Star2
116
代码
代码
Issues46
Pull Requests22
项目讨论
Wiki
分析
Star2
116
已关闭
mcmotionmanager fuzz #221
W_Qiye创建于 5月19日关闭于 5月28日
mcmotionmanager fuzz #221
已关闭
W_Qiye创建于 5月19日关闭于 5月28日
从已删除 :master合入到openharmony/distributedhardware_mechbody_controllermaster
共 105 个文件变更+7290-829
Mservices/include/transport/mc_send_adapter.h+1-1
@@ -34,7 +34,7 @@ class TransportSendAdapter : public std::enable_shared_from_this<TransportSendAd
34public:34public:
35 explicit TransportSendAdapter();35 explicit TransportSendAdapter();
36 virtual ~TransportSendAdapter();36 virtual ~TransportSendAdapter();
37- int32_t SendCommand(const std::shared_ptr<CommandBase> &cmd, int32_t delayMs = 0);37+ virtual int32_t SendCommand(const std::shared_ptr<CommandBase> &cmd, int32_t delayMs = 0);
38 bool DiscardExpiredData(const std::shared_ptr<CommandBase> &cmd);38 bool DiscardExpiredData(const std::shared_ptr<CommandBase> &cmd);
39 int32_t RegisterBluetoothListener();39 int32_t RegisterBluetoothListener();
40 int32_t UnRegisterBluetoothListener();40 int32_t UnRegisterBluetoothListener();
Mtest/fuzztest/BUILD.gn+20-0
@@ -62,5 +62,25 @@ group("fuzztest") {
62 "//foundation/distributedhardware/mechbody_controller/test/fuzztest/resourcemanagerutils_fuzzer:ResourcemanagerutilsFuzzTest",62 "//foundation/distributedhardware/mechbody_controller/test/fuzztest/resourcemanagerutils_fuzzer:ResourcemanagerutilsFuzzTest",
63 "//foundation/distributedhardware/mechbody_controller/test/fuzztest/subscribeeventutils_fuzzer:SubscribeeventutilsFuzzTest",63 "//foundation/distributedhardware/mechbody_controller/test/fuzztest/subscribeeventutils_fuzzer:SubscribeeventutilsFuzzTest",
64 "//foundation/distributedhardware/mechbody_controller/test/fuzztest/normalgetmechcapabilityinfocmd_fuzzer:NormalGetMechCapabilityInfoCmdFuzzTest",64 "//foundation/distributedhardware/mechbody_controller/test/fuzztest/normalgetmechcapabilityinfocmd_fuzzer:NormalGetMechCapabilityInfoCmdFuzzTest",
65+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerone_fuzzer:McMotionManagerOneFuzzTest",
66+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagertwo_fuzzer:McMotionManagerTwoFuzzTest",
67+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerthree_fuzzer:McMotionManagerThreeFuzzTest",
68+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerfour_fuzzer:McMotionManagerFourFuzzTest",
69+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerfive_fuzzer:McMotionManagerFiveFuzzTest",
70+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagersix_fuzzer:McMotionManagerSixFuzzTest",
71+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerseven_fuzzer:McMotionManagerSevenFuzzTest",
72+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagereight_fuzzer:McMotionManagerEightFuzzTest",
73+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagernine_fuzzer:McMotionManagerNineFuzzTest",
74+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerten_fuzzer:McMotionManagerTenFuzzTest",
75+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagereleven_fuzzer:McMotionManagerElevenFuzzTest",
76+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagertwelve_fuzzer:McMotionManagerTwelveFuzzTest",
77+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerthirteen_fuzzer:McMotionManagerThirteenFuzzTest",
78+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerfourteen_fuzzer:McMotionManagerFourteenFuzzTest",
79+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerfifteen_fuzzer:McMotionManagerFifteenFuzzTest",
80+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagersixteen_fuzzer:McMotionManagerSixteenFuzzTest",
81+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagerseventeen_fuzzer:McMotionManagerSeventeenFuzzTest",
82+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagereighteen_fuzzer:McMotionManagerEighteenFuzzTest",
83+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagernineteen_fuzzer:McMotionManagerNineteenFuzzTest",
84+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/mcmotionmanagertwenty_fuzzer:McMotionManagerTwentyFuzzTest",
65 ]85 ]
66}86}
Atest/fuzztest/common/mock_transport_send_adapter.h+172-0
@@ -0,0 +1,172 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MOCK_TRANSPORT_SEND_ADAPTER_H
17+#define MOCK_TRANSPORT_SEND_ADAPTER_H
18+ 
19+#include "mc_send_adapter.h"
20+#include "mc_get_mech_protocol_ver_cmd.h"
21+#include "mc_normal_get_mech_base_info_cmd.h"
22+#include "mc_normal_get_mech_capability_info_cmd.h"
23+#include "mc_get_mech_limit_info_cmd.h"
24+#include "mc_normal_set_mech_protocol_ver_cmd.h"
25+#include "mc_data_buffer.h"
26+#include <memory>
27+#include <thread>
28+#include <chrono>
29+#include "mechbody_controller_log.h"
30+ 
31+namespace OHOS {
32+namespace MechBodyController {
33+const std::string TAG = "MockTransportSendAdapter";
34+class MockTransportSendAdapter : public TransportSendAdapter {
35+public:
36+ MockTransportSendAdapter() = default;
37+ ~MockTransportSendAdapter() override = default;
38+
39+ int32_t SendCommand(const std::shared_ptr<CommandBase> &command, int32_t delay = 0) override
40+ {
41+ HILOGI("MockTransportSendAdapter SendCommand start");
42+ if (command == nullptr) {
43+ return -1;
44+ }
45+
46+ std::thread([this, command, delay]() {
47+ if (delay > 0) {
48+ std::this_thread::sleep_for(std::chrono::milliseconds(delay));
49+ }
50+ SimulateResponse(command);
51+ }).detach();
52+
53+ return 0;
54+ }
55+
56+private:
57+ static constexpr uint16_t CMD_TYPE_GET_PROTOCOL_VER = 0x202;
58+ static constexpr uint16_t CMD_TYPE_GET_BASE_INFO = 0x101;
59+ static constexpr uint16_t CMD_TYPE_GET_CAPABILITY = 0x302;
60+ static constexpr uint16_t CMD_TYPE_GET_LIMIT_INFO = 0x305;
61+ static constexpr uint16_t CMD_TYPE_SET_PROTOCOL_VER = 0x102;
62+
63+ static constexpr int32_t BUFFER_SIZE_PROTOCOL_VER = 5;
64+ static constexpr int32_t BUFFER_SIZE_BASE_INFO = 35;
65+ static constexpr int32_t BUFFER_SIZE_CAPABILITY = 3;
66+ static constexpr int32_t BUFFER_SIZE_LIMIT_INFO = 26;
67+ static constexpr int32_t BUFFER_SIZE_SET_PROTOCOL = 3;
68+ static constexpr int32_t BASE_INFO_NAME_LENGTH = 32;
69+
70+ static constexpr uint8_t STATUS_SUCCESS = 0x01;
71+ static constexpr uint8_t STATUS_BUSY = 0x02;
72+
73+ void SimulateResponse(const std::shared_ptr<CommandBase> &command)
74+ {
75+ HILOGI("SimulateResponse start");
76+ auto cmdType = command->GetCmdType();
77+ HILOGI("SimulateResponse cmdType: 0x%{public}x", cmdType);
78+
79+ switch (cmdType) {
80+ case CMD_TYPE_GET_PROTOCOL_VER:
81+ HandleGetProtocolVerCommand(command);
82+ break;
83+ case CMD_TYPE_GET_BASE_INFO:
84+ HandleGetBaseInfoCommand(command);
85+ break;
86+ case CMD_TYPE_GET_CAPABILITY:
87+ HandleGetCapabilityCommand(command);
88+ break;
89+ case CMD_TYPE_GET_LIMIT_INFO:
90+ HandleGetLimitInfoCommand(command);
91+ break;
92+ case CMD_TYPE_SET_PROTOCOL_VER:
93+ HandleSetProtocolVerCommand(command);
94+ break;
95+ default:
96+ break;
97+ }
98+ }
99+
100+ void HandleGetProtocolVerCommand(const std::shared_ptr<CommandBase> &command)
101+ {
102+ auto protocolVerCmd = std::static_pointer_cast<GetMechProtocolVerCmd>(command);
103+ auto responseData = std::make_shared<MechDataBuffer>(BUFFER_SIZE_PROTOCOL_VER);
104+ if (responseData != nullptr) {
105+ responseData->AppendUint8(STATUS_BUSY);
106+ responseData->AppendUint8(0x02);
107+ responseData->AppendUint8(0x00);
108+ responseData->AppendUint8(0x00);
109+ responseData->AppendUint8(0x02);
110+ protocolVerCmd->TriggerResponse(responseData);
111+ }
112+ }
113+
114+ void HandleGetBaseInfoCommand(const std::shared_ptr<CommandBase> &command)
115+ {
116+ auto baseInfoCmd = std::static_pointer_cast<NormalGetMechBaseInfoCmd>(command);
117+ auto responseData = std::make_shared<MechDataBuffer>(BUFFER_SIZE_BASE_INFO);
118+ if (responseData != nullptr) {
119+ responseData->AppendUint8(STATUS_SUCCESS);
120+ responseData->AppendUint8(0x01);
121+ responseData->AppendUint8(0x02);
122+ for (int i = 0; i < BASE_INFO_NAME_LENGTH; i++) {
123+ responseData->AppendUint8(0x00);
124+ }
125+ baseInfoCmd->TriggerResponse(responseData);
126+ }
127+ }
128+
129+ void HandleGetCapabilityCommand(const std::shared_ptr<CommandBase> &command)
130+ {
131+ auto capabilityCmd = std::static_pointer_cast<NormalGetMechCapabilityInfoCmd>(command);
132+ auto responseData = std::make_shared<MechDataBuffer>(BUFFER_SIZE_CAPABILITY);
133+ if (responseData != nullptr) {
134+ responseData->AppendUint8(STATUS_BUSY);
135+ responseData->AppendUint8(0x00);
136+ responseData->AppendUint8(0x01);
137+ capabilityCmd->TriggerResponse(responseData);
138+ }
139+ }
140+
141+ void HandleGetLimitInfoCommand(const std::shared_ptr<CommandBase> &command)
142+ {
143+ auto limitCmd = std::static_pointer_cast<GetMechLimitInfoCmd>(command);
144+ auto responseData = std::make_shared<MechDataBuffer>(BUFFER_SIZE_LIMIT_INFO);
145+ if (responseData != nullptr) {
146+ responseData->AppendFloat(3.14f);
147+ responseData->AppendFloat(0.0f);
148+ responseData->AppendFloat(1.57f);
149+ responseData->AppendFloat(-3.14f);
150+ responseData->AppendFloat(0.0f);
151+ responseData->AppendFloat(-1.57f);
152+ limitCmd->TriggerResponse(responseData);
153+ }
154+ }
155+
156+ void HandleSetProtocolVerCommand(const std::shared_ptr<CommandBase> &command)
157+ {
158+ auto setProtocolCmd = std::static_pointer_cast<NormalSetMechProtocolVerCmd>(command);
159+ auto responseData = std::make_shared<MechDataBuffer>(BUFFER_SIZE_SET_PROTOCOL);
160+ if (responseData != nullptr) {
161+ responseData->AppendUint8(STATUS_SUCCESS);
162+ responseData->AppendUint8(0x02);
163+ responseData->AppendUint8(0x02);
164+ setProtocolCmd->TriggerResponse(responseData);
165+ }
166+ }
167+};
168+ 
169+} // namespace MechBodyController
170+} // namespace OHOS
171+ 
172+#endif // MOCK_TRANSPORT_SEND_ADAPTER_H
Dtest/fuzztest/mcmotionmanager_fuzzer/BUILD.gn+0-157
@@ -1,157 +0,0 @@
1-# Copyright (c) 2025 Huawei Device Co., Ltd.
2-# Licensed under the Apache License, Version 2.0 (the "License");
3-# you may not use this file except in compliance with the License.
4-# You may obtain a copy of the License at
5-#
6-# http://www.apache.org/licenses/LICENSE-2.0
7-#
8-# Unless required by applicable law or agreed to in writing, software
9-# distributed under the License is distributed on an "AS IS" BASIS,
10-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11-# See the License for the specific language governing permissions and
12-# limitations under the License.
