1 /*
2  * Copyright (c) 2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #ifdef FUZZTEST
17 #define private public
18 #define protected public
19 #endif
20 
21 #include "unittest_fuzzer.h"
22 #include "addsmstoken_fuzzer.h"
23 #include "mms_apn_info.h"
24 #include "mms_network_client.h"
25 #include "mms_persist_helper.h"
26 #include "mms_conn_callback_stub.h"
27 #include "cdma_sms_sender.h"
28 #include "cdma_sms_receive_handler.h"
29 #include "cdma_sms_message.h"
30 
31 namespace OHOS {
32 using namespace Telephony;
33 
34 class Fuzzer {
35 public:
Fuzzer(const uint8_t* data, size_t size)36     Fuzzer(const uint8_t* data, size_t size):g_data(data), g_size(size) {}
~Fuzzer()37     virtual ~Fuzzer() {};
38     virtual void StartFuzzerTest() = 0;
39 
40 protected:
GetString(size_t size = 0)41     std::string GetString(size_t size = 0)
42     {
43         std::string str(reinterpret_cast<const char*>(g_data), g_size);
44         if (size != 0 && size < str.size()) {
45             str.resize(size);
46         }
47         return str;
48     }
GetPort(int nRangeStart = 0, int nRangeEnd = 0)49     size_t GetPort(int nRangeStart = 0, int nRangeEnd = 0)
50     {
51         nRangeStart = nRangeStart != 0 ? nRangeStart : m_nPortRangeStartDef;
52         nRangeEnd = nRangeEnd != 0 ? nRangeEnd : m_nPortRangeEndDef;
53         nRangeEnd = nRangeEnd > nRangeStart ? nRangeEnd : nRangeStart + 1;
54 
55         return g_size % (nRangeEnd - nRangeStart) + nRangeStart;
56     }
57     template<typename T>
GetEnumRandom(std::vector<T> vect)58     T GetEnumRandom(std::vector<T> vect)
59     {
60         size_t nItem = g_size % vect.size();
61         return vect[nItem];
62     }
63 
GetDataRange(char* szBuf, uint8_t& nSize, int nRangeMin, int nRangeMax)64     void GetDataRange(char* szBuf, uint8_t& nSize, int nRangeMin, int nRangeMax)
65     {
66         nSize = g_size % (nRangeMax-nRangeMin) + nRangeMin;
67         if (memset_s(szBuf, nSize, 0x00, nSize) != EOK
68         || memcpy_s(szBuf, nSize, g_data, nSize) != EOK) {
69             return;
70         }
71     }
GetPduVect()72     std::vector<uint8_t> GetPduVect()
73     {
74         std::string strData = GetString(30);
75         std::vector<uint8_t> vectUint8(strData.begin(), strData.end());
76 
77         static std::vector<int> vectPduType {0, 1, 2, 3};
78         vectUint8[0] = GetEnumRandom(vectPduType);
79         return vectUint8;
80     }
81 protected:
GetEnumRandom_SmsEncodingType()82     SmsEncodingType GetEnumRandom_SmsEncodingType()
83     {
84         static std::vector<SmsEncodingType> vect{
85             SmsEncodingType::OCTET, SmsEncodingType::EPM, SmsEncodingType::ASCII_7BIT,
86             SmsEncodingType::IA5, SmsEncodingType::UNICODE, SmsEncodingType::SHIFT_JIS,
87             SmsEncodingType::KOREAN, SmsEncodingType::LATIN_HEBREW, SmsEncodingType::LATIN,
88             SmsEncodingType::GSM7BIT, SmsEncodingType::GSMDCS, SmsEncodingType::EUCKR,
89             SmsEncodingType::RESERVED
90         };
91         return GetEnumRandom(vect);
92     }
GetEnumRandom_CdmaTransportMsgType()93     CdmaTransportMsgType GetEnumRandom_CdmaTransportMsgType()
94     {
95         static std::vector<CdmaTransportMsgType> vect{
96             CdmaTransportMsgType::P2P,
97             CdmaTransportMsgType::BROADCAST,
98             CdmaTransportMsgType::ACK
99         };
100         return GetEnumRandom(vect);
101     }
GetEnumRandom_DataCodingScheme()102     DataCodingScheme GetEnumRandom_DataCodingScheme()
103     {
104         static std::vector<DataCodingScheme> vect{
