1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "dialcall_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #define private public
21 #include "addcalltoken_fuzzer.h"
22 #include "call_manager_service.h"
23 #include "system_ability_definition.h"
24
25 using namespace OHOS::Telephony;
26 namespace OHOS {
27 static bool g_isInited = false;
28 constexpr int32_t SLOT_NUM = 2;
29 constexpr int32_t ACTIVE_NUM = 2;
30 constexpr int32_t VEDIO_STATE_NUM = 2;
31 constexpr int32_t DIAL_SCENE_NUM = 3;
32 constexpr int32_t DIAL_TYPE_NUM = 3;
33 constexpr int32_t CALL_TYPE_NUM = 3;
34 constexpr int32_t CALL_ID_NUM = 10;
35
IsServiceInited()36 bool IsServiceInited()
37 {
38 if (!g_isInited) {
39 DelayedSingleton<CallManagerService>::GetInstance()->OnStart();
40 if (DelayedSingleton<CallManagerService>::GetInstance()->GetServiceRunningState() ==
41 static_cast<int32_t>(CallManagerService::ServiceRunningState::STATE_RUNNING)) {
42 g_isInited = true;
43 }
44 }
45 return g_isInited;
46 }
47
OnRemoteRequest(const uint8_t * data,size_t size)48 void OnRemoteRequest(const uint8_t *data, size_t size)
49 {
50 if (!IsServiceInited()) {
51 return;
52 }
53
54 MessageParcel dataMessageParcel;
55 if (!dataMessageParcel.WriteInterfaceToken(CallManagerServiceStub::GetDescriptor())) {
56 return;
57 }
58 dataMessageParcel.WriteBuffer(data, size);
59 dataMessageParcel.RewindRead(0);
60 uint32_t code = static_cast<uint32_t>(size);
61 MessageParcel reply;
62 MessageOption option;
63 DelayedSingleton<CallManagerService>::GetInstance()->OnRemoteRequest(code, dataMessageParcel, reply, option);
64 }
65
OnRegisterCallBack(const uint8_t * data,size_t size)66 int32_t OnRegisterCallBack(const uint8_t *data, size_t size)
67 {
68 if (!IsServiceInited()) {
69 return TELEPHONY_ERROR;
70 }
71 MessageParcel dataMessageParcel;
72 if (!dataMessageParcel.WriteInterfaceToken(CallManagerServiceStub::GetDescriptor())) {
73 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
74 }
75 sptr<ICallAbilityCallback> callbackWrap;
76 memcpy_s(callbackWrap, sizeof(callbackWrap), data, sizeof(callbackWrap));
77 if (callbackWrap == nullptr) {
78 return TELEPHONY_ERR_LOCAL_PTR_NULL;
79 }
80 if (!dataMessageParcel.WriteRemoteObject(callbackWrap->AsObject().GetRefPtr())) {
81 return TELEPHONY_ERR_WRITE_DATA_FAIL;
82 }
83 MessageParcel reply;
84 return DelayedSingleton<CallManagerService>::GetInstance()->OnRegisterCallBack(dataMessageParcel, reply);
85 }
86
HasCall(const uint8_t * data,size_t size)87 bool HasCall(const uint8_t *data, size_t size)
88 {
89 if (!IsServiceInited()) {
90 return TELEPHONY_ERROR;
91 }
92 MessageParcel dataParcel;
93 dataParcel.WriteBuffer(data, size);
94 dataParcel.RewindRead(0);
95 MessageParcel reply;
96 return DelayedSingleton<CallManagerService>::GetInstance()->OnHasCall(dataParcel, reply);
97 }
98
GetCallState(const uint8_t * data,size_t size)99 int32_t GetCallState(const uint8_t *data, size_t size)
100 {
101 if (!IsServiceInited()) {
102 return TELEPHONY_ERROR;
103 }
104 MessageParcel dataParcel;
105 dataParcel.WriteBuffer(data, size);
106 dataParcel.RewindRead(0);
107 MessageParcel reply;
108 return DelayedSingleton<CallManagerService>::GetInstance()->OnGetCallState(dataParcel, reply);
109 }
110
GetCallWaiting(const uint8_t * data,size_t size)111 int32_t GetCallWaiting(const uint8_t *data, size_t size)
