1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #define private public
17 #define protected public
18 #include "fuzzer/FuzzedDataProvider.h"
19 #include "scanserviceability_fuzzer.h"
20 #include "scan_service_ability.h"
21 #include "scan_callback_proxy.h"
22 #include "scan_service_ability_mock.h"
23 
24 namespace OHOS {
25 namespace Scan {
26     constexpr size_t FOO_MAX_LEN = 1024;
27     constexpr size_t U32_AT_SIZE = 4;
28 #ifdef SANE_ENABLE
29     constexpr uint8_t MAX_STRING_LENGTH = 255;
30     constexpr int MAX_SET_NUMBER = 100;
31 
TestInitScan(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)32     void TestInitScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
33     {
34         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
35         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
36         ScanServiceAbility::GetInstance()->ExitScan();
37     }
38 
TestGetScannerList(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)39     void TestGetScannerList(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
40     {
41         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
42         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
43         ScanServiceAbility::GetInstance()->GetScannerList();
44     }
45 
TestStopDiscover(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)46     void TestStopDiscover(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
47     {
48         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
49         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
50         ScanServiceAbility::GetInstance()->StopDiscover();
51     }
52 
TestOpenScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)53     void TestOpenScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
54     {
55         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
56         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
57         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
58         ScanServiceAbility::GetInstance()->OpenScanner(scannerId);
59     }
60 
TestCloseScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)61     void TestCloseScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
62     {
63         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
64         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
65         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
66         ScanServiceAbility::GetInstance()->OpenScanner(scannerId);
67         ScanServiceAbility::GetInstance()->CloseScanner(scannerId);
68     }
69 
TestGetScanOptionDesc(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)70     void TestGetScanOptionDesc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
71     {
72         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
73         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
74         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
75         int32_t optionIndex = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
76         ScanOptionDescriptor desc;
77         ScanServiceAbility::GetInstance()->GetScanOptionDesc(scannerId, optionIndex, desc);
78     }
79 
TestStartScan(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)80     void TestStartScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
81     {
82         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
83         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
84         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
85         bool batchMode = dataProvider->ConsumeBool();
86         ScanServiceAbility::GetInstance()->StartScan(scannerId, batchMode);
87     }
88 
TestGetSingleFrameFD(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)89     void TestGetSingleFrameFD(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
90     {
91         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
92         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
93         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
94         uint32_t frameSize = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
95         uint32_t fd = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
96         ScanServiceAbility::GetInstance()->GetSingleFrameFD(scannerId, frameSize, fd);
97     }
98 
TestCancelScan(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)99     void TestCancelScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
100     {
101         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
102         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
103         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
104         ScanServiceAbility::GetInstance()->CancelScan(scannerId);
105     }
106 
TestSetScanIOMode(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)107     void TestSetScanIOMode(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
108     {
109         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
110         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
111         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
112         bool isNonBlocking = dataProvider->ConsumeBool();
113         ScanServiceAbility::GetInstance()->SetScanIOMode(scannerId, isNonBlocking);
114     }
115 
TestGetScanSelectFd(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)116     void TestGetScanSelectFd(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
117     {
118         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
119         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
120         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
121         int32_t fd = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
122         ScanServiceAbility::GetInstance()->GetScanSelectFd(scannerId, fd);
123     }
124 
TestOn(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)125     void TestOn(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
126     {
127         std::string taskId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
128         std::string type = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
