1 /*
2  * Copyright (c) 2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "telephonystateregistry_fuzzer.h"
17 
18 #include <cstddef>
19 #include <cstdint>
20 #define private public
21 #define protected public
22 #include "addstateregistrytoken_fuzzer.h"
23 #include "if_system_ability_manager.h"
24 #include "iservice_registry.h"
25 #include "securec.h"
26 #include "system_ability_definition.h"
27 #include "telephony_observer.h"
28 #include "telephony_state_registry_service.h"
29 #include "telephony_state_registry_stub.h"
30 
31 using namespace OHOS::Telephony;
32 namespace OHOS {
33 static bool g_isInited = false;
34 constexpr int32_t BOOL_NUM = 2;
35 constexpr int32_t SLOT_NUM = 2;
36 constexpr int32_t ROAMING_NUM = 4;
37 constexpr int32_t REG_NUM = 6;
38 constexpr int32_t CELL_NUM = 7;
39 constexpr int32_t SIGNAL_NUM = 6;
40 constexpr int32_t SIGNAL_PLUS = 1;
41 constexpr int32_t NR_NUM = 7;
42 constexpr int32_t RADIO_NUM = 13;
43 
IsServiceInited()44 bool IsServiceInited()
45 {
46     if (!g_isInited) {
47         DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnStart();
48         if (DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->GetServiceRunningState() ==
49             static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
50             g_isInited = true;
51         }
52     }
53     return g_isInited;
54 }
55 
OnRemoteRequest(const uint8_t * data,size_t size)56 void OnRemoteRequest(const uint8_t *data, size_t size)
57 {
58     if (!IsServiceInited()) {
59         return;
60     }
61     MessageParcel dataMessageParcel;
62     if (!dataMessageParcel.WriteInterfaceToken(TelephonyStateRegistryStub::GetDescriptor())) {
63         return;
64     }
65     dataMessageParcel.WriteBuffer(data, size);
66     dataMessageParcel.RewindRead(0);
67     uint32_t code = static_cast<uint32_t>(size);
68     MessageParcel reply;
69     MessageOption option;
70     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnRemoteRequest(
71         code, dataMessageParcel, reply, option);
72 }
73 
CreateGsmCellInfo(std::unique_ptr<GsmCellInformation> & cell,const uint8_t * data,size_t size)74 void CreateGsmCellInfo(std::unique_ptr<GsmCellInformation> &cell, const uint8_t *data, size_t size)
75 {
76     if (cell == nullptr) {
77         return;
78     }
79     cell->lac_ = static_cast<int32_t>(size);
80     cell->bsic_ = static_cast<int32_t>(size);
81     cell->arfcn_ = static_cast<int32_t>(size);
82     std::string mcc(reinterpret_cast<const char *>(data), size);
83     cell->mcc_ = mcc;
84     std::string mnc(reinterpret_cast<const char *>(data), size);
85     cell->mnc_ = mnc;
86     cell->cellId_ = static_cast<int32_t>(size);
87     cell->timeStamp_ = static_cast<uint64_t>(size);
88     cell->signalIntensity_ = static_cast<int32_t>(size);
89     cell->signalLevel_ = static_cast<int32_t>(size);
90     cell->isCamped_ = static_cast<int32_t>(size % BOOL_NUM);
91 }
92 
CreateLteCellInfo(std::unique_ptr<LteCellInformation> & cell,const uint8_t * data,size_t size)93 void CreateLteCellInfo(std::unique_ptr<LteCellInformation> &cell, const uint8_t *data, size_t size)
94 {
95     if (cell == nullptr) {
96         return;
97     }
98     cell->pci_ = static_cast<int32_t>(size);
99     cell->tac_ = static_cast<int32_t>(size);
100     cell->earfcn_ = static_cast<int32_t>(size);
101     std::string mcc(reinterpret_cast<const char *>(data), size);
102     cell->mcc_ = mcc;
103     std::string mnc(reinterpret_cast<const char *>(data), size);
104     cell->mnc_ = mnc;
105     cell->cellId_ = static_cast<int32_t>(size);
106     cell->timeStamp_ = static_cast<uint64_t>(size);
107     cell->signalIntensity_ = static_cast<int32_t>(size);
108     cell->signalLevel_ = static_cast<int32_t>(size);
109     cell->isCamped_ = static_cast<int32_t>(size % BOOL_NUM);
110 }
111 