112 {
113 if (!IsServiceInited()) {
114 return TELEPHONY_ERROR;
115 }
116 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
117 MessageParcel dataParcel;
118 dataParcel.WriteInt32(slotId);
119 dataParcel.WriteBuffer(data, size);
120 dataParcel.RewindRead(0);
121 MessageParcel reply;
122 return DelayedSingleton<CallManagerService>::GetInstance()->OnGetCallWaiting(dataParcel, reply);
123 }
124
IsRinging(const uint8_t * data,size_t size)125 bool IsRinging(const uint8_t *data, size_t size)
126 {
127 if (!IsServiceInited()) {
128 return false;
129 }
130 MessageParcel dataParcel;
131 dataParcel.WriteBuffer(data, size);
132 dataParcel.RewindRead(0);
133 MessageParcel reply;
134 return DelayedSingleton<CallManagerService>::GetInstance()->OnIsRinging(dataParcel, reply);
135 }
136
IsInEmergencyCall(const uint8_t * data,size_t size)137 bool IsInEmergencyCall(const uint8_t *data, size_t size)
138 {
139 if (!IsServiceInited()) {
140 return false;
141 }
142 MessageParcel dataParcel;
143 dataParcel.WriteBuffer(data, size);
144 dataParcel.RewindRead(0);
145 MessageParcel reply;
146 return DelayedSingleton<CallManagerService>::GetInstance()->OnIsInEmergencyCall(dataParcel, reply);
147 }
148
DialCall(const uint8_t * data,size_t size)149 int32_t DialCall(const uint8_t *data, size_t size)
150 {
151 if (!IsServiceInited()) {
152 return TELEPHONY_ERROR;
153 }
154 std::string number(reinterpret_cast<const char *>(data), size);
155 auto numberU16 = Str8ToStr16(number);
156 int32_t accountId = static_cast<int32_t>(size % SLOT_NUM);
157 int32_t videoState = static_cast<int32_t>(size % VEDIO_STATE_NUM);
158 int32_t dialScene = static_cast<int32_t>(size % DIAL_SCENE_NUM);
159 int32_t dialType = static_cast<int32_t>(size % DIAL_TYPE_NUM);
160 int32_t callType = static_cast<int32_t>(size % CALL_TYPE_NUM);
161 MessageParcel dataParcel;
162 dataParcel.WriteString16(numberU16);
163 dataParcel.WriteInt32(accountId);
164 dataParcel.WriteInt32(videoState);
165 dataParcel.WriteInt32(dialScene);
166 dataParcel.WriteInt32(dialType);
167 dataParcel.WriteInt32(callType);
168 dataParcel.RewindRead(0);
169
170 MessageParcel reply;
171 return DelayedSingleton<CallManagerService>::GetInstance()->OnDialCall(dataParcel, reply);
172 }
173
RemoveMissedIncomingCallNotification(const uint8_t * data,size_t size)174 void RemoveMissedIncomingCallNotification(const uint8_t *data, size_t size)
175 {
176 if (!IsServiceInited()) {
177 return;
178 }
179 MessageParcel dataMessageParcel;
180 dataMessageParcel.WriteBuffer(data, size);
181 dataMessageParcel.RewindRead(0);
182 MessageParcel reply;
183 DelayedSingleton<CallManagerService>::GetInstance()->OnRemoveMissedIncomingCallNotification(
184 dataMessageParcel, reply);
185 }
186
SetCallWaiting(const uint8_t * data,size_t size)187 int32_t SetCallWaiting(const uint8_t *data, size_t size)
188 {
189 if (!IsServiceInited()) {
190 return TELEPHONY_ERROR;
191 }
192 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
193 int32_t activate = static_cast<int32_t>(size % ACTIVE_NUM);
194 MessageParcel dataParcel;
195 dataParcel.WriteInt32(slotId);
196 dataParcel.WriteBool(activate);
197 dataParcel.RewindRead(0);
198 MessageParcel reply;
199 return DelayedSingleton<CallManagerService>::GetInstance()->OnSetCallWaiting(dataParcel, reply);
200 }
201