129         sptr<IRemoteObject> impl;
130         ScanCallbackProxy scanCallbackProxy(impl);
131         sptr<IScanCallback> listener = iface_cast<IScanCallback>(impl);
132         ScanServiceAbility::registeredListeners_[type] = listener;
133         ScanServiceAbility::GetInstance()->On(taskId, type, listener);
134         ScanServiceAbility::registeredListeners_.clear();
135     }
136 
TestOff(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)137     void TestOff(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
138     {
139         std::string taskId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
140         std::string type = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
141         sptr<IRemoteObject> impl;
142         ScanCallbackProxy scanCallbackProxy(impl);
143         sptr<IScanCallback> listener = iface_cast<IScanCallback>(impl);
144         ScanServiceAbility::registeredListeners_[type] = listener;
145         ScanServiceAbility::GetInstance()->Off(taskId, type);
146     }
147 
TestGetScannerState(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)148     void TestGetScannerState(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
149     {
150         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
151         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
152         int32_t scannerState = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
153         ScanServiceAbility::GetInstance()->GetScannerState(scannerState);
154     }
155 
TestSelectScanOptionDesc(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)156     void TestSelectScanOptionDesc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
157     {
158         SANE_Option_Descriptor optionDesc;
159         const SANE_Option_Descriptor *optionDescPtr = &optionDesc;
160         ScanOptionDescriptor desc;
161         optionDesc.constraint_type = SANE_CONSTRAINT_RANGE;
162         SANE_Range range;
163         range.min = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
164         range.max = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
165         range.quant = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
166         const SANE_Range* rangePtr = &range;
167         optionDesc.constraint.range = rangePtr;
168         ScanServiceAbility::GetInstance()->SelectScanOptionDesc(optionDescPtr, desc);
169     }
170 
TestOnStartScan(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)171     void TestOnStartScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
172     {
173         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
174         bool batchMode = dataProvider->ConsumeBool();
175         auto scanSaPtr = ScanServiceAbility::GetInstance();
176         if (scanSaPtr == nullptr) {
177             return;
178         }
179         scanSaPtr->OnStartScan(scannerId, batchMode);
180         int32_t userId = scanSaPtr->GetCurrentUserId();
181         scanSaPtr->ObtainUserCacheDirectory(userId);
182         userId = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
183         scanSaPtr->ObtainUserCacheDirectory(userId);
184         constexpr int32_t DEFAULT_USERID = 100;
185         userId = DEFAULT_USERID;
186         scanSaPtr->ObtainUserCacheDirectory(userId);
187     }
188 
TestSendDeviceInfoTCP(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)189     void TestSendDeviceInfoTCP(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
190     {
191         ScanDeviceInfoTCP info;
192         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
193         ScanServiceAbility::GetInstance()->SendDeviceInfoTCP(info, event);
194     }
195 
TestSendDeviceInfo(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)196     void TestSendDeviceInfo(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
197     {
198         ScanDeviceInfo  info;
199         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
200         ScanServiceAbility::GetInstance()->SendDeviceInfo(info, event);
201     }
202 
TestSendDeviceInfoSync(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)203     void TestSendDeviceInfoSync(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
204     {
205         ScanDeviceInfoSync  info;
206         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
207         ScanServiceAbility::GetInstance()->SendDeviceInfoSync(info, event);
208     }
209 
TestDisConnectUsbScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)210     void TestDisConnectUsbScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
211     {
212         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
213         std::string newDeviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
214         ScanServiceAbility::GetInstance()->DisConnectUsbScanner(serialNumber, newDeviceId);
215     }
216 
TestUpdateUsbScannerId(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)217     void TestUpdateUsbScannerId(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
218     {
219         std::string discoverMode = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
220         ScanDeviceInfoSync usbSyncInfo;
221         usbSyncInfo.discoverMode = discoverMode;
222         ScanServiceAbility::GetInstance()->UpdateScannerId(usbSyncInfo);
223         usbSyncInfo.discoverMode = "USB";
224         ScanServiceAbility::GetInstance()->UpdateScannerId(usbSyncInfo);
225         usbSyncInfo.discoverMode = "TCP";
226         ScanServiceAbility::GetInstance()->UpdateScannerId(usbSyncInfo);
227     }
228 
TestSendInitEvent(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)229     void TestSendInitEvent(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
230     {
231         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
232         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
233         ScanServiceAbility::GetInstance()->SendInitEvent(scanVersion, event);
234     }
235 
TestSendDeviceSearchEnd(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)236     void TestSendDeviceSearchEnd(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
237     {