UpdateCellInfo(const uint8_t * data,size_t size)112 void UpdateCellInfo(const uint8_t *data, size_t size)
113 {
114     if (!IsServiceInited()) {
115         return;
116     }
117     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
118     int32_t loopSize = static_cast<int32_t>(size);
119     MessageParcel dataMessageParcel;
120     dataMessageParcel.WriteInt32(slotId);
121     dataMessageParcel.WriteInt32(loopSize);
122     for (int32_t i = 0; i < loopSize; i++) {
123         CellInformation::CellType type = static_cast<CellInformation::CellType>(size % CELL_NUM);
124         if (type == CellInformation::CellType::CELL_TYPE_GSM) {
125             std::unique_ptr<GsmCellInformation> cell = std::make_unique<GsmCellInformation>();
126             if (cell == nullptr) {
127                 return;
128             }
129             CreateGsmCellInfo(cell, data, size);
130             cell->Marshalling(dataMessageParcel);
131         }
132         if (type == CellInformation::CellType::CELL_TYPE_LTE) {
133             std::unique_ptr<LteCellInformation> cell = std::make_unique<LteCellInformation>();
134             if (cell == nullptr) {
135                 return;
136             }
137             CreateLteCellInfo(cell, data, size);
138             cell->Marshalling(dataMessageParcel);
139         }
140     }
141     dataMessageParcel.RewindRead(0);
142     MessageParcel reply;
143     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellInfo(dataMessageParcel, reply);
144 }
145 
UpdateCallState(const uint8_t * data,size_t size)146 void UpdateCallState(const uint8_t *data, size_t size)
147 {
148     if (!IsServiceInited()) {
149         return;
150     }
151     int32_t callState = static_cast<int32_t>(size);
152     std::string phoneNumber(reinterpret_cast<const char *>(data), size);
153     MessageParcel dataMessageParcel;
154     dataMessageParcel.WriteInt32(callState);
155     dataMessageParcel.WriteString16(Str8ToStr16(phoneNumber));
156     dataMessageParcel.RewindRead(0);
157     MessageParcel reply;
158     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCallState(dataMessageParcel, reply);
159 }
160 
UpdateCallStateForSlotId(const uint8_t * data,size_t size)161 void UpdateCallStateForSlotId(const uint8_t *data, size_t size)
162 {
163     if (!IsServiceInited()) {
164         return;
165     }
166     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
167     int32_t callState = static_cast<int32_t>(size);
168     std::string incomingNumber(reinterpret_cast<const char *>(data), size);
169     MessageParcel dataMessageParcel;
170     dataMessageParcel.WriteInt32(slotId);
171     dataMessageParcel.WriteInt32(callState);
172     dataMessageParcel.WriteString16(Str8ToStr16(incomingNumber));
173     dataMessageParcel.RewindRead(0);
174     MessageParcel reply;
175     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCallStateForSlotId(
176         dataMessageParcel, reply);
177 }
178 
CreateGsmSignalInfo(std::unique_ptr<GsmSignalInformation> & signal,const uint8_t * data,size_t size)179 void CreateGsmSignalInfo(std::unique_ptr<GsmSignalInformation> &signal, const uint8_t *data, size_t size)
180 {
181     if (signal == nullptr) {
182         return;
183     }
184     int32_t offset = 0;
185     signal->signalBar_ = static_cast<int32_t>(*data + offset);
186     offset += sizeof(int32_t);
187     signal->gsmRxlev_ = static_cast<int32_t>(*data + offset);
188     offset += sizeof(int32_t);
189     signal->gsmBer_ = static_cast<int32_t>(*data + offset);
190 }
191 
CreateCDMASignalInfo(std::unique_ptr<CdmaSignalInformation> & signal,const uint8_t * data,size_t size)192 void CreateCDMASignalInfo(std::unique_ptr<CdmaSignalInformation> &signal, const uint8_t *data, size_t size)
193 {
194     if (signal == nullptr) {
195         return;
196     }
197     int32_t offset = 0;
198     signal->signalBar_ = static_cast<int32_t>(*data + offset);
