1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #define private public
17 #define protected public
18 #include "fuzzer/FuzzedDataProvider.h"
19 #include "scanserviceability_fuzzer.h"
20 #include "scan_service_ability.h"
21 #include "scan_callback_proxy.h"
22 #include "scan_service_ability_mock.h"
23 
24 namespace OHOS {
25 namespace Scan {
26     constexpr size_t FOO_MAX_LEN = 1024;
27     constexpr size_t U32_AT_SIZE = 4;
28 #ifdef SANE_ENABLE
29     constexpr uint8_t MAX_STRING_LENGTH = 255;
30     constexpr int MAX_SET_NUMBER = 100;
31 
TestInitScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)32     void TestInitScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
33     {
34         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
35         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
36         ScanServiceAbility::GetInstance()->ExitScan();
37     }
38 
TestGetScannerList(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)39     void TestGetScannerList(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
40     {
41         OHOS::Scan::ScanServiceAbilityMock::MockPermission();
42         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
43         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
44         ScanServiceAbility::GetInstance()->GetScannerList();
45     }
46 
TestStopDiscover(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)47     void TestStopDiscover(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
48     {
49         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
50         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
51         ScanServiceAbility::GetInstance()->StopDiscover();
52     }
53 
TestOpenScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)54     void TestOpenScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
55     {
56         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
57         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
58         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
59         ScanServiceAbility::GetInstance()->OpenScanner(scannerId);
60     }
61 
TestCloseScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)62     void TestCloseScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
63     {
64         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
65         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
66         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
67         ScanServiceAbility::GetInstance()->OpenScanner(scannerId);
68         ScanServiceAbility::GetInstance()->CloseScanner(scannerId);
69     }
70 
TestGetScanOptionDesc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)71     void TestGetScanOptionDesc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
72     {
73         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
74         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
75         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
76         int32_t optionIndex = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
77         ScanOptionDescriptor desc;
78         ScanServiceAbility::GetInstance()->GetScanOptionDesc(scannerId, optionIndex, desc);
79     }
80 
TestStartScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)81     void TestStartScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
82     {
83         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
84         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
85         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
86         bool batchMode = dataProvider->ConsumeBool();
87         ScanServiceAbility::GetInstance()->StartScan(scannerId, batchMode);
88     }
89 
TestGetSingleFrameFD(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)90     void TestGetSingleFrameFD(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
91     {
92         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
93         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
94         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
95         uint32_t frameSize = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
96         uint32_t fd = dataProvider->ConsumeIntegralInRange<uint32_t>(0, MAX_SET_NUMBER);
97         ScanServiceAbility::GetInstance()->GetSingleFrameFD(scannerId, frameSize, fd);
98     }
99 
TestCancelScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)100     void TestCancelScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
101     {
102         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
103         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
104         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
105         ScanServiceAbility::GetInstance()->CancelScan(scannerId);
106     }
107 
TestSetScanIOMode(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)108     void TestSetScanIOMode(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
109     {
110         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
111         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
112         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
113         bool isNonBlocking = dataProvider->ConsumeBool();
114         ScanServiceAbility::GetInstance()->SetScanIOMode(scannerId, isNonBlocking);
115     }
116 
TestGetScanSelectFd(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)117     void TestGetScanSelectFd(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
118     {
119         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
120         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
121         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
122         int32_t fd = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
123         ScanServiceAbility::GetInstance()->GetScanSelectFd(scannerId, fd);
124     }
125 
TestOn(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)126     void TestOn(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
