1/*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 *     http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16#include "setpreviewwindow_fuzzer.h"
17
18#include <cstddef>
19#include <cstdint>
20#include <string_ex.h>
21#define private public
22
23#include "addcellularcalltoken_fuzzer.h"
24#include "cellular_call_service.h"
25#include "securec.h"
26#include "surface_utils.h"
27#include "system_ability_definition.h"
28
29using namespace OHOS::Telephony;
30namespace OHOS {
31static bool g_isInited = false;
32constexpr int32_t BOOL_NUM = 2;
33constexpr int32_t VEDIO_STATE_NUM = 2;
34constexpr int32_t OFFSET_SIZE = 11;
35constexpr size_t MAX_NUMBER_LEN = 99;
36
37bool IsServiceInited()
38{
39    if (!g_isInited) {
40        DelayedSingleton<CellularCallService>::GetInstance()->OnStart();
41    }
42    if (!g_isInited && (static_cast<int32_t>(DelayedSingleton<CellularCallService>::GetInstance()->state_) ==
43                           static_cast<int32_t>(ServiceRunningState::STATE_RUNNING))) {
44        g_isInited = true;
45    }
46    return g_isInited;
47}
48
49void OnRemoteRequest(const uint8_t *data, size_t size)
50{
51    if (!IsServiceInited()) {
52        return;
53    }
54
55    MessageParcel dataMessageParcel;
56    if (!dataMessageParcel.WriteInterfaceToken(CellularCallStub::GetDescriptor())) {
57        return;
58    }
59    int32_t maxSize = static_cast<int32_t>(size) + OFFSET_SIZE;
60    dataMessageParcel.WriteInt32(maxSize);
61    dataMessageParcel.WriteBuffer(data, size);
62    dataMessageParcel.RewindRead(0);
63    uint32_t code = static_cast<uint32_t>(size);
64    MessageParcel reply;
65    MessageOption option;
66    DelayedSingleton<CellularCallService>::GetInstance()->OnRemoteRequest(code, dataMessageParcel, reply, option);
67}
68
69void SetPreviewWindow(const uint8_t *data, size_t size)
70{
71    if (!IsServiceInited()) {
72        return;
73    }
74
75    int32_t maxSize = static_cast<int32_t>(size);
76    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
77    int32_t index = static_cast<int32_t>(size);
78    std::string surfaceId(reinterpret_cast<const char *>(data), size);
79    MessageParcel dataMessageParcel;
80    dataMessageParcel.WriteInt32(maxSize);
81    dataMessageParcel.WriteInt32(slotId);
82    dataMessageParcel.WriteInt32(index);
83    int len = static_cast<int>(surfaceId.length());
84    std::string subSurfaceId = surfaceId;
85    if (len >= 1) {
86        subSurfaceId = surfaceId.substr(0, 1);
87    }
88    if (subSurfaceId.empty() || subSurfaceId[0] < '0' || subSurfaceId[0] > '9') {
89        subSurfaceId = "";
90        dataMessageParcel.WriteString(subSurfaceId);
91    } else {
92        dataMessageParcel.WriteString(subSurfaceId);
93        uint64_t tmpSurfaceId = std::stoull(subSurfaceId);
94        auto surface = SurfaceUtils::GetInstance()->GetSurface(tmpSurfaceId);
95        if (surface != nullptr) {
96            sptr<IBufferProducer> producer = surface->GetProducer();
97            if (producer != nullptr) {
98                dataMessageParcel.WriteRemoteObject(producer->AsObject());
99            }
100        }
101    }
102    dataMessageParcel.RewindRead(0);
103    MessageParcel reply;
104    DelayedSingleton<CellularCallService>::GetInstance()->OnSetPreviewWindowInner(dataMessageParcel, reply);
105}
106
107void SetDisplayWindow(const uint8_t *data, size_t size)
108{
109    if (!IsServiceInited()) {
110        return;
111    }
112
113    int32_t maxSize = static_cast<int32_t>(size);
114    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
115    int32_t index = static_cast<int32_t>(size);
116    std::string surfaceId(reinterpret_cast<const char *>(data), size);
117    MessageParcel dataMessageParcel;
118    dataMessageParcel.WriteInt32(maxSize);
119    dataMessageParcel.WriteInt32(slotId);