199     offset += sizeof(int32_t);
200     signal->cdmaRssi_ = static_cast<int32_t>(*data + offset);
201     offset += sizeof(int32_t);
202     signal->cdmaEcno_ = static_cast<int32_t>(*data + offset);
203 }
204 
CreateLTESignalInfo(std::unique_ptr<LteSignalInformation> & signal,const uint8_t * data,size_t size)205 void CreateLTESignalInfo(std::unique_ptr<LteSignalInformation> &signal, const uint8_t *data, size_t size)
206 {
207     if (signal == nullptr) {
208         return;
209     }
210     int32_t offset = 0;
211     signal->signalBar_ = static_cast<int32_t>(*data + offset);
212     offset += sizeof(int32_t);
213     signal->rxlev_ = static_cast<int32_t>(*data + offset);
214     offset += sizeof(int32_t);
215     signal->lteRsrp_ = static_cast<int32_t>(*data + offset);
216     offset += sizeof(int32_t);
217     signal->lteRsrq_ = static_cast<int32_t>(*data + offset);
218     offset += sizeof(int32_t);
219     signal->lteSnr_ = static_cast<int32_t>(*data + offset);
220 }
221 
CreateWCDMASignalInfo(std::unique_ptr<WcdmaSignalInformation> & signal,const uint8_t * data,size_t size)222 void CreateWCDMASignalInfo(std::unique_ptr<WcdmaSignalInformation> &signal, const uint8_t *data, size_t size)
223 {
224     if (signal == nullptr) {
225         return;
226     }
227     int32_t offset = 0;
228     signal->signalBar_ = static_cast<int32_t>(*data + offset);
229     offset += sizeof(int32_t);
230     signal->wcdmaRxlev_ = static_cast<int32_t>(*data + offset);
231     offset += sizeof(int32_t);
232     signal->wcdmaRscp_ = static_cast<int32_t>(*data + offset);
233     offset += sizeof(int32_t);
234     signal->wcdmaEcio_ = static_cast<int32_t>(*data + offset);
235     offset += sizeof(int32_t);
236     signal->wcdmaBer_ = static_cast<int32_t>(*data + offset);
237 }
238 
CreateNRSignalInfo(std::unique_ptr<NrSignalInformation> & signal,const uint8_t * data,size_t size)239 void CreateNRSignalInfo(std::unique_ptr<NrSignalInformation> &signal, const uint8_t *data, size_t size)
240 {
241     if (signal == nullptr) {
242         return;
243     }
244     int32_t offset = 0;
245     signal->signalBar_ = static_cast<int32_t>(*data + offset);
246     offset += sizeof(int32_t);
247     signal->nrRsrp_ = static_cast<int32_t>(*data + offset);
248     offset += sizeof(int32_t);
249     signal->nrRsrq_ = static_cast<int32_t>(*data + offset);
250     offset += sizeof(int32_t);
251     signal->nrSinr_ = static_cast<int32_t>(*data + offset);
252 }
253 
UpdateLteNrSignalInfo(const uint8_t * data,size_t size,MessageParcel & dataMessageParcel,SignalInformation::NetworkType type)254 void UpdateLteNrSignalInfo(const uint8_t *data, size_t size, MessageParcel &dataMessageParcel,
255     SignalInformation::NetworkType type)
256 {
257     if (type == SignalInformation::NetworkType::LTE) {
258         std::unique_ptr<LteSignalInformation> signal = std::make_unique<LteSignalInformation>();
259         if (signal == nullptr) {
260             return;
261         }
262         CreateLTESignalInfo(signal, data, size);
263         signal->Marshalling(dataMessageParcel);
264     }
265     if (type == SignalInformation::NetworkType::NR) {
266         std::unique_ptr<NrSignalInformation> signal = std::make_unique<NrSignalInformation>();
267         if (signal == nullptr) {
268             return;
269         }
270         CreateNRSignalInfo(signal, data, size);
271         signal->Marshalling(dataMessageParcel);
272     }
273 }
274 
UpdateSignalInfo(const uint8_t * data,size_t size)275 void UpdateSignalInfo(const uint8_t *data, size_t size)
276 {
277     if (!IsServiceInited()) {
278         return;
279     }
280     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
281     int32_t loopSize = static_cast<int32_t>(size);
282     MessageParcel dataMessageParcel;
283     dataMessageParcel.WriteInt32(slotId);
