsumeIntegral<int32_t>();
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetSessionName).WillRepeatedly(testing::Return(""));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    EXPECT_CALL(mock, GetSessionName).WillRepeatedly(testing::Return("123"));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    EXPECT_CALL(mock, WriteString).WillRepeatedly(testing::Return(false));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    EXPECT_CALL(mock, WriteString).WillRepeatedly(testing::Return(true));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    EXPECT_CALL(mock, InvokeListenThread).WillRepeatedly(testing::Return(1));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    EXPECT_CALL(mock, InvokeListenThread).WillRepeatedly(testing::Return(ERR_NONE));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+}
+
+void OnRemoteInvokerDataBusMessageTest002(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct DHandleEntryTxRx> replyMessage = std::make_shared<DHandleEntryTxRx>();
+    if (replyMessage == nullptr || dBinderService == nullptr) {
+        return;
+    }
+    int32_t handle = provider.ConsumeIntegral<int32_t>();
+    sptr<IPCObjectProxy> proxy = new (std::nothrow) IPCObjectProxy(handle);
+    if (proxy == nullptr) {
+        return;
+    }
+
+    std::string remoteDeviceId = provider.ConsumeRandomLengthString(DEVICEID_LENGTH);
+    int32_t pid = provider.ConsumeIntegral<int32_t>();
+    int32_t uid = provider.ConsumeIntegral<int32_t>();
+    uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
+
+    NiceMock<DBinderServiceInterfaceMock> mock;
+    EXPECT_CALL(mock, GetSessionName).WillRepeatedly(testing::Return("123"));
+    EXPECT_CALL(mock, WriteString).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(mock, InvokeListenThread).WillRepeatedly(testing::Return(ERR_NONE));
+    EXPECT_CALL(mock, ReadString).WillRepeatedly(testing::Return("123"));
+    EXPECT_CALL(mock, ReadUint64).WillRepeatedly(testing::Return(0));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    EXPECT_CALL(mock, ReadUint64).WillRepeatedly(testing::Return(1));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+
+    std::string serverSessionName = "";
+    RandomString(serverSessionName);
+    EXPECT_CALL(mock, ReadString).WillRepeatedly(testing::Return(serverSessionName));
+    dBinderService->OnRemoteInvokerDataBusMessage(proxy, replyMessage, remoteDeviceId, pid, uid, tokenId);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::GetDatabusNameByProxyTest(provider);
+    OHOS::CreateDatabusNameTest(provider);
+    OHOS::SetReplyMessageTest(provider);
+    OHOS::OnRemoteInvokerDataBusMessageTest001(provider);
+    OHOS::OnRemoteInvokerDataBusMessageTest002(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock004_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/BUILD.gn
new file mode 100644
index 00000000..7a492998
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/BUILD.gn
@@ -0,0 +1,34 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderServiceMock005FuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbinderservicemock005_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+  include_dirs = [ "../include" ]
+  sources = [ "dbinderservicemock005_fuzzer.cpp" ]
+  external_deps = [
+    "c_utils:utils",
+    "hilog:libhilog",
+    "ipc:libdbinder",
+    "ipc:ipc_core",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/dbinderservicemock005_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/dbinderservicemock005_fuzzer.cpp
new file mode 100644
index 00000000..4dfce25d
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/dbinderservicemock005_fuzzer.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderservicemock_fuzzer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <ctime>
+#include <condition_variable>
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include "dbinder_service.h"
+#include "dbinder_service_stub.h"
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+#include "string_ex.h"
+
+namespace OHOS {
+const static size_t MAX_STRING_PARAM_LEN = 100;
+
+void RegisterRemoteProxyTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string name = provider.ConsumeRandomLengthString(SERVICENAME_LENGTH);
+    const std::u16string serviceName = Str8ToStr16(name);
+
+    int handle = provider.ConsumeIntegral<int>();
+    sptr<IRemoteObject> binderObject = new (std::nothrow) IPCObjectProxy(handle);
+    if (binderObject == nullptr) {
+        return;
+    }
+    dBinderService->RegisterRemoteProxy(serviceName, binderObject);
+
+    binder_uintptr_t binder = (binder_uintptr_t)binderObject.GetRefPtr();
+    dBinderService->GetRegisterService(binder);
+}
+void InvokerRemoteDBinderWhenWaitRspTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+
+    uint32_t pid = provider.ConsumeIntegral<uint32_t>();
+    uint32_t uid = provider.ConsumeIntegral<uint32_t>();
+    uint64_t num = provider.ConsumeIntegral<uint64_t>();
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    const std::u16string serviceName = Str8ToStr16(std::to_string(num));
+    const std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = static_cast<binder_uintptr_t>(provider.ConsumeIntegral<uint64_t>());
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+    std::shared_ptr<struct ThreadLockInfo> threadLockInfo = std::make_shared<struct ThreadLockInfo>();
+    stub->SetNegoStatusAndTime(NegotiationStatus::NEGO_INIT, 1);
+    dBinderService->InvokerRemoteDBinderWhenWaitRsp(stub, seqNumber, pid, uid, threadLockInfo);
+
+    if (threadLockInfo == nullptr) {
+        return;
+    }
+    dBinderService->AttachThreadLockInfo(seqNumber, deviceID, threadLockInfo);
+    dBinderService->InvokerRemoteDBinderWhenWaitRsp(stub, seqNumber, pid, uid, threadLockInfo);
+}
+
+void OnRemoteMessageTaskTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    dBinderService->OnRemoteMessageTask(nullptr);
+    std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<DHandleEntryTxRx>();
+    if (message == nullptr) {
+        return;
+    }
+    message->seqNumber = provider.ConsumeIntegral<uint32_t>();
+    message->dBinderCode = DBinderCode::MESSAGE_AS_REMOTE_ERROR;
+    dBinderService->OnRemoteMessageTask(message);
+}
+
+void ProcessOnSessionClosedTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::string otherNetworkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    uint32_t otherSeqNumber = provider.ConsumeIntegral<uint32_t>();
+    dBinderService->AttachThreadLockInfo(seqNumber, networkId, std::make_shared<ThreadLockInfo>());
