From c316f5d70abba228550f66fbba4518e32f5d2d9e Mon Sep 17 00:00:00 2001 From: Tome Date: Fri, 1 Aug 2025 16:50:56 +0800 Subject: [PATCH] =?UTF-8?q?FUZZ=20=E8=A1=A5=E5=85=85=E5=8F=8A=E7=BB=B4?= =?UTF-8?q?=E6=8A=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Tome Signed-off-by: Tome --- .../sinkserviceinitsink_fuzzer.cpp | 11 ++--- ...serviceunsubscribelocalhardware_fuzzer.cpp | 17 +++++++- .../sourcehandlerinitsource_fuzzer.cpp | 27 +++++++++++- .../sourceproxydcameranotify_fuzzer.cpp | 41 ++++++++++++++++++- 4 files changed, 86 insertions(+), 10 deletions(-) diff --git a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp index 7c469e81..239c2fd2 100644 --- a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceinitsink_fuzzer/sinkserviceinitsink_fuzzer.cpp @@ -14,7 +14,6 @@ */ #include "sinkserviceinitsink_fuzzer.h" - #include #include @@ -49,13 +48,11 @@ void SinkServiceInitSinkFuzzTest(const uint8_t* data, size_t size) std::string param(reinterpret_cast(data), size); std::string dhId = "1"; - std::shared_ptr sinkService = - std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); sptr sinkCallback(new DCameraSinkCallback()); std::shared_ptr sinkDevice = std::make_shared(dhId, sinkCallback); sinkDevice->accessControl_ = std::make_shared(); sinkDevice->controller_ = std::make_shared(sinkDevice->accessControl_, sinkCallback); - sinkService->InitSink(param, sinkCallback); + sinkService_->InitSink(param, sinkCallback); usleep(SINK_FUZZ_TEST_SLEEP); } @@ -76,9 +73,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SinkServiceOnStartFuzzTest(); + OHOS::DistributedHardware::SinkServiceInitSinkFuzzTest(data, size); OHOS::DistributedHardware::SinkServiceReleaseSinkFuzzTest(); OHOS::DistributedHardware::SinkServiceOnStopFuzzTest(); - OHOS::DistributedHardware::SinkServiceInitSinkFuzzTest(data, size); - return 0; -} + return 0; +} \ No newline at end of file diff --git a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceunsubscribelocalhardware_fuzzer/sinkserviceunsubscribelocalhardware_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceunsubscribelocalhardware_fuzzer/sinkserviceunsubscribelocalhardware_fuzzer.cpp index 0948b956..c6d59ebe 100644 --- a/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceunsubscribelocalhardware_fuzzer/sinkserviceunsubscribelocalhardware_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sinkfuzztest/sinkserviceunsubscribelocalhardware_fuzzer/sinkserviceunsubscribelocalhardware_fuzzer.cpp @@ -23,7 +23,7 @@ #include "distributed_camera_sink_service.h" #include "if_system_ability_manager.h" #include "iservice_registry.h" - +#include namespace OHOS { namespace DistributedHardware { void SinkServiceUnsubscribeLocalHardwareFuzzTest(const uint8_t* data, size_t size) @@ -41,6 +41,20 @@ void SinkServiceUnsubscribeLocalHardwareFuzzTest(const uint8_t* data, size_t siz sinkService->UnsubscribeLocalHardware(dhId); } + +void SinkServiceUnsubscribeNotFoundFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + std::shared_ptr sinkService = + std::make_shared(DISTRIBUTED_HARDWARE_CAMERA_SINK_SA_ID, true); + + FuzzedDataProvider provider(data, size); + std::string fuzzedDhId = provider.ConsumeRandomLengthString(128); + + sinkService->UnsubscribeLocalHardware(fuzzedDhId); +} } } @@ -49,6 +63,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SinkServiceUnsubscribeLocalHardwareFuzzTest(data, size); + OHOS::DistributedHardware::SinkServiceUnsubscribeNotFoundFuzzTest(data, size); return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourcehandlerinitsource_fuzzer/sourcehandlerinitsource_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourcehandlerinitsource_fuzzer/sourcehandlerinitsource_fuzzer.cpp index c844037a..64ca8e4a 