1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "gsmsmssender_fuzzer.h"
17
18 #define private public
19 #define protected public
20
21 #include "addsmstoken_fuzzer.h"
22 #include "core_manager_inner.h"
23 #include "delivery_short_message_callback_stub.h"
24 #include "i_sms_service_interface.h"
25 #include "send_short_message_callback_stub.h"
26 #include "sms_service.h"
27
28 using namespace OHOS::Telephony;
29 namespace OHOS {
30 static bool g_isInited = false;
31 constexpr int32_t SLOT_NUM = 2;
32 static int32_t STATUS_COUNT = 4;
33 constexpr int32_t TYPE_NUM = 6;
34 constexpr int32_t SLEEP_TIME_SECONDS = 2;
35
IsServiceInited()36 bool IsServiceInited()
37 {
38 if (!g_isInited) {
39 CoreManagerInner::GetInstance().isInitAllObj_ = true;
40 DelayedSingleton<SmsService>::GetInstance()->registerToService_ = true;
41 DelayedSingleton<SmsService>::GetInstance()->WaitCoreServiceToInit();
42 DelayedSingleton<SmsService>::GetInstance()->OnStart();
43 if (DelayedSingleton<SmsService>::GetInstance()->GetServiceRunningState() ==
44 static_cast<int32_t>(Telephony::ServiceRunningState::STATE_RUNNING)) {
45 g_isInited = true;
46 }
47 }
48 return g_isInited;
49 }
50
OnRemoteRequest(const uint8_t * data,size_t size)51 void OnRemoteRequest(const uint8_t *data, size_t size)
52 {
53 if (!IsServiceInited()) {
54 return;
55 }
56
57 MessageParcel dataParcel;
58 if (!dataParcel.WriteInterfaceToken(SmsInterfaceStub::GetDescriptor())) {
59 TELEPHONY_LOGE("OnRemoteRequest WriteInterfaceToken is false");
60 return;
61 }
62
63 MessageParcel replyParcel;
64 MessageOption option(MessageOption::TF_SYNC);
65
66 dataParcel.WriteBuffer(data, size);
67 dataParcel.RewindRead(0);
68 uint32_t code = static_cast<uint32_t>(size);
69
70 DelayedSingleton<SmsService>::GetInstance()->OnRemoteRequest(code, dataParcel, replyParcel, option);
71 return;
72 }
73
AddSimMessage(const uint8_t * data,size_t size)74 void AddSimMessage(const uint8_t *data, size_t size)
75 {
76 if (!IsServiceInited()) {
77 return;
78 }
79
80 MessageParcel dataParcel;
81 MessageParcel replyParcel;
82 MessageOption option(MessageOption::TF_SYNC);
83
84 std::string smsc(reinterpret_cast<const char *>(data), size);
85 std::string pdu(reinterpret_cast<const char *>(data), size);
86 auto smscU16 = Str8ToStr16(smsc);
87 auto pduU16 = Str8ToStr16(pdu);
88 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
89 auto status = static_cast<ISmsServiceInterface::SimMessageStatus>(size % STATUS_COUNT);
90
91 dataParcel.WriteInt32(slotId);
92 dataParcel.WriteString16(smscU16);
93 dataParcel.WriteString16(pduU16);
94 dataParcel.WriteUint32(status);
95 dataParcel.RewindRead(0);
96 DelayedSingleton<SmsService>::GetInstance()->OnAddSimMessage(dataParcel, replyParcel, option);
97
98 std::shared_ptr<SmsInterfaceManager> interfaceManager = std::make_shared<SmsInterfaceManager>(slotId);
99 if (interfaceManager == nullptr) {
100 TELEPHONY_LOGE("interfaceManager nullptr");
101 return;
102 }
103 interfaceManager->AddSimMessage(smsc, pdu, status);
104
105 std::shared_ptr<SmsMiscManager> smsMiscManager = std::make_shared<SmsMiscManager>(slotId);
106 if (smsMiscManager == nullptr) {
107 TELEPHONY_LOGE("smsMiscManager nullptr");
108 return;
109 }
110 smsMiscManager->AddSimMessage(smsc, pdu, status);
111 }
112
HasSmsCapability(const uint8_t * data,size_t size)113 void HasSmsCapability(const uint8_t *data, size_t size)
114 {
115 if (!IsServiceInited()) {
116 return;
117 }
118
119 MessageParcel dataParcel;
120 MessageParcel replyParcel;
121 MessageOption option(MessageOption::TF_SYNC);
122
123 dataParcel.WriteBuffer(data, size);
124 dataParcel.RewindRead(0);
125 DelayedSingleton<SmsService>::GetInstance()->OnHasSmsCapability(dataParcel, replyParcel, option);
126
127 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
128 std::shared_ptr<SmsInterfaceManager> interfaceManager = std::make_shared<SmsInterfaceManager>(slotId);
129 if (interfaceManager == nullptr) {
130 TELEPHONY_LOGE("interfaceManager nullptr error");
131 return;
132 }
133 interfaceManager->HasSmsCapability();
134 }
135
SendSmsTest(const uint8_t * data,size_t size)136 void SendSmsTest(const uint8_t *data, size_t size)
137 {
138 std::function<void(std::shared_ptr<SmsSendIndexer>)> fun = nullptr;
139 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
140 auto sender = std::make_shared<GsmSmsSender>(slotId, fun);
141 sender->Init();
142
143 std::string desAddr(reinterpret_cast<const char *>(data), size);
144 std::string scAddr(reinterpret_cast<const char *>(data), size);