+    dBinderService->AttachThreadLockInfo(otherSeqNumber, otherNetworkId, std::make_shared<ThreadLockInfo>());
+
+    dBinderService->ProcessOnSessionClosed(networkId);
+    dBinderService->DetachThreadLockInfo(seqNumber);
+    dBinderService->DetachThreadLockInfo(otherSeqNumber);
+}
+
+void IsInvalidStubTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    const std::string serviceName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    const std::u16string serviceName16 = Str8ToStr16(serviceName);
+    const std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    binder_uintptr_t binderObject = provider.ConsumeIntegral<binder_uintptr_t>();
+    sptr<DBinderServiceStub> stub = new (std::nothrow) DBinderServiceStub(serviceName16, deviceID, binderObject);
+    if (stub == nullptr) {
+        return;
+    }
+    binder_uintptr_t binderObjectPtr = reinterpret_cast<binder_uintptr_t>(stub.GetRefPtr());
+    binder_uintptr_t stubTag = dBinderService->stubTagNum_++;
+    auto result = dBinderService->mapDBinderStubRegisters_.insert({stubTag, binderObjectPtr});
+    if (!result.second) {
+        return;
+    }
+    dBinderService->DBinderStubRegisted_.push_back(stub);
+    auto replyMessage = std::make_shared<struct DHandleEntryTxRx>();
+    if (replyMessage == nullptr) {
+        return;
+    }
+    replyMessage->stub = stubTag;
+
+    dBinderService->IsInvalidStub(replyMessage);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::RegisterRemoteProxyTest(provider);
+    OHOS::InvokerRemoteDBinderWhenWaitRspTest(provider);
+    OHOS::OnRemoteMessageTaskTest(provider);
+    OHOS::ProcessOnSessionClosedTest(provider);
+    OHOS::IsInvalidStubTest(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock005_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/BUILD.gn b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/BUILD.gn
new file mode 100644
index 00000000..956019b4
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/BUILD.gn
@@ -0,0 +1,34 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("DBinderServiceMock006FuzzTest") {
+  module_out_path = "ipc/ipc"
+  fuzz_config_file = "../dbinderservicemock006_fuzzer"
+  defines = [
+    "private = public",
+    "protected = public",
+  ]
+  include_dirs = [ "../include" ]
+  sources = [ "dbinderservicemock006_fuzzer.cpp" ]
+  external_deps = [
+    "c_utils:utils",
+    "hilog:libhilog",
+    "ipc:libdbinder",
+    "ipc:ipc_core",
+  ]
+}
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/corpus/init b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/corpus/init
new file mode 100644
index 00000000..7ade8a0f
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/dbinderservicemock006_fuzzer.cpp b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/dbinderservicemock006_fuzzer.cpp
new file mode 100644
index 00000000..83dd0676
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/dbinderservicemock006_fuzzer.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dbinderservicemock_fuzzer.h"
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <ctime>
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include "dbinder_service.h"
+#include "dbinder_service_stub.h"
+#include "dbinder_remote_listener.h"
+#include "dbinder_softbus_client.h"
+#include "string_ex.h"
+
+namespace OHOS {
+const static size_t MAX_STRING_PARAM_LEN = 100;
+
+void IsValidSessionNameTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct DHandleEntryTxRx> replyMessage = std::make_shared<DHandleEntryTxRx>();
+    if (dBinderService == nullptr || replyMessage == nullptr) {
+        return;
+    }
+
+    replyMessage->serviceNameLength = SERVICENAME_LENGTH;
+    dBinderService->IsValidSessionName(replyMessage);
+    replyMessage->serviceNameLength = SERVICENAME_LENGTH + 1;
+    dBinderService->IsValidSessionName(replyMessage);
+}
+
+void WakeupThreadByStubTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string networkId = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    uint32_t seqNumber = provider.ConsumeIntegral<uint32_t>();
+    dBinderService->AttachThreadLockInfo(seqNumber, networkId, std::make_shared<ThreadLockInfo>());
+    dBinderService->WakeupThreadByStub(seqNumber);
+    dBinderService->DetachThreadLockInfo(seqNumber);
+}
+
+void NoticeServiceDieInnerTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    std::string serviceName = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    std::u16string serviceName16 = Str8ToStr16(serviceName);
+    std::string deviceID = provider.ConsumeRandomLengthString(MAX_STRING_PARAM_LEN);
+    dBinderService->NoticeServiceDieInner(serviceName16, deviceID);
+}
+
+void QueryProxyObjectTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    if (dBinderService == nullptr) {
+        return;
+    }
+    binder_uintptr_t binderObject = provider.ConsumeIntegral<binder_uintptr_t>();
+    dBinderService->AttachProxyObject(nullptr, binderObject);
+    dBinderService->QueryProxyObject(binderObject);
+    dBinderService->DetachProxyObject(binderObject);
+}
+
+void AttachSessionObjectTest(FuzzedDataProvider &provider)
+{
+    sptr<DBinderService> dBinderService = DBinderService::GetInstance();
+    std::shared_ptr<struct SessionInfo> sessionInfo = std::make_shared<SessionInfo>();
+    if (dBinderService == nullptr || sessionInfo == nullptr) {
+        return;
+    }
+
+    binder_uintptr_t stub = provider.ConsumeIntegral<binder_uintptr_t>();
+    dBinderService->AttachSessionObject(sessionInfo, stub);
+    dBinderService->DetachSessionObject(stub);
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    FuzzedDataProvider provider(data, size);
+    OHOS::IsValidSessionNameTest(provider);
+    OHOS::WakeupThreadByStubTest(provider);
+    OHOS::NoticeServiceDieInnerTest(provider);
+    OHOS::QueryProxyObjectTest(provider);
+    OHOS::AttachSessionObjectTest(provider);
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/project.xml b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/project.xml
new file mode 100644
index 00000000..226522bd
--- /dev/null
+++ b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/dbinderservicemock006_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>10000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/dbinderservicemock_fuzzer.h b/test/fuzztest/ipc/native/src/mock/dbinderservicemock/include/dbinderservicemock_fuzzer.h
similarity index 100%
rename from test/fuzztest/dbinder/dbinder_service/src/mock/dbinderservicemock_fuzzer/dbinderservicemock_fuzzer.h
rename to test/fuzztest/ipc/native/src/mock/dbinderservicemock/include/dbinderservicemock_fuzzer.h
-- 
Gitee


