From 72302a9ccd7e1ef48043c7fd033bd1c3662d4d82 Mon Sep 17 00:00:00 2001 From: bailu1992 Date: Wed, 18 Jun 2025 22:20:39 +0800 Subject: [PATCH] Modification of fuzz test cases Signed-off-by: bailu1992 --- .../createdatachannelstub_fuzzer.cpp | 28 ++++++++++++++----- .../disableactiveinfocbstub_fuzzer.cpp | 2 +- .../enableactiveinfocbstub_fuzzer.cpp | 2 +- .../getactiveinfoliststub_fuzzer.cpp | 20 +++++++++---- .../getallsensorsstub_fuzzer.cpp | 15 +++++++--- .../getsensorlistbydevicestub_fuzzer.cpp | 2 +- .../resetsensorsstub_fuzzer.cpp | 3 +- .../resumesensorsstub_fuzzer.cpp | 11 ++++++-- .../sensordisablestub_fuzzer.cpp | 24 ++++++++-------- .../sensorenablestub_fuzzer.cpp | 28 ++++++++----------- .../sensoronremoterequest_fuzzer.cpp | 2 +- .../suspendsensorsstub_fuzzer.cpp | 11 ++++++-- .../transferclientremoteobjectstub_fuzzer.cpp | 26 +++++++++++++++-- 13 files changed, 117 insertions(+), 57 deletions(-) diff --git a/test/fuzztest/services/createdatachannelstub_fuzzer/createdatachannelstub_fuzzer.cpp b/test/fuzztest/services/createdatachannelstub_fuzzer/createdatachannelstub_fuzzer.cpp index 43bea080..488a87f9 100644 --- a/test/fuzztest/services/createdatachannelstub_fuzzer/createdatachannelstub_fuzzer.cpp +++ b/test/fuzztest/services/createdatachannelstub_fuzzer/createdatachannelstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; static sptr g_remote = new (std::nothrow) IPCObjectStub(); } // namespace @@ -82,12 +82,26 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_remote == nullptr || g_service == nullptr) { return false; } - int32_t clientFd = 0; - GetObject(clientFd, data, size); - g_service->CreateSocketChannel(g_remote, clientFd); - g_service->DestroySocketChannel(g_remote); - g_service->TransferDataChannel(clientFd, g_remote); - g_service->DestroySensorChannel(g_remote); + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); + int32_t fd = 0; + GetObject(fd, data, size); + datas.WriteFileDescriptor(fd); + datas.WriteRemoteObject(g_remote); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_TRANSFER_DATA_CHANNEL), + datas, reply, option); + datas.RewindRead(0); + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_DESTROY_SENSOR_CHANNEL), + datas, reply, option); + datas.RewindRead(0); + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_CREATE_SOCKET_CHANNEL), + datas, reply, option); + datas.RewindRead(0); + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_DESTROY_SOCKET_CHANNEL), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/disableactiveinfocbstub_fuzzer/disableactiveinfocbstub_fuzzer.cpp b/test/fuzztest/services/disableactiveinfocbstub_fuzzer/disableactiveinfocbstub_fuzzer.cpp index 249064fa..c91ab496 100644 --- a/test/fuzztest/services/disableactiveinfocbstub_fuzzer/disableactiveinfocbstub_fuzzer.cpp +++ b/test/fuzztest/services/disableactiveinfocbstub_fuzzer/disableactiveinfocbstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; } // namespace void SetUpTestCase() diff --git a/test/fuzztest/services/enableactiveinfocbstub_fuzzer/enableactiveinfocbstub_fuzzer.cpp b/test/fuzztest/services/enableactiveinfocbstub_fuzzer/enableactiveinfocbstub_fuzzer.cpp index 279510c5..bc6f23d2 100644 --- a/test/fuzztest/services/enableactiveinfocbstub_fuzzer/enableactiveinfocbstub_fuzzer.cpp +++ b/test/fuzztest/services/enableactiveinfocbstub_fuzzer/enableactiveinfocbstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService";; } // namespace void SetUpTestCase() diff --git a/test/fuzztest/services/getactiveinfoliststub_fuzzer/getactiveinfoliststub_fuzzer.cpp b/test/fuzztest/services/getactiveinfoliststub_fuzzer/getactiveinfoliststub_fuzzer.cpp index 8cb7bac2..5aa635ef 100644 --- a/test/fuzztest/services/getactiveinfoliststub_fuzzer/getactiveinfoliststub_fuzzer.cpp +++ b/test/fuzztest/services/getactiveinfoliststub_fuzzer/getactiveinfoliststub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService";; } // namespace template @@ -81,12 +81,22 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_service == nullptr) { return false; } - std::vector activeInfoList; + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); int32_t pid = 0; GetObject(pid, data, size); - g_service->GetActiveInfoList(pid, activeInfoList); - g_service->EnableActiveInfoCB(); - g_service->DisableActiveInfoCB(); + datas.WriteInt32(pid); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_GET_ACTIVE_INFO_LIST), + datas, reply, option); + datas.RewindRead(0); + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_ENABLE_ACTIVE_INFO_C_B), + datas, reply, option); + datas.RewindRead(0); + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_DISABLE_ACTIVE_INFO_C_B), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/getallsensorsstub_fuzzer/getallsensorsstub_fuzzer.cpp