284     dataMessageParcel.WriteInt32(loopSize);
285     for (int32_t i = 0; i < loopSize; i++) {
286         SignalInformation::NetworkType type =
287             static_cast<SignalInformation::NetworkType>(size % SIGNAL_NUM + SIGNAL_PLUS);
288         if (type == SignalInformation::NetworkType::GSM) {
289             std::unique_ptr<GsmSignalInformation> signal = std::make_unique<GsmSignalInformation>();
290             if (signal == nullptr) {
291                 return;
292             }
293             CreateGsmSignalInfo(signal, data, size);
294             signal->Marshalling(dataMessageParcel);
295         }
296         if (type == SignalInformation::NetworkType::CDMA) {
297             std::unique_ptr<CdmaSignalInformation> signal = std::make_unique<CdmaSignalInformation>();
298             if (signal == nullptr) {
299                 return;
300             }
301             CreateCDMASignalInfo(signal, data, size);
302             signal->Marshalling(dataMessageParcel);
303         }
304         if (type == SignalInformation::NetworkType::LTE || type == SignalInformation::NetworkType::NR) {
305             UpdateLteNrSignalInfo(data, size, dataMessageParcel, type);
306         }
307         if (type == SignalInformation::NetworkType::WCDMA) {
308             std::unique_ptr<WcdmaSignalInformation> signal = std::make_unique<WcdmaSignalInformation>();
309             if (signal == nullptr) {
310                 return;
311             }
312             CreateWCDMASignalInfo(signal, data, size);
313             signal->Marshalling(dataMessageParcel);
314         }
315     }
316     dataMessageParcel.RewindRead(0);
317     MessageParcel reply;
318     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateSignalInfo(dataMessageParcel, reply);
319 }
320 
UpdateNetworkState(const uint8_t * data,size_t size)321 void UpdateNetworkState(const uint8_t *data, size_t size)
322 {
323     if (!IsServiceInited()) {
324         return;
325     }
326     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
327     MessageParcel dataMessageParcel;
328     dataMessageParcel.WriteInt32(slotId);
329     auto networkState = std::make_unique<NetworkState>();
330     if (networkState == nullptr) {
331         return;
332     }
333     networkState->isEmergency_ = static_cast<int32_t>(size % BOOL_NUM);
334     std::string mOperatorNumeric(reinterpret_cast<const char *>(data), size);
335     std::string mFullName(reinterpret_cast<const char *>(data), size);
336     std::string mShortName(reinterpret_cast<const char *>(data), size);
337     networkState->psOperatorInfo_.operatorNumeric = mOperatorNumeric;
338     networkState->psOperatorInfo_.fullName = mFullName;
339     networkState->psOperatorInfo_.shortName = mShortName;
340     networkState->csOperatorInfo_.operatorNumeric = mOperatorNumeric;
341     networkState->csOperatorInfo_.fullName = mFullName;
342     networkState->csOperatorInfo_.shortName = mShortName;
343     networkState->csRoaming_ = static_cast<RoamingType>(size % ROAMING_NUM);
344     networkState->psRoaming_ = static_cast<RoamingType>(size % ROAMING_NUM);
345     networkState->psRegStatus_ = static_cast<RegServiceState>(size % REG_NUM);
346     networkState->csRegStatus_ = static_cast<RegServiceState>(size % REG_NUM);
347     networkState->psRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
348     networkState->lastPsRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
349     networkState->lastCfgTech_ = static_cast<RadioTech>(size % RADIO_NUM);
350     networkState->csRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
351     networkState->cfgTech_ = static_cast<RadioTech>(size % RADIO_NUM);
352     networkState->nrState_ = static_cast<NrState>(size % NR_NUM);
353     networkState->Marshalling(dataMessageParcel);
354     dataMessageParcel.RewindRead(0);
355     MessageParcel reply;