238         std::string message = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
239         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
240         ScanServiceAbility::GetInstance()->SendDeviceSearchEnd(message, event);
241     }
242 
TestSetScannerSerialNumber(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)243     void TestSetScannerSerialNumber(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
244     {
245         ScanDeviceInfo tcpInfo;
246         tcpInfo.deviceId = "pantum6500:tcp 192.168.223.1 9200-M6700DW";
247         std::string ip = "192.168.223.1";
248         ScanDeviceInfoTCP scanDeviceInfoTCP;
249         scanDeviceInfoTCP.deviceName = "Pantum 6666 54QWER";
250         ScanMdnsService::InsertIpToScannerInfo(ip, scanDeviceInfoTCP);
251         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(tcpInfo);
252 
253         tcpInfo.deviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
254         ip = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
255         scanDeviceInfoTCP.deviceName = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
256         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(tcpInfo);
257 
258         ScanDeviceInfo usbInfo;
259         usbInfo.deviceId = "pantum6500:libusb:002:003";
260         ScanServiceAbility::usbSnMap["2-3"] = "QWERTY";
261         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(usbInfo);
262 
263         usbInfo.deviceId = "pantum6500:libusb:002:004";
264         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(usbInfo);
265         usbInfo.deviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
266         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(usbInfo);
267     }
268 
TestReInitScan(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)269     void TestReInitScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
270     {
271         ScanServiceAbility::GetInstance()->ServiceInit();
272         ScanServiceAbility::GetInstance()->InitServiceHandler();
273         ScanServiceAbility::GetInstance()->OnStart();
274         ScanServiceAbility::GetInstance()->OnStop();
275         ScanServiceAbility::GetInstance()->ManualStart();
276         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
277         ScanServiceAbility::GetInstance()->ReInitScan(scanVersion);
278         ScanServiceAbility::GetInstance()->SaneGetScanner();
279     }
280 
TestCheckPermission(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)281     void TestCheckPermission(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
282     {
283         std::string permissionName = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
284         ScanServiceAbility::GetInstance()->CheckPermission(permissionName);
285     }
286 
TestSendGetFrameResEvent(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)287     void TestSendGetFrameResEvent(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
288     {
289         bool isGetSucc = dataProvider->ConsumeBool();
290         int32_t sizeRead = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
291         ScanServiceAbility::GetInstance()->SendGetFrameResEvent(isGetSucc, sizeRead);
292     }
293 
TestSetScanOptionDescriptor(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)294     void TestSetScanOptionDescriptor(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
295     {
296         ScanOptionDescriptor desc;
297         SANE_Option_Descriptor optionDesc;
298         std::string name = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
299         std::string title = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
300         optionDesc.name = name.c_str();
301         optionDesc.title = title.c_str();
302         ScanServiceAbility::GetInstance()->SetScanOptionDescriptor(desc, &optionDesc);
303     }
304 
TestGetScanHandle(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)305     void TestGetScanHandle(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
306     {
307         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
308         ScanServiceAbility::GetInstance()->GetScanHandle(scannerId);
309     }
310 
TestGeneratePictureBatch(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)311     void TestGeneratePictureBatch(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
312     {
313         int32_t status = E_SCAN_NONE;
314         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
315         std::string file_name = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
316         std::string output_file = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
317         ScanProgress* scanProPtr = nullptr;
318         ScanServiceAbility::GetInstance()->GeneratePictureSingle(scannerId, file_name, output_file, status, scanProPtr);
319     }
320 
TestAddFoundUsbScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)321     void TestAddFoundUsbScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
322     {
323         ScanDeviceInfo info;
324         info.serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
325         ScanServiceAbility::GetInstance()->AddFoundUsbScanner(info);
326     }
327 
TestAddFoundTcpScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)328     void TestAddFoundTcpScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
329     {
330         ScanDeviceInfo info;
331         info.serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
332         ScanServiceAbility::GetInstance()->AddFoundTcpScanner(info);
333     }
334 
TestSetScannerInfo(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)335     void TestSetScannerInfo(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
336     {
337         SANE_Device currentDevice;
338         const SANE_Device* currentDevicePtr = &currentDevice;
339         const SANE_Device** currentDevicePtrPtr = &currentDevicePtr;
340         std::string name = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
341         std::string vendor = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
342         std::string model = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