120    dataMessageParcel.WriteInt32(index);
121    int len = static_cast<int>(surfaceId.length());
122    std::string subSurfaceId = surfaceId;
123    if (len >= 1) {
124        subSurfaceId = surfaceId.substr(0, 1);
125    }
126    if (subSurfaceId.empty() || subSurfaceId[0] < '0' || subSurfaceId[0] > '9') {
127        subSurfaceId = "";
128        dataMessageParcel.WriteString(subSurfaceId);
129    } else {
130        dataMessageParcel.WriteString(subSurfaceId);
131        uint64_t tmpSurfaceId = std::stoull(subSurfaceId);
132        auto surface = SurfaceUtils::GetInstance()->GetSurface(tmpSurfaceId);
133        if (surface != nullptr) {
134            sptr<IBufferProducer> producer = surface->GetProducer();
135            if (producer != nullptr) {
136                dataMessageParcel.WriteRemoteObject(producer->AsObject());
137            }
138        }
139    }
140    dataMessageParcel.RewindRead(0);
141    MessageParcel reply;
142    DelayedSingleton<CellularCallService>::GetInstance()->OnSetDisplayWindowInner(dataMessageParcel, reply);
143}
144
145void SetCameraZoom(const uint8_t *data, size_t size)
146{
147    if (!IsServiceInited()) {
148        return;
149    }
150
151    int32_t maxSize = static_cast<int32_t>(size);
152    float zoomRatio = static_cast<float>(size);
153    MessageParcel dataMessageParcel;
154    dataMessageParcel.WriteInt32(maxSize);
155    dataMessageParcel.WriteFloat(zoomRatio);
156    dataMessageParcel.RewindRead(0);
157    MessageParcel reply;
158    DelayedSingleton<CellularCallService>::GetInstance()->OnSetCameraZoomInner(dataMessageParcel, reply);
159}
160
161void ControlCamera(const uint8_t *data, size_t size)
162{
163    if (!IsServiceInited()) {
164        return;
165    }
166
167    int32_t maxSize = static_cast<int32_t>(size);
168    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
169    int32_t index = static_cast<int32_t>(size);
170    std::string cameraId(reinterpret_cast<const char *>(data), size);
171    MessageParcel dataMessageParcel;
172    dataMessageParcel.WriteInt32(maxSize);
173    dataMessageParcel.WriteInt32(slotId);
174    dataMessageParcel.WriteInt32(index);
175    dataMessageParcel.WriteString(cameraId);
176    dataMessageParcel.RewindRead(0);
177    MessageParcel reply;
178    DelayedSingleton<CellularCallService>::GetInstance()->OnControlCameraInner(dataMessageParcel, reply);
179}
180
181void SetPausePicture(const uint8_t *data, size_t size)
182{
183    if (!IsServiceInited()) {
184        return;
185    }
186
187    int32_t maxSize = static_cast<int32_t>(size);
188    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
189    int32_t index = static_cast<int32_t>(size);
190    std::string path(reinterpret_cast<const char *>(data), size);
191    MessageParcel dataMessageParcel;
192    dataMessageParcel.WriteInt32(maxSize);
193    dataMessageParcel.WriteInt32(slotId);
194    dataMessageParcel.WriteInt32(index);
195    dataMessageParcel.WriteString(path);
196    dataMessageParcel.RewindRead(0);
197    MessageParcel reply;
198    DelayedSingleton<CellularCallService>::GetInstance()->OnSetPausePictureInner(dataMessageParcel, reply);
199}
200
201void SetDeviceDirection(const uint8_t *data, size_t size)
202{
203    if (!IsServiceInited()) {
204        return;
205    }
206
207    int32_t maxSize = static_cast<int32_t>(size);
208    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
209    int32_t index = static_cast<int32_t>(size);
210    int32_t rotation = static_cast<int32_t>(size);
211    MessageParcel dataMessageParcel;
212    dataMessageParcel.WriteInt32(maxSize);
213    dataMessageParcel.WriteInt32(slotId);
214    dataMessageParcel.WriteInt32(index);
215    dataMessageParcel.WriteInt32(rotation);
216    dataMessageParcel.RewindRead(0);
217    MessageParcel reply;
218    DelayedSingleton<CellularCallService>::GetInstance()->OnSetDeviceDirectionInner(dataMessageParcel, reply);
