1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "addiccdiallingnumbers_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <thread>
21
22 #define private public
23 #include "addcoreservicetoken_fuzzer.h"
24 #include "core_service.h"
25 #include "napi_util.h"
26 #include "system_ability_definition.h"
27 #include "tel_event_handler.h"
28 #include "unistd.h"
29
30 using namespace OHOS::Telephony;
31 namespace OHOS {
32 static bool g_isInited = false;
33 constexpr int32_t SLOT_NUM = 2;
34 constexpr int32_t SIM_TYPE_NUM = 2;
35 constexpr int32_t SIZE_LIMIT = 4;
36 constexpr uint32_t FUCTION_SIZE = 100;
37
IsServiceInited()38 bool IsServiceInited()
39 {
40 if (!g_isInited) {
41 DelayedSingleton<CoreService>::GetInstance()->OnStart();
42 if (DelayedSingleton<CoreService>::GetInstance()->GetServiceRunningState() ==
43 static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
44 g_isInited = true;
45 }
46 }
47 return g_isInited;
48 }
49
OnRemoteRequest(const uint8_t * data,size_t size)50 void OnRemoteRequest(const uint8_t *data, size_t size)
51 {
52 if (!IsServiceInited()) {
53 return;
54 }
55
56 if (size < SIZE_LIMIT) {
57 return;
58 }
59
60 MessageParcel dataMessageParcel;
61 if (!dataMessageParcel.WriteInterfaceToken(CoreServiceStub::GetDescriptor())) {
62 return;
63 }
64 dataMessageParcel.WriteBuffer(data, size);
65 dataMessageParcel.RewindRead(0);
66
67 uint32_t code = (static_cast<uint32_t>(data[0]) << 24) | (static_cast<uint32_t>(data[1]) << 16) |
68 (static_cast<uint32_t>(data[2]) << 8) | (static_cast<uint32_t>(data[3])) % FUCTION_SIZE;
69
70 MessageParcel reply;
71 MessageOption option;
72 DelayedSingleton<CoreService>::GetInstance()->OnRemoteRequest(code, dataMessageParcel, reply, option);
73 }
74
GetSimGid1(const uint8_t * data,size_t size)75 void GetSimGid1(const uint8_t *data, size_t size)
76 {
77 if (!IsServiceInited()) {
78 return;
79 }
80
81 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
82 MessageParcel dataMessageParcel;
83 dataMessageParcel.WriteInt32(slotId);
84 dataMessageParcel.WriteBuffer(data, size);
85 dataMessageParcel.RewindRead(0);
86 MessageParcel reply;
87 DelayedSingleton<CoreService>::GetInstance()->OnGetSimGid1(dataMessageParcel, reply);
88 }
89
GetSimGid2(const uint8_t * data,size_t size)90 void GetSimGid2(const uint8_t *data, size_t size)
91 {
92 if (!IsServiceInited()) {
93 return;
94 }
95
96 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
97 MessageParcel dataMessageParcel;
98 dataMessageParcel.WriteInt32(slotId);
99 dataMessageParcel.WriteBuffer(data, size);
100 dataMessageParcel.RewindRead(0);
101 MessageParcel reply;
102 DelayedSingleton<CoreService>::GetInstance()->OnGetSimGid2(dataMessageParcel, reply);
103 }
104
GetSimAccountInfo(const uint8_t * data,size_t size)105 void GetSimAccountInfo(const uint8_t *data, size_t size)
106 {
107 if (!IsServiceInited()) {
108 return;
109 }
110
111 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
112 MessageParcel dataMessageParcel;
113 dataMessageParcel.WriteInt32(slotId);
114 dataMessageParcel.WriteBuffer(data, size);
115 dataMessageParcel.RewindRead(0);
116 MessageParcel reply;
117 DelayedSingleton<CoreService>::GetInstance()->OnGetSimSubscriptionInfo(dataMessageParcel, reply);
118 }
119
GetCardType(const uint8_t * data,size_t size)120 void GetCardType(const uint8_t *data, size_t size)
121 {
122 if (!IsServiceInited()) {
123 return;
124 }
125
126 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
127 MessageParcel dataMessageParcel;
128 dataMessageParcel.WriteInt32(slotId);
129 dataMessageParcel.WriteBuffer(data, size);
130 dataMessageParcel.RewindRead(0);
131 MessageParcel reply;
132 DelayedSingleton<CoreService>::GetInstance()->OnGetCardType(dataMessageParcel, reply);
133 }
134
GetSimState(const uint8_t * data,size_t size)135 void GetSimState(const uint8_t *data, size_t size)
136 {