343         std::string type = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
344         currentDevice.name = name.c_str();
345         currentDevice.vendor = vendor.c_str();
346         currentDevice.vendor = model.c_str();
347         currentDevice.type = type.c_str();
348         ScanDeviceInfo info;
349         ScanServiceAbility::GetInstance()->SetScannerInfo(currentDevicePtrPtr, info);
350     }
351 
TestSendDeviceList(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)352     void TestSendDeviceList(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
353     {
354         ScanDeviceInfo infoItem;
355         std::vector<ScanDeviceInfo> info;
356         info.push_back(infoItem);
357         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
358         ScanServiceAbility::GetInstance()->SendDeviceList(info, event);
359     }
360 
TestAddScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)361     void TestAddScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
362     {
363         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
364         std::string discoverMode = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
365         ScanServiceAbility::GetInstance()->AddScanner(serialNumber, discoverMode);
366     }
367 
TestUpdateScannerName(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)368     void TestUpdateScannerName(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
369     {
370         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
371         std::string discoverMode = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
372         std::string deviceName = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
373         ScanServiceAbility::GetInstance()->UpdateScannerName(serialNumber, discoverMode, deviceName);
374     }
375 
TestCleanScanTask(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)376     void TestCleanScanTask(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
377     {
378         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
379         ScanServiceAbility::GetInstance()->CleanScanTask(scannerId);
380     }
381 
TestGetAddedScanner(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)382     void TestGetAddedScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
383     {
384         ScanDeviceInfo addedScanner;
385         std::string newDeviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
386         addedScanner.SetDeviceId(newDeviceId);
387         std::vector<ScanDeviceInfo> allAddedScanner;
388         allAddedScanner.push_back(addedScanner);
389         ScanServiceAbility::GetInstance()->GetAddedScanner(allAddedScanner);
390     }
391 
TestNotPublicFunction(const uint8_t * data,size_t size,FuzzedDataProvider * dataProvider)392     void TestNotPublicFunction(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
393     {
394         if (dataProvider == nullptr) {
395             return;
396         }
397         OHOS::Scan::TestReInitScan(data, size, dataProvider);
398         OHOS::Scan::TestCheckPermission(data, size, dataProvider);
399         OHOS::Scan::TestSendGetFrameResEvent(data, size, dataProvider);
400         OHOS::Scan::TestSetScanOptionDescriptor(data, size, dataProvider);
401         OHOS::Scan::TestGetScanHandle(data, size, dataProvider);
402         OHOS::Scan::TestGeneratePictureBatch(data, size, dataProvider);
403         OHOS::Scan::TestAddFoundUsbScanner(data, size, dataProvider);
404         OHOS::Scan::TestAddFoundTcpScanner(data, size, dataProvider);
405         OHOS::Scan::TestSetScannerInfo(data, size, dataProvider);
406         OHOS::Scan::TestSendDeviceList(data, size, dataProvider);
407         OHOS::Scan::TestAddScanner(data, size, dataProvider);
408         OHOS::Scan::TestUpdateScannerName(data, size, dataProvider);
409         OHOS::Scan::TestCleanScanTask(data, size, dataProvider);
410         OHOS::Scan::TestGetAddedScanner(data, size, dataProvider);
411     }
412 
413 #endif
414 
415 }
416 }
417 
418 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)419 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
420 {
421     if (data == nullptr) {
422         return 0;
423     }
424 
425     if (size < OHOS::Scan::U32_AT_SIZE || size > OHOS::Scan::FOO_MAX_LEN) {
426         return 0;
427     }
428 #ifdef SANE_ENABLE
429     FuzzedDataProvider dataProvider(data, size);
430     OHOS::Scan::ScanServiceAbilityMock::MockPermission();
431     OHOS::Scan::TestInitScan(data, size, &dataProvider);
432     OHOS::Scan::TestGetScannerList(data, size, &dataProvider);
433     OHOS::Scan::TestStopDiscover(data, size, &dataProvider);
434     OHOS::Scan::TestOpenScanner(data, size, &dataProvider);
435     OHOS::Scan::TestCloseScanner(data, size, &dataProvider);
436     OHOS::Scan::TestGetScanOptionDesc(data, size, &dataProvider);
437     OHOS::Scan::TestStartScan(data, size, &dataProvider);
438     OHOS::Scan::TestGetSingleFrameFD(data, size, &dataProvider);
439     OHOS::Scan::TestCancelScan(data, size, &dataProvider);
440     OHOS::Scan::TestSetScanIOMode(data, size, &dataProvider);
441     OHOS::Scan::TestGetScanSelectFd(data, size, &dataProvider);
442     OHOS::Scan::TestOn(data, size, &dataProvider);
443     OHOS::Scan::TestOff(data, size, &dataProvider);
444     OHOS::Scan::TestGetScannerState(data, size, &dataProvider);
445     OHOS::Scan::TestSelectScanOptionDesc(data, size, &dataProvider);
446     OHOS::Scan::TestOnStartScan(data, size, &dataProvider);
447     OHOS::Scan::TestSendDeviceInfoTCP(data, size, &dataProvider);
448     OHOS::Scan::TestSendDeviceInfo(data, size, &dataProvider);
449     OHOS::Scan::TestSendDeviceInfoSync(data, size, &dataProvider);
450     OHOS::Scan::TestDisConnectUsbScanner(data, size, &dataProvider);
451     OHOS::Scan::TestUpdateUsbScannerId(data, size, &dataProvider);
452     OHOS::Scan::TestSendInitEvent(data, size, &dataProvider);
453     OHOS::Scan::TestSendDeviceSearchEnd(data, size, &dataProvider);
454     OHOS::Scan::TestSetScannerSerialNumber(data, size, &dataProvider);
455     OHOS::Scan::TestNotPublicFunction(data, size, &dataProvider);
456 #endif
457     return 0;
458 }