From c3370dac0289709fd362df9f5e83770a06d788f5 Mon Sep 17 00:00:00 2001 From: wanxiaoqing Date: Fri, 20 Jun 2025 17:02:18 +0800 Subject: [PATCH] =?UTF-8?q?fuzz=E8=A1=A5=E5=85=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: wanxiaoqing --- .../udmfservice_fuzzer/udmfservice_fuzzer.cpp | 161 +++++++++++++++--- 1 file changed, 139 insertions(+), 22 deletions(-) diff --git a/services/distributeddataservice/service/test/fuzztest/udmfservice_fuzzer/udmfservice_fuzzer.cpp b/services/distributeddataservice/service/test/fuzztest/udmfservice_fuzzer/udmfservice_fuzzer.cpp index 36e912c65..950a367e5 100644 --- a/services/distributeddataservice/service/test/fuzztest/udmfservice_fuzzer/udmfservice_fuzzer.cpp +++ b/services/distributeddataservice/service/test/fuzztest/udmfservice_fuzzer/udmfservice_fuzzer.cpp @@ -31,8 +31,6 @@ using namespace OHOS::UDMF; namespace OHOS { const std::u16string INTERFACE_TOKEN = u"OHOS.UDMF.UdmfService"; -constexpr uint32_t CODE_MIN = 0; -constexpr uint32_t CODE_MAX = static_cast(UdmfServiceInterfaceCode::CODE_BUTT) + 1; constexpr size_t NUM_MIN = 5; constexpr size_t NUM_MAX = 12; static constexpr int ID_LEN = 32; @@ -53,24 +51,6 @@ QueryOption GenerateFuzzQueryOption(FuzzedDataProvider &provider) return query; } -bool OnRemoteRequestFuzz(FuzzedDataProvider &provider) -{ - std::shared_ptr udmfServiceImpl = std::make_shared(); - std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); - udmfServiceImpl->OnBind( - { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); - - uint32_t code = provider.ConsumeIntegralInRange(CODE_MIN, CODE_MAX); - std::vector remainingData = provider.ConsumeRemainingBytes(); - MessageParcel request; - request.WriteInterfaceToken(INTERFACE_TOKEN); - request.WriteBuffer(static_cast(remainingData.data()), remainingData.size()); - request.RewindRead(0); - MessageParcel reply; - udmfServiceImpl->OnRemoteRequest(code, request, reply); - return true; -} - void SetDataFuzz(FuzzedDataProvider &provider) { std::shared_ptr udmfServiceImpl = std::make_shared(); @@ -265,6 +245,139 @@ void ClearAsynProcessFuzz(FuzzedDataProvider &provider) udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::CLEAR_ASYN_PROCESS_BY_KEY), requestUpdate, replyUpdate); } + +void SetAppShareOptionFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::SET_APP_SHARE_OPTION), + requestUpdate, replyUpdate); +} + +void GetAppShareOptionFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::GET_APP_SHARE_OPTION), + requestUpdate, replyUpdate); +} + +void RemoveAppShareOptionFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::REMOVE_APP_SHARE_OPTION), + requestUpdate, replyUpdate); +} + +void ClearAsynProcessByKeyFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::CLEAR_ASYN_PROCESS_BY_KEY), + requestUpdate, replyUpdate); +} + +void SetDelayInfoFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::SET_DELAY_INFO), + requestUpdate, replyUpdate); +} + +void PushDelayDataFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::SET_DELAY_DATA), + requestUpdate, replyUpdate); +} + +void GetDataIfAvailableFuzz(FuzzedDataProvider &provider) +{ + std::shared_ptr udmfServiceImpl = std::make_shared(); + std::shared_ptr executor = std::make_shared(NUM_MAX, NUM_MIN); + udmfServiceImpl->OnBind( + { "UdmfServiceStubFuzz", static_cast(IPCSkeleton::GetSelfTokenID()), std::move(executor) }); + std::vector groupId(ID_LEN, '0'); + for (size_t i = 0; i < groupId.size(); ++i) { + groupId[i] = provider.ConsumeIntegralInRange(MINIMUM, MINIMUM); + } + std::string businessUdKey(groupId.begin(), groupId.end()); + MessageParcel requestUpdate; + requestUpdate.WriteInterfaceToken(INTERFACE_TOKEN); + ITypesUtil::Marshal(requestUpdate, businessUdKey); + MessageParcel replyUpdate; + udmfServiceImpl->OnRemoteRequest(static_cast(UdmfServiceInterfaceCode::GET_DELAY_DATA), + requestUpdate, replyUpdate); +} } /* Fuzzer entry point */ @@ -280,7 +393,6 @@ extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { FuzzedDataProvider provider(data, size); - OHOS::OnRemoteRequestFuzz(provider); OHOS::SetDataFuzz(provider); OHOS::GetDataFuzz(provider); @@ -295,6 +407,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) OHOS::IsRemoteDataFuzz(provider); OHOS::ObtainAsynProcessFuzz(provider); OHOS::ClearAsynProcessFuzz(provider); - + OHOS::SetAppShareOptionFuzz(provider); + OHOS::GetAppShareOptionFuzz(provider); + OHOS::RemoveAppShareOptionFuzz(provider); + OHOS::SetDelayInfoFuzz(provider); + OHOS::PushDelayDataFuzz(provider); + OHOS::GetDataIfAvailableFuzz(provider); return 0; } \ No newline at end of file -- Gitee