13- 
14-import("//build/config/features.gni")
15-import("//build/ohos.gni")
16-import("//build/test.gni")
17-import(
18- "//foundation/distributedhardware/mechbody_controller/mechbody.gni")
19- 
20-ohos_fuzztest("McMotionManagerFuzzTest") {
21- module_out_path = "mechbody_controller/mechbody_controller/"
22- mechbody_path =
23- "//foundation/distributedhardware/mechbody_controller"
24- fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanager_fuzzer"
25- include_dirs = [
26- "${mechbody_path}/services/include",
27- "${mechbody_path}/services/include/dotReport",
28- "${mechbody_path}/services/include/connect",
29- "${mechbody_path}/services/include/controller",
30- "${mechbody_path}/services/include/motion",
31- "${mechbody_path}/services/include/transport",
32- "${mechbody_path}/services/include/transport/command",
33- "${mechbody_path}/services/include/transport/command/0x01",
34- "${mechbody_path}/services/include/transport/command/0x02",
35- "${mechbody_path}/services/include/transport/command/0x03",
36- "${mechbody_path}/interface/napi/mech_manager",
37- "${mechbody_path}/services/include/utils",
38- ]
39- cflags = [
40- "-g",
41- "-O0",
42- "-Wno-unused-variable",
43- "-fno-omit-frame-pointer",
44- ]
45- sources = [
46- "${mechbody_path}/services/src/connect/bluetooth_state_adapter.cpp",
47- "${mechbody_path}/services/src/connect/bluetooth_state_listener.cpp",
48- "${mechbody_path}/services/src/connect/mc_connect_manager.cpp",
49- "${mechbody_path}/services/src/controller/mc_camera_tracking_controller.cpp",
50- "${mechbody_path}/services/src/controller/mc_controller_ipc_death_listener.cpp",
51- "${mechbody_path}/services/src/controller/mc_controller_manager.cpp",
52- "${mechbody_path}/services/src/transport/mc_send_adapter.cpp",
53- "${mechbody_path}/services/src/mechbody_controller_service.cpp",
54- "${mechbody_path}/services/src/mechbody_controller_stub.cpp",
55- "${mechbody_path}/services/src/mechbody_controller_utils.cpp",
56- "${mechbody_path}/services/src/motion/mc_motion_manager.cpp",
57- "${mechbody_path}/services/src/transport/command/mc_command_base.cpp",
58- "${mechbody_path}/services/src/transport/command/mc_command_factory.cpp",
59- "${mechbody_path}/services/src/transport/command/mc_get_mech_protocol_ver_cmd.cpp",
60- "${mechbody_path}/services/src/transport/command/mc_set_mech_disconnect_cmd.cpp",
61- "${mechbody_path}/services/src/transport/mc_data_buffer.cpp",
62- "${mechbody_path}/services/src/transport/mc_protocol_convertor.cpp",
63- "${mechbody_path}/services/src/transport/mc_subscription_center.cpp",
64- "${mechbody_path}/services/src/ble_send_manager.cpp",
65- "${mechbody_path}/services/src/utils/load_mechbody_adapter.cpp",
66- "${mechbody_path}/services/src/dotReport/hisysevent_utils.cpp",
67- "${mechbody_path}/services/src/utils/subscribe_event_utils.cpp",
68- "${mechbody_path}/services/src/transport/command/0x01/mc_action_gimbal_feature_control_cmd.cpp",
69- "${mechbody_path}/services/src/transport/command/0x01/mc_get_mech_camera_tracking_layout_cmd.cpp",
70- "${mechbody_path}/services/src/transport/command/0x01/mc_get_mech_limit_info_cmd.cpp",
71- "${mechbody_path}/services/src/transport/command/0x01/mc_get_mech_real_name_cmd.cpp",
72- "${mechbody_path}/services/src/transport/command/0x01/mc_register_mech_camera_key_event_cmd.cpp",
73- "${mechbody_path}/services/src/transport/command/0x01/mc_register_mech_control_result_cmd.cpp",
74- "${mechbody_path}/services/src/transport/command/0x01/mc_register_mech_position_info_cmd.cpp",
75- "${mechbody_path}/services/src/transport/command/0x01/mc_register_mech_state_info_cmd.cpp",
76- "${mechbody_path}/services/src/transport/command/0x01/mc_register_mech_tracking_enable_cmd.cpp",
77- "${mechbody_path}/services/src/transport/command/0x01/mc_register_mech_wheel_data_cmd.cpp",
78- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_camera_info_cmd.cpp",
79- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_camera_tracking_enable_cmd.cpp",
80- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_camera_tracking_frame_cmd.cpp",
81- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_camera_tracking_layout_cmd.cpp",
82- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_config_cmd.cpp",
83- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_hid_preemptive_cmd.cpp",
84- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_rotation_by_speed_cmd.cpp",
85- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_rotation_cmd.cpp",
86- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_rotation_trace_cmd.cpp",
87- "${mechbody_path}/services/src/transport/command/0x01/mc_set_mech_stop_cmd.cpp",
88- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_get_mech_base_info_cmd.cpp",
89- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_get_mech_capability_info_cmd.cpp",
90- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_get_mech_coordinate_info_cmd.cpp",
91- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_get_mech_limit_info_cmd.cpp",
92- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_get_mech_pose_info_cmd.cpp",
93- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_get_mech_state_info_cmd.cpp",
94- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_register_mech_generic_event_cmd.cpp",
95- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_register_mech_key_event_cmd.cpp",
96- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_register_mech_position_info_cmd.cpp",
97- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_register_mech_state_info_cmd.cpp",
98- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_register_mech_tracking_enable_cmd.cpp",
99- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_camera_info_cmd.cpp",
100- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_camera_tracking_enable_cmd.cpp",
101- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_camera_tracking_frame_cmd.cpp",
102- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_location_report_cmd.cpp",
103- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_motion_control_cmd.cpp",
104- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_rotation_by_speed_cmd.cpp",
105- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_rotation_to_location_cmd.cpp",
106- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_protocol_ver_cmd.cpp",
107- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_rotation_trace_cmd.cpp",
108- "${mechbody_path}/services/src/transport/command/0x02/mc_normal_set_mech_phone_status_cmd.cpp",
109- "${mechbody_path}/services/src/transport/command/0x03/mc_wheel_get_mech_capability_info_cmd.cpp",
110- "${mechbody_path}/services/src/transport/command/0x03/mc_wheel_set_mech_rotation_to_base_cmd.cpp",
111- "${mechbody_path}/services/src/transport/command/0x03/mc_wheel_set_mech_rotation_trace_cmd.cpp",
112- "${mechbody_path}/services/src/transport/command/0x03/mc_wheel_set_mech_motion_control_cmd.cpp",
113- "${mechbody_path}/services/src/transport/command/0x03/mc_wheel_set_mech_scene_control_cmd.cpp",
114- "${mechbody_path}/services/src/transport/command/0x03/mc_wheel_set_mech_relative_position_cmd.cpp",
115- "${mechbody_path}/services/src/transport/command/0x03/mc_register_mech_cliff_info_cmd.cpp",
116- "${mechbody_path}/services/src/transport/command/0x03/mc_register_mech_obstacle_info_cmd.cpp",
117- "${mechbody_path}/test/fuzztest/mcmotionmanager_fuzzer/mcmotionmanager_fuzzer.cpp",
118- ]
119- 
120- deps = [ "${mechbody_path}/services:mechbody_service" ]
121- 
122- external_deps = [
123- "access_token:libaccesstoken_sdk",
124- "access_token:libnativetoken",
125- "access_token:libtokenid_sdk",
126- "access_token:libtoken_setproc",
127- "bluetooth:btframework",
128- "bluetooth:btcommon",
129- "camera_framework:camera_framework",
130- "drivers_interface_camera:metadata",
131- "cJSON:cjson_static",
132- "c_utils:utils",
133- "eventhandler:libeventhandler",
134- "graphic_surface:surface",
135- "hilog:libhilog",
136- "init:libbegetutil",
137- "input:libmmi-client",
138- "input:oh_input_manager",
139- "ipc:ipc_single",
140- "os_account:libaccountkits",
141- "os_account:os_account_innerkits",
142- "safwk:system_ability_fwk",
143- "samgr:samgr_proxy",
144- "sensor:sensor_interface_native",
145- "window_manager:libdm_lite",
146- "hisysevent:libhisysevent",
147- "distributed_notification_service:ans_innerkits",
148- "resource_management:global_resmgr",
149- "ability_runtime:ability_manager",
150- "ability_runtime:app_manager",
151- ]
152-}
153- 
154-group("fuzztest") {
155- testonly = true
156- deps = [ ":McMotionManagerFuzzTest" ]
157-}
Dtest/fuzztest/mcmotionmanager_fuzzer/mcmotionmanager_fuzzer.cpp+0-665
@@ -1,665 +0,0 @@
1-/*
2- * Copyright (c) 2025 Huawei Device Co., Ltd.
3- * Licensed under the Apache License, Version 2.0 (the "License");
4- * you may not use this file except in compliance with the License.
5- * You may obtain a copy of the License at
6- *
7- * http://www.apache.org/licenses/LICENSE-2.0
8- *
9- * Unless required by applicable law or agreed to in writing, software
10- * distributed under the License is distributed on an "AS IS" BASIS,
11- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12- * See the License for the specific language governing permissions and
13- * limitations under the License.
14- */
15- 
16-#include <fuzzer/FuzzedDataProvider.h>
17-#include "mcmotionmanager_fuzzer.h"
18-#include "mc_motion_manager.h"
19-#include "mc_connect_manager.h"
20-#include "mechbody_controller_types.h"
21-#include "mechbody_controller_enums.h"
22-#include "mc_send_adapter.h"
23-#include "mc_command_factory.h"
24-#include "mc_register_mech_position_info_cmd.h"
25-#include "mc_register_mech_camera_key_event_cmd.h"
26-#include "mc_register_mech_state_info_cmd.h"
27-#include "mc_normal_register_mech_generic_event_cmd.h"
28-#include "mc_register_mech_cliff_info_cmd.h"
29-#include "mc_register_mech_obstacle_info_cmd.h"
30-#include "mc_register_mech_control_result_cmd.h"
31-#include "mc_register_mech_wheel_data_cmd.h"
32-#include "mc_register_mech_tracking_enable_cmd.h"
33-#include <memory>
34-#include <map>
35- 
36-namespace {
37-constexpr int32_t TEST_MECH_ID = 1;
38-constexpr uint32_t OPT_SIZE = 80;
39- 
40-constexpr uint8_t FUZZ_TEST_GET_SPEED_CONTROL_TIME_LIMIT = 0;
41-constexpr uint8_t FUZZ_TEST_GET_ROTATE_SPEED_LIMIT = 1;
42-constexpr uint8_t FUZZ_TEST_GET_CURRENT_POSITION = 2;
43-constexpr uint8_t FUZZ_TEST_GET_ROTATION_LIMIT = 3;
44-constexpr uint8_t FUZZ_TEST_SET_MECH_CAMERA_TRACKING_ENABLED = 4;
45-constexpr uint8_t FUZZ_TEST_GET_MECH_CAMERA_TRACKING_ENABLED = 5;
46-constexpr uint8_t FUZZ_TEST_SET_MECH_CAMERA_TRACKING_LAYOUT = 6;
47-constexpr uint8_t FUZZ_TEST_GET_MECH_CAMERA_TRACKING_LAYOUT = 7;
48-constexpr uint8_t FUZZ_TEST_GET_MECH_BASE_INFO = 8;
49-constexpr uint8_t FUZZ_TEST_GET_MECH_CAPABILITY_INFO = 9;
50-constexpr uint8_t FUZZ_TEST_GET_ROTATION_AXES_STATUS = 10;
51-constexpr uint8_t FUZZ_TEST_IS_SUPPORT_ACTION = 11;
52-constexpr uint8_t FUZZ_TEST_ROTATE = 12;
53-constexpr uint8_t FUZZ_TEST_ROTATE_BY_SPEED = 13;
54-constexpr uint8_t FUZZ_TEST_STOP_ROTATE = 14;
55-constexpr uint8_t FUZZ_TEST_MOVE = 15;
56-constexpr uint8_t FUZZ_TEST_MOVE_BY_SPEED = 16;
57-constexpr uint8_t FUZZ_TEST_TURN_BY_SPEED = 17;
58-constexpr uint8_t FUZZ_TEST_DO_ACTION = 18;
59-constexpr uint8_t FUZZ_TEST_SET_MECH_CAMERA_TRACKING_FRAME = 19;
60-constexpr uint8_t FUZZ_TEST_SET_MECH_CAMERA_INFO = 20;
61-constexpr uint8_t FUZZ_TEST_SET_MECH_SCREEN_INFO = 21;
62-constexpr uint8_t FUZZ_TEST_PERFORM_PRESET_ACTION = 22;
63-constexpr uint8_t FUZZ_TEST_ACTION_GIMBAL_FEATURE_CONTROL = 23;
64-constexpr uint8_t FUZZ_TEST_GET_DEVICE_REAL_NAME = 24;
65-constexpr uint8_t FUZZ_TEST_CONVERT_MOVE_PARAMS_TO_ROTATE_PARAMS = 25;
66-constexpr uint8_t FUZZ_TEST_CONVERT_SPEED_PARAMS_TO_ROTATE_PARAMS = 26;
67-constexpr uint8_t FUZZ_TEST_CHECK_WHEEL_SPEED_LIMIT = 27;
68-constexpr uint8_t FUZZ_TEST_MECH_ATTITUDE_NOTIFY = 28;
69-constexpr uint8_t FUZZ_TEST_MECH_BUTTON_EVENT_NOTIFY = 29;
70-constexpr uint8_t FUZZ_TEST_MECH_PARAM_NOTIFY = 30;
71-constexpr uint8_t FUZZ_TEST_MECH_GENERIC_EVENT_NOTIFY = 31;
72-constexpr uint8_t FUZZ_TEST_MECH_CLIFF_INFO_NOTIFY = 32;
73-constexpr uint8_t FUZZ_TEST_MECH_OBSTACLE_INFO_NOTIFY = 33;
74-constexpr uint8_t FUZZ_TEST_MECH_EXECUTION_RESULT_NOTIFY = 34;
75-constexpr uint8_t FUZZ_TEST_MECH_WHEEL_ZOOM_NOTIFY = 35;
76-constexpr uint8_t FUZZ_TEST_MECH_TRACKING_STATUS_NOTIFY = 36;
77-constexpr uint8_t FUZZ_TEST_ROTATE_WITH_EXTREME_VALUES = 37;
78-constexpr uint8_t FUZZ_TEST_MOVE_WITH_ZERO_PARAMS = 38;
79-constexpr uint8_t FUZZ_TEST_MOVE_BY_SPEED_WITH_ZERO_PARAMS = 39;
80-constexpr uint8_t FUZZ_TEST_ROTATE_BY_SPEED_WITH_ZERO_DURATION = 40;
81-constexpr uint8_t FUZZ_TEST_TURN_BY_SPEED_WITH_ZERO_DURATION = 41;
82-constexpr uint8_t FUZZ_TEST_COUNT = 42;
83-}
84- 
85-using namespace OHOS;
86-using namespace OHOS::MechBodyController;
87- 
88-namespace {
89- 
90-class MockTransportSendAdapter : public TransportSendAdapter {
91-public:
92- MockTransportSendAdapter() = default;
93- ~MockTransportSendAdapter() override = default;
94- int32_t SendCommand(const std::shared_ptr<CommandBase> &command, int32_t delay = 0)
95- {
96- return 0;
97- }
98-};
99- 
100-std::shared_ptr<MotionManager> g_motionManager = nullptr;
101-std::shared_ptr<MockTransportSendAdapter> g_mockAdapter = nullptr;
102- 
103-void InitMotionManager()
104-{
105- if (g_motionManager == nullptr) {
106- g_mockAdapter = std::make_shared<MockTransportSendAdapter>();
107- g_motionManager = std::make_shared<MotionManager>(g_mockAdapter, TEST_MECH_ID, false, 0x00000000);
108- 
109- // 添加测试设备信息并设置为已连接状态，以便测试需要 ATTACHED 状态的函数
110- MechInfo testMech;
111- testMech.mechId = TEST_MECH_ID;
112- testMech.mechType = MechType::PORTABLE_GIMBAL;
113- testMech.mac = "AA:BB:CC:DD:EE:FF";
114- testMech.state = AttachmentState::ATTACHED;
115- testMech.deviceIdentifier = 0x00000000;
116- MechConnectManager::GetInstance().AddMechInfo(testMech);
117- MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
118- }
119-}
120- 
121-void FuzzGetSpeedControlTimeLimit(const uint8_t *data, size_t size)
122-{
123- FuzzedDataProvider provider(data, size);
124- InitMotionManager();
125- bool shouldPassNull = provider.ConsumeBool();
126- std::shared_ptr<TimeLimit> timeLimit = nullptr;
127- if (!shouldPassNull) {
128- timeLimit = std::make_shared<TimeLimit>();
129- }
130- g_motionManager->GetSpeedControlTimeLimit(timeLimit);
131-}
132- 
133-void FuzzGetRotateSpeedLimit(const uint8_t *data, size_t size)
134-{
135- FuzzedDataProvider provider(data, size);
136- InitMotionManager();
137- RotateSpeedLimit speedLimit;
138- g_motionManager->GetRotateSpeedLimit(speedLimit);
139-}
140- 
141-void FuzzGetCurrentPosition(const uint8_t *data, size_t size)
142-{
143- FuzzedDataProvider provider(data, size);
144- InitMotionManager();
145- bool shouldPassNull = provider.ConsumeBool();
146- std::shared_ptr<EulerAngles> eulerAngles = nullptr;
147- if (!shouldPassNull) {
148- eulerAngles = std::make_shared<EulerAngles>();
149- }
150- g_motionManager->GetCurrentPosition(eulerAngles);
151-}
152- 
153-void FuzzGetRotationLimit(const uint8_t *data, size_t size)