356     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateNetworkState(dataMessageParcel, reply);
357 }
358 
UpdateCellularDataConnectState(const uint8_t * data,size_t size)359 void UpdateCellularDataConnectState(const uint8_t *data, size_t size)
360 {
361     if (!IsServiceInited()) {
362         return;
363     }
364     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
365     int32_t offset = 0;
366     int32_t dataState = static_cast<int32_t>(*data + offset);
367     offset += sizeof(int32_t);
368     int32_t networkType = static_cast<int32_t>(*data + offset);
369     MessageParcel dataMessageParcel;
370     dataMessageParcel.WriteInt32(slotId);
371     dataMessageParcel.WriteInt32(dataState);
372     dataMessageParcel.WriteInt32(networkType);
373     dataMessageParcel.RewindRead(0);
374     MessageParcel reply;
375     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellularDataConnectState(
376         dataMessageParcel, reply);
377 }
378 
UpdateCellularDataFlow(const uint8_t * data,size_t size)379 void UpdateCellularDataFlow(const uint8_t *data, size_t size)
380 {
381     if (!IsServiceInited()) {
382         return;
383     }
384     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
385     int32_t flowData = static_cast<int32_t>(size);
386     MessageParcel dataMessageParcel;
387     dataMessageParcel.WriteInt32(slotId);
388     dataMessageParcel.WriteInt32(flowData);
389     dataMessageParcel.RewindRead(0);
390     MessageParcel reply;
391     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellularDataFlow(dataMessageParcel, reply);
392 }
393 
UpdateCfuIndicator(const uint8_t * data,size_t size)394 void UpdateCfuIndicator(const uint8_t *data, size_t size)
395 {
396     if (!IsServiceInited()) {
397         return;
398     }
399     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
400     bool cfuResult = static_cast<bool>(size % BOOL_NUM);
401     MessageParcel dataMessageParcel;
402     dataMessageParcel.WriteInt32(slotId);
403     dataMessageParcel.WriteBool(cfuResult);
404     dataMessageParcel.RewindRead(0);
405     MessageParcel reply;
406     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCfuIndicator(dataMessageParcel, reply);
407 }
408 
UpdateVoiceMailMsgIndicator(const uint8_t * data,size_t size)409 void UpdateVoiceMailMsgIndicator(const uint8_t *data, size_t size)
410 {
411     if (!IsServiceInited()) {
412         return;
413     }
414     int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
415     bool voiceMailMsgResult = static_cast<bool>(size % BOOL_NUM);
416     MessageParcel dataMessageParcel;
417     dataMessageParcel.WriteInt32(slotId);
418     dataMessageParcel.WriteBool(voiceMailMsgResult);
419     dataMessageParcel.RewindRead(0);
420     MessageParcel reply;
421     DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateVoiceMailMsgIndicator(
422         dataMessageParcel, reply);
423 }
424 
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)425 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
426 {
427     if (data == nullptr || size == 0) {
428         return;
429     }
430     OnRemoteRequest(data, size);
431     UpdateCellInfo(data, size);
432     UpdateCallState(data, size);
433     UpdateCallStateForSlotId(data, size);
434     UpdateSignalInfo(data, size);
435     UpdateNetworkState(data, size);
436     UpdateCellularDataConnectState(data, size);
437     UpdateCellularDataFlow(data, size);
438     UpdateCfuIndicator(data, size);
439     UpdateVoiceMailMsgIndicator(data, size);
440     return;
441 }
442 } // namespace OHOS
443 
444 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)445 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
446 {
447     OHOS::AddStateRegistryTokenFuzzer token;
448     /* Run your code on data */
449     OHOS::DoSomethingInterestingWithMyAPI(data, size);
450     return 0;
451 }
452 
453