105             DataCodingScheme::DATA_CODING_7BIT,
106             DataCodingScheme::DATA_CODING_8BIT,
107             DataCodingScheme::DATA_CODING_UCS2,
108             DataCodingScheme::DATA_CODING_AUTO,
109             DataCodingScheme::DATA_CODING_EUCKR,
110             DataCodingScheme::DATA_CODING_ASCII7BIT
111         };
112         return GetEnumRandom(vect);
113     }
GetEnumRandom_SmsTransTelsvcId()114     SmsTransTelsvcId GetEnumRandom_SmsTransTelsvcId()
115     {
116         static std::vector<SmsTransTelsvcId> vect = {
117             SmsTransTelsvcId::CMT_91, SmsTransTelsvcId::CPT_95,
118             SmsTransTelsvcId::CMT_95, SmsTransTelsvcId::VMN_95,
119             SmsTransTelsvcId::WAP, SmsTransTelsvcId::WEMT,
120             SmsTransTelsvcId::SCPT, SmsTransTelsvcId::CATPT,
121             SmsTransTelsvcId::RESERVED
122         };
123         return GetEnumRandom(vect);
124     }
GetEnumRandom_TeleserviceMsgType()125     TeleserviceMsgType GetEnumRandom_TeleserviceMsgType()
126     {
127         static std::vector<TeleserviceMsgType> vect = {
128             TeleserviceMsgType::DELIVER, TeleserviceMsgType::SUBMIT,
129             TeleserviceMsgType::CANCEL, TeleserviceMsgType::DELIVERY_ACK,
130             TeleserviceMsgType::USER_ACK, TeleserviceMsgType::READ_ACK,
131             TeleserviceMsgType::DELIVER_REPORT, TeleserviceMsgType::SUBMIT_REPORT,
132             TeleserviceMsgType::MAX_VALUE, TeleserviceMsgType::RESERVED
133         };
134         return GetEnumRandom(vect);
135     }
136 protected:
137     const uint8_t* g_data;
138     const size_t  g_size;
139     const int32_t g_slotId = 2;
140     const int m_nPortRangeStartDef = 1024;
141     const int m_nPortRangeEndDef = 49151;
142 };
143 
144 /*
145 * services/mms/include/mms_apn_info.h
146 * services/mms/mms_apn_info.cpp
147 */
148 class MmsApnInfoFuzzer final : public Fuzzer {
149 public:
150     using Fuzzer::Fuzzer;
151     ~MmsApnInfoFuzzer() final {};
152 public:
153     void StartFuzzerTest() override
154     {
155         if (!CreateObject()) {
156             return;
157         }
158         TestSetMmscUrl();
159         TestGetMmscUrl();
160         TestSetMmsProxyAddressAndProxyPort();
161         TestGetMmsProxyAddressAndProxyPort();
162         TestSplitAndMatchApnTypes();
163         TestGetMmsApnValue();
164         DestoryObject();
165     }
166 protected:
CreateObject()167     bool CreateObject()
168     {
169         m_pMmsApnInfo = std::make_unique<MmsApnInfo>(g_slotId);
170         return m_pMmsApnInfo != nullptr;
171     }
DestoryObject()172     void DestoryObject()
173     {
174         m_pMmsApnInfo.reset();
175     }
TestSetMmscUrl()176     void TestSetMmscUrl()
177     {
178         std::string strUrl = GetString();
179         m_pMmsApnInfo->setMmscUrl(strUrl);
180     }
TestGetMmscUrl()181     void TestGetMmscUrl()
182     {
183         m_pMmsApnInfo->getMmscUrl();
184     }
TestSetMmsProxyAddressAndProxyPort()185     void TestSetMmsProxyAddressAndProxyPort()
186     {
187         std::string strUrl = GetString();
188         m_pMmsApnInfo->setMmsProxyAddressAndProxyPort(strUrl);
189     }
TestGetMmsProxyAddressAndProxyPort()190     void TestGetMmsProxyAddressAndProxyPort()
191     {
192         m_pMmsApnInfo->getMmsProxyAddressAndProxyPort();
193     }
TestSplitAndMatchApnTypes()194     void TestSplitAndMatchApnTypes()
195     {
196         std::string apn = GetString();
197         m_pMmsApnInfo->SplitAndMatchApnTypes(apn);
198         apn += ",mms";