154-{
155- FuzzedDataProvider provider(data, size);
156- InitMotionManager();
157- RotateDegreeLimit rotationLimit;
158- g_motionManager->GetRotationLimit(rotationLimit);
159-}
160- 
161-void FuzzGetMechCameraTrackingEnabled(const uint8_t *data, size_t size)
162-{
163- FuzzedDataProvider provider(data, size);
164- InitMotionManager();
165- bool isEnabled = false;
166- g_motionManager->GetMechCameraTrackingEnabled(isEnabled);
167-}
168- 
169-void FuzzSetMechCameraTrackingEnabled(const uint8_t *data, size_t size)
170-{
171- FuzzedDataProvider provider(data, size);
172- InitMotionManager();
173- bool isEnabled = provider.ConsumeBool();
174- g_motionManager->SetMechCameraTrackingEnabled(isEnabled);
175-}
176- 
177-void FuzzGetMechCameraTrackingLayout(const uint8_t *data, size_t size)
178-{
179- FuzzedDataProvider provider(data, size);
180- InitMotionManager();
181- bool shouldPassNull = provider.ConsumeBool();
182- std::shared_ptr<LayoutParams> layoutParams = nullptr;
183- if (!shouldPassNull) {
184- layoutParams = std::make_shared<LayoutParams>();
185- }
186- g_motionManager->GetMechCameraTrackingLayout(layoutParams);
187-}
188- 
189-void FuzzSetMechCameraTrackingLayout(const uint8_t *data, size_t size)
190-{
191- FuzzedDataProvider provider(data, size);
192- InitMotionManager();
193- bool shouldPassNull = provider.ConsumeBool();
194- std::shared_ptr<LayoutParams> layoutParams = nullptr;
195- if (!shouldPassNull) {
196- layoutParams = std::make_shared<LayoutParams>();
197- layoutParams->isDefault = provider.ConsumeBool();
198- layoutParams->offsetX = provider.ConsumeFloatingPoint<float>();
199- layoutParams->offsetY = provider.ConsumeFloatingPoint<float>();
200- }
201- g_motionManager->SetMechCameraTrackingLayout(layoutParams);
202-}
203- 
204-void FuzzGetMechBaseInfo(const uint8_t *data, size_t size)
205-{
206- FuzzedDataProvider provider(data, size);
207- InitMotionManager();
208- bool shouldPassNull = provider.ConsumeBool();
209- std::shared_ptr<MechBaseInfo> mechBaseInfo = nullptr;
210- if (!shouldPassNull) {
211- mechBaseInfo = std::make_shared<MechBaseInfo>();
212- }
213- g_motionManager->GetMechBaseInfo(mechBaseInfo);
214-}
215- 
216-void FuzzGetMechCapabilityInfo(const uint8_t *data, size_t size)
217-{
218- FuzzedDataProvider provider(data, size);
219- InitMotionManager();
220- bool shouldPassNull = provider.ConsumeBool();
221- std::shared_ptr<MechCapabilityInfo> mechCapabilityInfo = nullptr;
222- if (!shouldPassNull) {
223- mechCapabilityInfo = std::make_shared<MechCapabilityInfo>();
224- }
225- g_motionManager->GetMechCapabilityInfo(mechCapabilityInfo);
226-}
227- 
228-void FuzzGetRotationAxesStatus(const uint8_t *data, size_t size)
229-{
230- FuzzedDataProvider provider(data, size);
231- InitMotionManager();
232- int32_t mechId = provider.ConsumeIntegral<int32_t>();
233- RotationAxesStatus axesStatus;
234- g_motionManager->GetRotationAxesStatus(mechId, axesStatus);
235-}
236- 
237-void FuzzIsSupportAction(const uint8_t *data, size_t size)
238-{
239- FuzzedDataProvider provider(data, size);
240- InitMotionManager();
241- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
242- ActionType actionType = static_cast<ActionType>(provider.ConsumeIntegral<int32_t>());
243- bool isSupport = false;
244- g_motionManager->IsSupportAction(tokenId, actionType, isSupport);
245-}
246- 
247-void FuzzRotate(const uint8_t *data, size_t size)
248-{
249- FuzzedDataProvider provider(data, size);
250- InitMotionManager();
251- bool shouldPassNull = provider.ConsumeBool();
252- std::shared_ptr<RotateParam> rotateParam = nullptr;
253- if (!shouldPassNull) {
254- rotateParam = std::make_shared<RotateParam>();
255- rotateParam->degree.yaw = provider.ConsumeFloatingPoint<float>();
256- rotateParam->degree.roll = provider.ConsumeFloatingPoint<float>();
257- rotateParam->degree.pitch = provider.ConsumeFloatingPoint<float>();
258- rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
259- rotateParam->isRelative = provider.ConsumeBool();
260- }
261- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
262- std::string napiCmdId = provider.ConsumeRandomLengthString();
263- g_motionManager->Rotate(rotateParam, tokenId, napiCmdId);
264-}
265- 
266-void FuzzRotateBySpeed(const uint8_t *data, size_t size)
267-{
268- FuzzedDataProvider provider(data, size);
269- InitMotionManager();
270- bool shouldPassNull = provider.ConsumeBool();
271- std::shared_ptr<RotateBySpeedParam> rotateSpeedParam = nullptr;
272- if (!shouldPassNull) {
273- rotateSpeedParam = std::make_shared<RotateBySpeedParam>();
274- rotateSpeedParam->speed.yawSpeed = provider.ConsumeFloatingPoint<float>();
275- rotateSpeedParam->speed.rollSpeed = provider.ConsumeFloatingPoint<float>();
276- rotateSpeedParam->speed.pitchSpeed = provider.ConsumeFloatingPoint<float>();
277- rotateSpeedParam->duration = provider.ConsumeIntegral<uint16_t>();
278- }
279- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
280- std::string napiCmdId = provider.ConsumeRandomLengthString();
281- g_motionManager->RotateBySpeed(rotateSpeedParam, tokenId, napiCmdId);
282-}
283- 
284-void FuzzStopRotate(const uint8_t *data, size_t size)
285-{
286- FuzzedDataProvider provider(data, size);
287- InitMotionManager();
288- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
289- std::string napiCmdId = provider.ConsumeRandomLengthString();
290- g_motionManager->StopRotate(tokenId, napiCmdId);
291-}
292- 
293-void FuzzMove(const uint8_t *data, size_t size)
294-{
295- FuzzedDataProvider provider(data, size);
296- InitMotionManager();
297- bool shouldPassNull = provider.ConsumeBool();
298- std::shared_ptr<MoveParams> moveParams = nullptr;
299- if (!shouldPassNull) {
300- moveParams = std::make_shared<MoveParams>();
301- moveParams->distance = provider.ConsumeIntegral<int32_t>();
302- moveParams->angle = provider.ConsumeFloatingPoint<float>();
303- moveParams->speedGear = static_cast<SpeedGear>(provider.ConsumeIntegral<int32_t>());
304- moveParams->mode = static_cast<MarchingMode>(provider.ConsumeIntegral<int32_t>());
305- }
306- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
307- std::string napiCmdId = provider.ConsumeRandomLengthString();
308- g_motionManager->Move(tokenId, napiCmdId, moveParams);
309-}
310- 
311-void FuzzMoveBySpeed(const uint8_t *data, size_t size)
312-{
313- FuzzedDataProvider provider(data, size);
314- InitMotionManager();
315- bool shouldPassNull = provider.ConsumeBool();
316- std::shared_ptr<SpeedParams> speedParams = nullptr;
317- if (!shouldPassNull) {
318- speedParams = std::make_shared<SpeedParams>();
319- speedParams->speed = provider.ConsumeIntegral<int16_t>();
320- speedParams->angle = provider.ConsumeFloatingPoint<float>();
321- speedParams->mode = static_cast<MarchingMode>(provider.ConsumeIntegral<int32_t>());
322- }
323- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
324- std::string napiCmdId = provider.ConsumeRandomLengthString();
325- uint16_t duration = provider.ConsumeIntegral<uint16_t>();
326- g_motionManager->MoveBySpeed(tokenId, napiCmdId, duration, speedParams);
327-}
328- 
329-void FuzzTurnBySpeed(const uint8_t *data, size_t size)
330-{
331- FuzzedDataProvider provider(data, size);
332- InitMotionManager();
333- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
334- std::string napiCmdId = provider.ConsumeRandomLengthString();
335- float angleSpeed = provider.ConsumeFloatingPoint<float>();
336- uint16_t duration = provider.ConsumeIntegral<uint16_t>();
337- g_motionManager->TurnBySpeed(tokenId, napiCmdId, angleSpeed, duration);
338-}
339- 
340-void FuzzDoAction(const uint8_t *data, size_t size)
341-{
342- FuzzedDataProvider provider(data, size);
343- InitMotionManager();
344- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
345- std::string napiCmdId = provider.ConsumeRandomLengthString();
346- ActionType actionType = static_cast<ActionType>(provider.ConsumeIntegral<int32_t>());
347- g_motionManager->DoAction(tokenId, napiCmdId, actionType);
348-}
349- 
350-void FuzzSetMechCameraTrackingFrame(const uint8_t *data, size_t size)
351-{
352- FuzzedDataProvider provider(data, size);
353- InitMotionManager();
354- bool shouldPassNull = provider.ConsumeBool();
355- std::shared_ptr<TrackingFrameParams> trackingFrameParams = nullptr;
356- if (!shouldPassNull) {
357- trackingFrameParams = std::make_shared<TrackingFrameParams>();
358- trackingFrameParams->targetId = provider.ConsumeIntegral<uint16_t>();
359- trackingFrameParams->timeStamp = provider.ConsumeIntegral<uint64_t>();
360- trackingFrameParams->cameraType = static_cast<CameraType>(provider.ConsumeIntegral<int32_t>());
361- trackingFrameParams->confidence = static_cast<ConfidenceLevel>(provider.ConsumeIntegral<int32_t>());
362- trackingFrameParams->objectType = provider.ConsumeIntegral<uint8_t>();
363- trackingFrameParams->roi.x = provider.ConsumeFloatingPoint<float>();
364- trackingFrameParams->roi.y = provider.ConsumeFloatingPoint<float>();
365- trackingFrameParams->roi.width = provider.ConsumeFloatingPoint<float>();
366- trackingFrameParams->roi.height = provider.ConsumeFloatingPoint<float>();
367- trackingFrameParams->fovV = provider.ConsumeFloatingPoint<float>();
368- trackingFrameParams->fovH = provider.ConsumeFloatingPoint<float>();
369- trackingFrameParams->isRecording = provider.ConsumeBool();
370- trackingFrameParams->timeDelay = provider.ConsumeIntegral<uint32_t>();
371- }
372- g_motionManager->SetMechCameraTrackingFrame(trackingFrameParams);
373-}
374- 
375-void FuzzSetMechCameraInfo(const uint8_t *data, size_t size)
376-{
377- FuzzedDataProvider provider(data, size);
378- InitMotionManager();
379- CameraInfoParams mechCameraInfo;
380- mechCameraInfo.fovV = provider.ConsumeIntegral<uint8_t>();
381- mechCameraInfo.fovH = provider.ConsumeIntegral<uint8_t>();
382- mechCameraInfo.zoomFactor = provider.ConsumeFloatingPoint<float>();
383- mechCameraInfo.isRecording = provider.ConsumeBool();
384- mechCameraInfo.cameraType = static_cast<CameraType>(provider.ConsumeIntegral<int32_t>());
385- g_motionManager->SetMechCameraInfo(mechCameraInfo);
386-}
387- 
388-void FuzzSetMechScreenInfo(const uint8_t *data, size_t size)
389-{
390- FuzzedDataProvider provider(data, size);
391- InitMotionManager();
392- ScreenInfoParams screenInfo;
393- screenInfo.isPortrait = provider.ConsumeBool();
394- g_motionManager->SetMechScreenInfo(screenInfo);
395-}
396- 
397-void FuzzPerformPresetAction(const uint8_t *data, size_t size)
398-{
399- FuzzedDataProvider provider(data, size);
400- InitMotionManager();
401- PresetAction action = static_cast<PresetAction>(provider.ConsumeIntegral<int32_t>());
402- int32_t delay = provider.ConsumeIntegral<int32_t>();
403- g_motionManager->PerformPresetAction(action, delay);
404-}
405- 
406-void FuzzActionGimbalFeatureControl(const uint8_t *data, size_t size)
407-{
408- FuzzedDataProvider provider(data, size);
409- InitMotionManager();
410- ActionControlParams actionControlParams;
411- actionControlParams.controlReq = provider.ConsumeIntegral<uint8_t>();
412- actionControlParams.timeOut = provider.ConsumeIntegral<uint16_t>();
413- actionControlParams.yawControl = provider.ConsumeIntegral<uint32_t>();
414- actionControlParams.pitchControl = provider.ConsumeIntegral<uint32_t>();
415- actionControlParams.rollControl = provider.ConsumeIntegral<uint32_t>();
416- g_motionManager->ActionGimbalFeatureControl(actionControlParams);
417-}
418- 
419-void FuzzGetDeviceRealName(const uint8_t *data, size_t size)
420-{
421- FuzzedDataProvider provider(data, size);
422- InitMotionManager();
423- const std::string &realName = g_motionManager->GetDeviceRealName();
424-}
425- 
426-void FuzzConvertMoveParamsToRotateParams(const uint8_t *data, size_t size)
427-{
428- FuzzedDataProvider provider(data, size);
429- InitMotionManager();
430- std::shared_ptr<MoveParams> moveParams = std::make_shared<MoveParams>();
431- moveParams->distance = provider.ConsumeIntegral<int32_t>();
432- moveParams->angle = provider.ConsumeFloatingPoint<float>();
433- moveParams->speedGear = static_cast<SpeedGear>(provider.ConsumeIntegral<int32_t>());
434- moveParams->mode = static_cast<MarchingMode>(provider.ConsumeIntegral<int32_t>());
435- std::vector<RotateParam> result = g_motionManager->ConvertMoveParamsToRotateParams(moveParams);
436-}
437- 
438-void FuzzConvertSpeedParamsToRotateParams(const uint8_t *data, size_t size)
439-{
440- FuzzedDataProvider provider(data, size);
441- InitMotionManager();
442- std::shared_ptr<SpeedParams> speedParams = std::make_shared<SpeedParams>();
443- speedParams->speed = provider.ConsumeIntegral<int16_t>();
444- speedParams->angle = provider.ConsumeFloatingPoint<float>();
445- speedParams->mode = static_cast<MarchingMode>(provider.ConsumeIntegral<int32_t>());
446- int32_t duration = provider.ConsumeIntegral<int32_t>();
447- std::vector<RotateParam> result = g_motionManager->ConvertSpeedParamsToRotateParams(speedParams, duration);
448-}
449- 
450-void FuzzCheckWheelSpeedLimit(const uint8_t *data, size_t size)
451-{
452- FuzzedDataProvider provider(data, size);
453- InitMotionManager();
454- std::vector<RotateParam> rotateParams;
455- size_t numParams = provider.ConsumeIntegralInRange<size_t>(0, 10);
456- for (size_t i = 0; i < numParams; ++i) {
457- RotateParam param;
458- param.forwardSpeed = provider.ConsumeIntegral<int16_t>();
459- param.turningSpeed = provider.ConsumeFloatingPoint<float>();
460- rotateParams.push_back(param);
461- }
462- g_motionManager->CheckWheelSpeedLimit(rotateParams);
463-}
464- 
465-void FuzzMechAttitudeNotify(const uint8_t *data, size_t size)
466-{
467- InitMotionManager();
468- auto cmd = std::make_shared<RegisterMechPositionInfoCmd>();
469- g_motionManager->MechAttitudeNotify(cmd);
470-}
471- 
472-void FuzzMechButtonEventNotify(const uint8_t *data, size_t size)
473-{
474- InitMotionManager();
475- auto cmd = std::make_shared<RegisterMechCameraKeyEventCmd>();
476- g_motionManager->MechButtonEventNotify(cmd);
477-}
478- 
479-void FuzzMechParamNotify(const uint8_t *data, size_t size)
480-{
481- InitMotionManager();
482- auto cmd = std::make_shared<RegisterMechStateInfoCmd>();
483- g_motionManager->MechParamNotify(cmd);
484-}
485- 
486-void FuzzMechGenericEventNotify(const uint8_t *data, size_t size)
487-{
488- InitMotionManager();
489- auto cmd = std::make_shared<NormalRegisterMechGenericEventCmd>();
490- g_motionManager->MechGenericEventNotify(cmd);
491-}
492- 
493-void FuzzMechCliffInfoNotify(const uint8_t *data, size_t size)
494-{
495- InitMotionManager();
496- auto cmd = std::make_shared<RegisterMechCliffInfoCmd>();
497- g_motionManager->MechCliffInfoNotify(cmd);
498-}
499- 
500-void FuzzMechObstacleInfoNotify(const uint8_t *data, size_t size)
501-{
502- InitMotionManager();
503- auto cmd = std::make_shared<RegisterMechObstacleInfoCmd>();
504- g_motionManager->MechObstacleInfoNotify(cmd);
505-}
506- 
507-void FuzzMechExecutionResultNotify(const uint8_t *data, size_t size)
508-{
509- InitMotionManager();
510- auto cmd = std::make_shared<RegisterMechControlResultCmd>();
511- g_motionManager->MechExecutionResultNotify(cmd);
512-}
513- 
