1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "callabilitycallback_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #define private public
21 #include "addcalltoken_fuzzer.h"
22 #include "call_ability_callback.h"
23 #include "call_ability_callback_proxy.h"
24 #include "call_manager_callback.h"
25 #include "call_manager_utils.h"
26
27 using namespace OHOS::Telephony;
28 namespace OHOS {
29 constexpr int32_t ACCOUNT_ID_NUM = 10;
30 constexpr int32_t BOOL_NUM = 2;
31 constexpr int32_t CALL_ID_NUM = 10;
32 constexpr int32_t REPORT_ID_NUM = 23;
33 constexpr int32_t RESULT_ID_NUM = 50;
34 constexpr int32_t OTT_ID_NUM = 11;
35 constexpr int32_t VEDIO_STATE_NUM = 2;
36 constexpr int32_t IMS_CALL_MODE_NUM = 5;
37 constexpr int32_t CALL_SESSION_EVENT_ID_NUM = 4;
38 constexpr int32_t VIDEO_REQUEST_RESULT_TYPE_NUM = 102;
39 sptr<CallAbilityCallback> callAbilityCallbackPtr_ = nullptr;
40
ServiceInited()41 bool ServiceInited()
42 {
43 if (!IsServiceInited()) {
44 return false;
45 }
46 callAbilityCallbackPtr_ = new (std::nothrow) CallAbilityCallback();
47 if (callAbilityCallbackPtr_ == nullptr) {
48 return false;
49 }
50 return true;
51 }
52
OnRemoteRequest(const uint8_t * data,size_t size)53 int32_t OnRemoteRequest(const uint8_t *data, size_t size)
54 {
55 if (!ServiceInited()) {
56 return TELEPHONY_ERROR;
57 }
58 MessageParcel messageParcel;
59 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackStub::GetDescriptor())) {
60 return TELEPHONY_ERROR;
61 }
62 messageParcel.RewindRead(0);
63 uint32_t code = static_cast<uint32_t>(*data);
64 MessageParcel reply;
65 MessageOption option;
66 return callAbilityCallbackPtr_->OnRemoteRequest(code, messageParcel, reply, option);
67 }
68
UpdateCallStateInfo(const uint8_t * data,size_t size)69 int32_t UpdateCallStateInfo(const uint8_t *data, size_t size)
70 {
71 if (!ServiceInited()) {
72 return TELEPHONY_ERROR;
73 }
74 CallAttributeInfo info;
75 std::string msg(reinterpret_cast<const char *>(data), size);
76 int32_t accountLength = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
77 int32_t bundleLength = msg.length() > kMaxBundleNameLen ? kMaxBundleNameLen : msg.length();
78 memcpy_s(info.accountNumber, kMaxNumberLen, msg.c_str(), accountLength);
79 memcpy_s(info.bundleName, kMaxBundleNameLen, msg.c_str(), bundleLength);
80 info.accountId = static_cast<int32_t>(size % ACCOUNT_ID_NUM);
81 info.startTime = static_cast<uint32_t>(size);
82 info.callId = static_cast<int32_t>(size % CALL_ID_NUM);
83 info.callBeginTime = static_cast<time_t>(size);
84 info.callEndTime = static_cast<time_t>(size);
85 info.ringBeginTime = static_cast<time_t>(size);
86 info.ringEndTime = static_cast<time_t>(size);
87 MessageParcel messageParcel;
88 messageParcel.WriteCString(info.accountNumber);
89 messageParcel.WriteCString(info.bundleName);
90 messageParcel.WriteBool(info.speakerphoneOn);
91 messageParcel.WriteInt32(info.accountId);
92 messageParcel.WriteInt32(static_cast<int32_t>(info.videoState));
93 messageParcel.WriteInt64(info.startTime);
94 messageParcel.WriteBool(info.isEcc);
95 messageParcel.WriteInt32(static_cast<int32_t>(info.callType));
96 messageParcel.WriteInt32(info.callId);
97 messageParcel.WriteInt32(static_cast<int32_t>(info.callState));
98 messageParcel.WriteInt32(static_cast<int32_t>(info.conferenceState));
99 messageParcel.WriteInt64(info.callBeginTime);
100 messageParcel.WriteInt64(info.callEndTime);
101 messageParcel.WriteInt64(info.ringBeginTime);
102 messageParcel.WriteInt64(info.ringEndTime);
103 messageParcel.WriteInt32(static_cast<int32_t>(info.callDirection));
104 messageParcel.WriteInt32(static_cast<int32_t>(info.answerType));
105 messageParcel.WriteInt32(info.index);
106 messageParcel.WriteString(info.voipCallInfo.voipCallId);
107 messageParcel.WriteString(info.voipCallInfo.userName);
