1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "telephonystateregistry_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20 #define private public
21 #define protected public
22 #include "addstateregistrytoken_fuzzer.h"
23 #include <fuzzer/FuzzedDataProvider.h>
24 #include "if_system_ability_manager.h"
25 #include "iservice_registry.h"
26 #include "securec.h"
27 #include "state_registry_ipc_interface_code.h"
28 #include "system_ability_definition.h"
29 #include "telephony_observer.h"
30 #include "telephony_state_manager.h"
31 #include "telephony_state_registry_service.h"
32 #include "telephony_state_registry_stub.h"
33
34 using namespace OHOS::Telephony;
35 namespace OHOS {
36 static bool g_isInited = false;
37 constexpr int32_t ROAMING_NUM = 4;
38 constexpr int32_t REG_NUM = 6;
39 constexpr int32_t CELL_NUM = 7;
40 constexpr int32_t SIGNAL_NUM = 6;
41 constexpr int32_t SIGNAL_PLUS = 1;
42 constexpr int32_t NR_NUM = 7;
43 constexpr int32_t RADIO_NUM = 13;
44 constexpr int32_t MIN_SLOT_ID = -1;
45 constexpr int32_t MAX_SLOT_ID = 4;
46 constexpr int32_t MAX_LOOP_SIZE = 1000;
47
GetRandomInt(int min,int max,const uint8_t * data,size_t size)48 int32_t GetRandomInt(int min, int max, const uint8_t *data, size_t size)
49 {
50 FuzzedDataProvider fdp(data, size);
51 return fdp.ConsumeIntegralInRange<int32_t>(min, max);
52 }
53
IsServiceInited()54 bool IsServiceInited()
55 {
56 if (!g_isInited) {
57 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnStart();
58 if (DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->GetServiceRunningState() ==
59 static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
60 g_isInited = true;
61 }
62 }
63 return g_isInited;
64 }
65
OnRemoteRequest(const uint8_t * data,size_t size)66 void OnRemoteRequest(const uint8_t *data, size_t size)
67 {
68 if (!IsServiceInited()) {
69 return;
70 }
71 MessageParcel dataMessageParcel;
72 if (!dataMessageParcel.WriteInterfaceToken(TelephonyStateRegistryStub::GetDescriptor())) {
73 return;
74 }
75 dataMessageParcel.WriteBuffer(data, size);
76 dataMessageParcel.RewindRead(0);
77 int32_t maxCode = static_cast<int32_t>(StateNotifyInterfaceCode::ICC_ACCOUNT_CHANGE) + 1;
78 uint32_t code = static_cast<uint32_t>(GetRandomInt(0, maxCode, data, size));
79 MessageParcel reply;
80 MessageOption option;
81 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnRemoteRequest(
82 code, dataMessageParcel, reply, option);
83 }
84
CreateGsmCellInfo(std::unique_ptr<GsmCellInformation> & cell,const uint8_t * data,size_t size)85 void CreateGsmCellInfo(std::unique_ptr<GsmCellInformation> &cell, const uint8_t *data, size_t size)
86 {
87 if (cell == nullptr) {
88 return;
89 }
90 cell->lac_ = GetRandomInt(0, INT32_MAX, data, size);
91 cell->bsic_ = GetRandomInt(0, INT32_MAX, data, size);
92 cell->arfcn_ = GetRandomInt(0, INT32_MAX, data, size);
93 std::string mcc(reinterpret_cast<const char *>(data), size);
94 cell->mcc_ = mcc;
95 std::string mnc(reinterpret_cast<const char *>(data), size);
96 cell->mnc_ = mnc;
97 cell->cellId_ = GetRandomInt(0, INT32_MAX, data, size);
98 cell->timeStamp_ = static_cast<uint64_t>(GetRandomInt(0, INT32_MAX, data, size));
99 cell->signalIntensity_ = GetRandomInt(0, INT32_MAX, data, size);
100 cell->signalLevel_ = GetRandomInt(0, INT32_MAX, data, size);
101 cell->isCamped_ = GetRandomInt(0, 1, data, size);
102 }
103
CreateLteCellInfo(std::unique_ptr<LteCellInformation> & cell,const uint8_t * data,size_t size)104 void CreateLteCellInfo(std::unique_ptr<LteCellInformation> &cell, const uint8_t *data, size_t size)
105 {
106 if (cell == nullptr) {
107 return;
108 }
109 cell->pci_ = GetRandomInt(0, INT32_MAX, data, size);
110 cell->tac_ = GetRandomInt(0, INT32_MAX, data, size);
111 cell->earfcn_ = GetRandomInt(0, INT32_MAX, data, size);