514-void FuzzMechWheelZoomNotify(const uint8_t *data, size_t size)
515-{
516- InitMotionManager();
517- auto cmd = std::make_shared<RegisterMechWheelDataCmd>();
518- g_motionManager->MechWheelZoomNotify(cmd);
519-}
520- 
521-void FuzzMechTrackingStatusNotify(const uint8_t *data, size_t size)
522-{
523- InitMotionManager();
524- auto cmd = std::make_shared<RegisterMechTrackingEnableCmd>();
525- g_motionManager->MechTrackingStatusNotify(cmd);
526-}
527- 
528-void FuzzRotateWithExtremeValues(const uint8_t *data, size_t size)
529-{
530- FuzzedDataProvider provider(data, size);
531- InitMotionManager();
532- auto rotateParam = std::make_shared<RotateParam>();
533- rotateParam->degree.yaw = provider.ConsumeFloatingPoint<float>();
534- rotateParam->degree.roll = provider.ConsumeFloatingPoint<float>();
535- rotateParam->degree.pitch = provider.ConsumeFloatingPoint<float>();
536- rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
537- rotateParam->isRelative = provider.ConsumeBool();
538- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
539- std::string napiCmdId = provider.ConsumeRandomLengthString();
540- g_motionManager->Rotate(rotateParam, tokenId, napiCmdId);
541-}
542- 
543-void FuzzMoveWithZeroParams(const uint8_t *data, size_t size)
544-{
545- FuzzedDataProvider provider(data, size);
546- InitMotionManager();
547- auto moveParams = std::make_shared<MoveParams>();
548- moveParams->distance = 0;
549- moveParams->angle = 0.0f;
550- moveParams->speedGear = SpeedGear::LOW_SPEED;
551- moveParams->mode = MarchingMode::TURNING_MOVING;
552- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
553- std::string napiCmdId = provider.ConsumeRandomLengthString();
554- g_motionManager->Move(tokenId, napiCmdId, moveParams);
555-}
556- 
557-void FuzzMoveBySpeedWithZeroParams(const uint8_t *data, size_t size)
558-{
559- FuzzedDataProvider provider(data, size);
560- InitMotionManager();
561- auto speedParams = std::make_shared<SpeedParams>();
562- speedParams->speed = 0;
563- speedParams->angle = 0.0f;
564- speedParams->mode = MarchingMode::TURNING_MOVING;
565- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
566- std::string napiCmdId = provider.ConsumeRandomLengthString();
567- uint16_t duration = provider.ConsumeIntegral<uint16_t>();
568- g_motionManager->MoveBySpeed(tokenId, napiCmdId, duration, speedParams);
569-}
570- 
571-void FuzzRotateBySpeedWithZeroDuration(const uint8_t *data, size_t size)
572-{
573- FuzzedDataProvider provider(data, size);
574- InitMotionManager();
575- auto rotateSpeedParam = std::make_shared<RotateBySpeedParam>();
576- rotateSpeedParam->speed.yawSpeed = provider.ConsumeFloatingPoint<float>();
577- rotateSpeedParam->speed.rollSpeed = provider.ConsumeFloatingPoint<float>();
578- rotateSpeedParam->speed.pitchSpeed = provider.ConsumeFloatingPoint<float>();
579- rotateSpeedParam->duration = 0;
580- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
581- std::string napiCmdId = provider.ConsumeRandomLengthString();
582- g_motionManager->RotateBySpeed(rotateSpeedParam, tokenId, napiCmdId);
583-}
584- 
585-void FuzzTurnBySpeedWithZeroDuration(const uint8_t *data, size_t size)
586-{
587- FuzzedDataProvider provider(data, size);
588- InitMotionManager();
589- uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
590- std::string napiCmdId = provider.ConsumeRandomLengthString();
591- float angleSpeed = provider.ConsumeFloatingPoint<float>();
592- g_motionManager->TurnBySpeed(tokenId, napiCmdId, angleSpeed, 0);
593-}
594- 
595-using FuzzTestFunc = void (*)(const uint8_t *, size_t);
596- 
597-FuzzTestFunc GetFuzzTestFunc(uint8_t selector)
598-{
599- static const FuzzTestFunc fuzzTestFuncs[] = {
600- FuzzGetSpeedControlTimeLimit,
601- FuzzGetRotateSpeedLimit,
602- FuzzGetCurrentPosition,
603- FuzzGetRotationLimit,
604- FuzzSetMechCameraTrackingEnabled,
605- FuzzGetMechCameraTrackingEnabled,
606- FuzzSetMechCameraTrackingLayout,
607- FuzzGetMechCameraTrackingLayout,
608- FuzzGetMechBaseInfo,
609- FuzzGetMechCapabilityInfo,
610- FuzzGetRotationAxesStatus,
611- FuzzIsSupportAction,
612- FuzzRotate,
613- FuzzRotateBySpeed,
614- FuzzStopRotate,
615- FuzzMove,
616- FuzzMoveBySpeed,
617- FuzzTurnBySpeed,
618- FuzzDoAction,
619- FuzzSetMechCameraTrackingFrame,
620- FuzzSetMechCameraInfo,
621- FuzzSetMechScreenInfo,
622- FuzzPerformPresetAction,
623- FuzzActionGimbalFeatureControl,
624- FuzzGetDeviceRealName,
625- FuzzConvertMoveParamsToRotateParams,
626- FuzzConvertSpeedParamsToRotateParams,
627- FuzzCheckWheelSpeedLimit,
628- FuzzMechAttitudeNotify,
629- FuzzMechButtonEventNotify,
630- FuzzMechParamNotify,
631- FuzzMechGenericEventNotify,
632- FuzzMechCliffInfoNotify,
633- FuzzMechObstacleInfoNotify,
634- FuzzMechExecutionResultNotify,
635- FuzzMechWheelZoomNotify,
636- FuzzMechTrackingStatusNotify,
637- FuzzRotateWithExtremeValues,
638- FuzzMoveWithZeroParams,
639- FuzzMoveBySpeedWithZeroParams,
640- FuzzRotateBySpeedWithZeroDuration,
641- FuzzTurnBySpeedWithZeroDuration
642- };
643- 
644- if (selector >= FUZZ_TEST_COUNT) {
645- return nullptr;
646- }
647- return fuzzTestFuncs[selector];
648-}
649- 
650-} // namespace
651- 
652-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
653-{
654- if (size < OPT_SIZE) {
655- return 0;
656- }
657- FuzzedDataProvider fdp(data + size - OPT_SIZE, OPT_SIZE);
658- uint8_t selector = fdp.ConsumeIntegral<uint8_t>() % FUZZ_TEST_COUNT;
659- 
660- FuzzTestFunc func = GetFuzzTestFunc(selector);
661- if (func != nullptr) {
662- func(data, size - OPT_SIZE);
663- }
664- return 0;
665-}
Atest/fuzztest/mcmotionmanagereight_fuzzer/BUILD.gn+86-0
@@ -0,0 +1,86 @@
1+# Copyright (c) 2025 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+import("//build/config/features.gni")
14+import("//build/test.gni")
15+ 
16+ohos_fuzztest("McMotionManagerEightFuzzTest") {
17+ module_out_path = "mechbody_controller/mechbody_controller/"
18+ mechbody_path =
19+ "//foundation/distributedhardware/mechbody_controller"
20+ fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanagereight_fuzzer"
21+ 
22+ include_dirs = [
23+ "//foundation/distributedhardware/mechbody_controller/services/include",
24+ "//foundation/distributedhardware/mechbody_controller/services/include/motion",
25+ "//foundation/distributedhardware/mechbody_controller/services/include/transport",
26+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command",
27+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x01",
28+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x02",
29+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x03",
30+ "//foundation/distributedhardware/mechbody_controller/services/include/controller",
31+ "//foundation/distributedhardware/mechbody_controller/services/include/connect",
32+ "//foundation/distributedhardware/mechbody_controller/services/include/swing",
33+ "//foundation/distributedhardware/mechbody_controller/services/include/utils",
34+ "//foundation/distributedhardware/mechbody_controller/interface/inner_api",
35+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/common",
36+ ]
37+
38+ cflags = ["-g", "-O0", "-w", "-fno-omit-frame-pointer", "-Dprivate=public", "-Dprotected=public"]
39+
40+ sources = [
41+ "mcmotionmanagereight_fuzzer.cpp"
42+ ]
43+
44+ deps = [
45+ "//foundation/distributedhardware/mechbody_controller/services:mechbody_service",
46+ ]
47+
48+ external_deps = [
49+ "access_token:libaccesstoken_sdk",
50+ "access_token:libtokenid_sdk",
51+ "access_token:libtokensetproc_shared",
52+ "ability_base:base",
53+ "ability_runtime:ability_manager",
54+ "ability_runtime:app_manager",
55+ "bluetooth:btcommon",
56+ "bluetooth:btframework",
57+ "camera_framework:camera_framework",
58+ "cJSON:cjson",
59+ "c_utils:utils",
60+ "distributed_notification_service:ans_innerkits",
61+ "drivers_interface_camera:metadata",
62+ "eventhandler:libeventhandler",
63+ "graphic_surface:surface",
64+ "hilog:libhilog",
65+ "hisysevent:libhisysevent",
66+ "init:libbegetutil",
67+ "input:libmmi-client",
68+ "input:oh_input_manager",
69+ "ipc:ipc_core",
70+ "os_account:libaccountkits",
71+ "os_account:os_account_innerkits",
72+ "safwk:system_ability_fwk",
73+ "samgr:samgr_proxy",
74+ "sensor:sensor_interface_native",
75+ "window_manager:libdm_lite",
76+ ]
77+
78+ ldflags = ["-Wl,--allow-multiple-definition"]
79+}
80+ 
81+group("fuzztest") {
82+ testonly = true
83+ deps = [
84+ ":McMotionManagerEightFuzzTest",
85+ ]
86+}
Rtest/fuzztest/mcmotionmanager_fuzzer/corpus/init→test/fuzztest/mcmotionmanagereight_fuzzer/corpus/init+1-1
@@ -13,4 +13,4 @@
13 * limitations under the License.13 * limitations under the License.
14 */14 */
15 15 
16-FUZZ16+FUZZ
Atest/fuzztest/mcmotionmanagereight_fuzzer/mcmotionmanagereight_fuzzer.cpp+214-0
@@ -0,0 +1,214 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <fuzzer/FuzzedDataProvider.h>
17+#include "mcmotionmanagereight_fuzzer.h"
18+#include "mc_motion_manager.h"
19+#include "mc_connect_manager.h"
20+#include "mechbody_controller_types.h"
21+#include "mechbody_controller_enums.h"
22+#include "mc_send_adapter.h"
23+#include "mc_command_factory.h"
24+#include "mc_register_mech_position_info_cmd.h"
25+#include "mc_register_mech_camera_key_event_cmd.h"
26+#include "mc_register_mech_state_info_cmd.h"
27+#include "mc_normal_register_mech_generic_event_cmd.h"
28+#include "mc_register_mech_cliff_info_cmd.h"
29+#include "mc_register_mech_obstacle_info_cmd.h"
30+#include "mc_register_mech_control_result_cmd.h"
31+#include "mc_register_mech_wheel_data_cmd.h"
32+#include "mc_register_mech_tracking_enable_cmd.h"
33+#include "mc_get_mech_protocol_ver_cmd.h"
34+#include "mc_normal_get_mech_base_info_cmd.h"
35+#include "mc_normal_get_mech_capability_info_cmd.h"
36+#include "mc_get_mech_limit_info_cmd.h"
37+#include "mc_normal_set_mech_protocol_ver_cmd.h"
38+#include "mc_data_buffer.h"
39+#include <memory>
40+#include <map>
41+#include "mechbody_controller_log.h"
42+#include "mock_transport_send_adapter.h"
43+ 
44+namespace {
45+constexpr int32_t TEST_MECH_ID = 1;
46+constexpr int32_t MAX_ACTION_TYPE_VALUE = 2006;
47+}
48+ 
49+using namespace OHOS;
50+using namespace OHOS::MechBodyController;
51+ 
52+namespace {
53+const std::string TAG = "MotionManagerEightFuzz";
54+ 
55+std::shared_ptr<MotionManager> g_motionManager = nullptr;
56+std::shared_ptr<MockTransportSendAdapter> g_mockAdapter = nullptr;
57+ 
58+void InitMotionManager()
59+{
60+ // 初始化motionManager
61+ if (g_motionManager == nullptr) {
62+ g_mockAdapter = std::make_shared<MockTransportSendAdapter>();
63+ g_motionManager = std::make_shared<MotionManager>(g_mockAdapter, TEST_MECH_ID, false, 0x00000000);
64+ 
65+ MechInfo testMech;
66+ testMech.mechId = TEST_MECH_ID;
67+ testMech.mechType = MechType::PORTABLE_GIMBAL;
68+ testMech.mac = "AA:BB:CC:DD:EE:FF";
69+ testMech.state = AttachmentState::ATTACHED;
70+ testMech.deviceIdentifier = 0x00000000;
71+ MechConnectManager::GetInstance().AddMechInfo(testMech);
72+ MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
73+ }
74+}
75+ 
76+void FuzzGetMechCapabilityInfo(const uint8_t *data, size_t size)
77+{
78+ FuzzedDataProvider provider(data, size);
79+ InitMotionManager();
80+ bool shouldPassNull = provider.ConsumeBool();
81+ std::shared_ptr<MechCapabilityInfo> mechCapabilityInfo = nullptr;
82+ if (!shouldPassNull) {
83+ mechCapabilityInfo = std::make_shared<MechCapabilityInfo>();
84+ }
85+ g_motionManager->GetMechCapabilityInfo(mechCapabilityInfo);
86+}
87+ 
88+void FuzzGetRotationAxesStatus(const uint8_t *data, size_t size)
89+{
90+ FuzzedDataProvider provider(data, size);
91+ InitMotionManager();
92+ int32_t mechId = provider.ConsumeIntegral<int32_t>();
93+ RotationAxesStatus axesStatus;
94+ g_motionManager->GetRotationAxesStatus(mechId, axesStatus);
95+}
96+ 
97+void FuzzIsSupportAction(const uint8_t *data, size_t size)
98+{
99+ FuzzedDataProvider provider(data, size);
100+ InitMotionManager();
101+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
102+ ActionType actionType = static_cast<ActionType>(provider.ConsumeIntegralInRange<int32_t>(0, MAX_ACTION_TYPE_VALUE));
103+ bool isSupport = false;
104+ g_motionManager->IsSupportAction(tokenId, actionType, isSupport);
105+}
106+ 
107+void FuzzRotate(const uint8_t *data, size_t size)
108+{
109+ FuzzedDataProvider provider(data, size);
110+ InitMotionManager();
111+ bool shouldPassNull = provider.ConsumeBool();
112+ std::shared_ptr<RotateParam> rotateParam = nullptr;
113+ if (!shouldPassNull) {
114+ rotateParam = std::make_shared<RotateParam>();
115+ rotateParam->degree.yaw = provider.ConsumeFloatingPoint<float>();
116+ rotateParam->degree.roll = provider.ConsumeFloatingPoint<float>();
117+ rotateParam->degree.pitch = provider.ConsumeFloatingPoint<float>();
118+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
119+ rotateParam->isRelative = provider.ConsumeBool();
120+ }
121+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
122+ std::string napiCmdId = provider.ConsumeRandomLengthString();
123+ g_motionManager->Rotate(rotateParam, tokenId, napiCmdId);
124+}
125+ 
126+void FuzzRotateBySpeed(const uint8_t *data, size_t size)
127+{
128+ FuzzedDataProvider provider(data, size);
129+ InitMotionManager();
130+ bool shouldPassNull = provider.ConsumeBool();
131+ std::shared_ptr<RotateBySpeedParam> rotateSpeedParam = nullptr;
132+ if (!shouldPassNull) {
133+ rotateSpeedParam = std::make_shared<RotateBySpeedParam>();
134+ rotateSpeedParam->speed.yawSpeed = provider.ConsumeFloatingPoint<float>();
135+ rotateSpeedParam->speed.rollSpeed = provider.ConsumeFloatingPoint<float>();
136+ rotateSpeedParam->speed.pitchSpeed = provider.ConsumeFloatingPoint<float>();
137+ rotateSpeedParam->duration = provider.ConsumeIntegral<uint16_t>();
138+ }
139+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
140+ std::string napiCmdId = provider.ConsumeRandomLengthString();
141+ g_motionManager->RotateBySpeed(rotateSpeedParam, tokenId, napiCmdId);
142+}
143+ 
144+void FuzzStopRotate(const uint8_t *data, size_t size)
145+{
146+ FuzzedDataProvider provider(data, size);
147+ InitMotionManager();
148+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
149+ std::string napiCmdId = provider.ConsumeRandomLengthString();
150+ g_motionManager->StopRotate(tokenId, napiCmdId);
151+}
152+ 
153+void FuzzMove(const uint8_t *data, size_t size)
154+{
155+ FuzzedDataProvider provider(data, size);
156+ InitMotionManager();
157+ bool shouldPassNull = provider.ConsumeBool();
158+ std::shared_ptr<MoveParams> moveParams = nullptr;
159+ if (!shouldPassNull) {
160+ moveParams = std::make_shared<MoveParams>();
161+ moveParams->distance = provider.ConsumeIntegral<int32_t>();
162+ moveParams->angle = provider.ConsumeFloatingPoint<float>();
163+ moveParams->speedGear = static_cast<SpeedGear>(provider.ConsumeIntegral<int32_t>());
164+ moveParams->mode = static_cast<MarchingMode>(provider.ConsumeIntegral<int32_t>());
165+ }
166+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
167+ std::string napiCmdId = provider.ConsumeRandomLengthString();
168+ g_motionManager->Move(tokenId, napiCmdId, moveParams);
169+}
170+ 
171+void FuzzMoveBySpeed(const uint8_t *data, size_t size)
172+{
173+ FuzzedDataProvider provider(data, size);