145 std::string text(reinterpret_cast<const char *>(data), size);
146 const sptr<ISendShortMessageCallback> sendCallback =
147 iface_cast<ISendShortMessageCallback>(new SendShortMessageCallbackStub());
148 const sptr<IDeliveryShortMessageCallback> deliveryCallback =
149 iface_cast<IDeliveryShortMessageCallback>(new DeliveryShortMessageCallbackStub());
150 sender->TextBasedSmsDelivery(desAddr, scAddr, text, sendCallback, deliveryCallback);
151 sender->DataBasedSmsDelivery(desAddr, scAddr, size, data, size, sendCallback, deliveryCallback);
152
153 std::vector<struct SplitInfo> cellsInfos;
154 struct SplitInfo cellInfo;
155 cellInfo.langId = static_cast<MSG_LANGUAGE_ID_T>(data[0]);
156 cellInfo.encodeType = static_cast<DataCodingScheme>(data[0] % TYPE_NUM);
157 cellInfo.encodeData.push_back(data[0]);
158 cellsInfos.push_back(cellInfo);
159 DataCodingScheme codingType = static_cast<DataCodingScheme>(data[0] % TYPE_NUM);
160 bool isStatusReport = (size % SLOT_NUM == 1);
161 GsmSmsMessage msg;
162 std::shared_ptr<struct SmsTpdu> tpdu =
163 msg.CreateDefaultSubmitSmsTpdu(desAddr, scAddr, text, isStatusReport, codingType);
164 sender->TextBasedSmsSplitDelivery(
165 text, text, cellsInfos, codingType, isStatusReport, tpdu, msg, sendCallback, deliveryCallback);
166 sender->SendCallbackExceptionCase(sendCallback, text);
167
168 std::shared_ptr<SmsSendIndexer> smsIndexer =
169 std::make_shared<SmsSendIndexer>(desAddr, scAddr, text, sendCallback, deliveryCallback);
170 sender->SendSmsToRil(smsIndexer);
171 sender->ResendTextDelivery(smsIndexer);
172 sender->ResendDataDelivery(smsIndexer);
173 bool isMore = (size % SLOT_NUM == 0);
174 auto encodeInfo = msg.GetSubmitEncodeInfo(text, isMore);
175 sender->SetSendIndexerInfo(smsIndexer, encodeInfo, 1);
176 sender->ResendTextDelivery(smsIndexer);
177 sender->voiceServiceState_ = static_cast<int32_t>(size);
178 sender->imsSmsCfg_ = static_cast<int32_t>(size);
179 sender->SendSmsToRil(smsIndexer);
180 sender->SetPduInfo(smsIndexer, msg, isMore);
181 }
182
SendSmsTest2(const uint8_t * data,size_t size)183 void SendSmsTest2(const uint8_t *data, size_t size)
184 {
185 std::function<void(std::shared_ptr<SmsSendIndexer>)> fun = nullptr;
186 int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
187 auto sender = std::make_shared<GsmSmsSender>(slotId, fun);
188 sender->Init();
189 sender->RegisterSatelliteCallback();
190 sender->UnregisterSatelliteCallback();
191 std::string desAddr(reinterpret_cast<const char *>(data), size);
192 std::string scAddr(reinterpret_cast<const char *>(data), size);
193 std::string text(reinterpret_cast<const char *>(data), size);
194 const sptr<ISendShortMessageCallback> sendCallback =
195 iface_cast<ISendShortMessageCallback>(new SendShortMessageCallbackStub());
196 const sptr<IDeliveryShortMessageCallback> deliveryCallback =
197 iface_cast<IDeliveryShortMessageCallback>(new DeliveryShortMessageCallbackStub());
198 GsmSimMessageParam smsData;
199 std::string pdu(reinterpret_cast<const char *>(data), size);
200 smsData.refId = static_cast<int64_t>(size);
201 smsData.smscPdu = pdu;
202 smsData.pdu = pdu;
203 std::shared_ptr<SmsSendIndexer> smsIndexer =
204 std::make_shared<SmsSendIndexer>(desAddr, scAddr, text, sendCallback, deliveryCallback);
205 sender->SendCsSms(smsIndexer, smsData);
206 sender->SendSatelliteSms(smsIndexer, smsData);
207 sender->SendImsSms(smsIndexer, smsData);
208 bool isSupported;
209 sender->IsImsSmsSupported(slotId, isSupported);
210 InnerEvent::Pointer event = InnerEvent::Get(static_cast<int32_t>(size));
211 sender->StatusReportAnalysis(event);
212 event = InnerEvent::Get(static_cast<int32_t>(size));
213 sender->StatusReportGetImsSms(event);
214 }
215
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)216 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
217 {
218 if (data == nullptr || size == 0) {
219 return;
220 }
221
222 OnRemoteRequest(data, size);
223 AddSimMessage(data, size);
224 HasSmsCapability(data, size);
225 SendSmsTest(data, size);
226 SendSmsTest2(data, size);
227 DelayedSingleton<ImsSmsClient>::GetInstance()->UnInit();
228 DelayedSingleton<ImsSmsClient>::DestroyInstance();
229 sleep(SLEEP_TIME_SECONDS);
230 DelayedSingleton<SmsService>::DestroyInstance();
231 }
232 } // namespace OHOS
233
234 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)235 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
236 {
237 /* Run your code on data */
238 OHOS::AddSmsTokenFuzzer token;
239 OHOS::DoSomethingInterestingWithMyAPI(data, size);
240 return 0;
241 }
242