1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "callabilitycallback_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 #define private public
21 #include "addcalltoken_fuzzer.h"
22 #include "call_ability_callback.h"
23 #include "call_ability_callback_proxy.h"
24 #include "call_manager_callback.h"
25 
26 using namespace OHOS::Telephony;
27 namespace OHOS {
28 constexpr int32_t ACCOUNT_ID_NUM = 10;
29 constexpr int32_t BOOL_NUM = 2;
30 constexpr int32_t CALL_ID_NUM = 10;
31 constexpr int32_t REPORT_ID_NUM = 23;
32 constexpr int32_t RESULT_ID_NUM = 50;
33 constexpr int32_t OTT_ID_NUM = 11;
34 constexpr int32_t VEDIO_STATE_NUM = 2;
35 constexpr int32_t IMS_CALL_MODE_NUM = 5;
36 constexpr int32_t CALL_SESSION_EVENT_ID_NUM = 4;
37 constexpr int32_t VIDEO_REQUEST_RESULT_TYPE_NUM = 102;
38 sptr<CallAbilityCallback> callAbilityCallbackPtr_ = nullptr;
39 
ServiceInited()40 bool ServiceInited()
41 {
42     if (!IsServiceInited()) {
43         return false;
44     }
45     callAbilityCallbackPtr_ = new (std::nothrow) CallAbilityCallback();
46     if (callAbilityCallbackPtr_ == nullptr) {
47         return false;
48     }
49     return true;
50 }
51 
OnRemoteRequest(const uint8_t * data,size_t size)52 int32_t OnRemoteRequest(const uint8_t *data, size_t size)
53 {
54     if (!ServiceInited()) {
55         return TELEPHONY_ERROR;
56     }
57     MessageParcel dataMessageParcel;
58     if (!dataMessageParcel.WriteInterfaceToken(CallAbilityCallbackStub::GetDescriptor())) {
59         return TELEPHONY_ERROR;
60     }
61     dataMessageParcel.RewindRead(0);
62     uint32_t code = static_cast<uint32_t>(size);
63     MessageParcel reply;
64     MessageOption option;
65     return callAbilityCallbackPtr_->OnRemoteRequest(code, dataMessageParcel, reply, option);
66 }
67 
UpdateCallStateInfo(const uint8_t * data,size_t size)68 int32_t UpdateCallStateInfo(const uint8_t *data, size_t size)
69 {
70     if (!ServiceInited()) {
71         return TELEPHONY_ERROR;
72     }
73     CallAttributeInfo info;
74     std::string msg(reinterpret_cast<const char *>(data), size);
75     int32_t accountLength = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
76     int32_t bundleLength = msg.length() > kMaxBundleNameLen ? kMaxBundleNameLen : msg.length();
77     memcpy_s(info.accountNumber, kMaxNumberLen, msg.c_str(), accountLength);
78     memcpy_s(info.bundleName, kMaxBundleNameLen, msg.c_str(), bundleLength);
79     info.accountId = static_cast<int32_t>(size % ACCOUNT_ID_NUM);
80     info.startTime = static_cast<uint32_t>(size);
81     info.callId = static_cast<int32_t>(size % CALL_ID_NUM);
82     info.callBeginTime = static_cast<time_t>(size);
83     info.callEndTime = static_cast<time_t>(size);
84     info.ringBeginTime = static_cast<time_t>(size);
85     info.ringEndTime = static_cast<time_t>(size);
86     MessageParcel dataMessageParcel;
87     dataMessageParcel.WriteCString(info.accountNumber);
88     dataMessageParcel.WriteCString(info.bundleName);
89     dataMessageParcel.WriteBool(info.speakerphoneOn);
90     dataMessageParcel.WriteInt32(info.accountId);
91     dataMessageParcel.WriteInt32(static_cast<int32_t>(info.videoState));
92     dataMessageParcel.WriteInt64(info.startTime);
93     dataMessageParcel.WriteBool(info.isEcc);
94     dataMessageParcel.WriteInt32(static_cast<int32_t>(info.callType));
95     dataMessageParcel.WriteInt32(info.callId);
96     dataMessageParcel.WriteInt32(static_cast<int32_t>(info.callState));
97     dataMessageParcel.WriteInt32(static_cast<int32_t>(info.conferenceState));
98     dataMessageParcel.WriteInt64(info.callBeginTime);
99     dataMessageParcel.WriteInt64(info.callEndTime);
100     dataMessageParcel.WriteInt64(info.ringBeginTime);
101     dataMessageParcel.WriteInt64(info.ringEndTime);
102     dataMessageParcel.WriteInt32(static_cast<int32_t>(info.callDirection));
103     dataMessageParcel.WriteInt32(static_cast<int32_t>(info.answerType));
104     dataMessageParcel.WriteInt32(info.index);
105     dataMessageParcel.WriteString(info.voipCallInfo.voipCallId);
