diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index 1c4a33acaca84456e4ced6a5b2f1fded21826eaa..3905d97c54e57811dd2dddd5d9394a2fb15ff180 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -17,9 +17,28 @@ group("fuzztest") { deps = [ # deps file "backupext_fuzzer:BackupExtFuzzTest", + "backupext_idlstub_fuzzer:BackupExtIdlStubFuzzTest", "backupsa_fuzzer:BackupSaFuzzTest", - "backupsaanother_fuzzer:BackupSaAnotherFuzzTest", - "backupsaappend_fuzzer:BackupSaAppendFuzzTest", + "backupsa_app_incrementaldone_fuzzer:BackupSaAppIncrementalDoneFuzzTest", + "backupsa_app_incrementalfileready_fuzzer:BackupSaAppIncrementalFileReadyFuzzTest", + "backupsa_appdone_fuzzer:BackupSaAppDoneFuzzTest", + "backupsa_appendbundles_backupsession_fuzzer:BackupSaAppendBundlesBackupSessionFuzzTest", + "backupsa_appendbundles_increbacksession_fuzzer:BackupSaAppendBundlesIncreBackupSessionFuzzTest", + "backupsa_appendbundles_restoresession_fuzzer:BackupSaAppendBundlesRestoreSessionFuzzTest", + "backupsa_appfileready_fuzzer:BackupSaAppFileReadyFuzzTest", + "backupsa_finish_fuzzer:BackupSaFinishFuzzTest", + "backupsa_fuzzer:BackupSaFuzzTest", + "backupsa_getfile_handle_fuzzer:BackupSaGetFileHandleFuzzTest", + "backupsa_getincremental_localcapabilities_fuzzer:BackupSaGetIncrementalLocalCapabilitiesFuzzTest", + "backupsa_getincrementalfile_handle_fuzzer:BackupSaGetIncrementalFileHandleFuzzTest", + "backupsa_getlocalcapabilities_fuzzer:BackupSaGetLocalCapabilitiesFuzzTest", + "backupsa_init_backupsession_fuzzer:BackupSaInitBackupSessionFuzzTest", + "backupsa_init_incrementalbackupession_fuzzer:BackupSaInitIncreBackupSessionFuzzTest", + "backupsa_init_restoresession_fuzzer:BackupSaInitRestoreSessionFuzzTest", + "backupsa_publish_file_fuzzer:BackupSaPublishFileFuzzTest", + "backupsa_publish_incrementalfile_fuzzer:BackupSaPublishIncrementalFileFuzzTest", + "backupsa_release_fuzzer:BackupSaReleaseFuzzTest", + "backupsa_start_fuzzer:BackupSaStartFuzzTest", "backupservicestub_fuzzer:BackupServiceStubFuzzTest", "fileshare_fuzzer:FileShareFuzzTest", "remotefileshare_fuzzer:RemoteFileShareFuzzTest", diff --git a/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp b/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp index a100e64faaa04738df7be32ed49a042aa5605b7a..ea0fe7d08e748ee2eae9a65f1a07e28a3659fc18 100644 --- a/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp +++ b/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp @@ -313,31 +313,6 @@ bool CmdGetIncrementalBackupFileHandleFuzzTest(OHOS::sptr ex extension->OnRemoteRequest(code, msg, reply, option); return true; } - -bool OnRemoteRequestFuzzTest(OHOS::sptr extension, const uint8_t *data, size_t size) -{ - uint32_t codeMax = 17; - for (uint32_t code = 1; code < codeMax; code++) { - MessageParcel datas; - MessageParcel reply; - MessageOption option; - - datas.WriteInterfaceToken(ExtensionStub::GetDescriptor()); - datas.WriteBuffer(reinterpret_cast(data), size); - datas.RewindRead(0); - if (extension == nullptr) { - return false; - } - try { - extension->OnRemoteRequest(code, datas, reply, option); - } catch (OHOS::FileManagement::Backup::BError &err) { - // filter Backup error - } catch (...) { - // filter other error - } - } - return true; -} } // namespace OHOS /* Fuzzer entry point */ @@ -373,7 +348,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) OHOS::CmdHandleIncrementalBackupFuzzTest(extension, data, size); OHOS::CmdIncrementalOnBackupFuzzTest(extension, data, size); OHOS::CmdGetIncrementalBackupFileHandleFuzzTest(extension, data, size); - OHOS::OnRemoteRequestFuzzTest(extension, data, size); } catch (OHOS::FileManagement::Backup::BError &err) { // Only filter BError errors, Other results are not expected. } diff --git a/test/fuzztest/backupext_idlstub_fuzzer/BUILD.gn b/test/fuzztest/backupext_idlstub_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..e43511f6d2fe60c428523d3de207f9780b1bb2fc --- /dev/null +++ b/test/fuzztest/backupext_idlstub_fuzzer/BUILD.gn @@ -0,0 +1,87 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupExtIdlStubFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = "${app_file_service_path}/test/fuzztest/backupext_idlstub_fuzzer" + include_dirs = [ + "${path_backup}/frameworks/native/backup_ext/include", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner/impl", + "${path_backup}/utils/include", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ + "${path_backup}/frameworks/native/backup_ext/src/ext_backup.cpp", + "${path_backup}/frameworks/native/backup_ext/src/ext_backup_ani.cpp", + "${path_backup}/frameworks/native/backup_ext/src/ext_backup_context.cpp", + "${path_backup}/frameworks/native/backup_ext/src/ext_backup_context_js.cpp", + "${path_backup}/frameworks/native/backup_ext/src/ext_backup_js.cpp", + "${path_backup}/frameworks/native/backup_ext/src/ext_backup_loader.cpp", + "${path_backup}/frameworks/native/backup_ext/src/ext_extension.cpp", + "${path_backup}/frameworks/native/backup_ext/src/installd_un_tar_file.cpp", + "${path_backup}/frameworks/native/backup_ext/src/sub_ext_extension.cpp", + "${path_backup}/frameworks/native/backup_ext/src/tar_file.cpp", + "${path_backup}/frameworks/native/backup_ext/src/untar_file.cpp", + "backupext_idlstub_fuzzer.cpp", + ] + + deps = [ + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + external_deps = [ + "ability_base:want", + "ability_runtime:ability_context_native", + "ability_runtime:abilitykit_native", + "ability_runtime:ani_common", + "ability_runtime:app_context", + "ability_runtime:appkit_native", + "ability_runtime:runtime", + "access_token:libaccesstoken_sdk", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "hilog:libhilog", + "hitrace:hitrace_meter", + "ipc:ipc_core", + "ipc:ipc_napi", + "jsoncpp:jsoncpp", + "napi:ace_napi", + "runtime_core:ani", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private = public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupext_idlstub_fuzzer/backupext_idlstub_fuzzer.cpp b/test/fuzztest/backupext_idlstub_fuzzer/backupext_idlstub_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..c94ee5dd8d4465c26dde0b94761fd555baf4615c --- /dev/null +++ b/test/fuzztest/backupext_idlstub_fuzzer/backupext_idlstub_fuzzer.cpp @@ -0,0 +1,65 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include "backupext_idlstub_fuzzer.h" +#include + +#include "ext_backup.h" +#include "ext_extension.h" +#include "message_parcel.h" + +namespace OHOS { +using namespace std; +using namespace OHOS::FileManagement::Backup; + +bool OnRemoteRequestFuzzTest(OHOS::sptr extension, const uint8_t *data, size_t size) +{ + uint32_t codeMax = 17; + for (uint32_t code = 1; code < codeMax; code++) { + MessageParcel datas; + MessageParcel reply; + MessageOption option; + + datas.WriteInterfaceToken(ExtensionStub::GetDescriptor()); + datas.WriteBuffer(reinterpret_cast(data), size); + datas.RewindRead(0); + if (extension == nullptr) { + return false; + } + try { + extension->OnRemoteRequest(code, datas, reply, option); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter Backup error + } catch (...) { + // filter other error + } + } + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + auto