108 messageParcel.WriteString(info.voipCallInfo.abilityName);
109 messageParcel.WriteString(info.voipCallInfo.extensionId);
110 messageParcel.WriteString(info.voipCallInfo.voipBundleName);
111 messageParcel.WriteUInt8Vector(info.voipCallInfo.userProfile);
112 messageParcel.RewindRead(0);
113 MessageParcel reply;
114 MessageOption option;
115 return callAbilityCallbackPtr_->OnUpdateCallStateInfo(messageParcel, reply);
116 }
117
UpdateCallEvent(const uint8_t * data,size_t size)118 int32_t UpdateCallEvent(const uint8_t *data, size_t size)
119 {
120 if (!ServiceInited()) {
121 return TELEPHONY_ERROR;
122 }
123 CallEventInfo info;
124 std::string msg(reinterpret_cast<const char *>(data), size);
125 int32_t phoneLength = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
126 int32_t bundleLength = msg.length() > kMaxBundleNameLen ? kMaxBundleNameLen : msg.length();
127 memcpy_s(info.phoneNum, kMaxNumberLen, msg.c_str(), phoneLength);
128 memcpy_s(info.bundleName, kMaxBundleNameLen, msg.c_str(), bundleLength);
129 int32_t length = sizeof(CallEventInfo);
130 MessageParcel messageParcel;
131 messageParcel.WriteInt32(length);
132 messageParcel.WriteRawData((const void *)&info, length);
133 messageParcel.RewindRead(0);
134 MessageParcel reply;
135 MessageOption option;
136 return callAbilityCallbackPtr_->OnUpdateCallEvent(messageParcel, reply);
137 }
138
UpdateCallDisconnectedCause(const uint8_t * data,size_t size)139 int32_t UpdateCallDisconnectedCause(const uint8_t *data, size_t size)
140 {
141 if (!ServiceInited()) {
142 return TELEPHONY_ERROR;
143 }
144 int32_t reason = static_cast<uint32_t>(size);
145 std::string message(reinterpret_cast<const char *>(data), size);
146 MessageParcel messageParcel;
147 messageParcel.WriteInt32(reason);
148 messageParcel.WriteString(message);
149 messageParcel.RewindRead(0);
150 MessageParcel reply;
151 MessageOption option;
152 return callAbilityCallbackPtr_->OnUpdateCallDisconnectedCause(messageParcel, reply);
153 }
154
UpdateAysncResults(const uint8_t * data,size_t size)155 int32_t UpdateAysncResults(const uint8_t *data, size_t size)
156 {
157 if (!ServiceInited()) {
158 return TELEPHONY_ERROR;
159 }
160 int32_t reportId = static_cast<uint32_t>(*data % REPORT_ID_NUM);
161 int32_t resultId = static_cast<uint32_t>(*data % RESULT_ID_NUM);
162 MessageParcel messageParcel;
163 messageParcel.WriteInt32(reportId);
164 messageParcel.WriteInt32(resultId);
165 messageParcel.RewindRead(0);
166 MessageParcel reply;
167 MessageOption option;
168 return callAbilityCallbackPtr_->OnUpdateAysncResults(messageParcel, reply);
169 }
170
UpdateOttCallRequest(const uint8_t * data,size_t size)171 int32_t UpdateOttCallRequest(const uint8_t *data, size_t size)
172 {
173 if (!ServiceInited()) {
174 return TELEPHONY_ERROR;
175 }
176 int32_t requestId = static_cast<uint32_t>(size % OTT_ID_NUM);
177 int32_t videoState = static_cast<uint32_t>(size % VEDIO_STATE_NUM);
178 std::string phoneNumber(reinterpret_cast<const char *>(data), size);
179 std::string bundleName(reinterpret_cast<const char *>(data), size);
180 MessageParcel messageParcel;
181 messageParcel.WriteInt32(requestId);
182 messageParcel.WriteInt32(videoState);
183 messageParcel.WriteString(phoneNumber);
184 messageParcel.WriteString(bundleName);
185 messageParcel.RewindRead(0);
186 MessageParcel reply;
187 MessageOption option;
188 return callAbilityCallbackPtr_->OnUpdateOttCallRequest(messageParcel, reply);
189 }
190
UpdateMmiCodeResults(const uint8_t * data,size_t size)191 int32_t UpdateMmiCodeResults(const uint8_t *data, size_t size)
192 {
193 if (!ServiceInited()) {
194 return TELEPHONY_ERROR;
195 }
196 MmiCodeInfo info;
197 int32_t length = sizeof(MmiCodeInfo);
198 info.result = static_cast<uint32_t>(size);
199 std::string msg(reinterpret_cast<const char *>(data), size);