127     {
128         std::string taskId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
129         std::string type = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
130         sptr<IRemoteObject> impl;
131         ScanCallbackProxy scanCallbackProxy(impl);
132         sptr<IScanCallback> listener = iface_cast<IScanCallback>(impl);
133         ScanServiceAbility::registeredListeners_[type] = listener;
134         ScanServiceAbility::GetInstance()->On(taskId, type, listener);
135         ScanServiceAbility::registeredListeners_.clear();
136     }
137 
TestOff(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)138     void TestOff(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
139     {
140         std::string taskId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
141         std::string type = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
142         sptr<IRemoteObject> impl;
143         ScanCallbackProxy scanCallbackProxy(impl);
144         sptr<IScanCallback> listener = iface_cast<IScanCallback>(impl);
145         ScanServiceAbility::registeredListeners_[type] = listener;
146         ScanServiceAbility::GetInstance()->Off(taskId, type);
147     }
148 
TestGetScannerState(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)149     void TestGetScannerState(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
150     {
151         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
152         ScanServiceAbility::GetInstance()->InitScan(scanVersion);
153         int32_t scannerState = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
154         ScanServiceAbility::GetInstance()->GetScannerState(scannerState);
155     }
156 
TestSelectScanOptionDesc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)157     void TestSelectScanOptionDesc(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
158     {
159         SANE_Option_Descriptor optionDesc;
160         const SANE_Option_Descriptor *optionDescPtr = &optionDesc;
161         ScanOptionDescriptor desc;
162         optionDesc.constraint_type = SANE_CONSTRAINT_RANGE;
163         SANE_Range range;
164         range.min = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
165         range.max = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
166         range.quant = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
167         const SANE_Range* rangePtr = &range;
168         optionDesc.constraint.range = rangePtr;
169         ScanServiceAbility::GetInstance()->SelectScanOptionDesc(optionDescPtr, desc);
170     }
171 
TestOnStartScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)172     void TestOnStartScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
173     {
174         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
175         bool batchMode = dataProvider->ConsumeBool();
176         ScanServiceAbility::GetInstance()->OnStartScan(scannerId, batchMode);
177     }
178 
TestSendDeviceInfoTCP(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)179     void TestSendDeviceInfoTCP(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
180     {
181         ScanDeviceInfoTCP info;
182         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
183         ScanServiceAbility::GetInstance()->SendDeviceInfoTCP(info, event);
184     }
185 
TestSendDeviceInfo(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)186     void TestSendDeviceInfo(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
187     {
188         ScanDeviceInfo  info;
189         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
190         ScanServiceAbility::GetInstance()->SendDeviceInfo(info, event);
191     }
192 
TestSendDeviceInfoSync(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)193     void TestSendDeviceInfoSync(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
194     {
195         ScanDeviceInfoSync  info;
196         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
197         ScanServiceAbility::GetInstance()->SendDeviceInfoSync(info, event);
198     }
199 
TestDisConnectUsbScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)200     void TestDisConnectUsbScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
201     {
202         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
203         std::string newDeviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
204         ScanServiceAbility::GetInstance()->DisConnectUsbScanner(serialNumber, newDeviceId);
205     }
206 
TestUpdateUsbScannerId(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)207     void TestUpdateUsbScannerId(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
208     {
209         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
210         std::string newDeviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
211         ScanServiceAbility::GetInstance()->UpdateUsbScannerId(serialNumber, newDeviceId);
212     }
213 
TestSendInitEvent(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)214     void TestSendInitEvent(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
215     {
216         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
217         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
218         ScanServiceAbility::GetInstance()->SendInitEvent(scanVersion, event);
219     }
220 
TestSendDeviceSearchEnd(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)221     void TestSendDeviceSearchEnd(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
222     {
223         std::string message = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
224         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
225         ScanServiceAbility::GetInstance()->SendDeviceSearchEnd(message, event);
226     }
227 
TestSetScannerSerialNumber(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)228     void TestSetScannerSerialNumber(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
229     {
230         ScanDeviceInfo tcpInfo;