extBackup = std::make_shared(); + auto extension = OHOS::sptr( + new OHOS::FileManagement::Backup::BackupExtExtension(extBackup, "")); + try { + OHOS::OnRemoteRequestFuzzTest(extension, data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // Only filter BError errors, Other results are not expected. + } + return 0; +} diff --git a/test/fuzztest/backupext_idlstub_fuzzer/backupext_idlstub_fuzzer.h b/test/fuzztest/backupext_idlstub_fuzzer/backupext_idlstub_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..cf70eb8c6ed3185511efed1b9202c1f0b846a952 --- /dev/null +++ b/test/fuzztest/backupext_idlstub_fuzzer/backupext_idlstub_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPEXTIDLSTUB_FUZZER_H +#define BACKUPEXTIDLSTUB_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupext_idlstub_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsaappend_fuzzer/corpus/init b/test/fuzztest/backupext_idlstub_fuzzer/corpus/init similarity index 92% rename from test/fuzztest/backupsaappend_fuzzer/corpus/init rename to test/fuzztest/backupext_idlstub_fuzzer/corpus/init index 6198079a28e860189d4294f6598f8ac6804c0dff..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 100644 --- a/test/fuzztest/backupsaappend_fuzzer/corpus/init +++ b/test/fuzztest/backupext_idlstub_fuzzer/corpus/init @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at diff --git a/test/fuzztest/backupext_idlstub_fuzzer/project.xml b/test/fuzztest/backupext_idlstub_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..8cd958170c96fc8fbad21fc1becdb23a91a9cd26 --- /dev/null +++ b/test/fuzztest/backupext_idlstub_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_app_incrementaldone_fuzzer/BUILD.gn b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..702c4ec898360e37fda49d032c8d8e45fed6afcf --- /dev/null +++ b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppIncrementalDoneFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_app_incrementaldone_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_app_incrementaldone_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_app_incrementaldone_fuzzer/backupsa_app_incrementaldone_fuzzer.cpp b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/backupsa_app_incrementaldone_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..04e3bc8696f7926f15346f4acb701490c8c823c9 --- /dev/null +++ b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/backupsa_app_incrementaldone_fuzzer.cpp @@ -0,0 +1,71 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_app_incrementaldone_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdAppIncrementalDoneFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + if (size >= sizeof(int32_t)) { + datas.WriteInt32(*(reinterpret_cast(data))); + } + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_APP_INCREMENTAL_DONE), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdAppIncrementalDoneFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_app_incrementaldone_fuzzer/backupsa_app_incrementaldone_fuzzer.h b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/backupsa_app_incrementaldone_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..155769148f8eeb1d17a38814ac32001cbd1ce5c6 --- /dev/null +++ b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/backupsa_app_incrementaldone_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPINCREMENTADONE_FUZZER_H +#define BACKUPSAAPPINCREMENTADONE_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_app_incrementaldone_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsaanother_fuzzer/corpus/init b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/corpus/init similarity index 92% rename from test/fuzztest/backupsaanother_fuzzer/corpus/init rename to test/fuzztest/backupsa_app_incrementaldone_fuzzer/corpus/init index 6198079a28e860189d4294f6598f8ac6804c0dff..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 100644 --- a/test/fuzztest/backupsaanother_fuzzer/corpus/init +++ b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/corpus/init @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at diff --git a/test/fuzztest/backupsaanother_fuzzer/project.xml b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/project.xml similarity index 95% rename from test/fuzztest/backupsaanother_fuzzer/project.xml rename to test/fuzztest/backupsa_app_incrementaldone_fuzzer/project.xml index 7133b2b92440904a5ed04b838733acea0f97486a..66e1dcac475475fb101b6f8670ec699e6e9696aa 100644 --- a/test/fuzztest/backupsaanother_fuzzer/project.xml +++ b/test/fuzztest/backupsa_app_incrementaldone_fuzzer/project.xml @@ -1,5 +1,5 @@ - + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/BUILD.gn b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..37ff84e60308ed89b4317da7c338116587a28f0a --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppendBundlesBackupSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_appendbundles_backupsession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/backupsa_appendbundles_backupsession_fuzzer.cpp b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/backupsa_appendbundles_backupsession_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..d767e0b5fc82d69023cd13d08bdff77577907de5 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/backupsa_appendbundles_backupsession_fuzzer.cpp @@ -0,0 +1,83 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_appendbundles_backupsession_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdAppendBundlesBackupSessionFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + if (size > 0) { + vector bundleNames; + for (size_t i = 0; i < size; i++) { + string param(reinterpret_cast(data), size); + string name = param + to_string(i); + bundleNames.push_back(name); + } + datas.WriteStringVector(bundleNames); + } + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_APPEND_BUNDLES_BACKUP_SESSION); + try { + service->OnRemoteRequest(code, datas, reply, option); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + // filter other error + } + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdAppendBundlesBackupSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/backupsa_appendbundles_backupsession_fuzzer.h b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/backupsa_appendbundles_backupsession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..4e0abe9ebc931e7dc221592c11c6c2b015f7e13c --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/backupsa_appendbundles_backupsession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPENDBUNDLEBACKUPSESSION_FUZZER_H +#define BACKUPSAAPPENDBUNDLEBACKUPSESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_appendbundles_backupsession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/corpus/init b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/project.xml b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_backupsession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/BUILD.gn b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..661fc6e345852c58cd6b685aaf679b87b1a649e8 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppendBundlesIncreBackupSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_appendbundles_increbacksession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.cpp