106     dataMessageParcel.WriteString(info.voipCallInfo.userName);
107     dataMessageParcel.WriteString(info.voipCallInfo.abilityName);
108     dataMessageParcel.WriteString(info.voipCallInfo.extensionId);
109     dataMessageParcel.WriteString(info.voipCallInfo.voipBundleName);
110     dataMessageParcel.WriteUInt8Vector(info.voipCallInfo.userProfile);
111     dataMessageParcel.RewindRead(0);
112     MessageParcel reply;
113     MessageOption option;
114     return callAbilityCallbackPtr_->OnUpdateCallStateInfo(dataMessageParcel, reply);
115 }
116 
UpdateCallEvent(const uint8_t * data,size_t size)117 int32_t UpdateCallEvent(const uint8_t *data, size_t size)
118 {
119     if (!ServiceInited()) {
120         return TELEPHONY_ERROR;
121     }
122     CallEventInfo info;
123     std::string msg(reinterpret_cast<const char *>(data), size);
124     int32_t phoneLength = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
125     int32_t bundleLength = msg.length() > kMaxBundleNameLen ? kMaxBundleNameLen : msg.length();
126     memcpy_s(info.phoneNum, kMaxNumberLen, msg.c_str(), phoneLength);
127     memcpy_s(info.bundleName, kMaxBundleNameLen, msg.c_str(), bundleLength);
128     int32_t length = sizeof(CallEventInfo);
129     MessageParcel dataMessageParcel;
130     dataMessageParcel.WriteInt32(length);
131     dataMessageParcel.WriteRawData((const void *)&info, length);
132     dataMessageParcel.RewindRead(0);
133     MessageParcel reply;
134     MessageOption option;
135     return callAbilityCallbackPtr_->OnUpdateCallEvent(dataMessageParcel, reply);
136 }
137 
UpdateCallDisconnectedCause(const uint8_t * data,size_t size)138 int32_t UpdateCallDisconnectedCause(const uint8_t *data, size_t size)
139 {
140     if (!ServiceInited()) {
141         return TELEPHONY_ERROR;
142     }
143     int32_t reason = static_cast<uint32_t>(size);
144     std::string message(reinterpret_cast<const char *>(data), size);
145     MessageParcel dataMessageParcel;
146     dataMessageParcel.WriteInt32(reason);
147     dataMessageParcel.WriteString(message);
148     dataMessageParcel.RewindRead(0);
149     MessageParcel reply;
150     MessageOption option;
151     return callAbilityCallbackPtr_->OnUpdateCallDisconnectedCause(dataMessageParcel, reply);
152 }
153 
UpdateAysncResults(const uint8_t * data,size_t size)154 int32_t UpdateAysncResults(const uint8_t *data, size_t size)
155 {
156     if (!ServiceInited()) {
157         return TELEPHONY_ERROR;
158     }
159     int32_t reportId = static_cast<uint32_t>(size % REPORT_ID_NUM);
160     int32_t resultId = static_cast<uint32_t>(size % RESULT_ID_NUM);
161     MessageParcel dataMessageParcel;
162     dataMessageParcel.WriteInt32(reportId);
163     dataMessageParcel.WriteInt32(resultId);
164     dataMessageParcel.RewindRead(0);
165     MessageParcel reply;
166     MessageOption option;
167     return callAbilityCallbackPtr_->OnUpdateAysncResults(dataMessageParcel, reply);
168 }
169 
UpdateOttCallRequest(const uint8_t * data,size_t size)170 int32_t UpdateOttCallRequest(const uint8_t *data, size_t size)
171 {
172     if (!ServiceInited()) {
173         return TELEPHONY_ERROR;
174     }
175     int32_t requestId = static_cast<uint32_t>(size % OTT_ID_NUM);
176     int32_t videoState = static_cast<uint32_t>(size % VEDIO_STATE_NUM);
177     std::string phoneNumber(reinterpret_cast<const char *>(data), size);
178     std::string bundleName(reinterpret_cast<const char *>(data), size);
179     MessageParcel dataMessageParcel;
180     dataMessageParcel.WriteInt32(requestId);
181     dataMessageParcel.WriteInt32(videoState);
182     dataMessageParcel.WriteString(phoneNumber);
183     dataMessageParcel.WriteString(bundleName);
184     dataMessageParcel.RewindRead(0);
185     MessageParcel reply;
186     MessageOption option;
187     return callAbilityCallbackPtr_->OnUpdateOttCallRequest(dataMessageParcel, reply);
188 }
189 
UpdateMmiCodeResults(const uint8_t * data,size_t size)190 int32_t UpdateMmiCodeResults(const uint8_t *data, size_t size)