From 239bd2a4e9894e2f04f1eceb668dc4c9ec3bffbe Mon Sep 17 00:00:00 2001
From: wuyunxun <wuyunxun@h-partners.com>
Date: Tue, 26 Aug 2025 20:25:46 +0800
Subject: [PATCH 14/15] =?UTF-8?q?=E5=88=A0=E9=99=A4=E5=86=97=E4=BD=99?=
 =?UTF-8?q?=E4=BB=A3=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wuyunxun <wuyunxun@h-partners.com>
Change-Id: I3439e0b63f43d7eda0b9e455e2b2e8a53cf2b050
---
 .../dbinder_service/src/dbinder_service_unittest.cpp | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp b/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
index 5ef12864..17aa0f81 100644
--- a/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
+++ b/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
@@ -51,7 +51,6 @@ public:
     virtual bool StartListener() = 0;
     virtual std::shared_ptr<struct DHandleEntryTxRx> CreateMessage(const sptr<DBinderServiceStub> &stub,
         uint32_t seqNumber, uint32_t pid, uint32_t uid) = 0;
-    virtual std::shared_ptr<DBinderRemoteListener> GetRemoteListener() = 0;
     virtual bool SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg) = 0;
     virtual int32_t GetLocalNodeDeviceId(const std::string &pkgName, std::string &devId) = 0;
     virtual std::string GetSessionName() = 0;
@@ -69,7 +68,6 @@ public:
     MOCK_METHOD0(StartListener, bool());
     MOCK_METHOD4(CreateMessage, std::shared_ptr<struct DHandleEntryTxRx>(const sptr<DBinderServiceStub> &stub,
         uint32_t seqNumber, uint32_t pid, uint32_t uid));
-    MOCK_METHOD0(GetRemoteListener, std::shared_ptr<DBinderRemoteListener>());
     MOCK_METHOD2(SendDataToRemote, bool(const std::string &networkId, const struct DHandleEntryTxRx *msg));
     MOCK_METHOD2(GetLocalNodeDeviceId, int32_t(const std::string &pkgName, std::string &devId));
     MOCK_METHOD0(GetSessionName, std::string());
@@ -115,14 +113,6 @@ extern "C" {
         return GetDBinderServiceInterfaceMock()->CreateMessage(stub, seqNumber, pid, uid);
     }
 