b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/backupsa_appendbundles_increbacksession_fuzzer.cpp similarity index 87% rename from test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.cpp rename to test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/backupsa_appendbundles_increbacksession_fuzzer.cpp index 8c3ae92d8cd04655bea0f5e016cb2c184f7ce5a8..246576d0be91e59828d1dd66b69d95563765a23a 100644 --- a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.cpp +++ b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/backupsa_appendbundles_increbacksession_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -13,7 +13,7 @@ * limitations under the License. */ -#include "backupsaanother_fuzzer.h" +#include "backupsa_appendbundles_increbacksession_fuzzer.h" #include #include @@ -82,7 +82,13 @@ bool CmdAppendBundlesBackupSessionFuzzTest(const uint8_t *data, size_t size) sptr service(new Service(SERVICE_ID)); uint32_t code = static_cast(IServiceIpcCode::COMMAND_APPEND_BUNDLES_BACKUP_SESSION); - service->OnRemoteRequest(code, datas, reply, option); + try { + service->OnRemoteRequest(code, datas, reply, option); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + // filter other error + } service = nullptr; return true; } @@ -198,7 +204,13 @@ bool CmdAppendBundlesIncrementalBackupSessionFuzzTest(const uint8_t *data, size_ sptr service(new Service(SERVICE_ID)); uint32_t code = static_cast( IServiceIpcCode::COMMAND_APPEND_BUNDLES_INCREMENTAL_BACKUP_SESSION); - service->OnRemoteRequest(code, datas, reply, option); + try { + service->OnRemoteRequest(code, datas, reply, option); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + // filter other error + } service = nullptr; return true; } @@ -305,15 +317,21 @@ bool CmdGetIncrementalFileHandleFuzzTest(const uint8_t *data, size_t size) /* Fuzzer entry point */ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { - OHOS::CmdGetFileHandleFuzzTest(data, size); - OHOS::CmdAppendBundlesBackupSessionFuzzTest(data, size); - OHOS::CmdReleaseFuzzTest(data, size); - OHOS::CmdGetLocalCapabilitiesIncrementalFuzzTest(data, size); - OHOS::CmdInitIncrementalBackupSessionFuzzTest(data, size); - OHOS::CmdPublishIncrementalFileFuzzTest(data, size); - OHOS::CmdAppIncrementalFileReadyFuzzTest(data, size); - OHOS::CmdAppIncrementalDoneFuzzTest(data, size); - OHOS::CmdGetIncrementalFileHandleFuzzTest(data, size); - OHOS::CmdAppendBundlesIncrementalBackupSessionFuzzTest(data, size); + try { + OHOS::CmdGetFileHandleFuzzTest(data, size); + OHOS::CmdAppendBundlesBackupSessionFuzzTest(data, size); + OHOS::CmdReleaseFuzzTest(data, size); + OHOS::CmdGetLocalCapabilitiesIncrementalFuzzTest(data, size); + OHOS::CmdInitIncrementalBackupSessionFuzzTest(data, size); + OHOS::CmdPublishIncrementalFileFuzzTest(data, size); + OHOS::CmdAppIncrementalFileReadyFuzzTest(data, size); + OHOS::CmdAppIncrementalDoneFuzzTest(data, size); + OHOS::CmdGetIncrementalFileHandleFuzzTest(data, size); + OHOS::CmdAppendBundlesIncrementalBackupSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } return 0; } \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/backupsa_appendbundles_increbacksession_fuzzer.h b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/backupsa_appendbundles_increbacksession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..383a9b454aa536a6ee0d3ac2acbfbb75cd62d287 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/backupsa_appendbundles_increbacksession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPENDBUNDLESINCREBACKUPSESSION_FUZZER_H +#define BACKUPSAAPPENDBUNDLESINCREBACKUPSESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_appendbundles_increbacksession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/corpus/init b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/project.xml b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_increbacksession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/BUILD.gn b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..1e2af73d6e028747d89dec928d88c41a31e53f8e --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppendBundlesRestoreSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_appendbundles_restoresession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.cpp b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/backupsa_appendbundles_restoresession_fuzzer.cpp similarity index 33% rename from test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.cpp rename to test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/backupsa_appendbundles_restoresession_fuzzer.cpp index 9a6e46113927a07fb242375553133ee2882cdd70..80befe6300eb8be169eb9ecb085c7ee8c29a1263 100644 --- a/test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.cpp +++ b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/backupsa_appendbundles_restoresession_fuzzer.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -13,7 +13,7 @@ * limitations under the License. */ -#include "backupsaappend_fuzzer.h" +#include "backupsa_appendbundles_restoresession_fuzzer.h" #include #include @@ -35,154 +35,6 @@ using namespace OHOS::FileManagement::Backup; namespace OHOS { constexpr int32_t SERVICE_ID = 5203; -bool CmdInitRestoreSessionFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - datas.WriteBuffer(data, size); - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_INIT_RESTORE_SESSION), - datas, reply, option); - service = nullptr; - return true; -} - -bool CmdInitBackupSessionFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - datas.WriteBuffer(data, size); - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_INIT_BACKUP_SESSION), - datas, reply, option); - service = nullptr; - return true; -} - -bool CmdPublishFileFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - if (size > 0) { - int pos = (size + 1) >> 1; - std::string fileName(reinterpret_cast(data), pos); - std::string bundleName(reinterpret_cast(data + pos), size - pos); - uint32_t sn = 0; - if (size > sizeof(uint32_t)) { - sn = *(reinterpret_cast(data)); - } - BFileInfo fileInfo(fileName, bundleName, sn); - datas.WriteParcelable(&fileInfo); - } - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_PUBLISH_FILE), - datas, reply, option); - service = nullptr; - return true; -} - -bool CmdGetLocalCapabilitiesFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - datas.WriteBuffer(data, size); - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - uint32_t code = static_cast(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES); - service->OnRemoteRequest(code, datas, reply, option); - service = nullptr; - return true; -} - -bool CmdAppFileReadyFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - std::string fileName(reinterpret_cast(data), size); - datas.WriteString(fileName); - - int fd = -1; - if (size >= sizeof(int)) { - fd = *(reinterpret_cast(data)); - } - datas.WriteFileDescriptor(UniqueFd(fd)); - - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - uint32_t code = static_cast(IServiceIpcCode::COMMAND_APP_FILE_READY); - service->OnRemoteRequest(code, datas, reply, option); - service = nullptr; - return true; -} - -bool CmdAppDoneFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - if (size >= sizeof(bool)) { - datas.WriteBool(*(reinterpret_cast(data))); - } - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_APP_DONE), - datas, reply, option); - service = nullptr; - return true; -} - -bool CmdStartFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - datas.WriteBuffer(data, size); - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_START), - datas, reply, option); - service = nullptr; - return true; -} - -bool CmdFinishFuzzTest(const uint8_t *data, size_t size) -{ - MessageParcel datas; - datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); - datas.WriteBuffer(data, size); - datas.RewindRead(0); - MessageParcel reply; - MessageOption option; - - sptr service(new Service(SERVICE_ID)); - service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_FINISH), - datas, reply, option); - service = nullptr; - return true; -} - bool CmdAppendBundlesRestoreSessionFuzzTest(const uint8_t *data, size_t size) { MessageParcel datas; @@ -230,14 +82,12 @@ bool CmdAppendBundlesRestoreSessionFuzzTest(const uint8_t *data, size_t size) extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { /* Run your code on data */ - OHOS::CmdInitRestoreSessionFuzzTest(data, size); - OHOS::CmdInitBackupSessionFuzzTest(data, size); - OHOS::CmdPublishFileFuzzTest(data, size); - OHOS::CmdGetLocalCapabilitiesFuzzTest(data, size); - OHOS::CmdAppFileReadyFuzzTest(data, size); - OHOS::CmdAppDoneFuzzTest(data, size); - OHOS::CmdStartFuzzTest(data, size); - OHOS::CmdFinishFuzzTest(data, size); - OHOS::CmdAppendBundlesRestoreSessionFuzzTest(data, size); + try { + OHOS::CmdAppendBundlesRestoreSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } return 0; } \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/backupsa_appendbundles_restoresession_fuzzer.h b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/backupsa_appendbundles_restoresession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..15bccb6cd5a6e4cb21761a219741b52556c50de3 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/backupsa_appendbundles_restoresession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPENDBUNDLESRESTORESESSION_FUZZER_H +#define BACKUPSAAPPENDBUNDLESRESTORESESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_appendbundles_restoresession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/corpus/init b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/project.xml b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_appendbundles_restoresession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_appfileready_fuzzer/BUILD.gn b/test/fuzztest/backupsa_appfileready_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..e218648ca4b6d4093a0c2a036fcedfd79b8b299b --- /dev/null +++ b/test/fuzztest/backupsa_appfileready_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppFileReadyFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_appfileready_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_appfileready_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_appfileready_fuzzer/backupsa_appfileready_fuzzer.cpp b/test/fuzztest/backupsa_appfileready_fuzzer/backupsa_appfileready_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..e3d9a82647dada374672a13d584de4a2e24c3e0d --- /dev/null +++ b/test/fuzztest/backupsa_appfileready_fuzzer/backupsa_appfileready_fuzzer.cpp @@ -0,0 +1,75 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_appfileready_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdAppFileReadyFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + std::string fileName(reinterpret_cast(data), size); + datas.WriteString(fileName); + + int fd = -1; + if (size >= sizeof(int)) { + fd = *(reinterpret_cast(data)); + } + datas.WriteFileDescriptor(UniqueFd(fd)); + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_APP_FILE_READY); + service->OnRemoteRequest(code, datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdAppFileReadyFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_appfileready_fuzzer/backupsa_appfileready_fuzzer.h b/test/fuzztest/backupsa_appfileready_fuzzer/backupsa_appfileready_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..33d5d2a5292a04033ead8e88ef7e8f41cc1b30dc --- /dev/null +++ b/test/fuzztest/backupsa_appfileready_fuzzer/backupsa_appfileready_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPFILEREADY_FUZZER_H +#define BACKUPSAAPPFILEREADY_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_appfileready_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_appfileready_fuzzer/corpus/init b/test/fuzztest/backupsa_appfileready_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_appfileready_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_appfileready_fuzzer/project.xml b/test/fuzztest/backupsa_appfileready_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_appfileready_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_finish_fuzzer/BUILD.gn b/test/fuzztest/backupsa_finish_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..a994a475920cb18437f2a179b4c36c55bd8b5fed --- /dev/null +++ b/test/fuzztest/backupsa_finish_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaFinishFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_finish_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_finish_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_finish_fuzzer/backupsa_finish_fuzzer.cpp b/test/fuzztest/backupsa_finish_fuzzer/backupsa_finish_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..04d1de87b9e11fbd6acea1b2fa55082159611945 --- /dev/null +++ b/test/fuzztest/backupsa_finish_fuzzer/backupsa_finish_fuzzer.cpp @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_finish_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; +bool CmdFinishFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_FINISH), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdFinishFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_finish_fuzzer/backupsa_finish_fuzzer.h b/test/fuzztest/backupsa_finish_fuzzer/backupsa_finish_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..c4473b66cd6f59665ad6e257fb57f41f2b258e42 --- /dev/null +++ b/test/fuzztest/backupsa_finish_fuzzer/backupsa_finish_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAFINISHFUZZ_FUZZER_H +#define BACKUPSAFINISHFUZZ_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_finish_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_finish_fuzzer/corpus/init b/test/fuzztest/backupsa_finish_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_finish_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_finish_fuzzer/project.xml b/test/fuzztest/backupsa_finish_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_finish_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_getfile_handle_fuzzer/BUILD.gn b/test/fuzztest/backupsa_getfile_handle_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..66fd866ef49cb9daf3abe2b216a7cee14e9d0a08 --- /dev/null +++ b/test/fuzztest/backupsa_getfile_handle_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaGetFileHandleFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_getfile_handle_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_getfile_handle_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_getfile_handle_fuzzer/backupsa_getfile_handle_fuzzer.cpp