231         tcpInfo.deviceId = "pantum6500:tcp 192.168.223.1 9200-M6700DW";
232         std::string ip = "192.168.223.1";
233         ScanDeviceInfoTCP scanDeviceInfoTCP;
234         scanDeviceInfoTCP.deviceName = "Pantum 6666 54QWER";
235         ScanServiceAbility::scanDeviceInfoTCPMap_[ip] = scanDeviceInfoTCP;
236         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(tcpInfo);
237 
238         tcpInfo.deviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
239         ip = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
240         scanDeviceInfoTCP.deviceName = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
241         ScanServiceAbility::scanDeviceInfoTCPMap_[ip] = scanDeviceInfoTCP;
242         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(tcpInfo);
243 
244         ScanDeviceInfo usbInfo;
245         usbInfo.deviceId = "pantum6500:libusb:002:003";
246         ScanServiceAbility::usbSnMap["2-3"] = "QWERTY";
247         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(usbInfo);
248 
249         usbInfo.deviceId = "pantum6500:libusb:002:004";
250         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(usbInfo);
251         usbInfo.deviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
252         ScanServiceAbility::GetInstance()->SetScannerSerialNumber(usbInfo);
253     }
254 
TestReInitScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)255     void TestReInitScan(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
256     {
257         ScanServiceAbility::GetInstance()->ServiceInit();
258         ScanServiceAbility::GetInstance()->InitServiceHandler();
259         ScanServiceAbility::GetInstance()->OnStart();
260         ScanServiceAbility::GetInstance()->OnStop();
261         ScanServiceAbility::GetInstance()->ManualStart();
262         int32_t scanVersion = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
263         ScanServiceAbility::GetInstance()->ReInitScan(scanVersion);
264         ScanServiceAbility::GetInstance()->SaneGetScanner();
265     }
266 
TestCheckPermission(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)267     void TestCheckPermission(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
268     {
269         std::string permissionName = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
270         ScanServiceAbility::GetInstance()->CheckPermission(permissionName);
271     }
272 
TestSendGetFrameResEvent(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)273     void TestSendGetFrameResEvent(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
274     {
275         bool isGetSucc = dataProvider->ConsumeBool();
276         int32_t sizeRead = dataProvider->ConsumeIntegralInRange<int32_t>(0, MAX_SET_NUMBER);
277         ScanServiceAbility::GetInstance()->SendGetFrameResEvent(isGetSucc, sizeRead);
278     }
279 
TestSetScanOptionDescriptor(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)280     void TestSetScanOptionDescriptor(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
281     {
282         ScanOptionDescriptor desc;
283         SANE_Option_Descriptor optionDesc;
284         optionDesc.name = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
285         optionDesc.title = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
286         optionDesc.desc = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
287         ScanServiceAbility::GetInstance()->SetScanOptionDescriptor(desc, &optionDesc);
288     }
289 
TestGetScanHandle(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)290     void TestGetScanHandle(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
291     {
292         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
293         ScanServiceAbility::GetInstance()->GetScanHandle(scannerId);
294     }
295 
TestGeneratePictureBatch(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)296     void TestGeneratePictureBatch(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
297     {
298         int32_t status = E_SCAN_NONE;
299         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
300         std::string file_name = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
301         std::string output_file = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
302         ScanProgress* scanProPtr = nullptr;
303         ScanServiceAbility::GetInstance()->GeneratePictureSingle(scannerId, file_name, output_file, status, scanProPtr);
304     }
305 
TestAddFoundUsbScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)306     void TestAddFoundUsbScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
307     {
308         ScanDeviceInfo info;
309         info.serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
310         ScanServiceAbility::GetInstance()->AddFoundUsbScanner(info);
311     }
312 
TestAddFoundTcpScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)313     void TestAddFoundTcpScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
314     {
315         ScanDeviceInfo info;
316         info.serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
317         ScanServiceAbility::GetInstance()->AddFoundTcpScanner(info);
318     }
319 
TestSetScannerInfo(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)320     void TestSetScannerInfo(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
321     {
322         SANE_Device currentDevice;
323         const SANE_Device* currentDevicePtr = &currentDevice;
324         const SANE_Device** currentDevicePtrPtr = &currentDevicePtr;
325         std::string name = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
326         std::string vendor = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
327         std::string model = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
328         std::string type = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
329         currentDevice.name = name.c_str();
330         currentDevice.vendor = vendor.c_str();
331         currentDevice.vendor = model.c_str();