-    std::shared_ptr<DBinderRemoteListener> DBinderService::GetRemoteListener()
-    {
-        if (g_interface == nullptr) {
-            return nullptr;
-        }
-        return GetDBinderServiceInterfaceMock()->GetRemoteListener();
-    }
-
     bool DBinderRemoteListener::SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg)
     {
         if (g_interface == nullptr) {
@@ -465,8 +455,6 @@ HWTEST_F(DBinderServiceTest, InvokerRemoteDBinderTest003, TestSize.Level1)
     std::shared_ptr<struct ThreadLockInfo> threadLockInfo = std::make_shared<struct ThreadLockInfo>();
     dBinderService.remoteListener_ = std::make_shared<DBinderRemoteListener>();
     dBinderService.AttachThreadLockInfo(PID, RANDOM_DEVICEID, threadLockInfo);
-    std::shared_ptr<struct DHandleEntryTxRx> entry = std::make_shared<struct DHandleEntryTxRx>();
-    ASSERT_NE(entry, nullptr);
 
     int32_t result = dBinderService.InvokerRemoteDBinder(dBinderServiceStub, PID, PID, PID);
     EXPECT_EQ(result, DBinderErrorCode::MAKE_THREADLOCK_FAILED);
-- 
Gitee


From c93e3c791c0297b51f849a02c6c2a3facf8bdee2 Mon Sep 17 00:00:00 2001
From: hanlin15 <lihanlin15@huawei.com>
Date: Wed, 27 Aug 2025 17:28:30 +0800
Subject: [PATCH 15/15] fix ut

Signed-off-by: hanlin15 <lihanlin15@huawei.com>
---
 .../dbinder_service/src/dbinder_service.cpp   |  2 +-
 .../unittest/dbinder_service_unittest.cpp     | 32 +++++++++++--------
 .../src/dbinder_service_unittest.cpp          | 11 ++++++-
 3 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/dbinder/dbinder_service/src/dbinder_service.cpp b/dbinder/dbinder_service/src/dbinder_service.cpp
index d5488cbd..6c09743f 100644
--- a/dbinder/dbinder_service/src/dbinder_service.cpp
+++ b/dbinder/dbinder_service/src/dbinder_service.cpp
@@ -1394,7 +1394,7 @@ int32_t DBinderService::NoticeServiceDieInner(const std::u16string &serviceName,
 