191 {
192     if (!ServiceInited()) {
193         return TELEPHONY_ERROR;
194     }
195     MmiCodeInfo info;
196     int32_t length = sizeof(MmiCodeInfo);
197     info.result = static_cast<uint32_t>(size);
198     std::string msg(reinterpret_cast<const char *>(data), size);
199     int32_t msgLength = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
200     memcpy_s(info.message, kMaxNumberLen, msg.c_str(), msgLength);
201     MessageParcel dataMessageParcel;
202     dataMessageParcel.WriteInt32(length);
203     dataMessageParcel.WriteRawData((const void *)&info, length);
204     dataMessageParcel.RewindRead(0);
205     MessageParcel reply;
206     MessageOption option;
207     return callAbilityCallbackPtr_->OnUpdateMmiCodeResults(dataMessageParcel, reply);
208 }
209 
UpdateAudioDeviceChange(const uint8_t * data,size_t size)210 int32_t UpdateAudioDeviceChange(const uint8_t *data, size_t size)
211 {
212     if (!ServiceInited()) {
213         return TELEPHONY_ERROR;
214     }
215     MessageParcel dataMessageParcel;
216     if (!dataMessageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
217         TELEPHONY_LOGE("write descriptor fail");
218         return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
219     }
220     AudioDevice device;
221     device.deviceType = AudioDeviceType::DEVICE_UNKNOWN;
222     std::string msg(reinterpret_cast<const char *>(data), size);
223     int32_t length = msg.length() > kMaxAddressLen ? kMaxAddressLen : msg.length();
224     memcpy_s(device.address, kMaxAddressLen, msg.c_str(), length);
225     int32_t dataSize = static_cast<uint32_t>(size);
226     dataMessageParcel.WriteInt32(dataSize);
227     dataMessageParcel.WriteRawData((const void *)&device, sizeof(AudioDevice));
228     dataMessageParcel.WriteRawData((const void *)&device, sizeof(AudioDevice));
229     dataMessageParcel.WriteBool(static_cast<uint32_t>(size % BOOL_NUM));
230     dataMessageParcel.RewindRead(0);
231     MessageParcel reply;
232     MessageOption option;
233     return callAbilityCallbackPtr_->OnUpdateAudioDeviceChange(dataMessageParcel, reply);
234 }
235 
UpdateImsCallModeChange(const uint8_t * data,size_t size)236 int32_t UpdateImsCallModeChange(const uint8_t *data, size_t size)
237 {
238     if (!ServiceInited()) {
239         return TELEPHONY_ERROR;
240     }
241     MessageParcel dataParcel;
242     MessageParcel replyParcel;
243     if (!dataParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
244         TELEPHONY_LOGE("write descriptor fail");
245         return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
246     }
247     int32_t length = sizeof(CallMediaModeInfo);
248     dataParcel.WriteInt32(length);
249     CallMediaModeInfo callMediaModeInfo;
250     callMediaModeInfo.callId = static_cast<int32_t>(size);
251     callMediaModeInfo.isRequestInfo = static_cast<bool>(size % BOOL_NUM);
252     callMediaModeInfo.result = static_cast<VideoRequestResultType>(size % VIDEO_REQUEST_RESULT_TYPE_NUM);
253     callMediaModeInfo.callMode = static_cast<ImsCallMode>(size % IMS_CALL_MODE_NUM);
254     dataParcel.WriteRawData((const void *)&callMediaModeInfo, length);
255     dataParcel.RewindRead(0);
256     return callAbilityCallbackPtr_->OnUpdateImsCallModeChange(dataParcel, replyParcel);
257 }
258 
UpdateCallSessionEventChange(const uint8_t * data,size_t size)259 int32_t UpdateCallSessionEventChange(const uint8_t *data, size_t size)
260 {
261     if (!ServiceInited()) {
262         return TELEPHONY_ERROR;
263     }
264     MessageParcel dataParcel;
265     MessageParcel replyParcel;
266     if (!dataParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
267         TELEPHONY_LOGE("write descriptor fail");
268         return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
269     }
270     int32_t length = sizeof(CallSessionEvent);
271     dataParcel.WriteInt32(length);
272     CallSessionEvent callSessionInfo;
273     callSessionInfo.callId = static_cast<int32_t>(size);