112 std::string mcc(reinterpret_cast<const char *>(data), size);
113 cell->mcc_ = mcc;
114 std::string mnc(reinterpret_cast<const char *>(data), size);
115 cell->mnc_ = mnc;
116 cell->cellId_ = GetRandomInt(0, INT32_MAX, data, size);
117 cell->timeStamp_ = static_cast<uint64_t>(GetRandomInt(0, INT32_MAX, data, size));
118 cell->signalIntensity_ = GetRandomInt(0, INT32_MAX, data, size);
119 cell->signalLevel_ = GetRandomInt(0, INT32_MAX, data, size);
120 cell->isCamped_ = GetRandomInt(0, 1, data, size);
121 }
122
UpdateCellInfo(const uint8_t * data,size_t size)123 void UpdateCellInfo(const uint8_t *data, size_t size)
124 {
125 if (!IsServiceInited()) {
126 return;
127 }
128 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
129 int32_t loopSize = GetRandomInt(0, MAX_LOOP_SIZE, data, size);
130 MessageParcel dataMessageParcel;
131 dataMessageParcel.WriteInt32(slotId);
132 dataMessageParcel.WriteInt32(loopSize);
133 for (int32_t i = 0; i < loopSize; i++) {
134 CellInformation::CellType type = static_cast<CellInformation::CellType>(size % CELL_NUM);
135 if (type == CellInformation::CellType::CELL_TYPE_GSM) {
136 std::unique_ptr<GsmCellInformation> cell = std::make_unique<GsmCellInformation>();
137 if (cell == nullptr) {
138 return;
139 }
140 CreateGsmCellInfo(cell, data, size);
141 cell->Marshalling(dataMessageParcel);
142 }
143 if (type == CellInformation::CellType::CELL_TYPE_LTE) {
144 std::unique_ptr<LteCellInformation> cell = std::make_unique<LteCellInformation>();
145 if (cell == nullptr) {
146 return;
147 }
148 CreateLteCellInfo(cell, data, size);
149 cell->Marshalling(dataMessageParcel);
150 }
151 }
152 dataMessageParcel.RewindRead(0);
153 MessageParcel reply;
154 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellInfo(dataMessageParcel, reply);
155 }
156
UpdateCallState(const uint8_t * data,size_t size)157 void UpdateCallState(const uint8_t *data, size_t size)
158 {
159 if (!IsServiceInited()) {
160 return;
161 }
162 int32_t maxState = static_cast<int32_t>(Telephony::CallStatus::CALL_STATUS_ANSWERED) + 1;
163 int32_t callState = GetRandomInt(-1, maxState, data, size);
164 std::string phoneNumber(reinterpret_cast<const char *>(data), size);
165 MessageParcel dataMessageParcel;
166 dataMessageParcel.WriteInt32(callState);
167 dataMessageParcel.WriteString16(Str8ToStr16(phoneNumber));
168 dataMessageParcel.RewindRead(0);
169 MessageParcel reply;
170 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCallState(dataMessageParcel, reply);
171 }
172
UpdateCallStateForSlotId(const uint8_t * data,size_t size)173 void UpdateCallStateForSlotId(const uint8_t *data, size_t size)
174 {
175 if (!IsServiceInited()) {
176 return;
177 }
178 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
179 int32_t maxState = static_cast<int32_t>(Telephony::CallStatus::CALL_STATUS_ANSWERED) + 1;
180 int32_t callState = GetRandomInt(-1, maxState, data, size);
181 std::string incomingNumber(reinterpret_cast<const char *>(data), size);
182 MessageParcel dataMessageParcel;
183 dataMessageParcel.WriteInt32(slotId);
184 dataMessageParcel.WriteInt32(callState);
185 dataMessageParcel.WriteString16(Str8ToStr16(incomingNumber));
186 dataMessageParcel.RewindRead(0);
187 MessageParcel reply;
188 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCallStateForSlotId(
189 dataMessageParcel, reply);
190 }
191
CreateGsmSignalInfo(std::unique_ptr<GsmSignalInformation> & signal,const uint8_t * data,size_t size)192 void CreateGsmSignalInfo(std::unique_ptr<GsmSignalInformation> &signal, const uint8_t *data, size_t size)
193 {
194 if (signal == nullptr) {
195 return;
196 }
197 int32_t offset = 0;
198 signal->signalBar_ = static_cast<int32_t>(*data + offset);
199 offset += sizeof(int32_t);