     DBINDER_LOGI(LOG_LABEL, "service:%{public}s deviceId:%{public}s",
         Str16ToStr8(serviceName).c_str(), DBinderService::ConvertToSecureDeviceID(deviceID).c_str());
-    return NoticeCallbackProxy(serviceName, deviceID);
+    return NoticeCallbackProxy(serviceName, deviceID) ? ERR_NONE : DBINDER_SERVICE_NOTICE_DIE_ERR;
 }
 
 int32_t DBinderService::NoticeServiceDie(const std::u16string &serviceName, const std::string &deviceID)
diff --git a/dbinder/test/unittest/dbinder_service_unittest.cpp b/dbinder/test/unittest/dbinder_service_unittest.cpp
index 9f2e5331..04d9df9c 100755
--- a/dbinder/test/unittest/dbinder_service_unittest.cpp
+++ b/dbinder/test/unittest/dbinder_service_unittest.cpp
@@ -1056,7 +1056,7 @@ HWTEST_F(DBinderServiceUnitTest, IsSameLoadSaItem001, TestSize.Level1)
     int32_t systemAbilityId = TEST_SYSTEM_ABILITY_ID;
     std::shared_ptr<DHandleEntryTxRx> loadSaItem = std::make_shared<DHandleEntryTxRx>();
     EXPECT_TRUE(loadSaItem != nullptr);
-    loadSaItem->stubIndex = TEST_SYSTEM_ABILITY_ID;
+    loadSaItem->binderObject  = TEST_SYSTEM_ABILITY_ID;
     strcpy_s(loadSaItem->deviceIdInfo.fromDeviceId, DEVICEID_LENGTH, "aaaaaaaaaaaaaa");
     bool res = dBinderService->IsSameLoadSaItem(srcNetworkId, systemAbilityId, loadSaItem);
     EXPECT_EQ(res, true);
@@ -1346,8 +1346,6 @@ HWTEST_F(DBinderServiceUnitTest, NoticeDeviceDieTest003, TestSize.Level1)
     sptr<DBinderService> dBinderService = DBinderService::GetInstance();
     EXPECT_TRUE(dBinderService != nullptr);
     std::string deviceID("123456");
-    dBinderService->remoteListener_ = std::make_shared<DBinderRemoteListener>();
-    EXPECT_TRUE(dBinderService->remoteListener_ != nullptr);
     EXPECT_EQ(dBinderService->NoticeDeviceDie(deviceID), DBINDER_SERVICE_NOTICE_DIE_ERR);
 }
 
@@ -1408,7 +1406,13 @@ HWTEST_F(DBinderServiceUnitTest, NoticeServiceDieInnerTest003, TestSize.Level1)
     dBinderService->StartRemoteListener();
     std::u16string serviceName(u"testServer");
     std::string deviceID("123456");
-    EXPECT_EQ(dBinderService->NoticeServiceDieInner(serviceName, deviceID), ERR_NONE);
+    binder_uintptr_t binderObject = TEST_BINDER_OBJECT_PTR;
+    sptr<DBinderServiceStub> dBinderServiceStub = new (std::nothrow) DBinderServiceStub(serviceName, deviceID,
+        binderObject);
+    EXPECT_TRUE(dBinderServiceStub != nullptr);
+    dBinderService->DBinderStubRegisted_.push_back(dBinderServiceStub);
+    EXPECT_EQ(dBinderService->NoticeServiceDieInner(serviceName, deviceID), DBINDER_SERVICE_NOTICE_DIE_ERR);
+    dBinderService->DBinderStubRegisted_.clear();
 }
 
 /**
@@ -1453,7 +1457,7 @@ HWTEST_F(DBinderServiceUnitTest, NoticeCallbackProxyTest001, TestSize.Level1)
         binderObject);
     EXPECT_TRUE(dBinderServiceStub != nullptr);
     dBinderService->AttachCallbackProxy(object, dBinderServiceStub.GetRefPtr());
-    EXPECT_EQ(dBinderService->NoticeCallbackProxy(serviceName, deviceID), false);
+    EXPECT_EQ(dBinderService->NoticeCallbackProxy(serviceName, deviceID), true);
 }
 