274     callSessionInfo.eventId = static_cast<CallSessionEventId>(size % CALL_SESSION_EVENT_ID_NUM);
275     dataParcel.WriteRawData((const void *)&callSessionInfo, length);
276     dataParcel.RewindRead(0);
277     return callAbilityCallbackPtr_->OnUpdateCallSessionEventChange(dataParcel, replyParcel);
278 }
279 
UpdatePeerDimensionsChange(const uint8_t * data,size_t size)280 int32_t UpdatePeerDimensionsChange(const uint8_t *data, size_t size)
281 {
282     if (!ServiceInited()) {
283         return TELEPHONY_ERROR;
284     }
285     MessageParcel dataParcel;
286     MessageParcel replyParcel;
287     if (!dataParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
288         TELEPHONY_LOGE("write descriptor fail");
289         return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
290     }
291     int32_t length = sizeof(PeerDimensionsDetail);
292     dataParcel.WriteInt32(length);
293     PeerDimensionsDetail peerDimensionsInfo;
294     peerDimensionsInfo.callId = static_cast<int32_t>(size);
295     peerDimensionsInfo.width = static_cast<int32_t>(size);
296     peerDimensionsInfo.height = static_cast<int32_t>(size);
297     dataParcel.RewindRead(0);
298     return callAbilityCallbackPtr_->OnUpdatePeerDimensionsChange(dataParcel, replyParcel);
299 }
300 
UpdateCallDataUsageChange(const uint8_t * data,size_t size)301 int32_t UpdateCallDataUsageChange(const uint8_t *data, size_t size)
302 {
303     if (!ServiceInited()) {
304         return TELEPHONY_ERROR;
305     }
306     MessageParcel dataParcel;
307     MessageParcel replyParcel;
308     if (!dataParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
309         TELEPHONY_LOGE("write descriptor fail");
310         return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
311     }
312     int64_t dataUsage = static_cast<int64_t>(size);
313     dataParcel.WriteInt64(dataUsage);
314     dataParcel.RewindRead(0);
315     return callAbilityCallbackPtr_->OnUpdateCallDataUsageChange(dataParcel, replyParcel);
316 }
317 
UpdateCameraCapabilities(const uint8_t * data,size_t size)318 int32_t UpdateCameraCapabilities(const uint8_t *data, size_t size)
319 {
320     if (!ServiceInited()) {
321         return TELEPHONY_ERROR;
322     }
323     MessageParcel dataParcel;
324     MessageParcel replyParcel;
325     if (!dataParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
326         TELEPHONY_LOGE("write descriptor fail");
327         return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
328     }
329     int32_t length = sizeof(CameraCapabilities);
330     dataParcel.WriteInt32(length);
331     CameraCapabilities cameraCapabilitiesInfo;
332     cameraCapabilitiesInfo.callId = static_cast<int32_t>(size);
333     cameraCapabilitiesInfo.width = static_cast<int32_t>(size);
334     cameraCapabilitiesInfo.height = static_cast<int32_t>(size);
335     dataParcel.RewindRead(0);
336     return callAbilityCallbackPtr_->OnUpdateCameraCapabilities(dataParcel, replyParcel);
337 }
338 
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)339 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
340 {
341     if (data == nullptr || size == 0) {
342         return;
343     }
344     OnRemoteRequest(data, size);
345     UpdateCallStateInfo(data, size);
346     UpdateCallEvent(data, size);
347     UpdateCallDisconnectedCause(data, size);
348     UpdateAysncResults(data, size);
349     UpdateOttCallRequest(data, size);
350     UpdateMmiCodeResults(data, size);
351     UpdateAudioDeviceChange(data, size);
352     UpdateImsCallModeChange(data, size);
353     UpdateCallSessionEventChange(data, size);
354     UpdatePeerDimensionsChange(data, size);
355     UpdateCallDataUsageChange(data, size);
356     UpdateCameraCapabilities(data, size);
357 }
358 } // namespace OHOS
359 
360 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)361 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
362 {
363     OHOS::AddCallTokenFuzzer token;
364     /* Run your code on data */
365     OHOS::DoSomethingInterestingWithMyAPI(data, size);
366     return 0;
367 }
368