200 signal->gsmRxlev_ = static_cast<int32_t>(*data + offset);
201 offset += sizeof(int32_t);
202 signal->gsmBer_ = static_cast<int32_t>(*data + offset);
203 }
204
CreateCDMASignalInfo(std::unique_ptr<CdmaSignalInformation> & signal,const uint8_t * data,size_t size)205 void CreateCDMASignalInfo(std::unique_ptr<CdmaSignalInformation> &signal, const uint8_t *data, size_t size)
206 {
207 if (signal == nullptr) {
208 return;
209 }
210 int32_t offset = 0;
211 signal->signalBar_ = static_cast<int32_t>(*data + offset);
212 offset += sizeof(int32_t);
213 signal->cdmaRssi_ = static_cast<int32_t>(*data + offset);
214 offset += sizeof(int32_t);
215 signal->cdmaEcno_ = static_cast<int32_t>(*data + offset);
216 }
217
CreateLTESignalInfo(std::unique_ptr<LteSignalInformation> & signal,const uint8_t * data,size_t size)218 void CreateLTESignalInfo(std::unique_ptr<LteSignalInformation> &signal, const uint8_t *data, size_t size)
219 {
220 if (signal == nullptr) {
221 return;
222 }
223 int32_t offset = 0;
224 signal->signalBar_ = static_cast<int32_t>(*data + offset);
225 offset += sizeof(int32_t);
226 signal->rxlev_ = static_cast<int32_t>(*data + offset);
227 offset += sizeof(int32_t);
228 signal->lteRsrp_ = static_cast<int32_t>(*data + offset);
229 offset += sizeof(int32_t);
230 signal->lteRsrq_ = static_cast<int32_t>(*data + offset);
231 offset += sizeof(int32_t);
232 signal->lteSnr_ = static_cast<int32_t>(*data + offset);
233 }
234
CreateWCDMASignalInfo(std::unique_ptr<WcdmaSignalInformation> & signal,const uint8_t * data,size_t size)235 void CreateWCDMASignalInfo(std::unique_ptr<WcdmaSignalInformation> &signal, const uint8_t *data, size_t size)
236 {
237 if (signal == nullptr) {
238 return;
239 }
240 int32_t offset = 0;
241 signal->signalBar_ = static_cast<int32_t>(*data + offset);
242 offset += sizeof(int32_t);
243 signal->wcdmaRxlev_ = static_cast<int32_t>(*data + offset);
244 offset += sizeof(int32_t);
245 signal->wcdmaRscp_ = static_cast<int32_t>(*data + offset);
246 offset += sizeof(int32_t);
247 signal->wcdmaEcio_ = static_cast<int32_t>(*data + offset);
248 offset += sizeof(int32_t);
249 signal->wcdmaBer_ = static_cast<int32_t>(*data + offset);
250 }
251
CreateNRSignalInfo(std::unique_ptr<NrSignalInformation> & signal,const uint8_t * data,size_t size)252 void CreateNRSignalInfo(std::unique_ptr<NrSignalInformation> &signal, const uint8_t *data, size_t size)
253 {
254 if (signal == nullptr) {
255 return;
256 }
257 int32_t offset = 0;
258 signal->signalBar_ = static_cast<int32_t>(*data + offset);
259 offset += sizeof(int32_t);
260 signal->nrRsrp_ = static_cast<int32_t>(*data + offset);
261 offset += sizeof(int32_t);
262 signal->nrRsrq_ = static_cast<int32_t>(*data + offset);
263 offset += sizeof(int32_t);
264 signal->nrSinr_ = static_cast<int32_t>(*data + offset);
265 }
266
UpdateLteNrSignalInfo(const uint8_t * data,size_t size,MessageParcel & dataMessageParcel,SignalInformation::NetworkType type)267 void UpdateLteNrSignalInfo(const uint8_t *data, size_t size, MessageParcel &dataMessageParcel,
268 SignalInformation::NetworkType type)
269 {
270 if (type == SignalInformation::NetworkType::LTE) {
271 std::unique_ptr<LteSignalInformation> signal = std::make_unique<LteSignalInformation>();
272 if (signal == nullptr) {
273 return;
274 }
275 CreateLTESignalInfo(signal, data, size);
276 signal->Marshalling(dataMessageParcel);
277 }
278 if (type == SignalInformation::NetworkType::NR) {
279 std::unique_ptr<NrSignalInformation> signal = std::make_unique<NrSignalInformation>();
280 if (signal == nullptr) {
281 return;
282 }
283 CreateNRSignalInfo(signal, data, size);
284 signal->Marshalling(dataMessageParcel);
285 }
286 }
287
UpdateSignalInfo(const uint8_t * data,size_t size)288 void UpdateSignalInfo(const uint8_t *data, size_t size)