219}
220
221void SendUpdateCallMediaModeRequest(const uint8_t *data, size_t size)
222{
223    if (!IsServiceInited()) {
224        return;
225    }
226
227    int32_t maxSize = static_cast<int32_t>(size);
228    CellularCallInfo callInfo;
229    callInfo.callId = static_cast<int32_t>(size);
230    callInfo.slotId = static_cast<int32_t>(size % BOOL_NUM);
231    callInfo.accountId = static_cast<int32_t>(size % BOOL_NUM);
232    callInfo.callType = static_cast<CallType>(static_cast<int32_t>(size));
233    callInfo.videoState = static_cast<int32_t>(size % VEDIO_STATE_NUM);
234    callInfo.index = static_cast<int32_t>(size);
235    std::string telNum = "000000000";
236    std::string tempNum(reinterpret_cast<const char *>(data), size);
237    if (strlen(tempNum.c_str()) <= MAX_NUMBER_LEN) {
238        telNum = tempNum;
239    }
240    size_t length = strlen(telNum.c_str()) + 1;
241    if (strcpy_s(callInfo.phoneNum, length, telNum.c_str()) != EOK) {
242        return;
243    }
244    int32_t mode = static_cast<int32_t>(size);
245    MessageParcel dataMessageParcel;
246    dataMessageParcel.WriteInt32(maxSize);
247    dataMessageParcel.WriteRawData(static_cast<const void *>(&callInfo), sizeof(CellularCallInfo));
248    dataMessageParcel.WriteInt32(mode);
249    dataMessageParcel.RewindRead(0);
250    MessageParcel reply;
251    DelayedSingleton<CellularCallService>::GetInstance()->OnSendUpdateCallMediaModeRequestInner(
252        dataMessageParcel, reply);
253}
254
255void SendUpdateCallMediaModeResponse(const uint8_t *data, size_t size)
256{
257    if (!IsServiceInited()) {
258        return;
259    }
260
261    int32_t maxSize = static_cast<int32_t>(size);
262    CellularCallInfo callInfo;
263    callInfo.callId = static_cast<int32_t>(size);
264    callInfo.slotId = static_cast<int32_t>(size % BOOL_NUM);
265    callInfo.accountId = static_cast<int32_t>(size % BOOL_NUM);
266    callInfo.callType = static_cast<CallType>(static_cast<int32_t>(size));
267    callInfo.videoState = static_cast<int32_t>(size % VEDIO_STATE_NUM);
268    callInfo.index = static_cast<int32_t>(size);
269    std::string telNum = "000000000";
270    std::string tempNum(reinterpret_cast<const char *>(data), size);
271    if (strlen(tempNum.c_str()) <= MAX_NUMBER_LEN) {
272        telNum = tempNum;
273    }
274    size_t length = strlen(telNum.c_str()) + 1;
275    if (strcpy_s(callInfo.phoneNum, length, telNum.c_str()) != EOK) {
276        return;
277    }
278    int32_t mode = static_cast<int32_t>(size);
279    MessageParcel dataMessageParcel;
280    dataMessageParcel.WriteInt32(maxSize);
281    dataMessageParcel.WriteRawData(static_cast<const void *>(&callInfo), sizeof(CellularCallInfo));
282    dataMessageParcel.WriteInt32(mode);
283    dataMessageParcel.RewindRead(0);
284    MessageParcel reply;
285    DelayedSingleton<CellularCallService>::GetInstance()->OnSendUpdateCallMediaModeResponseInner(
286        dataMessageParcel, reply);
287}
288
289void SetMute(const uint8_t *data, size_t size)
290{
291    if (!IsServiceInited()) {
292        return;
293    }
294
295    int32_t mute = static_cast<int32_t>(size);
296    MessageParcel dataMessageParcel;
297    dataMessageParcel.WriteInt32(mute);
298    dataMessageParcel.WriteBuffer(data, size);
299    dataMessageParcel.RewindRead(0);
300    MessageParcel reply;
301    DelayedSingleton<CellularCallService>::GetInstance()->OnSetMuteInner(dataMessageParcel, reply);
302}
303
304void GetMute(const uint8_t *data, size_t size)
305{
306    if (!IsServiceInited()) {
307        return;
308    }
309
310    MessageParcel dataMessageParcel;
311    dataMessageParcel.WriteBuffer(data, size);
312    dataMessageParcel.RewindRead(0);
313    MessageParcel reply;
314    DelayedSingleton<CellularCallService>::GetInstance()->OnGetMuteInner(dataMessageParcel, reply);