200 int32_t msgLength = msg.length() > kMaxNumberLen ? kMaxNumberLen : msg.length();
201 memcpy_s(info.message, kMaxNumberLen, msg.c_str(), msgLength);
202 MessageParcel messageParcel;
203 messageParcel.WriteInt32(length);
204 messageParcel.WriteRawData((const void *)&info, length);
205 messageParcel.RewindRead(0);
206 MessageParcel reply;
207 MessageOption option;
208 return callAbilityCallbackPtr_->OnUpdateMmiCodeResults(messageParcel, reply);
209 }
210
UpdateAudioDeviceChange(const uint8_t * data,size_t size)211 int32_t UpdateAudioDeviceChange(const uint8_t *data, size_t size)
212 {
213 if (!ServiceInited()) {
214 return TELEPHONY_ERROR;
215 }
216 MessageParcel messageParcel;
217 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
218 TELEPHONY_LOGE("write descriptor fail");
219 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
220 }
221 AudioDevice device;
222 device.deviceType = AudioDeviceType::DEVICE_UNKNOWN;
223 std::string msg(reinterpret_cast<const char *>(data), size);
224 int32_t length = msg.length() > kMaxAddressLen ? kMaxAddressLen : msg.length();
225 memcpy_s(device.address, kMaxAddressLen, msg.c_str(), length);
226 int32_t dataSize = static_cast<uint32_t>(size);
227 messageParcel.WriteInt32(dataSize);
228 messageParcel.WriteRawData((const void *)&device, sizeof(AudioDevice));
229 messageParcel.WriteRawData((const void *)&device, sizeof(AudioDevice));
230 messageParcel.WriteBool(static_cast<uint32_t>(size % BOOL_NUM));
231 messageParcel.RewindRead(0);
232 MessageParcel reply;
233 MessageOption option;
234 return callAbilityCallbackPtr_->OnUpdateAudioDeviceChange(messageParcel, reply);
235 }
236
UpdateImsCallModeChange(const uint8_t * data,size_t size)237 int32_t UpdateImsCallModeChange(const uint8_t *data, size_t size)
238 {
239 if (!ServiceInited()) {
240 return TELEPHONY_ERROR;
241 }
242 MessageParcel messageParcel;
243 MessageParcel replyParcel;
244 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
245 TELEPHONY_LOGE("write descriptor fail");
246 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
247 }
248 int32_t length = sizeof(CallMediaModeInfo);
249 messageParcel.WriteInt32(length);
250 CallMediaModeInfo callMediaModeInfo;
251 callMediaModeInfo.callId = static_cast<int32_t>(*data);
252 callMediaModeInfo.isRequestInfo = static_cast<bool>(*data % BOOL_NUM);
253 callMediaModeInfo.result = static_cast<VideoRequestResultType>(*data % VIDEO_REQUEST_RESULT_TYPE_NUM);
254 callMediaModeInfo.callMode = static_cast<ImsCallMode>(*data % IMS_CALL_MODE_NUM);
255 messageParcel.WriteRawData((const void *)&callMediaModeInfo, length);
256 messageParcel.RewindRead(0);
257 return callAbilityCallbackPtr_->OnUpdateImsCallModeChange(messageParcel, replyParcel);
258 }
259
UpdateCallSessionEventChange(const uint8_t * data,size_t size)260 int32_t UpdateCallSessionEventChange(const uint8_t *data, size_t size)
261 {
262 if (!ServiceInited()) {
263 return TELEPHONY_ERROR;
264 }
265 MessageParcel messageParcel;
266 MessageParcel replyParcel;
267 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
268 TELEPHONY_LOGE("write descriptor fail");
269 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
270 }
271 int32_t length = sizeof(CallSessionEvent);
272 messageParcel.WriteInt32(length);
273 CallSessionEvent callSessionInfo;
274 callSessionInfo.callId = static_cast<int32_t>(*data);
275 callSessionInfo.eventId = static_cast<CallSessionEventId>(*data % CALL_SESSION_EVENT_ID_NUM);
276 messageParcel.WriteRawData((const void *)&callSessionInfo, length);
277 messageParcel.RewindRead(0);
278 return callAbilityCallbackPtr_->OnUpdateCallSessionEventChange(messageParcel, replyParcel);
279 }
280
UpdatePeerDimensionsChange(const uint8_t * data,size_t size)281 int32_t UpdatePeerDimensionsChange(const uint8_t *data, size_t size)