b/test/fuzztest/services/getallsensorsstub_fuzzer/getallsensorsstub_fuzzer.cpp index 9b1c351e..6ba66aee 100644 --- a/test/fuzztest/services/getallsensorsstub_fuzzer/getallsensorsstub_fuzzer.cpp +++ b/test/fuzztest/services/getallsensorsstub_fuzzer/getallsensorsstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService";; } // namespace template @@ -81,9 +81,16 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_service == nullptr) { return false; } - std::vector sensorList; - GetObject(sensorList[0], data, size); - g_service->GetSensorList(sensorList); + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); + int32_t pid = 0; + GetObject(pid, data, size); + datas.WriteInt32(pid); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_GET_SENSOR_LIST), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/getsensorlistbydevicestub_fuzzer/getsensorlistbydevicestub_fuzzer.cpp b/test/fuzztest/services/getsensorlistbydevicestub_fuzzer/getsensorlistbydevicestub_fuzzer.cpp index 77b68836..feefb630 100644 --- a/test/fuzztest/services/getsensorlistbydevicestub_fuzzer/getsensorlistbydevicestub_fuzzer.cpp +++ b/test/fuzztest/services/getsensorlistbydevicestub_fuzzer/getsensorlistbydevicestub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService";; } // namespace void SetUpTestCase() diff --git a/test/fuzztest/services/resetsensorsstub_fuzzer/resetsensorsstub_fuzzer.cpp b/test/fuzztest/services/resetsensorsstub_fuzzer/resetsensorsstub_fuzzer.cpp index 71ce1199..dd85c8c5 100644 --- a/test/fuzztest/services/resetsensorsstub_fuzzer/resetsensorsstub_fuzzer.cpp +++ b/test/fuzztest/services/resetsensorsstub_fuzzer/resetsensorsstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService";; } // namespace void SetUpTestCase() @@ -66,7 +66,6 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) SetUpTestCase(); MessageParcel datas; datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); - datas.WriteBuffer(data, size); datas.RewindRead(0); MessageParcel reply; MessageOption option; diff --git a/test/fuzztest/services/resumesensorsstub_fuzzer/resumesensorsstub_fuzzer.cpp b/test/fuzztest/services/resumesensorsstub_fuzzer/resumesensorsstub_fuzzer.cpp index 32ab0fd6..273deeb0 100644 --- a/test/fuzztest/services/resumesensorsstub_fuzzer/resumesensorsstub_fuzzer.cpp +++ b/test/fuzztest/services/resumesensorsstub_fuzzer/resumesensorsstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; } // namespace template @@ -81,9 +81,16 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_service == nullptr) { return false; } + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); int32_t pid = 0; GetObject(pid, data, size); - g_service->ResumeSensors(pid); + datas.WriteInt32(pid); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_RESUME_SENSORS), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/sensordisablestub_fuzzer/sensordisablestub_fuzzer.cpp b/test/fuzztest/services/sensordisablestub_fuzzer/sensordisablestub_fuzzer.cpp index b0175ad5..7541438e 100644 --- a/test/fuzztest/services/sensordisablestub_fuzzer/sensordisablestub_fuzzer.cpp +++ b/test/fuzztest/services/sensordisablestub_fuzzer/sensordisablestub_fuzzer.cpp @@ -34,8 +34,8 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; -} // namespace +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; +} template size_t GetObject(T &object, const uint8_t *data, size_t size) @@ -81,16 +81,16 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_service == nullptr) { return false; } - int32_t deviceId = 0; - GetObject(deviceId, data, size); - int32_t sensorId = 0; - GetObject(sensorId, data, size); - int32_t location = 0; - GetObject(location, data, size); - g_service->DisableSensor({deviceId, SENSOR_TYPE_ID_ACCELEROMETER, sensorId, location}); - int32_t sensorType = 0; - GetObject(sensorType, data, size); - g_service->DisableSensor({deviceId, sensorType, sensorId, location}); + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); + SensorDescriptionIPC sensorDesc; + GetObject(sensorDesc.deviceId, data, size); + datas.WriteParcelable(&sensorDesc); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_DISABLE_SENSOR), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/sensorenablestub_fuzzer/sensorenablestub_fuzzer.cpp b/test/fuzztest/services/sensorenablestub_fuzzer/sensorenablestub_fuzzer.cpp index c49539c2..f726c5cc 100644 --- a/test/fuzztest/services/sensorenablestub_fuzzer/sensorenablestub_fuzzer.cpp +++ b/test/fuzztest/services/sensorenablestub_fuzzer/sensorenablestub_fuzzer.cpp @@ -34,9 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; -int64_t g_samplingPeriod = 100000000; -int64_t