 /**
@@ -1932,15 +1936,15 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest003, TestSize.Level1)
     std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<DHandleEntryTxRx>();
     EXPECT_TRUE(message != nullptr);
     (void)memset_s(message.get(), sizeof(DHandleEntryTxRx), 0, sizeof(DHandleEntryTxRx));
-    message->stubIndex = systemAbilityId;
+    message->binderObject  = systemAbilityId;
     message->deviceIdInfo.fromDeviceId[0] = 't';
     message->transType = IRemoteObject::DATABUS_TYPE + 1;
     dBinderService->loadSaReply_.push_back(message);
 
     sptr<IRemoteObject> remoteObject1 = new (std::nothrow) IPCObjectProxy(1);
     EXPECT_TRUE(remoteObject1 != nullptr);
-    binder_uintptr_t binderObjectPtr = reinterpret_cast<binder_uintptr_t>(remoteObject1.GetRefPtr());
-    bool ret = dBinderService->AttachProxyObject(remoteObject1, binderObjectPtr);
+    dBinderService->proxyObject_.clear();
+    bool ret = dBinderService->AttachProxyObject(remoteObject1, message->binderObject);
     EXPECT_TRUE(ret);
 
     DBinderSoftbusClient::GetInstance().sendBytesFunc_ = MockDBinderRemoteListener::SendBytes;
@@ -1949,7 +1953,6 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest003, TestSize.Level1)
     int32_t socket = 1001;
     DBinderRemoteListener::ServerOnBind(socket, info);
 
-    message->binderObject = binderObjectPtr;
     /* verify running into the transType invalid branch */
     std::shared_ptr<MockDBinderRemoteListener> mockListener = std::make_shared<MockDBinderRemoteListener>();
     dBinderService->remoteListener_ = std::static_pointer_cast<DBinderRemoteListener>(mockListener);
@@ -1958,6 +1961,7 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest003, TestSize.Level1)
     EXPECT_EQ(MockDBinderRemoteListener::GetInstance().GetResult(), SA_INVOKE_FAILED);
     dBinderService->remoteListener_ = nullptr;
     DBinderSoftbusClient::GetInstance().sendBytesFunc_ = nullptr;
+    dBinderService->DetachProxyObject(message->binderObject);
 }
 
 /**
@@ -1975,7 +1979,7 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest004, TestSize.Level1)
     std::shared_ptr<struct DHandleEntryTxRx> message = std::make_shared<DHandleEntryTxRx>();
     EXPECT_TRUE(message != nullptr);
     (void)memset_s(message.get(), sizeof(DHandleEntryTxRx), 0, sizeof(DHandleEntryTxRx));
-    message->stubIndex = systemAbilityId;
+    message->binderObject  = systemAbilityId;
     message->deviceIdInfo.fromDeviceId[0] = 't';
     message->transType = IRemoteObject::DATABUS_TYPE;
     dBinderService->loadSaReply_.push_back(message);
@@ -1983,8 +1987,7 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest004, TestSize.Level1)
     /* verify running into the OnRemoteInvokerDataBusMessage fail branch */
     sptr<MockIPCObjectProxy> remoteObject1 = sptr<MockIPCObjectProxy>::MakeSptr();
     EXPECT_TRUE(remoteObject1 != nullptr);
-    binder_uintptr_t binderObjectPtr = reinterpret_cast<binder_uintptr_t>(remoteObject1.GetRefPtr());
-    bool ret = dBinderService->AttachProxyObject(remoteObject1, binderObjectPtr);
+    bool ret = dBinderService->AttachProxyObject(remoteObject1, message->binderObject);
     EXPECT_TRUE(ret);
 
     DBinderSoftbusClient::GetInstance().sendBytesFunc_ = MockDBinderRemoteListener::SendBytes;
@@ -1993,7 +1996,6 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest004, TestSize.Level1)
     int32_t socket = 1001;
     DBinderRemoteListener::ServerOnBind(socket, info);
 