137 if (!IsServiceInited()) {
138 return;
139 }
140
141 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
142 MessageParcel dataMessageParcel;
143 dataMessageParcel.WriteInt32(slotId);
144 dataMessageParcel.WriteBuffer(data, size);
145 dataMessageParcel.RewindRead(0);
146 MessageParcel reply;
147 DelayedSingleton<CoreService>::GetInstance()->OnGetSimState(dataMessageParcel, reply);
148 }
149
GetDsdsMode(const uint8_t * data,size_t size)150 void GetDsdsMode(const uint8_t *data, size_t size)
151 {
152 if (!IsServiceInited()) {
153 return;
154 }
155
156 int32_t dsdsMode = static_cast<int32_t>(*data);
157 MessageParcel dataMessageParcel;
158 dataMessageParcel.WriteInt32(dsdsMode);
159 dataMessageParcel.WriteBuffer(data, size);
160 dataMessageParcel.RewindRead(0);
161 MessageParcel reply;
162 DelayedSingleton<CoreService>::GetInstance()->OnGetDsdsMode(dataMessageParcel, reply);
163 }
164
HasSimCard(const uint8_t * data,size_t size)165 void HasSimCard(const uint8_t *data, size_t size)
166 {
167 if (!IsServiceInited()) {
168 return;
169 }
170
171 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
172 MessageParcel dataMessageParcel;
173 dataMessageParcel.WriteInt32(slotId);
174 dataMessageParcel.WriteBuffer(data, size);
175 dataMessageParcel.RewindRead(0);
176 MessageParcel reply;
177 DelayedSingleton<CoreService>::GetInstance()->OnHasSimCard(dataMessageParcel, reply);
178 }
179
AddIccDiallingNumbers(const uint8_t * data,size_t size)180 void AddIccDiallingNumbers(const uint8_t *data, size_t size)
181 {
182 if (!IsServiceInited()) {
183 return;
184 }
185
186 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
187 int32_t type = *data % SIM_TYPE_NUM + 1; // SIM_ADN 1 SIM_FDN 2
188 MessageParcel dataMessageParcel;
189 dataMessageParcel.WriteInt32(slotId);
190 dataMessageParcel.WriteInt32(type);
191 dataMessageParcel.WriteBuffer(data, size);
192 dataMessageParcel.RewindRead(0);
193 MessageParcel reply;
194 DelayedSingleton<CoreService>::GetInstance()->OnAddIccDiallingNumbers(dataMessageParcel, reply);
195 }
196
IsCTSimCard(const uint8_t * data,size_t size)197 void IsCTSimCard(const uint8_t *data, size_t size)
198 {
199 if (!IsServiceInited()) {
200 return;
201 }
202
203 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
204 MessageParcel dataMessageParcel;
205 dataMessageParcel.WriteInt32(slotId);
206 dataMessageParcel.WriteBuffer(data, size);
207 dataMessageParcel.RewindRead(0);
208 MessageParcel reply;
209 DelayedSingleton<CoreService>::GetInstance()->OnIsCTSimCard(dataMessageParcel, reply);
210 }
211
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)212 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
213 {
214 if (data == nullptr || size == 0) {
215 return;
216 }
217
218 OnRemoteRequest(data, size);
219 GetSimGid1(data, size);
220 GetSimGid2(data, size);
221 GetSimAccountInfo(data, size);
222 GetCardType(data, size);
223 GetSimState(data, size);
224 GetDsdsMode(data, size);
225 HasSimCard(data, size);
226 AddIccDiallingNumbers(data, size);
227 IsCTSimCard(data, size);
228 auto telRilManager = DelayedSingleton<CoreService>::GetInstance()->telRilManager_;
229 if (telRilManager == nullptr || telRilManager->handler_ == nullptr) {
230 return;
231 }
232 telRilManager->handler_->ClearFfrt(false);
233 telRilManager->handler_->queue_ = nullptr;
234 return;
235 }
236 } // namespace OHOS
237
238 /* Fuzzer entry point */
LLVMFuzzerInitialize(int * argc,char *** argv)239 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
240 {
241 OHOS::AddCoreServiceTokenFuzzer token;
242 return 0;
243 }
244
245 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)246 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
247 {
248 /* Run your code on data */
249 OHOS::DoSomethingInterestingWithMyAPI(data, size);
250 OHOS::DelayedSingleton<CoreService>::DestroyInstance();
251 return 0;
252 }
253