174+ InitMotionManager();
175+ bool shouldPassNull = provider.ConsumeBool();
176+ std::shared_ptr<SpeedParams> speedParams = nullptr;
177+ if (!shouldPassNull) {
178+ speedParams = std::make_shared<SpeedParams>();
179+ speedParams->speed = provider.ConsumeIntegral<int16_t>();
180+ speedParams->angle = provider.ConsumeFloatingPoint<float>();
181+ speedParams->mode = static_cast<MarchingMode>(provider.ConsumeIntegral<int32_t>());
182+ }
183+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
184+ std::string napiCmdId = provider.ConsumeRandomLengthString();
185+ uint16_t duration = provider.ConsumeIntegral<uint16_t>();
186+ g_motionManager->MoveBySpeed(tokenId, napiCmdId, duration, speedParams);
187+}
188+ 
189+void FuzzTurnBySpeed(const uint8_t *data, size_t size)
190+{
191+ FuzzedDataProvider provider(data, size);
192+ InitMotionManager();
193+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
194+ std::string napiCmdId = provider.ConsumeRandomLengthString();
195+ float angleSpeed = provider.ConsumeFloatingPoint<float>();
196+ uint16_t duration = provider.ConsumeIntegral<uint16_t>();
197+ g_motionManager->TurnBySpeed(tokenId, napiCmdId, angleSpeed, duration);
198+}
199+ 
200+} // namespace
201+ 
202+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
203+{
204+ FuzzGetMechCapabilityInfo(data, size);
205+ FuzzGetRotationAxesStatus(data, size);
206+ FuzzIsSupportAction(data, size);
207+ FuzzRotate(data, size);
208+ FuzzRotateBySpeed(data, size);
209+ FuzzStopRotate(data, size);
210+ FuzzMove(data, size);
211+ FuzzMoveBySpeed(data, size);
212+ FuzzTurnBySpeed(data, size);
213+ return 0;
214+}
Atest/fuzztest/mcmotionmanagereight_fuzzer/mcmotionmanagereight_fuzzer.h+34-0
@@ -0,0 +1,34 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MCMOTIONMANAGEREIGHT_FUZZER_FUZZER_H
17+#define MCMOTIONMANAGEREIGHT_FUZZER_FUZZER_H
18+ 
19+#include <cstdint>
20+#include <memory>
21+ 
22+namespace OHOS {
23+namespace MechBodyController {
24+ 
25+class MotionManager;
26+class TransportSendAdapter;
27+ 
28+std::shared_ptr<MotionManager> CreateTestMotionManager();
29+std::shared_ptr<TransportSendAdapter> CreateTestSendAdapter();
30+ 
31+} // namespace MechBodyController
32+} // namespace OHOS
33+ 
34+#endif // MCMOTIONMANAGEREIGHT_FUZZER_FUZZER_H
Rtest/fuzztest/mcmotionmanager_fuzzer/project.xml→test/fuzztest/mcmotionmanagereight_fuzzer/project.xml+0-0
文件重命名但无更改。
Atest/fuzztest/mcmotionmanagereighteen_fuzzer/BUILD.gn+86-0
@@ -0,0 +1,86 @@
1+# Copyright (c) 2025 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+import("//build/config/features.gni")
14+import("//build/test.gni")
15+ 
16+ohos_fuzztest("McMotionManagerEighteenFuzzTest") {
17+ module_out_path = "mechbody_controller/mechbody_controller/"
18+ mechbody_path =
19+ "//foundation/distributedhardware/mechbody_controller"
20+ fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanagereighteen_fuzzer"
21+ 
22+ include_dirs = [
23+ "//foundation/distributedhardware/mechbody_controller/services/include",
24+ "//foundation/distributedhardware/mechbody_controller/services/include/motion",
25+ "//foundation/distributedhardware/mechbody_controller/services/include/transport",
26+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command",
27+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x01",
28+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x02",
29+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x03",
30+ "//foundation/distributedhardware/mechbody_controller/services/include/controller",
31+ "//foundation/distributedhardware/mechbody_controller/services/include/connect",
32+ "//foundation/distributedhardware/mechbody_controller/services/include/swing",
33+ "//foundation/distributedhardware/mechbody_controller/services/include/utils",
34+ "//foundation/distributedhardware/mechbody_controller/interface/inner_api",
35+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/common",
36+ ]
37+
38+ cflags = ["-g", "-O0", "-w", "-fno-omit-frame-pointer", "-Dprivate=public", "-Dprotected=public"]
39+
40+ sources = [
41+ "mcmotionmanagereighteen_fuzzer.cpp"
42+ ]
43+
44+ deps = [
45+ "//foundation/distributedhardware/mechbody_controller/services:mechbody_service",
46+ ]
47+
48+ external_deps = [
49+ "access_token:libaccesstoken_sdk",
50+ "access_token:libtokenid_sdk",
51+ "access_token:libtokensetproc_shared",
52+ "ability_base:base",
53+ "ability_runtime:ability_manager",
54+ "ability_runtime:app_manager",
55+ "bluetooth:btcommon",
56+ "bluetooth:btframework",
57+ "camera_framework:camera_framework",
58+ "cJSON:cjson",
59+ "c_utils:utils",
60+ "distributed_notification_service:ans_innerkits",
61+ "drivers_interface_camera:metadata",
62+ "eventhandler:libeventhandler",
63+ "graphic_surface:surface",
64+ "hilog:libhilog",
65+ "hisysevent:libhisysevent",
66+ "init:libbegetutil",
67+ "input:libmmi-client",
68+ "input:oh_input_manager",
69+ "ipc:ipc_core",
70+ "os_account:libaccountkits",
71+ "os_account:os_account_innerkits",
72+ "safwk:system_ability_fwk",
73+ "samgr:samgr_proxy",
74+ "sensor:sensor_interface_native",
75+ "window_manager:libdm_lite",
76+ ]
77+
78+ ldflags = ["-Wl,--allow-multiple-definition"]
79+}
80+ 
81+group("fuzztest") {
82+ testonly = true
83+ deps = [
84+ ":McMotionManagerEighteenFuzzTest",
85+ ]
86+}
Rtest/fuzztest/mcmotionmanager_fuzzer/mcmotionmanager_fuzzer.h→test/fuzztest/mcmotionmanagereighteen_fuzzer/corpus/init+2-5
@@ -1,5 +1,5 @@
1/*1/*
2- * Copyright (c) 2025 Huawei Device Co., Ltd.2+ * Copyright (C) 2026 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at5 * You may obtain a copy of the License at
@@ -13,7 +13,4 @@
13 * limitations under the License.13 * limitations under the License.
14 */14 */
15 15 
16-#ifndef MCMOTIONMANAGER_FUZZER_H16+FUZZ
17-#define MCMOTIONMANAGER_FUZZER_H
18- 
19-#endif // MCMOTIONMANAGER_FUZZER_H
Atest/fuzztest/mcmotionmanagereighteen_fuzzer/mcmotionmanagereighteen_fuzzer.cpp+205-0
@@ -0,0 +1,205 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <fuzzer/FuzzedDataProvider.h>
17+#include "mcmotionmanagereighteen_fuzzer.h"
18+#include "mc_motion_manager.h"
19+#include "mc_connect_manager.h"
20+#include "mechbody_controller_types.h"
21+#include "mechbody_controller_enums.h"
22+#include "mc_send_adapter.h"
23+#include "mc_command_factory.h"
24+#include "mc_register_mech_position_info_cmd.h"
25+#include "mc_register_mech_camera_key_event_cmd.h"
26+#include "mc_register_mech_state_info_cmd.h"
27+#include "mc_normal_register_mech_generic_event_cmd.h"
28+#include "mc_register_mech_cliff_info_cmd.h"
29+#include "mc_register_mech_obstacle_info_cmd.h"
30+#include "mc_register_mech_control_result_cmd.h"
31+#include "mc_register_mech_wheel_data_cmd.h"
32+#include "mc_register_mech_tracking_enable_cmd.h"
33+#include "mc_get_mech_protocol_ver_cmd.h"
34+#include "mc_normal_get_mech_base_info_cmd.h"
35+#include "mc_normal_get_mech_capability_info_cmd.h"
36+#include "mc_get_mech_limit_info_cmd.h"
37+#include "mc_normal_set_mech_protocol_ver_cmd.h"
38+#include "mc_data_buffer.h"
39+#include <memory>
40+#include <map>
41+#include "mock_transport_send_adapter.h"
42+#include "mechbody_controller_log.h"
43+ 
44+namespace {
45+constexpr int32_t TEST_MECH_ID = 1;
46+constexpr int32_t MAX_ACTION_TYPE_VALUE = 2006;
47+}
48+ 
49+using namespace OHOS;
50+using namespace OHOS::MechBodyController;
51+ 
52+namespace {
53+const std::string TAG = "MotionManagerEighteenFuzz";
54+ 
55+std::shared_ptr<MotionManager> g_motionManager = nullptr;
56+std::shared_ptr<MockTransportSendAdapter> g_mockAdapter = nullptr;
57+ 
58+void InitMotionManager()
59+{
60+ if (g_motionManager == nullptr) {
61+ g_mockAdapter = std::make_shared<MockTransportSendAdapter>();
62+ g_motionManager = std::make_shared<MotionManager>(g_mockAdapter, TEST_MECH_ID, false, 0x00000000);
63+ 
64+ MechInfo testMech;
65+ testMech.mechId = TEST_MECH_ID;
66+ testMech.mechType = MechType::PORTABLE_GIMBAL;
67+ testMech.mac = "AA:BB:CC:DD:EE:FF";
68+ testMech.state = AttachmentState::ATTACHED;
69+ testMech.deviceIdentifier = 0x00000000;
70+ MechConnectManager::GetInstance().AddMechInfo(testMech);
71+ MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
72+ }
73+}
74+ 
75+void FuzzRegisterEventListenerV01(FuzzedDataProvider &provider)
76+{
77+ InitMotionManager();
78+ g_motionManager->RegisterEventListenerV01();
79+}
80+ 
81+void FuzzUnRegisterNotifyEvent(FuzzedDataProvider &provider)
82+{
83+ InitMotionManager();
84+ g_motionManager->RegisterEventListener();
85+ g_motionManager->UnRegisterNotifyEvent();
86+}
87+ 
88+void FuzzExecuteRotateCommand(FuzzedDataProvider &provider)
89+{
90+ InitMotionManager();
91+ RotateParam param;
92+ param.degree.yaw = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
93+ param.degree.roll = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
94+ param.degree.pitch = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
95+ param.duration = provider.ConsumeIntegral<uint16_t>();
96+ param.isRelative = provider.ConsumeBool();
97+
98+ uint8_t taskId = provider.ConsumeIntegral<uint8_t>();
99+ std::shared_ptr<CommandBase> result = g_motionManager->ExecuteRotateCommand(param, taskId);
100+}
101+ 
102+void FuzzHandelRotateParam(FuzzedDataProvider &provider)
103+{
104+ InitMotionManager();
105+ auto rotateParam = std::make_shared<RotateParam>();
106+ rotateParam->degree.yaw = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
107+ rotateParam->degree.roll = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
108+ rotateParam->degree.pitch = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
109+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
110+ rotateParam->isRelative = provider.ConsumeBool();
111+
112+ bool willLimitChange = false;
113+ g_motionManager->HandelRotateParam(rotateParam, willLimitChange);
114+}
115+ 
116+void FuzzCheckYawDegree(FuzzedDataProvider &provider)
117+{
118+ InitMotionManager();
119+ auto rotateParam = std::make_shared<RotateParam>();
120+ rotateParam->degree.yaw = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
121+ rotateParam->degree.roll = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
122+ rotateParam->degree.pitch = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
123+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
124+ rotateParam->isRelative = provider.ConsumeBool();
125+
126+ RotateDegreeLimit limit;
127+ limit.posMax.yaw = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
128+ limit.negMax.yaw = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
129+ limit.posMax.roll = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
130+ limit.negMax.roll = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
131+ limit.posMax.pitch = provider.ConsumeFloatingPointInRange<float>(0.0f, 1.57f);
132+ limit.negMax.pitch = provider.ConsumeFloatingPointInRange<float>(-1.57f, 0.0f);
133+
134+ float yawResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
135+ g_motionManager->CheckYawDegree(rotateParam, limit, yawResult);
136+}
137+ 
138+void FuzzCheckRollDegree(FuzzedDataProvider &provider)
139+{
140+ InitMotionManager();
141+ auto rotateParam = std::make_shared<RotateParam>();
142+ rotateParam->degree.yaw = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
143+ rotateParam->degree.roll = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
144+ rotateParam->degree.pitch = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
145+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
146+ rotateParam->isRelative = provider.ConsumeBool();
147+
148+ RotateDegreeLimit limit;
149+ limit.posMax.yaw = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
150+ limit.negMax.yaw = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
151+ limit.posMax.roll = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
152+ limit.negMax.roll = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
153+ limit.posMax.pitch = provider.ConsumeFloatingPointInRange<float>(0.0f, 1.57f);
154+ limit.negMax.pitch = provider.ConsumeFloatingPointInRange<float>(-1.57f, 0.0f);
155+
156+ float rollResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
157+ g_motionManager->CheckRollDegree(rotateParam, limit, rollResult);
158+}
159+ 
160+void FuzzCheckPitchDegree(FuzzedDataProvider &provider)
161+{
162+ InitMotionManager();
163+ auto rotateParam = std::make_shared<RotateParam>();
164+ rotateParam->degree.yaw = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
165+ rotateParam->degree.roll = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
166+ rotateParam->degree.pitch = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
167+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
168+ rotateParam->isRelative = provider.ConsumeBool();
169+
170+ RotateDegreeLimit limit;
171+ limit.posMax.yaw = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
172+ limit.negMax.yaw = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
173+ limit.posMax.roll = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
174+ limit.negMax.roll = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
175+ limit.posMax.pitch = provider.ConsumeFloatingPointInRange<float>(0.0f, 1.57f);
176+ limit.negMax.pitch = provider.ConsumeFloatingPointInRange<float>(-1.57f, 0.0f);
177+
178+ float pitchResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
179+ g_motionManager->CheckPitchDegree(rotateParam, limit, pitchResult);
180+}
181+ 
182+void FuzzRegisterEventsMultipleTimes(FuzzedDataProvider &provider)
183+{
184+ InitMotionManager();
185+ int32_t iterations = provider.ConsumeIntegralInRange<int32_t>(1, 10);
186+ for (int32_t i = 0; i < iterations; ++i) {
187+ g_motionManager->RegisterEventListener();
188+ }
189+}
190+ 
191+} // namespace
192+ 
193+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
194+{
195+ FuzzedDataProvider provider(data, size);
196+ FuzzRegisterEventListenerV01(provider);
197+ FuzzUnRegisterNotifyEvent(provider);
198+ FuzzExecuteRotateCommand(provider);
199+ FuzzHandelRotateParam(provider);
200+ FuzzCheckYawDegree(provider);
201+ FuzzCheckRollDegree(provider);
202+ FuzzCheckPitchDegree(provider);
203+ FuzzRegisterEventsMultipleTimes(provider);
204+ return 0;
205+}
Atest/fuzztest/mcmotionmanagereighteen_fuzzer/mcmotionmanagereighteen_fuzzer.h+34-0
@@ -0,0 +1,34 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MCMOTIONMANAGEREIGHTEEN_FUZZER_FUZZER_H
17+#define MCMOTIONMANAGEREIGHTEEN_FUZZER_FUZZER_H
18+ 
19+#include <cstdint>
20+#include <memory>
21+ 
22+namespace OHOS {
23+namespace MechBodyController {
24+ 
25+class MotionManager;
26+class TransportSendAdapter;
27+ 
28+std::shared_ptr<MotionManager> CreateTestMotionManager();
29+std::shared_ptr<TransportSendAdapter> CreateTestSendAdapter();
30+ 
31+} // namespace MechBodyController
32+} // namespace OHOS
33+ 
34+#endif // MCMOTIONMANAGEREIGHTEEN_FUZZER_FUZZER_H
Atest/fuzztest/mcmotionmanagereighteen_fuzzer/project.xml+25-0
@@ -0,0 +1,25 @@
1+<?xml version="1.0" encoding="utf-8"?>
2+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
3+ Licensed under the Apache License, Version 2.0 (the "License");
4+ you may not use this file except in compliance with the License.