332         currentDevice.type = type.c_str();
333         ScanDeviceInfo info;
334         ScanServiceAbility::GetInstance()->SetScannerInfo(currentDevicePtrPtr, info);
335     }
336 
TestSendDeviceList(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)337     void TestSendDeviceList(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
338     {
339         ScanDeviceInfo infoItem;
340         std::vector<ScanDeviceInfo> info;
341         info.push_back(infoItem);
342         std::string event = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
343         ScanServiceAbility::GetInstance()->SendDeviceList(info, event);
344     }
345 
TestAddScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)346     void TestAddScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
347     {
348         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
349         std::string discoverMode = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
350         ScanServiceAbility::GetInstance()->AddScanner(serialNumber, discoverMode);
351     }
352 
TestUpdateScannerName(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)353     void TestUpdateScannerName(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
354     {
355         std::string serialNumber = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
356         std::string discoverMode = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
357         std::string deviceName = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
358         ScanServiceAbility::GetInstance()->UpdateScannerName(serialNumber, discoverMode, deviceName);
359     }
360 
TestCleanScanTask(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)361     void TestCleanScanTask(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
362     {
363         std::string scannerId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
364         ScanServiceAbility::GetInstance()->CleanScanTask(scannerId);
365     }
366 
TestGetAddedScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)367     void TestGetAddedScanner(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
368     {
369         ScanDeviceInfo addedScanner;
370         std::string newDeviceId = dataProvider->ConsumeRandomLengthString(MAX_STRING_LENGTH);
371         addedScanner.SetDeviceId(newDeviceId);
372         std::vector<ScanDeviceInfo> allAddedScanner;
373         allAddedScanner.push_back(addedScanner);
374         ScanServiceAbility::GetInstance()->GetAddedScanner(allAddedScanner);
375     }
376 
TestNotPublicFunction(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)377     void TestNotPublicFunction(const uint8_t* data, size_t size, FuzzedDataProvider* dataProvider)
378     {
379         if (dataProvider == nullptr) {
380             return;
381         }
382         OHOS::Scan::TestReInitScan(data, size, dataProvider);
383         OHOS::Scan::TestCheckPermission(data, size, dataProvider);
384         OHOS::Scan::TestSendGetFrameResEvent(data, size, dataProvider);
385         OHOS::Scan::TestSetScanOptionDescriptor(data, size, dataProvider);
386         OHOS::Scan::TestGetScanHandle(data, size, dataProvider);
387         OHOS::Scan::TestGeneratePictureBatch(data, size, dataProvider);
388         OHOS::Scan::TestAddFoundUsbScanner(data, size, dataProvider);
389         OHOS::Scan::TestAddFoundTcpScanner(data, size, dataProvider);
390         OHOS::Scan::TestSetScannerInfo(data, size, dataProvider);
391         OHOS::Scan::TestSendDeviceList(data, size, dataProvider);
392         OHOS::Scan::TestAddScanner(data, size, dataProvider);
393         OHOS::Scan::TestUpdateScannerName(data, size, dataProvider);
394         OHOS::Scan::TestCleanScanTask(data, size, dataProvider);
395         OHOS::Scan::TestGetAddedScanner(data, size, dataProvider);
396     }
397 
398 #endif
399 
400 }
401 }
402 
403 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)404 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
405 {
406     if (data == nullptr) {
407         return 0;
408     }
409 
410     if (size < OHOS::Scan::U32_AT_SIZE || size > OHOS::Scan::FOO_MAX_LEN) {
411         return 0;
412     }
413 #ifdef SANE_ENABLE
414     FuzzedDataProvider dataProvider(data, size);
415     OHOS::Scan::ScanServiceAbilityMock::MockPermission();
416     OHOS::Scan::TestInitScan(data, size, &dataProvider);
417     OHOS::Scan::TestGetScannerList(data, size, &dataProvider);
418     OHOS::Scan::TestStopDiscover(data, size, &dataProvider);
419     OHOS::Scan::TestOpenScanner(data, size, &dataProvider);
420     OHOS::Scan::TestCloseScanner(data, size, &dataProvider);
421     OHOS::Scan::TestGetScanOptionDesc(data, size, &dataProvider);
422     OHOS::Scan::TestStartScan(data, size, &dataProvider);
423     OHOS::Scan::TestGetSingleFrameFD(data, size, &dataProvider);
424     OHOS::Scan::TestCancelScan(data, size, &dataProvider);
425     OHOS::Scan::TestSetScanIOMode(data, size, &dataProvider);
426     OHOS::Scan::TestGetScanSelectFd(data, size, &dataProvider);
427     OHOS::Scan::TestOn(data, size, &dataProvider);
428     OHOS::Scan::TestOff(data, size, &dataProvider);
429     OHOS::Scan::TestGetScannerState(data, size, &dataProvider);
430     OHOS::Scan::TestSelectScanOptionDesc(data, size, &dataProvider);
431     OHOS::Scan::TestOnStartScan(data, size, &dataProvider);
432     OHOS::Scan::TestSendDeviceInfoTCP(data, size, &dataProvider);
433     OHOS::Scan::TestSendDeviceInfo(data, size, &dataProvider);
434     OHOS::Scan::TestSendDeviceInfoSync(data, size, &dataProvider);
435     OHOS::Scan::TestDisConnectUsbScanner(data, size, &dataProvider);
436     OHOS::Scan::TestUpdateUsbScannerId(data, size, &dataProvider);
437     OHOS::Scan::TestSendInitEvent(data, size, &dataProvider);
438     OHOS::Scan::TestSendDeviceSearchEnd(data, size, &dataProvider);
439     OHOS::Scan::TestSetScannerSerialNumber(data, size, &dataProvider);
440     OHOS::Scan::TestNotPublicFunction(data, size, &dataProvider);
441 #endif
442     return 0;
443 }