1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "simoperation_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #include <thread>
21
22 #define private public
23 #include "addcoreservicetoken_fuzzer.h"
24 #include "core_service.h"
25 #include "napi_util.h"
26 #include "system_ability_definition.h"
27 #include "tel_event_handler.h"
28 #include "unistd.h"
29 #include "tel_ril_manager.h"
30 #include "sim_state_type.h"
31 #include "sim_manager.h"
32 #include "operator_config_cache.h"
33 #include "voice_mail_constants.h"
34
35 using namespace OHOS::Telephony;
36 namespace OHOS {
37 constexpr int32_t SLOT_NUM = 2;
38 constexpr int32_t LOCK_TYPE_NUM = 2;
39 constexpr int32_t LOCK_STATE_NUM = 3;
40 constexpr int32_t SLEEP_TIME_SECONDS = 100000;
41
GetInt(const uint8_t * data,size_t size,int index=0)42 static int32_t GetInt(const uint8_t *data, size_t size, int index = 0)
43 {
44 size_t typeSize = sizeof(int32_t);
45 uintptr_t align = reinterpret_cast<uintptr_t>(data) % typeSize;
46 const uint8_t *base = data + (align > 0 ? typeSize - align : 0);
47 if (size - align < typeSize * index + (typeSize - align)) {
48 return 0;
49 }
50 return *reinterpret_cast<const int32_t*>(base + index * typeSize);
51 }
52
SimOperationFunc(const uint8_t * data,size_t size)53 void SimOperationFunc(const uint8_t *data, size_t size)
54 {
55 int index = 0;
56 auto telRilManager = std::make_shared<TelRilManager>();
57 auto simManager = std::make_shared<SimManager>(telRilManager);
58 std::vector<std::shared_ptr<Telephony::SimStateManager>> simStateManager = { nullptr, nullptr };
59 std::vector<std::shared_ptr<Telephony::SimFileManager>> simFileManager = { nullptr, nullptr };
60 simManager->multiSimController_ =std::make_shared<MultiSimController>(
61 telRilManager, simStateManager, simFileManager);
62 int32_t slotId = static_cast<int32_t>(*data % SLOT_NUM);
63 int32_t enable = GetInt(data, size, index++);
64 std::string pin(reinterpret_cast<const char *>(data), size);
65 std::string puk(reinterpret_cast<const char *>(data), size);
66 std::u16string number(reinterpret_cast<const char16_t *>(data), size);
67 LockStatusResponse lockResponse;
68 int32_t lockType = *data % LOCK_TYPE_NUM + 1;
69 LockType lockEnum = static_cast<LockType>(lockType);
70 int32_t lockState = *data % LOCK_STATE_NUM + 1;
71 LockState lockStateEnum = static_cast<LockState>(lockState);
72 PersoLockInfo lockInfo;
73 SimAuthenticationResponse simResponse;
74 simManager->UnlockPin(slotId, pin, lockResponse);
75 simManager->UnlockPuk(slotId, pin, puk, lockResponse);
76 simManager->AlterPin(slotId, pin, puk, lockResponse);
77 simManager->UnlockPin2(slotId, pin, lockResponse);
78 simManager->UnlockPuk2(slotId, pin, puk, lockResponse);
79 simManager->AlterPin2(slotId, pin, puk, lockResponse);
80 simManager->GetLockState(slotId, lockEnum, lockStateEnum);
81 simManager->UnlockSimLock(slotId, lockInfo, lockResponse);
82 simManager->SetActiveSim(slotId, enable);
83 simManager->SetActiveSimSatellite(slotId, enable);
84 simManager->SetShowNumber(slotId, number);
85 simManager->SetShowName(slotId, number);
86 simManager->GetShowNumber(slotId, number);
87 simManager->GetShowName(slotId, number);
88 simManager->GetDsdsMode(enable);
89 simManager->SetDsdsMode(enable);
90 simManager->SendEnvelopeCmd(slotId, pin);
91 simManager->SendTerminalResponseCmd(slotId, pin);
92 simManager->SendCallSetupRequestResult(slotId, true);
93 simManager->GetSimIccId(slotId, number);
94 }
95
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)96 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
97 {
98 if (data == nullptr || size == 0) {
99 return;
100 }
101
102 SimOperationFunc(data, size);
103 auto telRilManager = std::static_pointer_cast<TelRilManager>(
104 DelayedSingleton<CoreService>::GetInstance()->telRilManager_);
105 if (telRilManager == nullptr || telRilManager->handler_ == nullptr) {
106 return;
107 }
108 auto handler = telRilManager->handler_;
109 if (handler != nullptr) {
110 handler->RemoveAllEvents();
111 usleep(SLEEP_TIME_SECONDS);
112 }
113 telRilManager->handler_->ClearFfrt(false);
114 telRilManager->handler_->queue_ = nullptr;
115 return;
116 }
117 } // namespace OHOS
118
119 /* Fuzzer entry point */
LLVMFuzzerInitialize(int * argc,char *** argv)120 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
121 {
122 OHOS::AddCoreServiceTokenFuzzer token;
123 return 0;
124 }
125
126 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)127 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
128 {
129 /* Run your code on data */
130 OHOS::DoSomethingInterestingWithMyAPI(data, size);
131 return 0;
132 }