From 8d0c07a67fe399b374ea921a6a9b78f3d9c4b0f2 Mon Sep 17 00:00:00 2001 From: y30045862 Date: Thu, 17 Aug 2023 21:36:23 +0800 Subject: [PATCH] =?UTF-8?q?UserFileService-FileAccessExtAbility-GetThumbna?= =?UTF-8?q?il=E7=94=A8=E4=BE=8B=20Signed-off-by:=20yangjingbo10=20?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Id6ef4d76d3e72665bbef0cee423d3dccf7b1e35f --- .../BUILD.gn | 69 ++++++++++ .../corpus/init | 16 +++ .../externalfileaccessgetthumbnail_fuzzer.cpp | 120 ++++++++++++++++++ .../externalfileaccessgetthumbnail_fuzzer.h | 21 +++ .../project.xml | 25 ++++ 5 files changed, 251 insertions(+) create mode 100644 test/fuzztest/externalfileaccessgetthumbnail_fuzzer/BUILD.gn create mode 100644 test/fuzztest/externalfileaccessgetthumbnail_fuzzer/corpus/init create mode 100644 test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.cpp create mode 100644 test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.h create mode 100644 test/fuzztest/externalfileaccessgetthumbnail_fuzzer/project.xml diff --git a/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/BUILD.gn b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/BUILD.gn new file mode 100644 index 00000000..488e4830 --- /dev/null +++ b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/BUILD.gn @@ -0,0 +1,69 @@ +# Copyright (c) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#####################hydra-fuzz################### +import("//build/config/features.gni") +import("//build/test.gni") +import("//foundation/filemanagement/user_file_service/filemanagement_aafwk.gni") +ohos_fuzztest("ExternalFileAccessGetThumbnailFuzzTest") { + module_out_path = "filemanagement/user_file_service" + fuzz_config_file = "${user_file_service_path}/test/fuzztest/externalfileaccessgetthumbnail_fuzzer" + include_dirs = [ + "${user_file_service_path}/utils", + "${ability_runtime_kits_path}/appkit/native/ability_runtime/app", + "${ability_runtime_kits_path}/appkit/native/app/include", + "${ability_runtime_kits_path}/appkit/native/ability_runtime/context", + "${user_file_service_path}/interfaces/inner_api/file_access/include", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "${user_file_service_path}/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.cpp" ] + + deps = [ + "${ability_runtime_path}/frameworks/native/ability/native:abilitykit_native", + "${ability_runtime_path}/frameworks/native/appkit:app_context", + "${access_token_path}/frameworks/accesstoken:accesstoken_communication_adapter_cxx", + "${user_file_service_path}/interfaces/inner_api/file_access:file_access_extension_ability_kit", + ] + + external_deps = [ + "ability_base:want", + "ability_base:zuri", + "ability_runtime:ability_manager", + "ability_runtime:app_context", + "ability_runtime:extensionkit_native", + "ability_runtime:napi_common", + "ability_runtime:runtime", + "access_token:libaccesstoken_sdk", + "access_token:libnativetoken", + "access_token:libtoken_setproc", + "bundle_framework:appexecfwk_base", + "bundle_framework:appexecfwk_core", + "c_utils:utils", + "hilog:libhilog", + "hitrace:hitrace_meter", + "image_framework:image_native", + "ipc:ipc_core", + "napi:ace_napi", + "samgr:samgr_proxy", + ] +} + +group("fuzztest") { + testonly = true + deps = [ ":ExternalFileAccessGetThumbnailFuzzTest" ] +} diff --git a/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/corpus/init b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/corpus/init new file mode 100644 index 00000000..2b595da0 --- /dev/null +++ b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/corpus/init @@ -0,0 +1,16 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.cpp b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.cpp new file mode 100644 index 00000000..4eb68cb3 --- /dev/null +++ b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.cpp @@ -0,0 +1,120 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include "externalfileaccessgetthumbnail_fuzzer.h" + +#include +#include +#include +#include + +#include "extension_base.h" +#include "extension_context.h" +#include "message_parcel.h" +#include "file_access_ext_stub.h" +#include "file_access_ext_stub_impl.h" +#include "file_access_ext_ability.h" +#include "js_file_access_ext_ability.h" +#include "js_runtime.h" +#include "securec.h" +#include "nativetoken_kit.h" +#include "token_setproc.h" +#include "accesstoken_kit.h" + +namespace OHOS { +using namespace std; +using namespace OHOS; +using namespace FileAccessFwk; +using namespace AbilityRuntime; +constexpr size_t FOO_MAX_LEN = 1024; +constexpr size_t U32_AT_SIZE = 4; + + +enum { + TOKEN_INDEX_ONE = 0, +}; + +void SetNativeToken() +{ + uint64_t tokenId; + const char **perms = new const char *[1]; + perms[TOKEN_INDEX_ONE] = "ohos.permission.FILE_ACCESS_MANAGER"; + NativeTokenInfoParams infoInstance = { + .dcapsNum = 0, + .permsNum = 1, + .aclsNum = 0, + .dcaps = nullptr, + .perms = perms, + .acls = nullptr, + .aplStr = "system_core", + }; + + infoInstance.processName = "ExternalFileAccessGetThumbnailFuzzTest"; + tokenId = GetAccessTokenId(&infoInstance); + const uint64_t systemAppMask = (static_cast(1) << 32); + tokenId |= systemAppMask; + SetSelfTokenID(tokenId); + OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo(); + delete[] perms; +} + +bool ExternalFileAccessGetThumbnailFuzzTest(std::unique_ptr data, size_t size) +{ + SetNativeToken(); + // CMD_GET_THUMBNAIL + uint32_t code = 15; + MessageParcel datas; + datas.WriteInterfaceToken(FileAccessExtStub::GetDescriptor()); + datas.WriteBuffer(data.get(), size); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + + auto fileAccessExtAbility = FileAccessExtAbility::Create(nullptr); + auto fileAccessExtAbilitySharePtr = std::shared_ptr(fileAccessExtAbility); + + sptr fileAccessExtStubObj(new (std::nothrow) FileAccessExtStubImpl( + fileAccessExtAbilitySharePtr, nullptr)); + + fileAccessExtStubObj->OnRemoteRequest(code, datas, reply, option); + + fileAccessExtAbility = nullptr; + fileAccessExtStubObj = nullptr; + + return true; +} +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + /* Run your code on data */ + if (data == nullptr) { + return 0; + } + + /* Validate the length of size */ + if (size < OHOS::U32_AT_SIZE || size > OHOS::FOO_MAX_LEN) { + return 0; + } + + auto str = std::make_unique(size + 1); + (void)memset_s(str.get(), size + 1, 0x00, size + 1); + if (memcpy_s(str.get(), size, data, size) != EOK) { + return 0; + } + + OHOS::ExternalFileAccessGetThumbnailFuzzTest(move(str), size); + return 0; +} diff --git a/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.h b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.h new file mode 100644 index 00000000..eae80c7a --- /dev/null +++ b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/externalfileaccessgetthumbnail_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef FILE_ACCESS_EXTERNAL_FILE_ACCESS_GET_THUMBNAIL_FUZZER_H +#define FILE_ACCESS_EXTERNAL_FILE_ACCESS_GET_THUMBNAIL_FUZZER_H + +#define FUZZ_PROJECT_NAME "externalfileaccessgetthumbnail_fuzzer" + +#endif \ No newline at end of file diff --git a/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/project.xml b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/project.xml new file mode 100644 index 00000000..2bb0dbd7 --- /dev/null +++ b/test/fuzztest/externalfileaccessgetthumbnail_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + -- Gitee