5+ You may obtain a copy of the License at
6+ 
7+ http://www.apache.org/licenses/LICENSE-2.0
8+ 
9+ Unless required by applicable law or agreed to in writing, software
10+ distributed under the License is distributed on an "AS IS" BASIS,
11+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ See the License for the specific language governing permissions and
13+ limitations under the License.
14+ 
15+-->
16+<fuzz_config>
17+ <fuzztest>
18+ <!-- maximum length of a test input -->
19+ <max_len>1000</max_len>
20+ <!-- maximum total time in seconds to run the fuzzer -->
21+ <max_total_time>300</max_total_time>
22+ <!-- memory usage limit in Mb -->
23+ <rss_limit_mb>4096</rss_limit_mb>
24+ </fuzztest>
25+</fuzz_config>
Atest/fuzztest/mcmotionmanagereleven_fuzzer/BUILD.gn+86-0
@@ -0,0 +1,86 @@
1+# Copyright (c) 2025 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+import("//build/config/features.gni")
14+import("//build/test.gni")
15+ 
16+ohos_fuzztest("McMotionManagerElevenFuzzTest") {
17+ module_out_path = "mechbody_controller/mechbody_controller/"
18+ mechbody_path =
19+ "//foundation/distributedhardware/mechbody_controller"
20+ fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanagereleven_fuzzer"
21+ 
22+ include_dirs = [
23+ "//foundation/distributedhardware/mechbody_controller/services/include",
24+ "//foundation/distributedhardware/mechbody_controller/services/include/motion",
25+ "//foundation/distributedhardware/mechbody_controller/services/include/transport",
26+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command",
27+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x01",
28+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x02",
29+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x03",
30+ "//foundation/distributedhardware/mechbody_controller/services/include/controller",
31+ "//foundation/distributedhardware/mechbody_controller/services/include/connect",
32+ "//foundation/distributedhardware/mechbody_controller/services/include/utils",
33+ "//foundation/distributedhardware/mechbody_controller/services/include/swing",
34+ "//foundation/distributedhardware/mechbody_controller/interface/inner_api",
35+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/common",
36+ ]
37+
38+ cflags = ["-g", "-O0", "-w", "-fno-omit-frame-pointer", "-Dprivate=public", "-Dprotected=public"]
39+
40+ sources = [
41+ "mcmotionmanagereleven_fuzzer.cpp"
42+ ]
43+
44+ deps = [
45+ "//foundation/distributedhardware/mechbody_controller/services:mechbody_service",
46+ ]
47+
48+ external_deps = [
49+ "access_token:libaccesstoken_sdk",
50+ "access_token:libtokenid_sdk",
51+ "access_token:libtokensetproc_shared",
52+ "ability_base:base",
53+ "ability_runtime:ability_manager",
54+ "ability_runtime:app_manager",
55+ "bluetooth:btcommon",
56+ "bluetooth:btframework",
57+ "camera_framework:camera_framework",
58+ "cJSON:cjson",
59+ "c_utils:utils",
60+ "distributed_notification_service:ans_innerkits",
61+ "drivers_interface_camera:metadata",
62+ "eventhandler:libeventhandler",
63+ "graphic_surface:surface",
64+ "hilog:libhilog",
65+ "hisysevent:libhisysevent",
66+ "init:libbegetutil",
67+ "input:libmmi-client",
68+ "input:oh_input_manager",
69+ "ipc:ipc_core",
70+ "os_account:libaccountkits",
71+ "os_account:os_account_innerkits",
72+ "safwk:system_ability_fwk",
73+ "samgr:samgr_proxy",
74+ "sensor:sensor_interface_native",
75+ "window_manager:libdm_lite",
76+ ]
77+
78+ ldflags = ["-Wl,--allow-multiple-definition"]
79+}
80+ 
81+group("fuzztest") {
82+ testonly = true
83+ deps = [
84+ ":McMotionManagerElevenFuzzTest",
85+ ]
86+}
Atest/fuzztest/mcmotionmanagereleven_fuzzer/corpus/init+16-0
@@ -0,0 +1,16 @@
1+/*
2+ * Copyright (C) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+FUZZ
Atest/fuzztest/mcmotionmanagereleven_fuzzer/mcmotionmanagereleven_fuzzer.cpp+202-0
@@ -0,0 +1,202 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <fuzzer/FuzzedDataProvider.h>
17+#include "mcmotionmanagereleven_fuzzer.h"
18+#include "mc_motion_manager.h"
19+#include "mc_connect_manager.h"
20+#include "mechbody_controller_types.h"
21+#include "mechbody_controller_enums.h"
22+#include "mc_send_adapter.h"
23+#include "mc_command_factory.h"
24+#include "mc_register_mech_position_info_cmd.h"
25+#include "mc_register_mech_camera_key_event_cmd.h"
26+#include "mc_register_mech_state_info_cmd.h"
27+#include "mc_normal_register_mech_generic_event_cmd.h"
28+#include "mc_register_mech_cliff_info_cmd.h"
29+#include "mc_register_mech_obstacle_info_cmd.h"
30+#include "mc_register_mech_control_result_cmd.h"
31+#include "mc_register_mech_wheel_data_cmd.h"
32+#include "mc_register_mech_tracking_enable_cmd.h"
33+#include "mc_get_mech_protocol_ver_cmd.h"
34+#include "mc_normal_get_mech_base_info_cmd.h"
35+#include "mc_normal_get_mech_capability_info_cmd.h"
36+#include "mc_get_mech_limit_info_cmd.h"
37+#include "mc_normal_set_mech_protocol_ver_cmd.h"
38+#include "mc_data_buffer.h"
39+#include <memory>
40+#include <map>
41+#include "mock_transport_send_adapter.h"
42+#include "mechbody_controller_log.h"
43+ 
44+namespace {
45+constexpr int32_t TEST_MECH_ID = 1;
46+constexpr int32_t MAX_ACTION_TYPE_VALUE = 2006;
47+}
48+ 
49+using namespace OHOS;
50+using namespace OHOS::MechBodyController;
51+ 
52+namespace {
53+const std::string TAG = "MotionManagerElevenFuzz";
54+ 
55+std::shared_ptr<MotionManager> g_motionManager = nullptr;
56+std::shared_ptr<MockTransportSendAdapter> g_mockAdapter = nullptr;
57+ 
58+void InitMotionManager()
59+{
60+ if (g_motionManager == nullptr) {
61+ g_mockAdapter = std::make_shared<MockTransportSendAdapter>();
62+ g_motionManager = std::make_shared<MotionManager>(g_mockAdapter, TEST_MECH_ID, false, 0x00000000);
63+ 
64+ MechInfo testMech;
65+ testMech.mechId = TEST_MECH_ID;
66+ testMech.mechType = MechType::PORTABLE_GIMBAL;
67+ testMech.mac = "AA:BB:CC:DD:EE:FF";
68+ testMech.state = AttachmentState::ATTACHED;
69+ testMech.deviceIdentifier = 0x00000000;
70+ MechConnectManager::GetInstance().AddMechInfo(testMech);
71+ MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
72+ }
73+}
74+ 
75+void FuzzMechTrackingStatusNotify(const uint8_t *data, size_t size)
76+{
77+ InitMotionManager();
78+ auto cmd = std::make_shared<RegisterMechTrackingEnableCmd>();
79+ g_motionManager->MechTrackingStatusNotify(cmd);
80+}
81+ 
82+void FuzzRotateWithExtremeValues(const uint8_t *data, size_t size)
83+{
84+ FuzzedDataProvider provider(data, size);
85+ InitMotionManager();
86+ auto rotateParam = std::make_shared<RotateParam>();
87+ rotateParam->degree.yaw = provider.ConsumeFloatingPoint<float>();
88+ rotateParam->degree.roll = provider.ConsumeFloatingPoint<float>();
89+ rotateParam->degree.pitch = provider.ConsumeFloatingPoint<float>();
90+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
91+ rotateParam->isRelative = provider.ConsumeBool();
92+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
93+ std::string napiCmdId = provider.ConsumeRandomLengthString();
94+ g_motionManager->Rotate(rotateParam, tokenId, napiCmdId);
95+}
96+ 
97+void FuzzMoveWithZeroParams(const uint8_t *data, size_t size)
98+{
99+ FuzzedDataProvider provider(data, size);
100+ InitMotionManager();
101+ auto moveParams = std::make_shared<MoveParams>();
102+ moveParams->distance = 0;
103+ moveParams->angle = 0.0f;
104+ moveParams->speedGear = SpeedGear::LOW_SPEED;
105+ moveParams->mode = MarchingMode::TURNING_MOVING;
106+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
107+ std::string napiCmdId = provider.ConsumeRandomLengthString();
108+ g_motionManager->Move(tokenId, napiCmdId, moveParams);
109+}
110+ 
111+void FuzzMoveBySpeedWithZeroParams(const uint8_t *data, size_t size)
112+{
113+ FuzzedDataProvider provider(data, size);
114+ InitMotionManager();
115+ auto speedParams = std::make_shared<SpeedParams>();
116+ speedParams->speed = 0;
117+ speedParams->angle = 0.0f;
118+ speedParams->mode = MarchingMode::TURNING_MOVING;
119+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
120+ std::string napiCmdId = provider.ConsumeRandomLengthString();
121+ uint16_t duration = provider.ConsumeIntegral<uint16_t>();
122+ g_motionManager->MoveBySpeed(tokenId, napiCmdId, duration, speedParams);
123+}
124+ 
125+void FuzzRotateBySpeedWithZeroDuration(const uint8_t *data, size_t size)
126+{
127+ FuzzedDataProvider provider(data, size);
128+ InitMotionManager();
129+ auto rotateSpeedParam = std::make_shared<RotateBySpeedParam>();
130+ rotateSpeedParam->speed.yawSpeed = provider.ConsumeFloatingPoint<float>();
131+ rotateSpeedParam->speed.rollSpeed = provider.ConsumeFloatingPoint<float>();
132+ rotateSpeedParam->speed.pitchSpeed = provider.ConsumeFloatingPoint<float>();
133+ rotateSpeedParam->duration = 0;
134+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
135+ std::string napiCmdId = provider.ConsumeRandomLengthString();
136+ g_motionManager->RotateBySpeed(rotateSpeedParam, tokenId, napiCmdId);
137+}
138+ 
139+void FuzzTurnBySpeedWithZeroDuration(const uint8_t *data, size_t size)
140+{
141+ FuzzedDataProvider provider(data, size);
142+ InitMotionManager();
143+ uint32_t tokenId = provider.ConsumeIntegral<uint32_t>();
144+ std::string napiCmdId = provider.ConsumeRandomLengthString();
145+ float angleSpeed = provider.ConsumeFloatingPoint<float>();
146+ g_motionManager->TurnBySpeed(tokenId, napiCmdId, angleSpeed, 0);
147+}
148+ 
149+void FuzzInit(const uint8_t *data, size_t size)
150+{
151+ HILOGI("FuzzInit start.");
152+ FuzzedDataProvider provider(data, size);
153+ bool isFirstConnect = provider.ConsumeBool();
154+ uint32_t deviceIdentifier = provider.ConsumeIntegral<uint32_t>();
155+ 
156+ auto mockAdapter = std::make_shared<MockTransportSendAdapter>();
157+ auto motionManager = std::make_shared<MotionManager>(mockAdapter, TEST_MECH_ID, isFirstConnect, deviceIdentifier);
158+ 
159+ MechInfo testMech;
160+ testMech.mechId = TEST_MECH_ID;
161+ testMech.mechType = MechType::PORTABLE_GIMBAL;
162+ testMech.mac = "AA:BB:CC:DD:EE:FF";
163+ testMech.state = AttachmentState::ATTACHED;
164+ testMech.deviceIdentifier = deviceIdentifier;
165+ MechConnectManager::GetInstance().AddMechInfo(testMech);
166+ MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
167+ 
168+ motionManager->Init();
169+}
170+ 
171+void FuzzMMIKeyEvent(const uint8_t *data, size_t size)
172+{
173+ FuzzedDataProvider provider(data, size);
174+ InitMotionManager();
175+ int32_t eventTypeValue = provider.ConsumeIntegral<int32_t>();
176+ CameraKeyEvent eventType = static_cast<CameraKeyEvent>(eventTypeValue);
177+ g_motionManager->MMIKeyEvent(eventType);
178+}
179+ 
180+void FuzzCreateKeyEvent(const uint8_t *data, size_t size)
181+{
182+ FuzzedDataProvider provider(data, size);
183+ InitMotionManager();
184+ int32_t keyCode = provider.ConsumeIntegral<int32_t>();
185+ int32_t keyAction = provider.ConsumeIntegral<int32_t>();
186+ g_motionManager->CreateKeyEvent(keyCode, keyAction);
187+}
188+ 
189+} // namespace
190+ 
191+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
192+{
193+ FuzzMechTrackingStatusNotify(data, size);
194+ FuzzRotateWithExtremeValues(data, size);
195+ FuzzMoveWithZeroParams(data, size);
196+ FuzzMoveBySpeedWithZeroParams(data, size);
197+ FuzzRotateBySpeedWithZeroDuration(data, size);
198+ FuzzTurnBySpeedWithZeroDuration(data, size);
199+ FuzzMMIKeyEvent(data, size);
200+ FuzzCreateKeyEvent(data, size);
201+ return 0;
202+}
Atest/fuzztest/mcmotionmanagereleven_fuzzer/mcmotionmanagereleven_fuzzer.h+34-0
@@ -0,0 +1,34 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MCMOTIONMANAGERELEVEN_FUZZER_FUZZER_H
17+#define MCMOTIONMANAGERELEVEN_FUZZER_FUZZER_H
18+ 
19+#include <cstdint>
20+#include <memory>
21+ 
22+namespace OHOS {
23+namespace MechBodyController {
24+ 
25+class MotionManager;
26+class TransportSendAdapter;
27+ 
28+std::shared_ptr<MotionManager> CreateTestMotionManager();
29+std::shared_ptr<TransportSendAdapter> CreateTestSendAdapter();
30+ 
31+} // namespace MechBodyController
32+} // namespace OHOS
33+ 
34+#endif // MCMOTIONMANAGERELEVEN_FUZZER_FUZZER_H
Atest/fuzztest/mcmotionmanagereleven_fuzzer/project.xml+25-0
@@ -0,0 +1,25 @@
1+<?xml version="1.0" encoding="utf-8"?>
2+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
3+ Licensed under the Apache License, Version 2.0 (the "License");
4+ you may not use this file except in compliance with the License.