SetCallRestriction(const uint8_t * data,size_t size)202 int32_t SetCallRestriction(const uint8_t *data, size_t size)
203 {
204 if (!IsServiceInited()) {
205 return TELEPHONY_ERROR;
206 }
207 CallRestrictionInfo info;
208 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
209 std::string msg(reinterpret_cast<const char *>(data), size);
210 int32_t length = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
211 memcpy_s(info.password, kMaxNumberLen, msg.c_str(), length);
212 MessageParcel dataParcel;
213 dataParcel.WriteInt32(slotId);
214 dataParcel.WriteRawData((const void *)&info, sizeof(CallRestrictionInfo));
215 dataParcel.RewindRead(0);
216 MessageParcel reply;
217 return DelayedSingleton<CallManagerService>::GetInstance()->OnSetCallRestriction(dataParcel, reply);
218 }
219
JoinConference(const uint8_t * data,size_t size)220 int32_t JoinConference(const uint8_t *data, size_t size)
221 {
222 if (!IsServiceInited()) {
223 return TELEPHONY_ERROR;
224 }
225 int32_t callId = static_cast<int32_t>(size % CALL_ID_NUM);
226 std::vector<std::u16string> numberList { u"0000000000" };
227 MessageParcel dataParcel;
228 dataParcel.WriteInt32(callId);
229 dataParcel.WriteString16Vector(numberList);
230 dataParcel.RewindRead(0);
231 MessageParcel reply;
232 return DelayedSingleton<CallManagerService>::GetInstance()->OnJoinConference(dataParcel, reply);
233 }
234
StartRtt(const uint8_t * data,size_t size)235 int32_t StartRtt(const uint8_t *data, size_t size)
236 {
237 if (!IsServiceInited()) {
238 return TELEPHONY_ERROR;
239 }
240
241 int32_t callId = static_cast<int32_t>(size % CALL_ID_NUM);
242 std::string msg(reinterpret_cast<const char *>(data), size);
243 MessageParcel dataParcel;
244 dataParcel.WriteInt32(callId);
245 dataParcel.WriteString(msg);
246 dataParcel.RewindRead(0);
247 MessageParcel reply;
248 return DelayedSingleton<CallManagerService>::GetInstance()->OnStartRtt(dataParcel, reply);
249 }
250
InputDialerSpecialCode(const uint8_t * data,size_t size)251 int32_t InputDialerSpecialCode(const uint8_t *data, size_t size)
252 {
253 if (!IsServiceInited()) {
254 return TELEPHONY_ERROR;
255 }
256 std::string specialCode(reinterpret_cast<const char *>(data), size);
257 MessageParcel dataParcel;
258 dataParcel.WriteString(specialCode);
259 dataParcel.RewindRead(0);
260 MessageParcel reply;
261 return DelayedSingleton<CallManagerService>::GetInstance()->OnInputDialerSpecialCode(dataParcel, reply);
262 }
263
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)264 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
265 {
266 if (data == nullptr || size == 0) {
267 return;
268 }
269 OnRemoteRequest(data, size);
270 OnRegisterCallBack(data, size);
271 HasCall(data, size);
272 GetCallState(data, size);
273 GetCallWaiting(data, size);
274 IsRinging(data, size);
275 IsInEmergencyCall(data, size);
276 DialCall(data, size);
277 RemoveMissedIncomingCallNotification(data, size);
278 SetCallWaiting(data, size);
279 SetCallRestriction(data, size);
280 JoinConference(data, size);
281 StartRtt(data, size);
282 InputDialerSpecialCode(data, size);
283 }
284 } // namespace OHOS
285
286 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)287 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
288 {
289 OHOS::AddCallTokenFuzzer token;
290 /* Run your code on data */
291 OHOS::DoSomethingInterestingWithMyAPI(data, size);
292 return 0;
293 }
294