289 {
290 if (!IsServiceInited()) {
291 return;
292 }
293 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
294 int32_t loopSize = GetRandomInt(0, MAX_LOOP_SIZE, data, size);
295 MessageParcel dataMessageParcel;
296 dataMessageParcel.WriteInt32(slotId);
297 dataMessageParcel.WriteInt32(loopSize);
298 for (int32_t i = 0; i < loopSize; i++) {
299 SignalInformation::NetworkType type =
300 static_cast<SignalInformation::NetworkType>(size % SIGNAL_NUM + SIGNAL_PLUS);
301 if (type == SignalInformation::NetworkType::GSM) {
302 std::unique_ptr<GsmSignalInformation> signal = std::make_unique<GsmSignalInformation>();
303 if (signal == nullptr) {
304 return;
305 }
306 CreateGsmSignalInfo(signal, data, size);
307 signal->Marshalling(dataMessageParcel);
308 }
309 if (type == SignalInformation::NetworkType::CDMA) {
310 std::unique_ptr<CdmaSignalInformation> signal = std::make_unique<CdmaSignalInformation>();
311 if (signal == nullptr) {
312 return;
313 }
314 CreateCDMASignalInfo(signal, data, size);
315 signal->Marshalling(dataMessageParcel);
316 }
317 if (type == SignalInformation::NetworkType::LTE || type == SignalInformation::NetworkType::NR) {
318 UpdateLteNrSignalInfo(data, size, dataMessageParcel, type);
319 }
320 if (type == SignalInformation::NetworkType::WCDMA) {
321 std::unique_ptr<WcdmaSignalInformation> signal = std::make_unique<WcdmaSignalInformation>();
322 if (signal == nullptr) {
323 return;
324 }
325 CreateWCDMASignalInfo(signal, data, size);
326 signal->Marshalling(dataMessageParcel);
327 }
328 }
329 dataMessageParcel.RewindRead(0);
330 MessageParcel reply;
331 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateSignalInfo(dataMessageParcel, reply);
332 }
333
UpdateNetworkState(const uint8_t * data,size_t size)334 void UpdateNetworkState(const uint8_t *data, size_t size)
335 {
336 if (!IsServiceInited()) {
337 return;
338 }
339 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
340 MessageParcel dataMessageParcel;
341 dataMessageParcel.WriteInt32(slotId);
342 auto networkState = std::make_unique<NetworkState>();
343 if (networkState == nullptr) {
344 return;
345 }
346 networkState->isEmergency_ = static_cast<bool>(GetRandomInt(0, 1, data, size));
347 std::string mOperatorNumeric(reinterpret_cast<const char *>(data), size);
348 std::string mFullName(reinterpret_cast<const char *>(data), size);
349 std::string mShortName(reinterpret_cast<const char *>(data), size);
350 networkState->psOperatorInfo_.operatorNumeric = mOperatorNumeric;
351 networkState->psOperatorInfo_.fullName = mFullName;
352 networkState->psOperatorInfo_.shortName = mShortName;
353 networkState->csOperatorInfo_.operatorNumeric = mOperatorNumeric;
354 networkState->csOperatorInfo_.fullName = mFullName;
355 networkState->csOperatorInfo_.shortName = mShortName;
356 networkState->csRoaming_ = static_cast<RoamingType>(GetRandomInt(0, ROAMING_NUM, data, size));
357 networkState->psRoaming_ = static_cast<RoamingType>(GetRandomInt(0, ROAMING_NUM, data, size));
358 networkState->psRegStatus_ = static_cast<RegServiceState>(GetRandomInt(0, REG_NUM, data, size));
359 networkState->csRegStatus_ = static_cast<RegServiceState>(GetRandomInt(0, REG_NUM, data, size));
360 networkState->psRadioTech_ = static_cast<RadioTech>(GetRandomInt(0, RADIO_NUM, data, size));
361 networkState->lastPsRadioTech_ = static_cast<RadioTech>(GetRandomInt(0, RADIO_NUM, data, size));
362 networkState->lastCfgTech_ = static_cast<RadioTech>(GetRandomInt(0, RADIO_NUM, data, size));
363 networkState->csRadioTech_ = static_cast<RadioTech>(GetRandomInt(0, RADIO_NUM, data, size));
364 networkState->cfgTech_ = static_cast<RadioTech>(GetRandomInt(0, RADIO_NUM, data, size));
365 networkState->nrState_ = static_cast<NrState>(GetRandomInt(0, NR_NUM, data, size));
