1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "satellitestatuschanged_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <thread>
21
22 #define private public
23 #include "addcoreservicetoken_fuzzer.h"
24 #include "core_service.h"
25 #include "napi_util.h"
26 #include "satellite_core_callback.h"
27 #include "tel_event_handler.h"
28 #include "unistd.h"
29 #include "tel_ril_manager.h"
30
31 using namespace OHOS::Telephony;
32 namespace OHOS {
33 static bool g_isInited = false;
34 constexpr int32_t SLOT_NUM = 2;
35 constexpr int32_t RESPONSE_TYPE = 2;
36 constexpr int32_t SATELLITE_TYPE = 3;
37 constexpr int32_t SATELLITE_CORE = 4;
38 constexpr int32_t SLEEP_TIME_SECONDS = 100000;
39
IsServiceInited()40 bool IsServiceInited()
41 {
42 auto service = DelayedSingleton<CoreService>::GetInstance();
43 if (service == nullptr) {
44 return g_isInited;
45 }
46 if (service->GetServiceRunningState() !=
47 static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
48 service->OnStart();
49 }
50 if (!g_isInited && service->GetServiceRunningState() ==
51 static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
52 g_isInited = true;
53 }
54 return g_isInited;
55 }
56
SetRadioStateResponse(const uint8_t * data,size_t size)57 void SetRadioStateResponse(const uint8_t *data, size_t size)
58 {
59 if (!IsServiceInited()) {
60 return;
61 }
62
63 MessageParcel dataMessageParcel;
64 int32_t eventId = static_cast<int32_t>(*data % SATELLITE_CORE);
65 dataMessageParcel.WriteInt32(eventId);
66 int32_t dataType = static_cast<int32_t>(*data % SATELLITE_TYPE);
67 dataMessageParcel.WriteInt32(dataType);
68 int32_t offset = 0;
69 if (dataType == 1) {
70 int32_t flag = static_cast<int32_t>(*data + offset);
71 dataMessageParcel.WriteInt32(flag);
72 offset += sizeof(int32_t);
73 int32_t serial = static_cast<int32_t>(*data + offset);
74 dataMessageParcel.WriteInt32(serial);
75 offset += sizeof(int32_t);
76 int32_t error = static_cast<int32_t>(*data + offset);
77 dataMessageParcel.WriteInt32(error);
78 offset += sizeof(int32_t);
79 int32_t type = static_cast<int32_t>(*data + offset);
80 dataMessageParcel.WriteInt32(type);
81 } else if (dataType == RESPONSE_TYPE) {
82 int64_t flag = static_cast<int64_t>(*data + offset);
83 dataMessageParcel.WriteInt64(flag);
84 offset += sizeof(int32_t);
85 int32_t state = static_cast<int32_t>(*data + offset);
86 dataMessageParcel.WriteInt32(state);
87 }
88 dataMessageParcel.WriteBuffer(data, size);
89 dataMessageParcel.RewindRead(0);
90 MessageParcel reply;
91 std::shared_ptr<SatelliteCoreCallback> callback = std::make_shared<SatelliteCoreCallback>(nullptr);
92 if (callback == nullptr) {
93 return;
94 }
95 callback->OnSetRadioStateResponse(dataMessageParcel, reply);
96 }
97
RadioStateChanged(const uint8_t * data,size_t size)98 void RadioStateChanged(const uint8_t *data, size_t size)
99 {
100 if (!IsServiceInited()) {
101 return;
102 }
103
104 MessageParcel dataMessageParcel;
105 int32_t eventId = static_cast<int32_t>(*data % SATELLITE_CORE);
106 dataMessageParcel.WriteInt32(eventId);
107 int32_t dataType = static_cast<int32_t>(*data % SATELLITE_TYPE);
108 dataMessageParcel.WriteInt32(dataType);
109 dataMessageParcel.WriteBuffer(data, size);
110 dataMessageParcel.RewindRead(0);
111 MessageParcel reply;
112 std::shared_ptr<SatelliteCoreCallback> callback = std::make_shared<SatelliteCoreCallback>(nullptr);
113 if (callback == nullptr) {
114 return;
115 }
116 callback->OnRadioStateChanged(dataMessageParcel, reply);
117 }
118
SatelliteStatusChanged(const uint8_t * data,size_t size)119 void SatelliteStatusChanged(const uint8_t *data, size_t size)
120 {
121 if (!IsServiceInited()) {
122 return;
123 }
124
125 MessageParcel dataMessageParcel;
126 int32_t eventId = static_cast<int32_t>(*data % SATELLITE_CORE);
127 dataMessageParcel.WriteInt32(eventId);
128 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
129 dataMessageParcel.WriteInt32(slotId);
130 int32_t mode = static_cast<int32_t>(*data % SATELLITE_TYPE);
131 dataMessageParcel.WriteInt32(mode);
132 dataMessageParcel.WriteBuffer(data, size);
133 dataMessageParcel.RewindRead(0);
134 MessageParcel reply;
135 std::shared_ptr<SatelliteCoreCallback> callback = std::make_shared<SatelliteCoreCallback>(nullptr);
136 if (callback == nullptr) {
137 return;
138 }
139 callback->OnSatelliteStatusChanged(dataMessageParcel, reply);
140 }
141
SimStateChanged(const uint8_t * data,size_t size)142 void SimStateChanged(const uint8_t *data, size_t size)
143 {
144 if (!IsServiceInited()) {
145 return;
146 }
147
148 MessageParcel dataMessageParcel;
149 int32_t eventId = static_cast<int32_t>(*data % SATELLITE_CORE);
150 dataMessageParcel.WriteInt32(eventId);
151 dataMessageParcel.WriteBuffer(data, size);
152 dataMessageParcel.RewindRead(0);
153 MessageParcel reply;
154 std::shared_ptr<SatelliteCoreCallback> callback = std::make_shared<SatelliteCoreCallback>(nullptr);
155 if (callback == nullptr) {
156 return;
157 }
158 callback->OnSimStateChanged(dataMessageParcel, reply);
159 }
160
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)161 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
162 {
163 if (data == nullptr || size == 0) {
164 return;
165 }
166
167 SetRadioStateResponse(data, size);
168 RadioStateChanged(data, size);
169 SatelliteStatusChanged(data, size);
170 SimStateChanged(data, size);
171 auto telRilManager = std::static_pointer_cast<TelRilManager>(
172 DelayedSingleton<CoreService>::GetInstance()->telRilManager_);
173 if (telRilManager == nullptr || telRilManager->handler_ == nullptr) {
174 return;
175 }
176 auto handler = telRilManager->handler_;
177 if (handler != nullptr) {
178 handler->RemoveAllEvents();
179 usleep(SLEEP_TIME_SECONDS);
180 }
181 telRilManager->handler_->ClearFfrt(false);
182 telRilManager->handler_->queue_ = nullptr;
183 return;
184 }
185 } // namespace OHOS
186
187 /* Fuzzer entry point */
LLVMFuzzerInitialize(int * argc,char *** argv)188 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
189 {
190 OHOS::AddCoreServiceTokenFuzzer token;
191 return 0;
192 }
193
194 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)195 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
196 {
197 /* Run your code on data */
198 OHOS::DoSomethingInterestingWithMyAPI(data, size);
199 if (OHOS::g_isInited) {
200 OHOS::DelayedSingleton<CoreService>::GetInstance()->OnStop();
201 OHOS::g_isInited = false;
202 }
203 usleep(OHOS::SLEEP_TIME_SECONDS);
204 return 0;
205 }