-    message->binderObject = binderObjectPtr;
     std::shared_ptr<MockDBinderRemoteListener> mockListener = std::make_shared<MockDBinderRemoteListener>();
     dBinderService->remoteListener_ = std::static_pointer_cast<DBinderRemoteListener>(mockListener);
     EXPECT_TRUE(dBinderService->remoteListener_ != nullptr);
@@ -2002,7 +2004,7 @@ HWTEST_F(DBinderServiceUnitTest, PopLoadSaItemTest004, TestSize.Level1)
     EXPECT_EQ(MockDBinderRemoteListener::GetInstance().GetResult(), SESSION_NAME_NOT_FOUND);
     dBinderService->remoteListener_ = nullptr;
     DBinderSoftbusClient::GetInstance().sendBytesFunc_ = nullptr;
-    ret = dBinderService->DetachProxyObject(binderObjectPtr);
+    ret = dBinderService->DetachProxyObject(message->binderObject);
     EXPECT_TRUE(ret);
 }
 
@@ -2417,9 +2419,11 @@ HWTEST_F(DBinderServiceUnitTest, InvokerRemoteDBinderWhenWaitRsp001, TestSize.Le
     int32_t ret = dBinderService->InvokerRemoteDBinderWhenWaitRsp(stub, seqNumber, pid, uid, threadLockInfo);
     EXPECT_EQ(ret, MAKE_THREADLOCK_FAILED);
 
+    threadLockInfo = std::make_shared<struct ThreadLockInfo>();
     dBinderService->threadLockInfo_[seqNumber] = threadLockInfo;
     ret = dBinderService->InvokerRemoteDBinderWhenWaitRsp(stub, seqNumber, pid, uid, threadLockInfo);
     EXPECT_EQ(ret, DBINDER_OK);
+    dBinderService->threadLockInfo_.clear();
 }
 
 /**
diff --git a/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp b/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
index 17aa0f81..7cf0fd50 100644
--- a/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
+++ b/test/unittest/dbinder/dbinder_service/src/dbinder_service_unittest.cpp
@@ -51,6 +51,7 @@ public:
     virtual bool StartListener() = 0;
     virtual std::shared_ptr<struct DHandleEntryTxRx> CreateMessage(const sptr<DBinderServiceStub> &stub,
         uint32_t seqNumber, uint32_t pid, uint32_t uid) = 0;
+    virtual std::shared_ptr<DBinderRemoteListener> GetRemoteListener() = 0;
     virtual bool SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg) = 0;
     virtual int32_t GetLocalNodeDeviceId(const std::string &pkgName, std::string &devId) = 0;
     virtual std::string GetSessionName() = 0;
@@ -68,6 +69,7 @@ public:
     MOCK_METHOD0(StartListener, bool());
     MOCK_METHOD4(CreateMessage, std::shared_ptr<struct DHandleEntryTxRx>(const sptr<DBinderServiceStub> &stub,
         uint32_t seqNumber, uint32_t pid, uint32_t uid));
+    MOCK_METHOD0(GetRemoteListener, std::shared_ptr<DBinderRemoteListener>());
     MOCK_METHOD2(SendDataToRemote, bool(const std::string &networkId, const struct DHandleEntryTxRx *msg));
     MOCK_METHOD2(GetLocalNodeDeviceId, int32_t(const std::string &pkgName, std::string &devId));
     MOCK_METHOD0(GetSessionName, std::string());
@@ -113,6 +115,14 @@ extern "C" {
         return GetDBinderServiceInterfaceMock()->CreateMessage(stub, seqNumber, pid, uid);
     }
 
+    std::shared_ptr<DBinderRemoteListener> DBinderService::GetRemoteListener()
+    {
+        if (g_interface == nullptr) {
+            return nullptr;
+        }
+        return GetDBinderServiceInterfaceMock()->GetRemoteListener();
+    }
+
     bool DBinderRemoteListener::SendDataToRemote(const std::string &networkId, const struct DHandleEntryTxRx *msg)
     {
         if (g_interface == nullptr) {
@@ -455,7 +465,6 @@ HWTEST_F(DBinderServiceTest, InvokerRemoteDBinderTest003, TestSize.Level1)
     std::shared_ptr<struct ThreadLockInfo> threadLockInfo = std::make_shared<struct ThreadLockInfo>();
     dBinderService.remoteListener_ = std::make_shared<DBinderRemoteListener>();
     dBinderService.AttachThreadLockInfo(PID, RANDOM_DEVICEID, threadLockInfo);
-
     int32_t result = dBinderService.InvokerRemoteDBinder(dBinderServiceStub, PID, PID, PID);
     EXPECT_EQ(result, DBinderErrorCode::MAKE_THREADLOCK_FAILED);
 }
-- 
Gitee