199         m_pMmsApnInfo->SplitAndMatchApnTypes(apn);
200     }
TestGetMmsApnValue()201     void TestGetMmsApnValue()
202     {
203         int count = 0;
204         std::string homeUrlVal = GetString();
205         std::string mmsIPAddressVal = GetString();
206         m_pMmsApnInfo->GetMmsApnValue(nullptr, count, homeUrlVal, mmsIPAddressVal);
207     }
208 private:
209     std::unique_ptr<MmsApnInfo> m_pMmsApnInfo;
210 };
211 
212 /*
213 * services/mms/include/mms_network_client.h
214 * services/mms/mms_network_client.cpp
215 */
216 class MmsNetworkClientFuzzer final : public Fuzzer {
217 public:
218     using Fuzzer::Fuzzer;
219     ~MmsNetworkClientFuzzer() final {}
220 public:
221     void StartFuzzerTest() override
222     {
223         if (!CreateObject()) {
224             return;
225         }
226         TestExecutePost();
227         TestExecuteGet();
228         TestGetMmsDataBuf();
229         TestCheckSendConf();
230         TestGetCoverUrl();
231         TestUpdateMmsPduToStorage();
232         TestGetMmsPduFromFile();
233         TestGetMmsPduFromDataBase();
234         TestDeleteMmsPdu();
235         TestWriteBufferToFile();
236         DestoryObject();
237     }
238 protected:
CreateObject()239     bool CreateObject()
240     {
241         m_pMmsNetworkClient = std::make_unique<MmsNetworkClient>(g_slotId);
242         return m_pMmsNetworkClient != nullptr;
243     }
DestoryObject()244     void DestoryObject()
245     {
246         m_pMmsNetworkClient.reset();
247     }
TestExecutePost()248     void TestExecutePost()
249     {
250         std::string  strNormalUrl = "www.baidu.com";
251         std::string  strBadUrl = GetString(30);
252         std::string  strPostData = GetString(256);
253         m_pMmsNetworkClient->Execute("POST", strNormalUrl, strPostData, "ua", "uaprof");
254         m_pMmsNetworkClient->Execute("POST", strBadUrl, strPostData, "ua", "uaprof");
255     }
TestExecuteGet()256     void TestExecuteGet()
257     {
258         std::string  strNormalUrl = "www.baidu.com";
259         std::string  strBadUrl = GetString(30);
260         std::string  strPostData = GetString(256);
261         m_pMmsNetworkClient->Execute("GET", strNormalUrl, strPostData, "ua", "uaprof");
262         m_pMmsNetworkClient->Execute("GET", strBadUrl, strPostData, "ua", "uaprof");
263     }
TestGetMmsDataBuf()264     void TestGetMmsDataBuf()
265     {
266         std::string  fileName = "www.baidu.com";
267         std::string  strBuf = GetString(256);
268         m_pMmsNetworkClient->GetMmsDataBuf(strBuf, fileName);
269     }
TestCheckSendConf()270     void TestCheckSendConf()
271     {
272         m_pMmsNetworkClient->CheckSendConf();
273     }
TestGetCoverUrl()274     void TestGetCoverUrl()
275     {
276         std::string emptyStr;
277         m_pMmsNetworkClient->GetCoverUrl(emptyStr);
278         std::string str = GetString(20);
279         m_pMmsNetworkClient->GetCoverUrl(str);
280     }
TestUpdateMmsPduToStorage()281     void TestUpdateMmsPduToStorage()
282     {
283         std::string storeDirName = GetString(20);
284         m_pMmsNetworkClient->UpdateMmsPduToStorage(storeDirName);
285     }
TestGetMmsPduFromFile()286     void TestGetMmsPduFromFile()
287     {
288         std::string fileName = GetString(20);
289         std::string strBuf = GetString(20);
290         m_pMmsNetworkClient->GetMmsPduFromFile(fileName, strBuf);
291     }
TestGetMmsPduFromDataBase()292     void TestGetMmsPduFromDataBase()
293     {
294         std::string dbUrl = GetString(20);