b/test/fuzztest/backupsa_getfile_handle_fuzzer/backupsa_getfile_handle_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..082edcd9b76e53960d1667d16043df769f4d5861 --- /dev/null +++ b/test/fuzztest/backupsa_getfile_handle_fuzzer/backupsa_getfile_handle_fuzzer.cpp @@ -0,0 +1,77 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_getfile_handle_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdGetFileHandleFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + int pos = (size + 1) >> 1; + if (size > 0) { + std::string param(string(reinterpret_cast(data), pos)); + datas.WriteString(param); + } + + if (size > 1) { + std::string param(string(reinterpret_cast(data + pos), size - pos)); + datas.WriteString(param); + } + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_GET_FILE_HANDLE), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdGetFileHandleFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_getfile_handle_fuzzer/backupsa_getfile_handle_fuzzer.h b/test/fuzztest/backupsa_getfile_handle_fuzzer/backupsa_getfile_handle_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..583af0752f5bf1d692b6650ed240ac1261d290c3 --- /dev/null +++ b/test/fuzztest/backupsa_getfile_handle_fuzzer/backupsa_getfile_handle_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAGETFILEHANDLE_FUZZER_H +#define BACKUPSAGETFILEHANDLE_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_getfile_handle_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_getfile_handle_fuzzer/corpus/init b/test/fuzztest/backupsa_getfile_handle_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_getfile_handle_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_getfile_handle_fuzzer/project.xml b/test/fuzztest/backupsa_getfile_handle_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_getfile_handle_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/BUILD.gn b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..9b060181c8899aa5e0fddc032ea388a675066fcd --- /dev/null +++ b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaGetIncrementalLocalCapabilitiesFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_getincremental_localcapabilities_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/backupsa_getincremental_localcapabilities_fuzzer.cpp b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/backupsa_getincremental_localcapabilities_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..96af190e25a3d0a150c1cedb562352d0903e2138 --- /dev/null +++ b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/backupsa_getincremental_localcapabilities_fuzzer.cpp @@ -0,0 +1,115 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_getincremental_localcapabilities_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +void GetBundleNamesData(const uint8_t *data, size_t size, vector &bundleNames) +{ + int minLen = sizeof(int64_t) + sizeof(int) + sizeof(int32_t); + if (size < minLen + 1) { + return; + } + FuzzedDataProvider fdp(data, size); + uint8_t loop = fdp.ConsumeIntegral(); + size--; + if (loop == 0 || (minLen * loop) > size) { + return; + } + int blob = (size / loop); + int len = (blob - minLen) >> 1; + for (size_t i = 0, pos = 1; i < loop; i++, pos += blob) { + int64_t nTime = fdp.ConsumeIntegral(); + int fd = fdp.ConsumeIntegral(); + int32_t priority = fdp.ConsumeIntegral(); + string name(reinterpret_cast(data + pos + minLen), len); + string parameters(reinterpret_cast(data + pos + len + minLen), len); + BIncrementalData incrementaData(name, nTime, fd, parameters, priority); + bundleNames.push_back(incrementaData); + } +} + +template +void WriteParcelableVector(const std::vector &parcelableVector, Parcel &data) +{ + if (!data.WriteUint32(parcelableVector.size())) { + return; + } + + for (const auto &parcelable : parcelableVector) { + if (!data.WriteParcelable(&parcelable)) { + return; + } + } + + return; +} + +bool CmdGetLocalCapabilitiesIncrementalFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + if (size >= sizeof(int32_t)) { + vector bundleNames; + GetBundleNamesData(data, size, bundleNames); + WriteParcelableVector(bundleNames, datas); + } + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES_INCREMENTAL); + service->OnRemoteRequest(code, datas, reply, option); + OHOS::AppFileService::SandboxHelper::ClearBackupSandboxPathMap(); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdGetLocalCapabilitiesIncrementalFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/backupsa_getincremental_localcapabilities_fuzzer.h b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/backupsa_getincremental_localcapabilities_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..6461fd44a0a09395357f1db7898148c20e4a30b0 --- /dev/null +++ b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/backupsa_getincremental_localcapabilities_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAGETINCREMENTALLOCALCAPABILITIES_FUZZER_H +#define BACKUPSAGETINCREMENTALLOCALCAPABILITIES_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_getincremental_localcapabilities_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/corpus/init b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/project.xml b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_getincremental_localcapabilities_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/BUILD.gn b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..1b28332e0a46ad67ee89ec7187a8148e3aa425d6 --- /dev/null +++ b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaGetIncrementalFileHandleFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_getincrementalfile_handle_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/backupsa_getincrementalfile_handle_fuzzer.cpp b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/backupsa_getincrementalfile_handle_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..46f721c716c64206a80112091ae0b1a368e1e16f --- /dev/null +++ b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/backupsa_getincrementalfile_handle_fuzzer.cpp @@ -0,0 +1,78 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_getincrementalfile_handle_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdGetIncrementalFileHandleFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + int pos = (size + 1) >> 1; + if (size > 0) { + string param(reinterpret_cast(data), pos); + datas.WriteString(param); + } + + if (size > 1) { + string param(reinterpret_cast(data + pos), size - pos); + datas.WriteString(param); + } + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_GET_INCREMENTAL_FILE_HANDLE), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdGetIncrementalFileHandleFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/backupsa_getincrementalfile_handle_fuzzer.h b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/backupsa_getincrementalfile_handle_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..3d5b9b5d9270d2686b10cac9d29bad4d5965ed7d --- /dev/null +++ b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/backupsa_getincrementalfile_handle_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAINCREMENTALFILEHANDLE_FUZZER_H +#define BACKUPSAINCREMENTALFILEHANDLE_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_getincrementalfile_handle_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/corpus/init b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/project.xml b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_getincrementalfile_handle_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/BUILD.gn b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..bbf0c01aa3feab713f3380662f80df7852e1b7d2 --- /dev/null +++ b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaGetLocalCapabilitiesFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_getlocalcapabilities_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_getlocalcapabilities_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/backupsa_getlocalcapabilities_fuzzer.cpp b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/backupsa_getlocalcapabilities_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..70e8d19ab898993faac8a36d6610d1a90e2886c1 --- /dev/null +++ b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/backupsa_getlocalcapabilities_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_getlocalcapabilities_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdGetLocalCapabilitiesFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES); + service->OnRemoteRequest(code, datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdGetLocalCapabilitiesFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/backupsa_getlocalcapabilities_fuzzer.h b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/backupsa_getlocalcapabilities_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..ea1e3b5566574cffdfa09bec292ae2dcfbceecc2 --- /dev/null +++ b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/backupsa_getlocalcapabilities_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAGETLOCALCAPABILITIES_FUZZER_H +#define BACKUPSAGETLOCALCAPABILITIES_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_getlocalcapabilities_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/corpus/init b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/project.xml b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_getlocalcapabilities_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_init_backupsession_fuzzer/BUILD.gn b/test/fuzztest/backupsa_init_backupsession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..ac3d3b950d8e6a26b86162352f95daba96170fc0 --- /dev/null +++ b/test/fuzztest/backupsa_init_backupsession_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaInitBackupSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_init_backupsession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_init_backupsession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_init_backupsession_fuzzer/backupsa_init_backupsession_fuzzer.cpp b/test/fuzztest/backupsa_init_backupsession_fuzzer/backupsa_init_backupsession_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..05eb10c66dddd37fbbc13eab10ef3db48c8f5637 --- /dev/null +++ b/test/fuzztest/backupsa_init_backupsession_fuzzer/backupsa_init_backupsession_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_init_backupsession_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdInitBackupSessionFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_INIT_BACKUP_SESSION), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdInitBackupSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_backupsession_fuzzer/backupsa_init_backupsession_fuzzer.h b/test/fuzztest/backupsa_init_backupsession_fuzzer/backupsa_init_backupsession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..58ed5a9308116452c4c5bbd2ae86324d2fbfd34c --- /dev/null +++ b/test/fuzztest/backupsa_init_backupsession_fuzzer/backupsa_init_backupsession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAINITBACKUPSESSION_FUZZER_H +#define BACKUPSAINITBACKUPSESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_init_backupsession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_backupsession_fuzzer/corpus/init b/test/fuzztest/backupsa_init_backupsession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_init_backupsession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_backupsession_fuzzer/project.xml b/test/fuzztest/backupsa_init_backupsession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_init_backupsession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/BUILD.gn b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..cee3d7d0dfc5131f7431c8f286ce164ef8d879e5 --- /dev/null +++ b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaInitIncreBackupSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_init_incrementalbackupession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/backupsa_init_incrementalbackupession_fuzzer.cpp b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/backupsa_init_incrementalbackupession_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..e517c87c3608be8a25e203c51c3a6e3625ea700e --- /dev/null +++ b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/backupsa_init_incrementalbackupession_fuzzer.cpp @@ -0,0 +1,68 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_init_incrementalbackupession_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdInitIncrementalBackupSessionFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_INIT_INCREMENTAL_BACKUP_SESSION); + service->OnRemoteRequest(code, datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdInitIncrementalBackupSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/backupsa_init_incrementalbackupession_fuzzer.h b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/backupsa_init_incrementalbackupession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..d31e4f6843366f8139dfbc699858ce4295c86598 --- /dev/null +++ b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/backupsa_init_incrementalbackupession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAINITINCREMENTALBACKUPSESSION_FUZZER_H +#define BACKUPSAINITINCREMENTALBACKUPSESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_init_incrementalbackupession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/corpus/init b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/project.xml b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_init_incrementalbackupession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_init_restoresession_fuzzer/BUILD.gn b/test/fuzztest/backupsa_init_restoresession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..d4fb83b64ef59d51bf22cf4c2a519ea2efcf7133 --- /dev/null +++ b/test/fuzztest/backupsa_init_restoresession_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaInitRestoreSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_init_restoresession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_init_restoresession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_init_restoresession_fuzzer/backupsa_init_restoresession_fuzzer.cpp b/test/fuzztest/backupsa_init_restoresession_fuzzer/backupsa_init_restoresession_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..c310b1c6483fae08978dfd60afe629c7fa0d5a0f --- /dev/null +++ b/test/fuzztest/backupsa_init_restoresession_fuzzer/backupsa_init_restoresession_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_init_restoresession_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdInitRestoreSessionFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_INIT_RESTORE_SESSION), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdInitRestoreSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_restoresession_fuzzer/backupsa_init_restoresession_fuzzer.h b/test/fuzztest/backupsa_init_restoresession_fuzzer/backupsa_init_restoresession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..488cb206d3406ffb96472b0c83f1be65b2dfaf02 --- /dev/null +++ b/test/fuzztest/backupsa_init_restoresession_fuzzer/backupsa_init_restoresession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAINITRESTORESESSION_FUZZER_H +#define BACKUPSAINITRESTORESESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_init_restoresession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_restoresession_fuzzer/corpus/init b/test/fuzztest/backupsa_init_restoresession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_init_restoresession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_init_restoresession_fuzzer/project.xml b/test/fuzztest/backupsa_init_restoresession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_init_restoresession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_publish_file_fuzzer/BUILD.gn b/test/fuzztest/backupsa_publish_file_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..ca176a82f71032289103292b312170753e724e98 --- /dev/null +++ b/test/fuzztest/backupsa_publish_file_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaPublishFileFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_publish_file_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_publish_file_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_publish_file_fuzzer/backupsa_publish_file_fuzzer.cpp b/test/fuzztest/backupsa_publish_file_fuzzer/backupsa_publish_file_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..2abda33eef08c2a2cce671245d38235d3fa09e46 --- /dev/null +++ b/test/fuzztest/backupsa_publish_file_fuzzer/backupsa_publish_file_fuzzer.cpp @@ -0,0 +1,77 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_publish_file_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdPublishFileFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + if (size > 0) { + int pos = (size + 1) >> 1; + std::string fileName(reinterpret_cast(data), pos); + std::string bundleName(reinterpret_cast(data + pos), size - pos); + uint32_t sn = 0; + if (size > sizeof(uint32_t)) { + sn = *(reinterpret_cast(data)); + } + BFileInfo fileInfo(fileName, bundleName, sn); + datas.WriteParcelable(&fileInfo); + } + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_PUBLISH_FILE), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdPublishFileFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_publish_file_fuzzer/backupsa_publish_file_fuzzer.h b/test/fuzztest/backupsa_publish_file_fuzzer/backupsa_publish_file_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..058f39fb77d55c24e73d58a859ef6f5805753cd4 --- /dev/null +++ b/test/fuzztest/backupsa_publish_file_fuzzer/backupsa_publish_file_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAPUBLISHFILE_FUZZER_H +#define BACKUPSAPUBLISHFILE_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_publish_file_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_publish_file_fuzzer/corpus/init b/test/fuzztest/backupsa_publish_file_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_publish_file_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_publish_file_fuzzer/project.xml b/test/fuzztest/backupsa_publish_file_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_publish_file_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/BUILD.gn b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..5bdb46590aa2894621197b22c71b62734d17baa7 --- /dev/null +++ b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/BUILD.gn @@ -0,0 +1,66 @@ +# Copyright (c) 2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaPublishIncrementalFileFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsa_publish_incrementalfile_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsa_publish_incrementalfile_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/interfaces/innerkits/native:sandbox_helper_native", + "${path_backup}/utils:backup_utils", + ] + + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/backupsa_publish_incrementalfile_fuzzer.cpp b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/backupsa_publish_incrementalfile_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..2c576fc97a9a7c22071b47816d39c41fb4db740e --- /dev/null +++ b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/backupsa_publish_incrementalfile_fuzzer.cpp @@ -0,0 +1,79 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_publish_incrementalfile_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdPublishIncrementalFileFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + if (size > 0) { + int pos = (size + 1) >> 1; + std::string fileName(reinterpret_cast(data), pos); + std::string bundleName(reinterpret_cast(data + pos), size - pos); + uint32_t sn = 0; + if (size > sizeof(uint32_t)) { + sn = *(reinterpret_cast(data)); + } + BFileInfo fileInfo(fileName, bundleName, sn); + datas.WriteParcelable(&fileInfo); + } + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_PUBLISH_INCREMENTAL_FILE); + service->OnRemoteRequest(code, datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdPublishIncrementalFileFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/backupsa_publish_incrementalfile_fuzzer.h b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/backupsa_publish_incrementalfile_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..95b0ead3e5c6e1eabc535c127b9414ebc5ba5fcf --- /dev/null +++ b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/backupsa_publish_incrementalfile_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAPUBLISHINCREMENTALFILE_FUZZER_H +#define BACKUPSAPUBLISHINCREMENTALFILE_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_publish_incrementalfile_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/corpus/init b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/project.xml b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_publish_incrementalfile_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsaanother_fuzzer/BUILD.gn b/test/fuzztest/backupsa_release_fuzzer/BUILD.gn similarity index 91% rename from test/fuzztest/backupsaanother_fuzzer/BUILD.gn rename to test/fuzztest/backupsa_release_fuzzer/BUILD.gn index 36412f43bd770ce6008cb96cf1806a78a79128f8..bac96c5be61e9c62a6a346a6a95afd01dacd147f 100644 --- a/test/fuzztest/backupsaanother_fuzzer/BUILD.gn +++ b/test/fuzztest/backupsa_release_fuzzer/BUILD.gn @@ -1,4 +1,4 @@ -# Copyright (c) 2024 Huawei Device Co., Ltd. +# Copyright (c) 2025 Huawei Device Co., Ltd. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at @@ -18,10 +18,10 @@ import("//foundation/filemanagement/app_file_service/app_file_service.gni") import("//foundation/filemanagement/app_file_service/backup.gni") ##############################fuzztest########################################## -ohos_fuzztest("BackupSaAnotherFuzzTest") { +ohos_fuzztest("BackupSaReleaseFuzzTest") { module_out_path = "app_file_service/app_file_service" fuzz_config_file = - "${app_file_service_path}/test/fuzztest/backupsaanother_fuzzer" + "${app_file_service_path}/test/fuzztest/backupsa_release_fuzzer" include_dirs = [ "${app_file_service_path}/services/backup_sa/include/module_ipc", "${app_file_service_path}/services/backup_sa/include", @@ -34,7 +34,7 @@ ohos_fuzztest("BackupSaAnotherFuzzTest") { "-Wno-unused-variable", "-fno-omit-frame-pointer", ] - sources = [ "backupsaanother_fuzzer.cpp" ] + sources = [ "backupsa_release_fuzzer.cpp" ] deps = [ "${app_file_service_path}/services/backup_sa:backup_sa", diff --git a/test/fuzztest/backupsa_release_fuzzer/backupsa_release_fuzzer.cpp b/test/fuzztest/backupsa_release_fuzzer/backupsa_release_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..1b0e4d6b6612e906aad52112f268f861c318b76b --- /dev/null +++ b/test/fuzztest/backupsa_release_fuzzer/backupsa_release_fuzzer.cpp @@ -0,0 +1,68 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_release_fuzzer.h" + +#include +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "sandbox_helper.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdReleaseFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_RELEASE); + service->OnRemoteRequest(code, datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + try { + OHOS::CmdReleaseFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.h b/test/fuzztest/backupsa_release_fuzzer/backupsa_release_fuzzer.h similarity index 77% rename from test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.h rename to test/fuzztest/backupsa_release_fuzzer/backupsa_release_fuzzer.h index f89e351e66d771ee30bc024ed714385ee7e74239..9996d12265d1731f1214c4b8efa633f284bbdefc 100644 --- a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.h +++ b/test/fuzztest/backupsa_release_fuzzer/backupsa_release_fuzzer.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2024 Huawei Device Co., Ltd. + * Copyright (c) 2025 Huawei Device Co., Ltd. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at @@ -13,9 +13,9 @@ * limitations under the License. */ -#ifndef BACKUPSAANOTHER_FUZZER_H -#define BACKUPSAANOTHER_FUZZER_H +#ifndef BACKUPSARELEASE_FUZZER_H +#define BACKUPSARELEASE_FUZZER_H -#define FUZZ_PROJECT_NAME "backupsaanother_fuzzer" +#define FUZZ_PROJECT_NAME "backupsa_release_fuzzer" #endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_release_fuzzer/corpus/init b/test/fuzztest/backupsa_release_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_release_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_release_fuzzer/project.xml b/test/fuzztest/backupsa_release_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_release_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsaappend_fuzzer/BUILD.gn b/test/fuzztest/backupsa_start_fuzzer/BUILD.gn similarity index 90% rename from test/fuzztest/backupsaappend_fuzzer/BUILD.gn rename to test/fuzztest/backupsa_start_fuzzer/BUILD.gn index 410ead2a27573f5b26ef45e0eac52f0b52156143..3d2089727b9ab4239c220712f597f5daee7e2e06 100644 --- a/test/fuzztest/backupsaappend_fuzzer/BUILD.gn +++ b/test/fuzztest/backupsa_start_fuzzer/BUILD.gn @@ -1,4 +1,4 @@ -# Copyright (c) 2021-2024 Huawei Device Co., Ltd. +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at @@ -18,10 +18,10 @@ import("//foundation/filemanagement/app_file_service/app_file_service.gni") import("//foundation/filemanagement/app_file_service/backup.gni") ##############################fuzztest########################################## -ohos_fuzztest("BackupSaAppendFuzzTest") { +ohos_fuzztest("BackupSaStartFuzzTest") { module_out_path = "app_file_service/app_file_service" fuzz_config_file = - "${app_file_service_path}/test/fuzztest/backupsaappend_fuzzer" + "${app_file_service_path}/test/fuzztest/backupsa_start_fuzzer" include_dirs = [ "${app_file_service_path}/services/backup_sa/include/module_ipc", "${app_file_service_path}/services/backup_sa/include", @@ -34,7 +34,7 @@ ohos_fuzztest("BackupSaAppendFuzzTest") { "-Wno-unused-variable", "-fno-omit-frame-pointer", ] - sources = [ "backupsaappend_fuzzer.cpp" ] + sources = [ "backupsa_start_fuzzer.cpp" ] deps = [ "${app_file_service_path}/services/backup_sa:backup_sa", @@ -58,5 +58,7 @@ ohos_fuzztest("BackupSaAppendFuzzTest") { "LOG_DOMAIN=0xD004303", "private=public", ] + + use_exceptions = true } ############################################################################### diff --git a/test/fuzztest/backupsa_start_fuzzer/backupsa_start_fuzzer.cpp b/test/fuzztest/backupsa_start_fuzzer/backupsa_start_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..1c039ee08c5c1c34604fade1c1760ca2a0d09d80 --- /dev/null +++ b/test/fuzztest/backupsa_start_fuzzer/backupsa_start_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsa_start_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdStartFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_START), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdStartFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + // filter backup error + } catch (...) { + // filter other error + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsa_start_fuzzer/backupsa_start_fuzzer.h b/test/fuzztest/backupsa_start_fuzzer/backupsa_start_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..64a1ad685a2974940696286d83db6918ddb746aa --- /dev/null +++ b/test/fuzztest/backupsa_start_fuzzer/backupsa_start_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSASTARTFUZZ_FUZZER_H +#define BACKUPSASTARTFUZZ_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsa_start_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsa_start_fuzzer/corpus/init b/test/fuzztest/backupsa_start_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsa_start_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsa_start_fuzzer/project.xml b/test/fuzztest/backupsa_start_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsa_start_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp b/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp index 09767b6eea6e4e70c82ee571c0a0664e558534b8..4589cf5490456cb1b76da73e1595e1007f52bbc9 100644 --- a/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp +++ b/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp @@ -657,16 +657,19 @@ bool IncrementalRestoreOnProcessInfoFuzzTest(sptr service, const bool OnRemoteRequestFuzzTest(sptr service, const uint8_t *data, size_t size) { - uint32_t codeMax = 26; + uint32_t codeMax = 31; for (uint32_t code = 1; code < codeMax; code++) { MessageParcel datas; MessageParcel reply; MessageOption option; - datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor()); datas.WriteBuffer(reinterpret_cast(data), size); datas.RewindRead(0); - service->OnRemoteRequest(code, datas, reply, option); + try { + service->OnRemoteRequest(code, datas, reply, option); + } catch (BError &err) { + // Only filter BError errors, Other results are not expected. + } } { MessageParcel datas;