5+ You may obtain a copy of the License at
6+ 
7+ http://www.apache.org/licenses/LICENSE-2.0
8+ 
9+ Unless required by applicable law or agreed to in writing, software
10+ distributed under the License is distributed on an "AS IS" BASIS,
11+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ See the License for the specific language governing permissions and
13+ limitations under the License.
14+ 
15+-->
16+<fuzz_config>
17+ <fuzztest>
18+ <!-- maximum length of a test input -->
19+ <max_len>1000</max_len>
20+ <!-- maximum total time in seconds to run the fuzzer -->
21+ <max_total_time>300</max_total_time>
22+ <!-- memory usage limit in Mb -->
23+ <rss_limit_mb>4096</rss_limit_mb>
24+ </fuzztest>
25+</fuzz_config>
Atest/fuzztest/mcmotionmanagerfifteen_fuzzer/BUILD.gn+86-0
@@ -0,0 +1,86 @@
1+# Copyright (c) 2025 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+import("//build/config/features.gni")
14+import("//build/test.gni")
15+ 
16+ohos_fuzztest("McMotionManagerFifteenFuzzTest") {
17+ module_out_path = "mechbody_controller/mechbody_controller/"
18+ mechbody_path =
19+ "//foundation/distributedhardware/mechbody_controller"
20+ fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanagerfifteen_fuzzer"
21+ 
22+ include_dirs = [
23+ "//foundation/distributedhardware/mechbody_controller/services/include",
24+ "//foundation/distributedhardware/mechbody_controller/services/include/motion",
25+ "//foundation/distributedhardware/mechbody_controller/services/include/transport",
26+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command",
27+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x01",
28+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x02",
29+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x03",
30+ "//foundation/distributedhardware/mechbody_controller/services/include/controller",
31+ "//foundation/distributedhardware/mechbody_controller/services/include/connect",
32+ "//foundation/distributedhardware/mechbody_controller/services/include/utils",
33+ "//foundation/distributedhardware/mechbody_controller/services/include/swing",
34+ "//foundation/distributedhardware/mechbody_controller/interface/inner_api",
35+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/common",
36+ ]
37+
38+ cflags = ["-g", "-O0", "-w", "-fno-omit-frame-pointer", "-Dprivate=public", "-Dprotected=public"]
39+
40+ sources = [
41+ "mcmotionmanagerfifteen_fuzzer.cpp"
42+ ]
43+
44+ deps = [
45+ "//foundation/distributedhardware/mechbody_controller/services:mechbody_service",
46+ ]
47+
48+ external_deps = [
49+ "access_token:libaccesstoken_sdk",
50+ "access_token:libtokenid_sdk",
51+ "access_token:libtokensetproc_shared",
52+ "ability_base:base",
53+ "ability_runtime:ability_manager",
54+ "ability_runtime:app_manager",
55+ "bluetooth:btcommon",
56+ "bluetooth:btframework",
57+ "camera_framework:camera_framework",
58+ "cJSON:cjson",
59+ "c_utils:utils",
60+ "distributed_notification_service:ans_innerkits",
61+ "drivers_interface_camera:metadata",
62+ "eventhandler:libeventhandler",
63+ "graphic_surface:surface",
64+ "hilog:libhilog",
65+ "hisysevent:libhisysevent",
66+ "init:libbegetutil",
67+ "input:libmmi-client",
68+ "input:oh_input_manager",
69+ "ipc:ipc_core",
70+ "os_account:libaccountkits",
71+ "os_account:os_account_innerkits",
72+ "safwk:system_ability_fwk",
73+ "samgr:samgr_proxy",
74+ "sensor:sensor_interface_native",
75+ "window_manager:libdm_lite",
76+ ]
77+
78+ ldflags = ["-Wl,--allow-multiple-definition"]
79+}
80+ 
81+group("fuzztest") {
82+ testonly = true
83+ deps = [
84+ ":McMotionManagerFifteenFuzzTest",
85+ ]
86+}
Atest/fuzztest/mcmotionmanagerfifteen_fuzzer/corpus/init+16-0
@@ -0,0 +1,16 @@
1+/*
2+ * Copyright (C) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+FUZZ
Atest/fuzztest/mcmotionmanagerfifteen_fuzzer/mcmotionmanagerfifteen_fuzzer.cpp+162-0
@@ -0,0 +1,162 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <fuzzer/FuzzedDataProvider.h>
17+#include "mcmotionmanagerfifteen_fuzzer.h"
18+#include "mc_motion_manager.h"
19+#include "mc_connect_manager.h"
20+#include "mechbody_controller_types.h"
21+#include "mechbody_controller_enums.h"
22+#include "mc_send_adapter.h"
23+#include "mc_command_factory.h"
24+#include "mc_register_mech_position_info_cmd.h"
25+#include "mc_register_mech_camera_key_event_cmd.h"
26+#include "mc_register_mech_state_info_cmd.h"
27+#include "mc_normal_register_mech_generic_event_cmd.h"
28+#include "mc_register_mech_cliff_info_cmd.h"
29+#include "mc_register_mech_obstacle_info_cmd.h"
30+#include "mc_register_mech_control_result_cmd.h"
31+#include "mc_register_mech_wheel_data_cmd.h"
32+#include "mc_register_mech_tracking_enable_cmd.h"
33+#include "mc_get_mech_protocol_ver_cmd.h"
34+#include "mc_normal_get_mech_base_info_cmd.h"
35+#include "mc_normal_get_mech_capability_info_cmd.h"
36+#include "mc_get_mech_limit_info_cmd.h"
37+#include "mc_normal_set_mech_protocol_ver_cmd.h"
38+#include "mc_data_buffer.h"
39+#include <memory>
40+#include <map>
41+#include "mock_transport_send_adapter.h"
42+#include "mechbody_controller_log.h"
43+ 
44+namespace {
45+constexpr int32_t TEST_MECH_ID = 1;
46+constexpr int32_t MAX_ACTION_TYPE_VALUE = 2006;
47+}
48+ 
49+using namespace OHOS;
50+using namespace OHOS::MechBodyController;
51+ 
52+namespace {
53+const std::string TAG = "MotionManagerFifteenFuzz";
54+ 
55+std::shared_ptr<MotionManager> g_motionManager = nullptr;
56+std::shared_ptr<MockTransportSendAdapter> g_mockAdapter = nullptr;
57+ 
58+void InitMotionManager()
59+{
60+ if (g_motionManager == nullptr) {
61+ g_mockAdapter = std::make_shared<MockTransportSendAdapter>();
62+ g_motionManager = std::make_shared<MotionManager>(g_mockAdapter, TEST_MECH_ID, false, 0x00000000);
63+ 
64+ MechInfo testMech;
65+ testMech.mechId = TEST_MECH_ID;
66+ testMech.mechType = MechType::PORTABLE_GIMBAL;
67+ testMech.mac = "AA:BB:CC:DD:EE:FF";
68+ testMech.state = AttachmentState::ATTACHED;
69+ testMech.deviceIdentifier = 0x00000000;
70+ MechConnectManager::GetInstance().AddMechInfo(testMech);
71+ MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
72+ }
73+}
74+ 
75+void FuzzIsDesktopScene(FuzzedDataProvider &provider)
76+{
77+ InitMotionManager();
78+ std::vector<AppExecFwk::AppStateData> list;
79+ g_motionManager->IsDesktopScene(list);
80+}
81+ 
82+void FuzzConnectServiceExtension(FuzzedDataProvider &provider)
83+{
84+ InitMotionManager();
85+ AAFwk::WantParams wantParams;
86+ g_motionManager->ConnectServiceExtension(wantParams);
87+}
88+ 
89+void FuzzIsLimitedWithExtremeValues(FuzzedDataProvider &provider)
90+{
91+ InitMotionManager();
92+ g_motionManager->IsLimited(FLT_MAX, FLT_MAX, FLT_MAX);
93+ g_motionManager->IsLimited(FLT_MIN, FLT_MIN, FLT_MIN);
94+ g_motionManager->IsLimited(-FLT_MAX, -FLT_MAX, -FLT_MAX);
95+ g_motionManager->IsLimited(0.0f, 0.0f, 0.0f);
96+ g_motionManager->IsLimited(-1.0f, 1.0f, 0.0f);
97+ g_motionManager->IsLimited(-3.14f, 3.14f, 0.0f);
98+}
99+ 
100+void FuzzIsLimitedWithBoundaryConditions(FuzzedDataProvider &provider)
101+{
102+ InitMotionManager();
103+ // 测试边界条件
104+ g_motionManager->IsLimited(-0.001f, 0.001f, 0.0f);
105+ g_motionManager->IsLimited(-0.001f, 0.001f, 0.001f);
106+ g_motionManager->IsLimited(-0.001f, 0.001f, -0.001f);
107+ g_motionManager->IsLimited(-100.0f, 100.0f, 99.999f);
108+ g_motionManager->IsLimited(-100.0f, 100.0f, -99.999f);
109+}
110+ 
111+void FuzzProcessTrackingStatusMultipleCalls(FuzzedDataProvider &provider)
112+{
113+ InitMotionManager();
114+ int32_t iterations = provider.ConsumeIntegralInRange<int32_t>(1, 10);
115+ for (int32_t i = 0; i < iterations; ++i) {
116+ g_motionManager->ProcessTrackingStatus();
117+ }
118+}
119+ 
120+void FuzzGetMechRealNameMultipleCalls(FuzzedDataProvider &provider)
121+{
122+ InitMotionManager();
123+ int32_t iterations = provider.ConsumeIntegralInRange<int32_t>(1, 10);
124+ for (int32_t i = 0; i < iterations; ++i) {
125+ g_motionManager->GetMechRealName();
126+ }
127+}
128+ 
129+void FuzzGetWheelCapabilityInfoMultipleCalls(FuzzedDataProvider &provider)
130+{
131+ InitMotionManager();
132+ int32_t iterations = provider.ConsumeIntegralInRange<int32_t>(1, 10);
133+ for (int32_t i = 0; i < iterations; ++i) {
134+ g_motionManager->GetWheelCapabilityInfo();
135+ }
136+}
137+ 
138+void FuzzMechExecutionResultNotifyMultipleCalls(FuzzedDataProvider &provider)
139+{
140+ InitMotionManager();
141+ int32_t iterations = provider.ConsumeIntegralInRange<int32_t>(1, 10);
142+ for (int32_t i = 0; i < iterations; ++i) {
143+ auto cmd = std::make_shared<RegisterMechControlResultCmd>();
144+ g_motionManager->MechExecutionResultNotify(cmd);
145+ }
146+}
147+ 
148+} // namespace
149+ 
150+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
151+{
152+ FuzzedDataProvider provider(data, size);
153+ FuzzIsDesktopScene(provider);
154+ FuzzConnectServiceExtension(provider);
155+ FuzzIsLimitedWithExtremeValues(provider);
156+ FuzzIsLimitedWithBoundaryConditions(provider);
157+ FuzzProcessTrackingStatusMultipleCalls(provider);
158+ FuzzGetMechRealNameMultipleCalls(provider);
159+ FuzzGetWheelCapabilityInfoMultipleCalls(provider);
160+ FuzzMechExecutionResultNotifyMultipleCalls(provider);
161+ return 0;
162+}
Atest/fuzztest/mcmotionmanagerfifteen_fuzzer/mcmotionmanagerfifteen_fuzzer.h+34-0
@@ -0,0 +1,34 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MCMOTIONMANAGERFIFTEEN_FUZZER_FUZZER_H
17+#define MCMOTIONMANAGERFIFTEEN_FUZZER_FUZZER_H
18+ 
19+#include <cstdint>
20+#include <memory>
21+ 
22+namespace OHOS {
23+namespace MechBodyController {
24+ 
25+class MotionManager;
26+class TransportSendAdapter;
27+ 
28+std::shared_ptr<MotionManager> CreateTestMotionManager();
29+std::shared_ptr<TransportSendAdapter> CreateTestSendAdapter();
30+ 
31+} // namespace MechBodyController
32+} // namespace OHOS
33+ 
34+#endif // MCMOTIONMANAGERFIFTEEN_FUZZER_FUZZER_H
Atest/fuzztest/mcmotionmanagerfifteen_fuzzer/project.xml+25-0
@@ -0,0 +1,25 @@
1+<?xml version="1.0" encoding="utf-8"?>
2+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
3+ Licensed under the Apache License, Version 2.0 (the "License");
4+ you may not use this file except in compliance with the License.
5+ You may obtain a copy of the License at
6+ 
7+ http://www.apache.org/licenses/LICENSE-2.0
8+ 
9+ Unless required by applicable law or agreed to in writing, software
10+ distributed under the License is distributed on an "AS IS" BASIS,
11+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ See the License for the specific language governing permissions and
13+ limitations under the License.
