diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn index 94ef49b8512b96699b20a672bc2dec92a9a4a072..2cb0d7ca5d1db37e55e256d0851aa962fe22da78 100644 --- a/test/fuzztest/BUILD.gn +++ b/test/fuzztest/BUILD.gn @@ -18,6 +18,15 @@ group("fuzztest") { # deps file "backupext_fuzzer:BackupExtFuzzTest", "backupsa_fuzzer:BackupSaFuzzTest", + "backupsaappdone_fuzzer:BackupSaAppDoneFuzzTest", + "backupsaappendbundlesrestoresession_fuzzer:BackupSaAppendBundlesRestoreSessionFuzzTest", + "backupsaappfileready_fuzzer:BackupSaAppFileReadyFuzzTest", + "backupsafinish_fuzzer:BackupSaFinishFuzzTest", + "backupsagetlocalcapabilities_fuzzer:BackupSaGetLocalCapabilitiesFuzzTest", + "backupsainitbackupsession_fuzzer:BackupSaInitBackupSessionFuzzTest", + "backupsainitrestoresession_fuzzer:BackupSaInitRestoreSessionFuzzTest", + "backupsapublishfile_fuzzer:BackupSaPublishFileFuzzTest", + "backupsastart_fuzzer:BackupSaStartFuzzTest", "backupsaappendbundlesbackupsession_fuzzer:BackupSaAppendBundlesBackupSessionFuzzTest", "backupsaappendbundlesincrementalbackupsession_fuzzer:BackupSaAppendBundlesIncrementalBackupSessionFuzzTest", "backupsaappincrementaldone_fuzzer:BackupSaAppIncrementalDoneFuzzTest", diff --git a/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp b/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp index a100e64faaa04738df7be32ed49a042aa5605b7a..c921424d2cfb7f017adf6b47cb651bc8d1c56769 100644 --- a/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp +++ b/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp @@ -348,6 +348,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) auto extension = OHOS::sptr( new OHOS::FileManagement::Backup::BackupExtExtension(extBackup, "")); + OHOS::OnRemoteRequestFuzzTest(extension, data, size); OHOS::InitFuzzTest(extBackup, data, size); OHOS::OnCommandFuzzTest(extBackup, data, size); OHOS::OnConnectFuzzTest(extBackup, data, size); @@ -373,7 +374,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) OHOS::CmdHandleIncrementalBackupFuzzTest(extension, data, size); OHOS::CmdIncrementalOnBackupFuzzTest(extension, data, size); OHOS::CmdGetIncrementalBackupFileHandleFuzzTest(extension, data, size); - OHOS::OnRemoteRequestFuzzTest(extension, data, size); } catch (OHOS::FileManagement::Backup::BError &err) { // Only filter BError errors, Other results are not expected. } diff --git a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp index 7f4e7a15622f8144d5f122e13e75a3abee19fcd2..8bd10a0d6ab1c2d8d13f96c9421ba6070aff75b7 100644 --- a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp +++ b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp @@ -61,7 +61,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t dataSize) } catch (OHOS::FileManagement::Backup::BError &err) { HILOGE("BackupSaFuzzTest error"); } catch (...) { - // filter other error + HILOGE("BackupSaFuzzTest exception"); } return 0; } \ No newline at end of file diff --git a/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.cpp b/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..c62c0624f3af8297ebe51fe6037ff80dd8ef8c6b --- /dev/null +++ b/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.cpp @@ -0,0 +1,70 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsaappdone_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdAppDoneFuzzTest(const uint8_t *data, size_t size) +{ + if (data == nullptr || size < sizeof(int32_t)) { + return false; + } + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + int32_t errCode = *(reinterpret_cast(data)); + datas.WriteInt32(errCode); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_APP_DONE), + datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdAppDoneFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/BUILD.gn b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..61d72bd322adb1876318bfe53e84dfe15a5b1322 --- /dev/null +++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppendBundlesRestoreSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsaappendbundlesrestoresession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.h b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..4c1b680a1089f4556ffc832f3d4729b64a066ff4 --- /dev/null +++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPENDBUNDLESRESTORESESSION_FUZZER_H +#define BACKUPSAAPPENDBUNDLESRESTORESESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsaappendbundlesrestoresession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsaappfileready_fuzzer/BUILD.gn b/test/fuzztest/backupsaappfileready_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..9b027583fca4eedfc1d37b73d520e7b56455a34a --- /dev/null +++ b/test/fuzztest/backupsaappfileready_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaAppFileReadyFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsaappfileready_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsaappfileready_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.cpp b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..ad76fb640e0f2e0a2b57955cf5b034ee56747ad9 --- /dev/null +++ b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.cpp @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsaappfileready_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdAppFileReadyFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + std::string fileName(reinterpret_cast(data), size); + datas.WriteString(fileName); + + int fd = -1; + if (size >= sizeof(int)) { + fd = *(reinterpret_cast(data)); + } + datas.WriteFileDescriptor(UniqueFd(fd)); + + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_APP_FILE_READY); + service->OnRemoteRequest(code, datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdAppFileReadyFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.h b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..6fbc9e6b7d96a5b653aaf2162608b131279721f5 --- /dev/null +++ b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAAPPFILEREADY_FUZZER_H +#define BACKUPSAAPPFILEREADY_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsaappfileready_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsaappfileready_fuzzer/corpus/init b/test/fuzztest/backupsaappfileready_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsaappfileready_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsaappfileready_fuzzer/project.xml b/test/fuzztest/backupsaappfileready_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsaappfileready_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.cpp b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..0785ebd6a423ad91d0a5b00fb08ddb144c8f21d6 --- /dev/null +++ b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.cpp @@ -0,0 +1,65 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsafinish_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; +bool CmdFinishFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_FINISH), + datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdFinishFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.h b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..8191a46424602c2354e125827ae2d4c537032306 --- /dev/null +++ b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAFINISHFUZZ_FUZZER_H +#define BACKUPSAFINISHFUZZ_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsafinish_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsafinish_fuzzer/corpus/init b/test/fuzztest/backupsafinish_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsafinish_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsafinish_fuzzer/project.xml b/test/fuzztest/backupsafinish_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsafinish_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/BUILD.gn b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..7bc3a73ca3d3bb6e24c4c749a87f6b0bdbcd8023 --- /dev/null +++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaGetLocalCapabilitiesFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsagetlocalcapabilities_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsagetlocalcapabilities_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.cpp b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..4db07727610c3b2930f3eed28b2900e4458ad82d --- /dev/null +++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.cpp @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsagetlocalcapabilities_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdGetLocalCapabilitiesFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + uint32_t code = static_cast(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES); + service->OnRemoteRequest(code, datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdGetLocalCapabilitiesFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.h b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..61e1af185d94a2eec27dc844649cc60223a7b0bc --- /dev/null +++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAGETLOCALCAPABILITIES_FUZZER_H +#define BACKUPSAGETLOCALCAPABILITIES_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsagetlocalcapabilities_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/corpus/init b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/project.xml b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/BUILD.gn b/test/fuzztest/backupsainitbackupsession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..64168d4e5330e30f05133969fd43a59cee471b59 --- /dev/null +++ b/test/fuzztest/backupsainitbackupsession_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaInitBackupSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsainitbackupsession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsainitbackupsession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.cpp b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..5ac3b7af74ff25b722f4079b1e5cc00264007f59 --- /dev/null +++ b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsainitbackupsession_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdInitBackupSessionFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_INIT_BACKUP_SESSION), + datas, reply, option); + service = nullptr; + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdInitBackupSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.h b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..117776b31acb7b65a6cb0ff8a860f5fb0af46632 --- /dev/null +++ b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAINITBACKUPSESSION_FUZZER_H +#define BACKUPSAINITBACKUPSESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsainitbackupsession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/corpus/init b/test/fuzztest/backupsainitbackupsession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsainitbackupsession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/project.xml b/test/fuzztest/backupsainitbackupsession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsainitbackupsession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/BUILD.gn b/test/fuzztest/backupsainitrestoresession_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..2961ddd9efc6f3ffb5dfe7cdd49c6fe4de778089 --- /dev/null +++ b/test/fuzztest/backupsainitrestoresession_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaInitRestoreSessionFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsainitrestoresession_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsainitrestoresession_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.cpp b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..f5adc5aa2ef4df327f071d7011af30bfb90af47c --- /dev/null +++ b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.cpp @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsainitrestoresession_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdInitRestoreSessionFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_INIT_RESTORE_SESSION), + datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdInitRestoreSessionFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.h b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..0b21b9243c3b4f69cbda9181d65b5ff6bed54839 --- /dev/null +++ b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAINITRESTORESESSION_FUZZER_H +#define BACKUPSAINITRESTORESESSION_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsainitrestoresession_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/corpus/init b/test/fuzztest/backupsainitrestoresession_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsainitrestoresession_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/project.xml b/test/fuzztest/backupsainitrestoresession_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsainitrestoresession_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsapublishfile_fuzzer/BUILD.gn b/test/fuzztest/backupsapublishfile_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..0dfafe417476b05d3ad750f659addffe659a622e --- /dev/null +++ b/test/fuzztest/backupsapublishfile_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaPublishFileFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsapublishfile_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsapublishfile_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.cpp b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..27b6562a23fd062f72b147dc26d8aae941a4686d --- /dev/null +++ b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.cpp @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsapublishfile_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdPublishFileFuzzTest(const uint8_t *data, size_t size) +{ + if (data == nullptr || size < sizeof(uint32_t)) { + return false; + } + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + uint32_t sn = *(reinterpret_cast(data)); + int len = (size - sizeof(uint32_t)) >> 1; + std::string fileName(reinterpret_cast(data + sizeof(uint32_t)), len); + std::string bundleName(reinterpret_cast(data + sizeof(uint32_t) + len), len); + BFileInfo fileInfo(fileName, bundleName, sn); + datas.WriteParcelable(&fileInfo); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_PUBLISH_FILE), + datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdPublishFileFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.h b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.h new file mode 100644 index 0000000000000000000000000000000000000000..38fa27870f696f17e64bbc1eef1c35e654aaa136 --- /dev/null +++ b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef BACKUPSAPUBLISHFILE_FUZZER_H +#define BACKUPSAPUBLISHFILE_FUZZER_H + +#define FUZZ_PROJECT_NAME "backupsapublishfile_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/backupsapublishfile_fuzzer/corpus/init b/test/fuzztest/backupsapublishfile_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsapublishfile_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsapublishfile_fuzzer/project.xml b/test/fuzztest/backupsapublishfile_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsapublishfile_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/backupsastart_fuzzer/BUILD.gn b/test/fuzztest/backupsastart_fuzzer/BUILD.gn new file mode 100644 index 0000000000000000000000000000000000000000..3299389bbe157cd33cd26d98fd6a01166965e232 --- /dev/null +++ b/test/fuzztest/backupsastart_fuzzer/BUILD.gn @@ -0,0 +1,64 @@ +# Copyright (c) 2021-2025 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/app_file_service/app_file_service.gni") +import("//foundation/filemanagement/app_file_service/backup.gni") + +##############################fuzztest########################################## +ohos_fuzztest("BackupSaStartFuzzTest") { + module_out_path = "app_file_service/app_file_service" + fuzz_config_file = + "${app_file_service_path}/test/fuzztest/backupsastart_fuzzer" + include_dirs = [ + "${app_file_service_path}/services/backup_sa/include/module_ipc", + "${app_file_service_path}/services/backup_sa/include", + "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl", + "${app_file_service_path}/frameworks/native/backup_kit_inner/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "backupsastart_fuzzer.cpp" ] + + deps = [ + "${app_file_service_path}/services/backup_sa:backup_sa", + "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner", + "${path_backup}/utils:backup_utils", + ] + public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ] + external_deps = [ + "ability_runtime:ability_manager", + "ability_runtime:abilitykit_native", + "bounds_checking_function:libsec_shared", + "c_utils:utils", + "file_api:filemgmt_libn", + "hilog:libhilog", + "ipc:ipc_core", + "safwk:system_ability_fwk", + ] + + defines = [ + "LOG_TAG=\"app_file_service\"", + "LOG_DOMAIN=0xD004303", + "private=public", + ] + + use_exceptions = true +} +############################################################################### diff --git a/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.cpp b/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.cpp new file mode 100644 index 0000000000000000000000000000000000000000..ade2f0a21a4579e8bfab4ba891973ddd945fe613 --- /dev/null +++ b/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.cpp @@ -0,0 +1,66 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "backupsastart_fuzzer.h" + +#include +#include +#include +#include +#include + +#include "message_parcel.h" +#include "service.h" +#include "service_proxy.h" +#include "service_reverse.h" +#include "service_stub.h" +#include "securec.h" +#include "system_ability.h" + +using namespace std; +using namespace OHOS::FileManagement::Backup; + +namespace OHOS { +constexpr int32_t SERVICE_ID = 5203; + +bool CmdStartFuzzTest(const uint8_t *data, size_t size) +{ + MessageParcel datas; + datas.WriteInterfaceToken(ServiceStub::GetDescriptor()); + datas.WriteBuffer(data, size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + sptr service(new Service(SERVICE_ID)); + service->OnRemoteRequest(static_cast(IServiceIpcCode::COMMAND_START), + datas, reply, option); + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + try { + OHOS::CmdStartFuzzTest(data, size); + } catch (OHOS::FileManagement::Backup::BError &err) { + HILOGE("BackupSaFuzzTest error"); + } catch (...) { + HILOGE("BackupSaFuzzTest exception"); + } + return 0; +} \ No newline at end of file diff --git a/test/fuzztest/backupsastart_fuzzer/corpus/init b/test/fuzztest/backupsastart_fuzzer/corpus/init new file mode 100644 index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 --- /dev/null +++ b/test/fuzztest/backupsastart_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/backupsastart_fuzzer/project.xml b/test/fuzztest/backupsastart_fuzzer/project.xml new file mode 100644 index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa --- /dev/null +++ b/test/fuzztest/backupsastart_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp b/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp index 09767b6eea6e4e70c82ee571c0a0664e558534b8..8f9b3cb143ed5fb5dacfb7276a132ed59b5959c4 100644 --- a/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp +++ b/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp @@ -657,16 +657,19 @@ bool IncrementalRestoreOnProcessInfoFuzzTest(sptr service, const bool OnRemoteRequestFuzzTest(sptr service, const uint8_t *data, size_t size) { - uint32_t codeMax = 26; + uint32_t codeMax = 31; for (uint32_t code = 1; code < codeMax; code++) { MessageParcel datas; MessageParcel reply; MessageOption option; - datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor()); datas.WriteBuffer(reinterpret_cast(data), size); datas.RewindRead(0); - service->OnRemoteRequest(code, datas, reply, option); + try { + service->OnRemoteRequest(code, datas, reply, option); + } catch (BError &err) { + // Only filter BError errors, Other results are not expected. + } } { MessageParcel datas; @@ -697,7 +700,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) printf("service handler is nullptr"); return 0; } - + OHOS::OnRemoteRequestFuzzTest(incrementalRestoreService, data, size); OHOS::BackupOnFileReadyFuzzTest(backupService, data, size); OHOS::BackupOnBundleStartedFuzzTest(backupService, data, size); OHOS::BackupOnResultReportFuzzTest(backupService, data, size); @@ -730,7 +733,5 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) OHOS::IncrementalRestoreOnFileReadyFuzzTest(incrementalRestoreService, data, size); OHOS::IncrementalRestoreOnResultReportFuzzTest(incrementalRestoreService, data, size); OHOS::IncrementalRestoreOnProcessInfoFuzzTest(incrementalRestoreService, data, size); - OHOS::OnRemoteRequestFuzzTest(incrementalRestoreService, data, size); - return 0; } \ No newline at end of file