366 networkState->Marshalling(dataMessageParcel);
367 dataMessageParcel.RewindRead(0);
368 MessageParcel reply;
369 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateNetworkState(dataMessageParcel, reply);
370 }
371
UpdateCellularDataConnectState(const uint8_t * data,size_t size)372 void UpdateCellularDataConnectState(const uint8_t *data, size_t size)
373 {
374 if (!IsServiceInited()) {
375 return;
376 }
377 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
378 int32_t offset = 0;
379 int32_t dataState = static_cast<int32_t>(*data + offset);
380 offset += sizeof(int32_t);
381 int32_t networkType = static_cast<int32_t>(*data + offset);
382 MessageParcel dataMessageParcel;
383 dataMessageParcel.WriteInt32(slotId);
384 dataMessageParcel.WriteInt32(dataState);
385 dataMessageParcel.WriteInt32(networkType);
386 dataMessageParcel.RewindRead(0);
387 MessageParcel reply;
388 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellularDataConnectState(
389 dataMessageParcel, reply);
390 }
391
UpdateCellularDataFlow(const uint8_t * data,size_t size)392 void UpdateCellularDataFlow(const uint8_t *data, size_t size)
393 {
394 if (!IsServiceInited()) {
395 return;
396 }
397 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
398 int32_t flowData = GetRandomInt(0, INT32_MAX, data, size);
399 MessageParcel dataMessageParcel;
400 dataMessageParcel.WriteInt32(slotId);
401 dataMessageParcel.WriteInt32(flowData);
402 dataMessageParcel.RewindRead(0);
403 MessageParcel reply;
404 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellularDataFlow(dataMessageParcel, reply);
405 }
406
UpdateCfuIndicator(const uint8_t * data,size_t size)407 void UpdateCfuIndicator(const uint8_t *data, size_t size)
408 {
409 if (!IsServiceInited()) {
410 return;
411 }
412 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
413 bool cfuResult = static_cast<bool>(GetRandomInt(0, 1, data, size));
414 MessageParcel dataMessageParcel;
415 dataMessageParcel.WriteInt32(slotId);
416 dataMessageParcel.WriteBool(cfuResult);
417 dataMessageParcel.RewindRead(0);
418 MessageParcel reply;
419 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCfuIndicator(dataMessageParcel, reply);
420 }
421
UpdateVoiceMailMsgIndicator(const uint8_t * data,size_t size)422 void UpdateVoiceMailMsgIndicator(const uint8_t *data, size_t size)
423 {
424 if (!IsServiceInited()) {
425 return;
426 }
427 int32_t slotId = GetRandomInt(MIN_SLOT_ID, MAX_SLOT_ID, data, size);
428 bool voiceMailMsgResult = static_cast<bool>(GetRandomInt(0, 1, data, size));
429 MessageParcel dataMessageParcel;
430 dataMessageParcel.WriteInt32(slotId);
431 dataMessageParcel.WriteBool(voiceMailMsgResult);
432 dataMessageParcel.RewindRead(0);
433 MessageParcel reply;
434 DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateVoiceMailMsgIndicator(
435 dataMessageParcel, reply);
436 }
437
DoSomethingInterestingWithMyAPI(const uint8_t * data,size_t size)438 void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
439 {
440 if (data == nullptr || size == 0) {
441 return;
442 }
443 OnRemoteRequest(data, size);
444 UpdateCellInfo(data, size);
445 UpdateCallState(data, size);
446 UpdateCallStateForSlotId(data, size);
447 UpdateSignalInfo(data, size);
448 UpdateNetworkState(data, size);
449 UpdateCellularDataConnectState(data, size);
450 UpdateCellularDataFlow(data, size);
451 UpdateCfuIndicator(data, size);
452 UpdateVoiceMailMsgIndicator(data, size);
453 return;
454 }
455 } // namespace OHOS
456
457 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)458 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
459 {
460 OHOS::AddStateRegistryTokenFuzzer token;
461 /* Run your code on data */
462 OHOS::DoSomethingInterestingWithMyAPI(data, size);
463 return 0;
464 }
465
466