1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "setgetcbconfig_fuzzer.h"
17
18 #define private public
19
20 #include "addsmstoken_fuzzer.h"
21 #include "sms_service.h"
22 #include "string_utils.h"
23
24 using namespace OHOS::Telephony;
25 namespace OHOS {
26 static bool g_isInited = false;
27 static int32_t SIM_COUNT = 2;
28 static int32_t CB_CHANNEL_DIVISOR = 2;
29 static int32_t NET_COUNT = 3;
30
IsServiceInited()31 bool IsServiceInited()
32 {
33 if (!g_isInited) {
34 DelayedSingleton<SmsService>::GetInstance()->OnStart();
35 if (DelayedSingleton<SmsService>::GetInstance()->GetServiceRunningState() ==
36 static_cast<int32_t>(Telephony::ServiceRunningState::STATE_RUNNING)) {
37 g_isInited = true;
38 }
39 }
40 return g_isInited;
41 }
42
SetCBConfigFuzz(const uint8_t * data,size_t size)43 void SetCBConfigFuzz(const uint8_t *data, size_t size)
44 {
45 if (!IsServiceInited()) {
46 return;
47 }
48
49 MessageParcel dataParcel;
50 MessageParcel replyParcel;
51 MessageOption option(MessageOption::TF_SYNC);
52
53 int32_t slotId = static_cast<int32_t>(size % SIM_COUNT);
54 bool enable = slotId == 1 ? true : false;
55 uint32_t fromMsgId = static_cast<uint32_t>(size / CB_CHANNEL_DIVISOR);
56 uint32_t toMsgId = static_cast<uint32_t>(size);
57 int32_t netType = static_cast<int32_t>(size % NET_COUNT);
58
59 dataParcel.WriteInt32(slotId);
60 dataParcel.WriteBool(enable);
61 dataParcel.WriteUint32(fromMsgId);
62 dataParcel.WriteUint32(toMsgId);
63 dataParcel.WriteUint8(netType);
64
65 size_t dataSize = size - sizeof(uint32_t);
66 dataParcel.WriteBuffer(data + sizeof(uint32_t), dataSize);
67 dataParcel.RewindRead(0);
68 DelayedSingleton<SmsService>::GetInstance()->OnSetCBConfig(dataParcel, replyParcel, option);
69
70 std::shared_ptr<SmsInterfaceManager> interfaceManager = std::make_shared<SmsInterfaceManager>(slotId);
71 if (interfaceManager == nullptr) {
72 TELEPHONY_LOGE("interfaceManager nullptr error");
73 return;
74 }
75 interfaceManager->SetCBConfig(enable, fromMsgId, toMsgId, netType);
76
77 auto smsMiscRunner = AppExecFwk::EventRunner::Create("SmsMiscRunner");
78 if (smsMiscRunner == nullptr) {
79 TELEPHONY_LOGE("failed to create SmsMiscRunner");
80 return;
81 }
82 std::shared_ptr<SmsMiscManager> smsMiscManager = std::make_shared<SmsMiscManager>(smsMiscRunner, slotId);
83 if (smsMiscManager == nullptr) {
84 TELEPHONY_LOGE("smsMiscManager nullptr error");
85 return;
86 }
87 smsMiscManager->SetCBConfig(enable, fromMsgId, toMsgId, netType);
88 }
89
SetImsSmsConfigFuzz(const uint8_t * data,size_t size)90 void SetImsSmsConfigFuzz(const uint8_t *data, size_t size)
91 {
92 if (!IsServiceInited()) {
93 return;
94 }
95
96 MessageParcel dataParcel;
97 MessageParcel replyParcel;
98 MessageOption option(MessageOption::TF_SYNC);
99
100 int32_t slotId = static_cast<int32_t>(size % SIM_COUNT);
101 int32_t enable = slotId == 1 ? true : false;
102 dataParcel.WriteInt32(slotId);
103 dataParcel.WriteInt32(enable);
104 size_t dataSize = size - sizeof(uint32_t);
105
106 dataParcel.WriteBuffer(data + sizeof(uint32_t), dataSize);
107 dataParcel.RewindRead(0);
108 DelayedSingleton<SmsService>::GetInstance()->OnSetImsSmsConfig(dataParcel, replyParcel, option);
109
110 std::shared_ptr<SmsInterfaceManager> interfaceManager = std::make_shared<SmsInterfaceManager>(slotId);
111 if (interfaceManager == nullptr) {
112 TELEPHONY_LOGE("interfaceManager nullptr error");
113 return;
114 }
115 interfaceManager->SetImsSmsConfig(slotId, enable);
116
117 auto smsSendManager = std::make_shared<SmsSendManager>(slotId);
118 if (smsSendManager == nullptr) {
119 return;
120 }
121 smsSendManager->SetImsSmsConfig(slotId, enable);
122 }
123
UpdataCBMessage(const uint8_t * data,size_t size)124 void UpdataCBMessage(const uint8_t *data, size_t size)
125 {
126 std::string pdu(reinterpret_cast<const char *>(data), size);
127 auto cbMessage = SmsCbMessage::CreateCbMessage(pdu);
128 if (cbMessage == nullptr) {
129 return;
130 }
131 cbMessage->GetCbHeader();
132 auto cbMessageByVectorInit = SmsCbMessage::CreateCbMessage(StringUtils::HexToByteVector(pdu));
133 if (cbMessageByVectorInit == nullptr) {
134 return;
135 }
136 cbMessageByVectorInit->GetCbMessageRaw();
137 cbMessageByVectorInit->IsSinglePageMsg();
138
139 cbMessage->PduAnalysis(StringUtils::HexToByteVector(pdu));
140 cbMessage->Decode2gHeader(StringUtils::HexToByteVector(pdu));
141 cbMessage->Decode3gHeader(StringUtils::HexToByteVector(pdu));
142
143 cbMessage->Decode2gCbMsg(StringUtils::HexToByteVector(pdu));
144 cbMessage->Decode3gCbMsg(StringUtils::HexToByteVector(pdu));
145 cbMessage->Decode3g7Bit(StringUtils::HexToByteVector(pdu));
146 cbMessage->Decode3gUCS2(StringUtils::HexToByteVector(pdu));
147 cbMessage->DecodeEtwsMsg(StringUtils::HexToByteVector(pdu));
148
149 std::string raw(reinterpret_cast<const char *>(data), size);
150 std::string message(reinterpret_cast<const char *>(data), size);
151 cbMessage->ConvertToUTF8(raw, message);
152 }
153
DoCBConfigWithMyAPI(const uint8_t * data,size_t size)154 void DoCBConfigWithMyAPI(const uint8_t *data, size_t size)
155 {
156 if (data == nullptr || size == 0) {
157 return;
158 }
159 SetCBConfigFuzz(data, size);
160 SetImsSmsConfigFuzz(data, size);
161 UpdataCBMessage(data, size);
162 }
163 } // namespace OHOS
164
165 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)166 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
167 {
168 /* Run your code on data */
169 OHOS::AddSmsTokenFuzzer token;
170 OHOS::DoCBConfigWithMyAPI(data, size);
171 return 0;
172 }
173