315}
316
317void StartDtmf(const uint8_t *data, size_t size)
318{
319    if (!IsServiceInited()) {
320        return;
321    }
322
323    int32_t maxSize = static_cast<int32_t>(size);
324    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
325    int32_t callId = static_cast<int32_t>(size);
326    int32_t accountId = static_cast<int32_t>(size);
327    int32_t videoState = static_cast<int32_t>(size % VEDIO_STATE_NUM);
328    int32_t index = static_cast<int32_t>(size);
329    char cDtmfCode = static_cast<char>(size);
330    std::string telNum = "000000000";
331    std::string tempNum(reinterpret_cast<const char *>(data), size);
332    if (strlen(tempNum.c_str()) <= MAX_NUMBER_LEN) {
333        telNum = tempNum;
334    }
335    size_t length = strlen(telNum.c_str()) + 1;
336    CellularCallInfo callInfo;
337    callInfo.slotId = slotId;
338    callInfo.callId = callId;
339    callInfo.accountId = accountId;
340    callInfo.videoState = videoState;
341    callInfo.index = index;
342    if (strcpy_s(callInfo.phoneNum, length, telNum.c_str()) != EOK) {
343        return;
344    }
345    MessageParcel dataMessageParcel;
346    dataMessageParcel.WriteInt32(maxSize);
347    dataMessageParcel.WriteInt8(cDtmfCode);
348    dataMessageParcel.WriteRawData(static_cast<const void *>(&callInfo), sizeof(CellularCallInfo));
349    dataMessageParcel.RewindRead(0);
350    MessageParcel reply;
351    DelayedSingleton<CellularCallService>::GetInstance()->OnStartDtmfInner(dataMessageParcel, reply);
352}
353
354void CancelCallUpgrade(const uint8_t *data, size_t size)
355{
356    if (!IsServiceInited()) {
357        return;
358    }
359
360    int32_t maxSize = static_cast<int32_t>(size);
361    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
362    int32_t index = static_cast<int32_t>(size);
363    MessageParcel dataMessageParcel;
364    dataMessageParcel.WriteInt32(maxSize);
365    dataMessageParcel.WriteInt32(slotId);
366    dataMessageParcel.WriteInt32(index);
367    dataMessageParcel.RewindRead(0);
368    MessageParcel reply;
369    DelayedSingleton<CellularCallService>::GetInstance()->OnCancelCallUpgradeInner(dataMessageParcel, reply);
370}
371
372void RequestCameraCapabilities(const uint8_t *data, size_t size)
373{
374    if (!IsServiceInited()) {
375        return;
376    }
377
378    int32_t maxSize = static_cast<int32_t>(size);
379    int32_t slotId = static_cast<int32_t>(size % BOOL_NUM);
380    int32_t index = static_cast<int32_t>(size);
381    MessageParcel dataMessageParcel;
382    dataMessageParcel.WriteInt32(maxSize);
383    dataMessageParcel.WriteInt32(slotId);
384    dataMessageParcel.WriteInt32(index);
385    dataMessageParcel.RewindRead(0);
386    MessageParcel reply;
387    DelayedSingleton<CellularCallService>::GetInstance()->OnRequestCameraCapabilitiesInner(dataMessageParcel, reply);
388}
389
390void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
391{
392    if (data == nullptr || size == 0) {
393        return;
394    }
395
396    OnRemoteRequest(data, size);
397    SetPreviewWindow(data, size);
398    SetDisplayWindow(data, size);
399    SetCameraZoom(data, size);
400    ControlCamera(data, size);
401    SetPausePicture(data, size);
402    SetDeviceDirection(data, size);
403    SetMute(data, size);
404    GetMute(data, size);
405    StartDtmf(data, size);
406    SendUpdateCallMediaModeRequest(data, size);
407    SendUpdateCallMediaModeResponse(data, size);
408    CancelCallUpgrade(data, size);
409    RequestCameraCapabilities(data, size);
410}
411} // namespace OHOS
412
413/* Fuzzer entry point */
414extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
415{
416    OHOS::AddCellularCallTokenFuzzer token;
417    /* Run your code on data */
418    OHOS::DoSomethingInterestingWithMyAPI(data, size);
419    return 0;
420}
421