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourcehandlerinitsource_fuzzer/sourcehandlerinitsource_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourcehandlerinitsource_fuzzer/sourcehandlerinitsource_fuzzer.cpp @@ -18,6 +18,7 @@ #include #include +#include #include "dcamera_source_handler.h" #include "distributed_camera_constants.h" @@ -32,6 +33,18 @@ void SourceHandlerInitSourceFuzzTest(const uint8_t* data, size_t size) DCameraSourceHandler::GetInstance().InitSource(params); } + +void SourceHandlerInitSourceSuccessFuzzTest(const uint8_t* data, size_t size) +{ + if ((data == nullptr) || (size == 0)) { + return; + } + FuzzedDataProvider provider(data, size); + std::string version = provider.ConsumeRandomLengthString(32); + std::string type = provider.ConsumeRandomLengthString(32); + std::string params = "{\"Version\":\"" + version + "\",\"Type\":\"" + type + "\"}"; + DCameraSourceHandler::GetInstance().InitSource(params); +} } } @@ -39,7 +52,19 @@ void SourceHandlerInitSourceFuzzTest(const uint8_t* data, size_t size) extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ - OHOS::DistributedHardware::SourceHandlerInitSourceFuzzTest(data, size); + const int32_t fuzzerChoice = 2; + if (data == nullptr || size < 1) { + return 0; + } + uint8_t choice = data[0]; + const uint8_t* remainingData = data + 1; + size_t remainingSize = size - 1; + + if (choice % fuzzerChoice == 0) { + OHOS::DistributedHardware::SourceHandlerInitSourceFuzzTest(remainingData, remainingSize); + } else { + OHOS::DistributedHardware::SourceHandlerInitSourceSuccessFuzzTest(remainingData, remainingSize); + } return 0; } diff --git a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceproxydcameranotify_fuzzer/sourceproxydcameranotify_fuzzer.cpp b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceproxydcameranotify_fuzzer/sourceproxydcameranotify_fuzzer.cpp index 8db67503..44f93804 100644 --- a/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceproxydcameranotify_fuzzer/sourceproxydcameranotify_fuzzer.cpp +++ b/interfaces/inner_kits/native_cpp/test/sourcefuzztest/sourceproxydcameranotify_fuzzer/sourceproxydcameranotify_fuzzer.cpp @@ -12,7 +12,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - +#include #include "sourceproxydcameranotify_fuzzer.h" #include "dcamera_source_callback.h" @@ -44,6 +44,44 @@ void SourceProxyDCameraNotifyFuzzTest(const uint8_t* data, size_t size) dCSourceProxy->DCameraNotify(devId, dhId, events); } + +namespace { +std::shared_ptr GetSourceProxy() +{ + static auto proxy = []() { + sptr samgr = + SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager(); + if (samgr == nullptr) { + return std::shared_ptr(nullptr); + } + sptr remoteObject = samgr->GetSystemAbility(DISTRIBUTED_HARDWARE_CAMERA_SOURCE_SA_ID); + return std::make_shared(remoteObject); + }(); + return proxy; +} +} + +void SourceProxyDCameraNotifyImprovedFuzzTest(const uint8_t* data, size_t size) +{ + if (data == nullptr || size == 0) { + return; + } + + auto dCSourceProxy = GetSourceProxy(); + if (dCSourceProxy == nullptr) { + return; + } + + FuzzedDataProvider provider(data, size); + std::string devId = provider.ConsumeRandomLengthString(128); + std::string dhId = provider.ConsumeRandomLengthString(128); + + std::string eventType = provider.ConsumeRandomLengthString(32); + std::string eventContent = provider.ConsumeRandomLengthString(256); + std::string events = "{\"type\":\"" + eventType + "\",\"content\":\"" + eventContent + "\"}"; + + dCSourceProxy->DCameraNotify(devId, dhId, events); +} } } @@ -52,6 +90,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { /* Run your code on data */ OHOS::DistributedHardware::SourceProxyDCameraNotifyFuzzTest(data, size); + OHOS::DistributedHardware::SourceProxyDCameraNotifyImprovedFuzzTest(data, size); return 0; } -- Gitee