From d3b170be1544b0da828aef117453fdee2a406547 Mon Sep 17 00:00:00 2001 From: y30045862 Date: Fri, 2 Jun 2023 11:08:23 +0800 Subject: [PATCH] add backupServiceFuzzTest Signed-off-by: yangjingbo10 Change-Id: Ifbb49624d1480068abfb7ed63594a7d0696ade76 --- bundle.json | 2 +- test/fuzztest/BUILD.gn | 6 +- test/fuzztest/backupsa_fuzzer/BUILD.gn | 58 ++++++++++++ .../backupsa_fuzzer/backupsa_fuzzer.cpp | 88 +++++++++++++++++++ .../backupsa_fuzzer/backupsa_fuzzer.h | 21 +++++ test/fuzztest/backupsa_fuzzer/corpus/init | 16 ++++ test/fuzztest/backupsa_fuzzer/project.xml | 25 ++++++ 7 files changed, 212 insertions(+), 4 deletions(-) create mode 100644 test/fuzztest/backupsa_fuzzer/BUILD.gn create mode 100644 test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp create mode 100644 test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.h create mode 100644 test/fuzztest/backupsa_fuzzer/corpus/init create mode 100644 test/fuzztest/backupsa_fuzzer/project.xml diff --git a/bundle.json b/bundle.json index 36e9a215b..fc96cbdcc 100644 --- a/bundle.json +++ b/bundle.json @@ -96,7 +96,7 @@ } ], "test": [ - "//foundation/filemanagement/app_file_service/test/fuzztest:fuzztest", + "//foundation/filemanagement/app_file_service/test/fuzztest:app_file_service_fuzztest", "//foundation/filemanagement/app_file_service/test/unittest:unittest", "//foundation/filemanagement/app_file_service:tgt_backup_tests" ] diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index cb07dfdcf..6662e0aca 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -11,12 +11,12 @@ # See the License for the specific language governing permissions and # limitations under the License. -group("fuzztest") { +group("app_file_service_fuzztest") { testonly = true - deps = [] - deps += [ + deps = [ # deps file + "backupsa_fuzzer:BackupSaFuzzTest", "remotefileshare_fuzzer:RemoteFileShareFuzzTest", ] } diff --git a/test/fuzztest/backupsa_fuzzer/BUILD.gn b/test/fuzztest/backupsa_fuzzer/BUILD.gn new file mode 100644 index 000000000..24e5c5cc0 --- /dev/null +++ b/test/fuzztest/backupsa_fuzzer/BUILD.gn @@ -0,0 +1,58 @@ +# Copyright (c) 2021-2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaFuzzTest") { + module_out_path = "filemanagement/app_file_service" + fuzz_config_file = "${app_file_service_path}/test/fuzztest/backupsa_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/utils:backup_utils", + "${third_party_path}/bounds_checking_function:libsec_shared", + ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "c_utils:utils", + "file_api:filemgmt_libn", + "hiviewdfx_hilog_native:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD200000", + ] +} +############################################################################### diff --git a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp new file mode 100644 index 000000000..d2916c73b --- /dev/null +++ b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_fuzzer.h" + +#include +#include +#include + +#include +#include "message_parcel.h" +#include "service_stub.h" +#include "service.h" +#include "securec.h" +#include "system_ability.h" + +#include "filemgmt_libhilog.h" + +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; +constexpr uint8_t MAX_CALL_TRANSACTION = 16; +constexpr int32_t SERVICE_ID = 5203; +std::shared_ptr service = std::make_shared(SERVICE_ID, true); + +uint32_t GetU32Data(const char* ptr) +{ + // 将第0个数字左移24位，将第1个数字左移16位，将第2个数字左移8位，第3个数字不左移 + return (ptr[0] << 24) | (ptr[1] << 16) | (ptr[2] << 8) | (ptr[3]); +} + +bool BackupSaFuzzTest(std::unique_ptr data, size_t size) +{ + uint32_t code = GetU32Data(data.get()); + if (code == 0) { + return true; + } + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data.get(), size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + service->OnRemoteRequest(code % MAX_CALL_TRANSACTION, datas, reply, option); + + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + if (size < OHOS::U32_AT_SIZE) { + return 0; + } + + /* Validate the length of size */ + if (size == 0 || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + auto str = std::make_unique(size + 1); + (void)memset_s(str.get(), size + 1, 0x00, size + 1); + if (memcpy_s(str.get(), size, data, size) != EOK) { + return 0; + } + OHOS::BackupSaFuzzTest(move(str), size); + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.h b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.h new file mode 100644 index 000000000..8c78aa051 --- /dev/null +++ b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2021 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSA_FUZZER_H +#define BACKUPSA_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_fuzzer/corpus/init b/test/fuzztest/backupsa_fuzzer/corpus/init new file mode 100644 index 000000000..8eb5a7d6e --- /dev/null +++ b/test/fuzztest/backupsa_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_fuzzer/project.xml b/test/fuzztest/backupsa_fuzzer/project.xml new file mode 100644 index 000000000..85e7ef2c1 --- /dev/null +++ b/test/fuzztest/backupsa_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + -- Gitee