14+ 
15+-->
16+<fuzz_config>
17+ <fuzztest>
18+ <!-- maximum length of a test input -->
19+ <max_len>1000</max_len>
20+ <!-- maximum total time in seconds to run the fuzzer -->
21+ <max_total_time>300</max_total_time>
22+ <!-- memory usage limit in Mb -->
23+ <rss_limit_mb>4096</rss_limit_mb>
24+ </fuzztest>
25+</fuzz_config>
Atest/fuzztest/mcmotionmanagerfive_fuzzer/BUILD.gn+86-0
@@ -0,0 +1,86 @@
1+# Copyright (c) 2025 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+import("//build/config/features.gni")
14+import("//build/test.gni")
15+ 
16+ohos_fuzztest("McMotionManagerFiveFuzzTest") {
17+ module_out_path = "mechbody_controller/mechbody_controller/"
18+ mechbody_path =
19+ "//foundation/distributedhardware/mechbody_controller"
20+ fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanagerfive_fuzzer"
21+ 
22+ include_dirs = [
23+ "//foundation/distributedhardware/mechbody_controller/services/include",
24+ "//foundation/distributedhardware/mechbody_controller/services/include/motion",
25+ "//foundation/distributedhardware/mechbody_controller/services/include/transport",
26+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command",
27+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x01",
28+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x02",
29+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x03",
30+ "//foundation/distributedhardware/mechbody_controller/services/include/controller",
31+ "//foundation/distributedhardware/mechbody_controller/services/include/connect",
32+ "//foundation/distributedhardware/mechbody_controller/services/include/swing",
33+ "//foundation/distributedhardware/mechbody_controller/services/include/utils",
34+ "//foundation/distributedhardware/mechbody_controller/interface/inner_api",
35+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/common",
36+ ]
37+
38+ cflags = ["-g", "-O0", "-w", "-fno-omit-frame-pointer", "-Dprivate=public", "-Dprotected=public"]
39+
40+ sources = [
41+ "mcmotionmanagerfive_fuzzer.cpp"
42+ ]
43+
44+ deps = [
45+ "//foundation/distributedhardware/mechbody_controller/services:mechbody_service",
46+ ]
47+
48+ external_deps = [
49+ "access_token:libaccesstoken_sdk",
50+ "access_token:libtokenid_sdk",
51+ "access_token:libtokensetproc_shared",
52+ "ability_base:base",
53+ "ability_runtime:ability_manager",
54+ "ability_runtime:app_manager",
55+ "bluetooth:btcommon",
56+ "bluetooth:btframework",
57+ "camera_framework:camera_framework",
58+ "cJSON:cjson",
59+ "c_utils:utils",
60+ "distributed_notification_service:ans_innerkits",
61+ "drivers_interface_camera:metadata",
62+ "eventhandler:libeventhandler",
63+ "graphic_surface:surface",
64+ "hilog:libhilog",
65+ "hisysevent:libhisysevent",
66+ "init:libbegetutil",
67+ "input:libmmi-client",
68+ "input:oh_input_manager",
69+ "ipc:ipc_core",
70+ "os_account:libaccountkits",
71+ "os_account:os_account_innerkits",
72+ "safwk:system_ability_fwk",
73+ "samgr:samgr_proxy",
74+ "sensor:sensor_interface_native",
75+ "window_manager:libdm_lite",
76+ ]
77+
78+ ldflags = ["-Wl,--allow-multiple-definition"]
79+}
80+ 
81+group("fuzztest") {
82+ testonly = true
83+ deps = [
84+ ":McMotionManagerFiveFuzzTest",
85+ ]
86+}
Atest/fuzztest/mcmotionmanagerfive_fuzzer/corpus/init+16-0
@@ -0,0 +1,16 @@
1+/*
2+ * Copyright (C) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+FUZZ
Atest/fuzztest/mcmotionmanagerfive_fuzzer/mcmotionmanagerfive_fuzzer.cpp+214-0
@@ -0,0 +1,214 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <fuzzer/FuzzedDataProvider.h>
17+#include "mcmotionmanagerfive_fuzzer.h"
18+#include "mc_motion_manager.h"
19+#include "mc_connect_manager.h"
20+#include "mechbody_controller_types.h"
21+#include "mechbody_controller_enums.h"
22+#include "mc_send_adapter.h"
23+#include "mc_command_factory.h"
24+#include "mc_register_mech_position_info_cmd.h"
25+#include "mc_register_mech_camera_key_event_cmd.h"
26+#include "mc_register_mech_state_info_cmd.h"
27+#include "mc_normal_register_mech_generic_event_cmd.h"
28+#include "mc_register_mech_cliff_info_cmd.h"
29+#include "mc_register_mech_obstacle_info_cmd.h"
30+#include "mc_register_mech_control_result_cmd.h"
31+#include "mc_register_mech_wheel_data_cmd.h"
32+#include "mc_register_mech_tracking_enable_cmd.h"
33+#include "mc_get_mech_protocol_ver_cmd.h"
34+#include "mc_normal_get_mech_base_info_cmd.h"
35+#include "mc_normal_get_mech_capability_info_cmd.h"
36+#include "mc_get_mech_limit_info_cmd.h"
37+#include "mc_normal_set_mech_protocol_ver_cmd.h"
38+#include "mc_data_buffer.h"
39+#include <memory>
40+#include <map>
41+#include "mechbody_controller_log.h"
42+#include "mock_transport_send_adapter.h"
43+ 
44+namespace {
45+constexpr int32_t TEST_MECH_ID = 1;
46+constexpr int32_t MAX_ACTION_TYPE_VALUE = 2006;
47+}
48+ 
49+using namespace OHOS;
50+using namespace OHOS::MechBodyController;
51+ 
52+namespace {
53+const std::string TAG = "MotionManagerFiveFuzz";
54+class MockCommandBase : public CommandBase {
55+public:
56+ MockCommandBase() = default;
57+ ~MockCommandBase() override = default;
58+ 
59+ std::shared_ptr<MechDataBuffer> Marshal() const override
60+ {
61+ return nullptr;
62+ }
63+ 
64+ void TriggerResponse(std::shared_ptr<MechDataBuffer> data) override {}
65+ 
66+ void SetCmdSet(uint8_t cmdSet) { cmdSet_ = cmdSet; }
67+ void SetCmdId(uint8_t cmdId) { cmdId_ = cmdId; }
68+};
69+ 
70+std::shared_ptr<MotionManager> g_motionManager = nullptr;
71+std::shared_ptr<MockTransportSendAdapter> g_mockAdapter = nullptr;
72+ 
73+void InitMotionManager()
74+{
75+ if (g_motionManager == nullptr) {
76+ g_mockAdapter = std::make_shared<MockTransportSendAdapter>();
77+ g_motionManager = std::make_shared<MotionManager>(g_mockAdapter, TEST_MECH_ID, false, 0x00000000);
78+ 
79+ MechInfo testMech;
80+ testMech.mechId = TEST_MECH_ID;
81+ testMech.mechType = MechType::PORTABLE_GIMBAL;
82+ testMech.mac = "AA:BB:CC:DD:EE:FF";
83+ testMech.state = AttachmentState::ATTACHED;
84+ testMech.deviceIdentifier = 0x00000000;
85+ MechConnectManager::GetInstance().AddMechInfo(testMech);
86+ MechConnectManager::GetInstance().NotifyMechState(TEST_MECH_ID, true);
87+ }
88+}
89+ 
90+void FuzzAllCheckDegreeMethods(FuzzedDataProvider &provider)
91+{
92+ InitMotionManager();
93+ auto rotateParam = std::make_shared<RotateParam>();
94+ rotateParam->degree.yaw = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
95+ rotateParam->degree.roll = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
96+ rotateParam->degree.pitch = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
97+ rotateParam->duration = provider.ConsumeIntegral<uint16_t>();
98+ rotateParam->isRelative = provider.ConsumeBool();
99+
100+ RotateDegreeLimit limit;
101+ limit.posMax.yaw = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
102+ limit.negMax.yaw = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
103+ limit.posMax.roll = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
104+ limit.negMax.roll = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
105+ limit.posMax.pitch = provider.ConsumeFloatingPointInRange<float>(0.0f, 1.57f);
106+ limit.negMax.pitch = provider.ConsumeFloatingPointInRange<float>(-1.57f, 0.0f);
107+
108+ float yawResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
109+ float rollResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
110+ float pitchResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
111+
112+ g_motionManager->CheckRollDegree(rotateParam, limit, rollResult);
113+ g_motionManager->CheckPitchDegree(rotateParam, limit, pitchResult);
114+}
115+ 
116+void FuzzAllCheckSpeedMethods(FuzzedDataProvider &provider)
117+{
118+ InitMotionManager();
119+ auto rotateBySpeedParam = std::make_shared<RotateBySpeedParam>();
120+ rotateBySpeedParam->speed.yawSpeed = provider.ConsumeFloatingPointInRange<float>(-1.0f, 1.0f);
121+ rotateBySpeedParam->speed.rollSpeed = provider.ConsumeFloatingPointInRange<float>(-1.0f, 1.0f);
122+ rotateBySpeedParam->speed.pitchSpeed = provider.ConsumeFloatingPointInRange<float>(-1.0f, 1.0f);
123+ rotateBySpeedParam->duration = provider.ConsumeIntegral<uint16_t>();
124+
125+ RotateDegreeLimit limit;
126+ limit.posMax.yaw = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
127+ limit.negMax.yaw = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
128+ limit.posMax.roll = provider.ConsumeFloatingPointInRange<float>(0.0f, 3.14f);
129+ limit.negMax.roll = provider.ConsumeFloatingPointInRange<float>(-3.14f, 0.0f);
130+ limit.posMax.pitch = provider.ConsumeFloatingPointInRange<float>(0.0f, 1.57f);
131+ limit.negMax.pitch = provider.ConsumeFloatingPointInRange<float>(-1.57f, 0.0f);
132+
133+ float yawResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
134+ float rollResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
135+ float pitchResult = provider.ConsumeFloatingPointInRange<float>(-6.28f, 6.28f);
136+
137+ g_motionManager->CheckYawSpeed(rotateBySpeedParam, limit, yawResult);
138+ g_motionManager->CheckRollSpeed(rotateBySpeedParam, limit, rollResult);
139+ g_motionManager->CheckPitchSpeed(rotateBySpeedParam, limit, pitchResult);
140+}
141+ 
142+void FuzzTryGetDeviceRealNameSync(FuzzedDataProvider &provider)
143+{
144+ InitMotionManager();
145+ uint32_t timeoutMs = provider.ConsumeIntegral<uint32_t>();
146+ const std::string &deviceRealName = g_motionManager->TryGetDeviceRealNameSync(timeoutMs);
147+}
148+ 
149+void FuzzTryGetDeviceRealNameSyncWithZeroTimeout(FuzzedDataProvider &provider)
150+{
151+ InitMotionManager();
152+ const std::string &deviceRealName = g_motionManager->TryGetDeviceRealNameSync(0);
153+}
154+ 
155+void FuzzTryGetDeviceRealNameSyncWithTimeout(FuzzedDataProvider &provider)
156+{
157+ InitMotionManager();
158+ uint32_t timeoutMs = provider.ConsumeIntegralInRange<uint32_t>(1000, 5000);
159+ const std::string &deviceRealName = g_motionManager->TryGetDeviceRealNameSync(timeoutMs);
160+}
161+ 
162+void FuzzTryGetDeviceRealNameSyncAfterSetName(FuzzedDataProvider &provider)
163+{
164+ InitMotionManager();
165+ std::string deviceRealName = provider.ConsumeRandomLengthString(32);
166+ g_motionManager->SetDeviceRealName(deviceRealName);
167+
168+ uint32_t timeoutMs = provider.ConsumeIntegralInRange<uint32_t>(100, 1000);
169+ const std::string &result = g_motionManager->TryGetDeviceRealNameSync(timeoutMs);
170+}
171+ 
172+void FuzzFormatLimit(FuzzedDataProvider &provider)
173+{
174+ InitMotionManager();
175+ RotateDegreeLimit params;
176+ params.posMax.yaw = provider.ConsumeFloatingPointInRange<float>(0.0f, 10.0f);
177+ params.negMax.yaw = provider.ConsumeFloatingPointInRange<float>(-10.0f, 0.0f);
178+ params.posMax.roll = provider.ConsumeFloatingPointInRange<float>(0.0f, 10.0f);
179+ params.negMax.roll = provider.ConsumeFloatingPointInRange<float>(-10.0f, 0.0f);
180+ params.posMax.pitch = provider.ConsumeFloatingPointInRange<float>(0.0f, 10.0f);
181+ params.negMax.pitch = provider.ConsumeFloatingPointInRange<float>(-10.0f, 0.0f);
182+
183+ g_motionManager->FormatLimit(params);
184+}
185+ 
186+void FuzzFormatLimitWithNoLimit(FuzzedDataProvider &provider)
187+{
188+ InitMotionManager();
189+ RotateDegreeLimit params;
190+ params.posMax.yaw = 3.1415927f;
191+ params.negMax.yaw = -3.1415926f;
192+ params.posMax.roll = 3.1415927f;
193+ params.negMax.roll = -3.1415926f;
194+ params.posMax.pitch = 3.1415927f;
195+ params.negMax.pitch = -3.1415926f;
196+
197+ g_motionManager->FormatLimit(params);
198+}
199+ 
200+} // namespace
201+ 
202+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
203+{
204+ FuzzedDataProvider provider(data, size);
205+ FuzzAllCheckDegreeMethods(provider);
206+ FuzzAllCheckSpeedMethods(provider);
207+ FuzzTryGetDeviceRealNameSync(provider);
208+ FuzzTryGetDeviceRealNameSyncWithZeroTimeout(provider);
209+ FuzzTryGetDeviceRealNameSyncWithTimeout(provider);
210+ FuzzTryGetDeviceRealNameSyncAfterSetName(provider);
211+ FuzzFormatLimit(provider);
212+ FuzzFormatLimitWithNoLimit(provider);
213+ return 0;
214+}
Atest/fuzztest/mcmotionmanagerfive_fuzzer/mcmotionmanagerfive_fuzzer.h+34-0
@@ -0,0 +1,34 @@
1+/*
2+ * Copyright (c) 2025 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MCMOTIONMANAGERFIVE_FUZZER_H
17+#define MCMOTIONMANAGERFIVE_FUZZER_H
18+ 
19+#include <cstdint>
20+#include <memory>
21+ 
22+namespace OHOS {
23+namespace MechBodyController {
24+ 
25+class MotionManager;
26+class TransportSendAdapter;
27+ 
28+std::shared_ptr<MotionManager> CreateTestMotionManager();
29+std::shared_ptr<TransportSendAdapter> CreateTestSendAdapter();
30+ 
31+} // namespace MechBodyController
32+} // namespace OHOS
33+ 
34+#endif // MCMOTIONMANAGERFIVE_FUZZER_H
Atest/fuzztest/mcmotionmanagerfive_fuzzer/project.xml+25-0
@@ -0,0 +1,25 @@
1+<?xml version="1.0" encoding="utf-8"?>
2+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
3+ Licensed under the Apache License, Version 2.0 (the "License");
4+ you may not use this file except in compliance with the License.
5+ You may obtain a copy of the License at
6+ 
7+ http://www.apache.org/licenses/LICENSE-2.0
8+ 
9+ Unless required by applicable law or agreed to in writing, software
10+ distributed under the License is distributed on an "AS IS" BASIS,
11+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ See the License for the specific language governing permissions and
13+ limitations under the License.
14+ 
15+-->
16+<fuzz_config>
17+ <fuzztest>
18+ <!-- maximum length of a test input -->
19+ <max_len>1000</max_len>
20+ <!-- maximum total time in seconds to run the fuzzer -->
21+ <max_total_time>300</max_total_time>
22+ <!-- memory usage limit in Mb -->
23+ <rss_limit_mb>4096</rss_limit_mb>
24+ </fuzztest>
25+</fuzz_config>
Atest/fuzztest/mcmotionmanagerfour_fuzzer/BUILD.gn+86-0
@@ -0,0 +1,86 @@
1+# Copyright (c) 2025 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+import("//build/config/features.gni")
14+import("//build/test.gni")
15+ 
16+ohos_fuzztest("McMotionManagerFourFuzzTest") {
17+ module_out_path = "mechbody_controller/mechbody_controller/"
18+ mechbody_path =
19+ "//foundation/distributedhardware/mechbody_controller"
20+ fuzz_config_file = "${mechbody_path}/test/fuzztest/mcmotionmanagerfour_fuzzer"
21+ 
22+ include_dirs = [
23+ "//foundation/distributedhardware/mechbody_controller/services/include",
24+ "//foundation/distributedhardware/mechbody_controller/services/include/motion",
25+ "//foundation/distributedhardware/mechbody_controller/services/include/transport",
26+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command",
27+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x01",
28+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x02",
29+ "//foundation/distributedhardware/mechbody_controller/services/include/transport/command/0x03",
30+ "//foundation/distributedhardware/mechbody_controller/services/include/controller",
31+ "//foundation/distributedhardware/mechbody_controller/services/include/connect",
32+ "//foundation/distributedhardware/mechbody_controller/services/include/swing",
33+ "//foundation/distributedhardware/mechbody_controller/services/include/utils",
34+ "//foundation/distributedhardware/mechbody_controller/interface/inner_api",
35+ "//foundation/distributedhardware/mechbody_controller/test/fuzztest/common",
36+ ]
37+
38+ cflags = ["-g", "-O0", "-w", "-fno-omit-frame-pointer", "-Dprivate=public", "-Dprotected=public"]
39+
40+ sources = [
41+ "mcmotionmanagerfour_fuzzer.cpp"
42+ ]
43+
44+ deps = [
45+ "//foundation/distributedhardware/mechbody_controller/services:mechbody_service",
46+ ]
47+
48+ external_deps = [
49+ "access_token:libaccesstoken_sdk",
50+ "access_token:libtokenid_sdk",
51+ "access_token:libtokensetproc_shared",
52+ "ability_base:base",
53+ "ability_runtime:ability_manager",
54+ "ability_runtime:app_manager",
55+ "bluetooth:btcommon",
56+ "bluetooth:btframework",
57+ "camera_framework:camera_framework",
58+ "cJSON:cjson",
59+ "c_utils:utils",
60+ "distributed_notification_service:ans_innerkits",
61+ "drivers_interface_camera:metadata",
62+ "eventhandler:libeventhandler",
63+ "graphic_surface:surface",
64+ "hilog:libhilog",
65+ "hisysevent:libhisysevent",
66+ "init:libbegetutil",
67+ "input:libmmi-client",
68+ "input:oh_input_manager",
69+ "ipc:ipc_core",
70+ "os_account:libaccountkits",
71+ "os_account:os_account_innerkits",
72+ "safwk:system_ability_fwk",
73+ "samgr:samgr_proxy",
74+ "sensor:sensor_interface_native",
75+ "window_manager:libdm_lite",
76+ ]
77+
78+ ldflags = ["-Wl,--allow-multiple-definition"]
79+}
80+ 
81+group("fuzztest") {
82+ testonly = true
83+ deps = [
84+ ":McMotionManagerFourFuzzTest",
85+ ]
86+}
Atest/fuzztest/mcmotionmanagerfour_fuzzer/corpus/init+16-0
@@ -0,0 +1,16 @@
1+/*
2+ * Copyright (C) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+FUZZ