295         std::string strBuf = GetString(20);
296         m_pMmsNetworkClient->GetMmsPduFromDataBase(dbUrl, strBuf);
297     }
TestDeleteMmsPdu()298     void TestDeleteMmsPdu()
299     {
300         std::string dbUrl = GetString(20);
301         m_pMmsNetworkClient->DeleteMmsPdu(dbUrl);
302     }
TestWriteBufferToFile()303     void TestWriteBufferToFile()
304     {
305         std::unique_ptr<char[]> bufp = std::make_unique<char[]>(g_size);
306         std::string strPathName = GetString(20);
307         m_pMmsNetworkClient->WriteBufferToFile(bufp, g_size, strPathName);
308     }
309 private:
310     std::unique_ptr<MmsNetworkClient> m_pMmsNetworkClient;
311 };
312 
313 class MmsPersistHelperFuzzer final : public Fuzzer {
314 public:
315     using Fuzzer::Fuzzer;
316     ~MmsPersistHelperFuzzer() final {}
317 public:
318     void StartFuzzerTest() override
319     {
320         if (!CreateObject()) {
321             return;
322         }
323         TestMakeUrl();
324         TestInsert();
325         TestGet();
326         TestDelete();
327         TestGet();
328         TestSetMmsPdu();
329         TestSplitPdu();
330         TestSplitUrl();
331         DestoryObject();
332     }
333 protected:
CreateObject()334     bool CreateObject()
335     {
336         m_pMmsPersistHelper = std::make_unique<MmsPersistHelper>();
337         return m_pMmsPersistHelper != nullptr;
338     }
DestoryObject()339     void DestoryObject()
340     {
341         m_pMmsPersistHelper.reset();
342     }
TestMakeUrl()343     void TestMakeUrl()
344     {
345         std::string strUrl = GetString();
346     }
TestInsert()347     void TestInsert()
348     {
349         std::string strMmsPdu = GetString();
350         m_pMmsPersistHelper->InsertMmsPdu(strMmsPdu, m_strUrl);
351     }
TestGet()352     void TestGet()
353     {
354         m_pMmsPersistHelper->GetMmsPdu(m_strUrl);
355     }
TestDelete()356     void TestDelete()
357     {
358         m_pMmsPersistHelper->DeleteMmsPdu(m_strUrl);
359     }
TestSetMmsPdu()360     void TestSetMmsPdu()
361     {
362         std::string mmsPdu = GetString(100);
363         m_pMmsPersistHelper->SetMmsPdu(mmsPdu);
364     }
TestSplitPdu()365     void TestSplitPdu()
366     {
367         std::string mmsPdu = StringUtils::StringToHex(GetString(100));
368         m_pMmsPersistHelper->SplitPdu(mmsPdu);
369     }
TestSplitUrl()370     void TestSplitUrl()
371     {
372         std::string url = GetString(100);
373         m_pMmsPersistHelper->SplitUrl(url);
374         url += ",fuzzer";
375         m_pMmsPersistHelper->SplitUrl(url);
376     }
377 private:
378     std::string                       m_strUrl;
379     std::unique_ptr<MmsPersistHelper> m_pMmsPersistHelper;
380 };
381 
382 class MmsConnCallbackStubFuzzer final : public Fuzzer {
383 public:
384     using Fuzzer::Fuzzer;
385     ~MmsConnCallbackStubFuzzer() final {}
386 public:
387     void StartFuzzerTest() override
388     {
389         if (!CreateObject()) {
390             return;
391         }
392         TestNetAvailable();
393         DestoryObject();
394     }
395 protected:
CreateObject()396     bool CreateObject()
397     {
398         m_pMmsConnCallbackStub = std::make_unique<MmsConnCallbackStub>();
399         return m_pMmsConnCallbackStub != nullptr;
400     }
DestoryObject()401     void DestoryObject()
402     {
403         m_pMmsConnCallbackStub.reset();
404     }
TestNetAvailable()405     void TestNetAvailable()
406     {
407         sptr<NetManagerStandard::NetHandle> pNetHandle = new NetManagerStandard::NetHandle;