g_maxReportDelay = 100000000; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; } // namespace template @@ -83,24 +81,22 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_service == nullptr) { return false; } + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); size_t startPos = 0; - int32_t deviceId = 0; - startPos += GetObject(deviceId, data + startPos, size - startPos); - int32_t sensorId = 0; - startPos += GetObject(sensorId, data + startPos, size - startPos); - int32_t location = 0; - startPos += GetObject(location, data + startPos, size - startPos); - g_service->EnableSensor({deviceId, SENSOR_TYPE_ID_ACCELEROMETER, sensorId, location}, - g_samplingPeriod, g_maxReportDelay); - g_service->ResetSensors(); - - int32_t sensorType = 0; - startPos += GetObject(sensorType, data + startPos, size - startPos); + SensorDescriptionIPC sensorDesc {-1, 1, 0, 1}; + datas.WriteParcelable(&sensorDesc); int64_t samplingPeriod = 0; startPos += GetObject(samplingPeriod, data + startPos, size - startPos); + datas.WriteInt64(samplingPeriod); int64_t maxReportDelay = 0; GetObject(maxReportDelay, data + startPos, size - startPos); - g_service->EnableSensor({deviceId, sensorType, sensorId, location}, samplingPeriod, maxReportDelay); + datas.WriteInt64(maxReportDelay); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_ENABLE_SENSOR), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/sensoronremoterequest_fuzzer/sensoronremoterequest_fuzzer.cpp b/test/fuzztest/services/sensoronremoterequest_fuzzer/sensoronremoterequest_fuzzer.cpp index 1c0a01ef..27f049b8 100644 --- a/test/fuzztest/services/sensoronremoterequest_fuzzer/sensoronremoterequest_fuzzer.cpp +++ b/test/fuzztest/services/sensoronremoterequest_fuzzer/sensoronremoterequest_fuzzer.cpp @@ -35,7 +35,7 @@ namespace { constexpr size_t U32_AT_SIZE = 4; constexpr uint32_t IPC_CODE_COUNT = 13; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; } // namespace void SetUpTestCase() diff --git a/test/fuzztest/services/suspendsensorsstub_fuzzer/suspendsensorsstub_fuzzer.cpp b/test/fuzztest/services/suspendsensorsstub_fuzzer/suspendsensorsstub_fuzzer.cpp index 3f5c276d..2f461639 100644 --- a/test/fuzztest/services/suspendsensorsstub_fuzzer/suspendsensorsstub_fuzzer.cpp +++ b/test/fuzztest/services/suspendsensorsstub_fuzzer/suspendsensorsstub_fuzzer.cpp @@ -34,7 +34,7 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; } // namespace template @@ -81,9 +81,16 @@ bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) if (g_service == nullptr) { return false; } + MessageParcel datas; + datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); int32_t pid = 0; GetObject(pid, data, size); - g_service->SuspendSensors(pid); + datas.WriteInt32(pid); + datas.RewindRead(0); + MessageParcel reply; + MessageOption option; + g_service->OnRemoteRequest(static_cast(ISensorServiceIpcCode::COMMAND_SUSPEND_SENSORS), + datas, reply, option); return true; } } // namespace Sensors diff --git a/test/fuzztest/services/transferclientremoteobjectstub_fuzzer/transferclientremoteobjectstub_fuzzer.cpp b/test/fuzztest/services/transferclientremoteobjectstub_fuzzer/transferclientremoteobjectstub_fuzzer.cpp index a680a43e..be05b43e 100644 --- a/test/fuzztest/services/transferclientremoteobjectstub_fuzzer/transferclientremoteobjectstub_fuzzer.cpp +++ b/test/fuzztest/services/transferclientremoteobjectstub_fuzzer/transferclientremoteobjectstub_fuzzer.cpp @@ -34,9 +34,24 @@ using Security::AccessToken::AccessTokenID; namespace { constexpr size_t U32_AT_SIZE = 4; auto g_service = SensorDelayedSpSingleton::GetInstance(); -const std::u16string SENSOR_INTERFACE_TOKEN = u"ISensorService"; +const std::u16string SENSOR_INTERFACE_TOKEN = u"OHOS.Sensors.ISensorService"; +static sptr g_remote = new (std::nothrow) IPCObjectStub(); } // namespace +template +size_t GetObject(T &object, const uint8_t *data, size_t size) +{ + size_t objectSize = sizeof(object); + if (objectSize > size) { + return 0; + } + errno_t ret = memcpy_s(&object, objectSize, data, objectSize); + if (ret != EOK) { + return 0; + } + return objectSize; +} + void SetUpTestCase() { const char **perms = new (std::nothrow) const char *[2]; @@ -64,10 +79,15 @@ void SetUpTestCase() bool OnRemoteRequestFuzzTest(const uint8_t *data, size_t size) { SetUpTestCase(); + if (g_remote == nullptr || g_service == nullptr) { + return false; + } MessageParcel datas; datas.WriteInterfaceToken(SENSOR_INTERFACE_TOKEN); - sptr sensorClient = nullptr; - datas.WriteRemoteObject(sensorClient); + datas.WriteRemoteObject(g_remote); + int32_t pid = 0; + GetObject(pid, data, size); + datas.WriteInt32(pid); datas.RewindRead(0); MessageParcel reply; MessageOption option; -- Gitee