282 {
283 if (!ServiceInited()) {
284 return TELEPHONY_ERROR;
285 }
286 MessageParcel messageParcel;
287 MessageParcel replyParcel;
288 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
289 TELEPHONY_LOGE("write descriptor fail");
290 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
291 }
292 int32_t length = sizeof(PeerDimensionsDetail);
293 messageParcel.WriteInt32(length);
294 PeerDimensionsDetail peerDimensionsInfo;
295 peerDimensionsInfo.callId = static_cast<int32_t>(*data);
296 peerDimensionsInfo.width = static_cast<int32_t>(*data);
297 peerDimensionsInfo.height = static_cast<int32_t>(*data);
298 messageParcel.RewindRead(0);
299 return callAbilityCallbackPtr_->OnUpdatePeerDimensionsChange(messageParcel, replyParcel);
300 }
301
UpdateCallDataUsageChange(const uint8_t * data,size_t size)302 int32_t UpdateCallDataUsageChange(const uint8_t *data, size_t size)
303 {
304 if (!ServiceInited()) {
305 return TELEPHONY_ERROR;
306 }
307 MessageParcel messageParcel;
308 MessageParcel replyParcel;
309 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
310 TELEPHONY_LOGE("write descriptor fail");
311 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
312 }
313 int64_t dataUsage = static_cast<int64_t>(*data);
314 messageParcel.WriteInt64(dataUsage);
315 messageParcel.RewindRead(0);
316 return callAbilityCallbackPtr_->OnUpdateCallDataUsageChange(messageParcel, replyParcel);
317 }
318
UpdateCameraCapabilities(const uint8_t * data,size_t size)319 int32_t UpdateCameraCapabilities(const uint8_t *data, size_t size)
320 {
321 if (!ServiceInited()) {
322 return TELEPHONY_ERROR;
323 }
324 MessageParcel messageParcel;
325 MessageParcel replyParcel;
326 if (!messageParcel.WriteInterfaceToken(CallAbilityCallbackProxy::GetDescriptor())) {
327 TELEPHONY_LOGE("write descriptor fail");
328 return TELEPHONY_ERR_WRITE_DESCRIPTOR_TOKEN_FAIL;
329 }
330 int32_t length = sizeof(CameraCapabilities);
331 messageParcel.WriteInt32(length);
332 CameraCapabilities cameraCapabilitiesInfo;
333 cameraCapabilitiesInfo.callId = static_cast<int32_t>(*data);
334 cameraCapabilitiesInfo.width = static_cast<int32_t>(*data);
335 cameraCapabilitiesInfo.height = static_cast<int32_t>(*data);
336 messageParcel.RewindRead(0);
337 return callAbilityCallbackPtr_->OnUpdateCameraCapabilities(messageParcel, replyParcel);
338 }
339
WriteCallAttributeInfo(const uint8_t * data,size_t size)340 void WriteCallAttributeInfo(const uint8_t *data, size_t size)
341 {
342 MessageParcel messageParcel;
343 CallAttributeInfo info;
344 info.accountId = static_cast<int32_t>(*data);
345 info.callId = static_cast<int32_t>(*data);
346 info.callState = static_cast<TelCallState>(static_cast<int32_t>(*data));
347 CallManagerUtils::WriteCallAttributeInfo(info, messageParcel);
348 }
349
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)350 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
351 {
352 if (data == nullptr || size == 0) {
353 return;
354 }
355 OnRemoteRequest(data, size);
356 UpdateCallStateInfo(data, size);
357 UpdateCallEvent(data, size);
358 UpdateCallDisconnectedCause(data, size);
359 UpdateAysncResults(data, size);
360 UpdateOttCallRequest(data, size);
361 UpdateMmiCodeResults(data, size);
362 UpdateAudioDeviceChange(data, size);
363 UpdateImsCallModeChange(data, size);
364 UpdateCallSessionEventChange(data, size);
365 UpdatePeerDimensionsChange(data, size);
366 UpdateCallDataUsageChange(data, size);
367 UpdateCameraCapabilities(data, size);
368 WriteCallAttributeInfo(data, size);
369 }
370 } // namespace OHOS
371
372 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)373 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
374 {
375 OHOS::AddCallTokenFuzzer token;
376 /* Run your code on data */
377 OHOS::DoSomethingInterestingWithMyAPI(data, size);
378 return 0;
379 }
380