408         sptr<NetManagerStandard::NetAllCapabilities> pNetAllCap = new NetManagerStandard::NetAllCapabilities;
409         sptr<NetManagerStandard::NetLinkInfo> pNetLinkInfo = new NetManagerStandard::NetLinkInfo;
410 
411         m_pMmsConnCallbackStub->NetAvailable(pNetHandle);
412         m_pMmsConnCallbackStub->NetCapabilitiesChange(pNetHandle, pNetAllCap);
413         m_pMmsConnCallbackStub->NetConnectionPropertiesChange(pNetHandle, pNetLinkInfo);
414         m_pMmsConnCallbackStub->NetLost(pNetHandle);
415         m_pMmsConnCallbackStub->NetUnavailable();
416         m_pMmsConnCallbackStub->NetBlockStatusChange(pNetHandle, false);
417     }
418 private:
419     std::unique_ptr<MmsConnCallbackStub> m_pMmsConnCallbackStub;
420 };
421 
422 class CdmaSmsSenderFuzzer final : public Fuzzer {
423 public:
424     using Fuzzer::Fuzzer;
425     ~CdmaSmsSenderFuzzer() final {}
426 public:
427     void StartFuzzerTest() override
428     {
429         if (!CreateObject()) {
430             return;
431         }
432         TestTextBasedSmsDeliveryViaIms();
433         TestSendSmsToRil();
434         TestGetOrSimpleCall();
435         EncodeMsg();
436         DestoryObject();
437     }
438 protected:
CreateObject()439     bool CreateObject()
440     {
441         m_pCdmaSmsSender = std::make_unique<CdmaSmsSender>(g_slotId, &CdmaSmsSenderFuzzer::SendRetryFunc);
442         m_pCdmaSmsSender->Init();
443         return m_pCdmaSmsSender != nullptr;
444     }
DestoryObject()445     void DestoryObject()
446     {
447         m_pCdmaSmsSender.reset();
448     }
SendRetryFunc(std::shared_ptr<SmsSendIndexer> index)449     static void SendRetryFunc(std::shared_ptr<SmsSendIndexer> index) {}
TestTextBasedSmsDeliveryViaIms()450     void TestTextBasedSmsDeliveryViaIms()
451     {
452         std::string strScAddr = GetString(MAX_ADDRESS_LEN-1);
453         std::string strDtAddr = GetString(MAX_ADDRESS_LEN-1);
454         std::string strText = GetString();
455         size_t      nPort   = GetPort();
456         uint16_t dataBaseId = 0;
457         sptr<ISendShortMessageCallback> sendCallback = nullptr;
458         sptr<IDeliveryShortMessageCallback> deliveryCallback = nullptr;
459         bool isMmsApp = true;
460 
461         m_pCdmaSmsSender->TextBasedSmsDeliveryViaIms(strDtAddr, strScAddr, strText, sendCallback, deliveryCallback,
462             dataBaseId, isMmsApp);
463         m_pCdmaSmsSender->DataBasedSmsDeliveryViaIms(
464             strDtAddr, strScAddr, nPort, g_data, g_size, sendCallback, deliveryCallback);
465     }
TestSendSmsToRil()466     void TestSendSmsToRil()
467     {
468         std::string strScAddr = GetString(MAX_ADDRESS_LEN-1);
469         std::string strDtAddr = GetString(MAX_ADDRESS_LEN-1);
470         std::string strText = GetString();
471         sptr<ISendShortMessageCallback> sendCallback = nullptr;
472         sptr<IDeliveryShortMessageCallback> deliveryCallback = nullptr;
473         std::shared_ptr<SmsSendIndexer> pSendIndexer
474             = std::make_shared<SmsSendIndexer>(strDtAddr, strScAddr, strText,
475             sendCallback, deliveryCallback);
476 
477         m_pCdmaSmsSender->SendSmsToRil(pSendIndexer);
478         m_pCdmaSmsSender->ResendTextDelivery(nullptr);
479         m_pCdmaSmsSender->ResendTextDelivery(pSendIndexer);
480         m_pCdmaSmsSender->ResendDataDelivery(nullptr);
481         m_pCdmaSmsSender->ResendDataDelivery(pSendIndexer);
482 
483         std::unique_ptr<CdmaTransportMsg> transMsg = std::make_unique<CdmaTransportMsg>();
484         transMsg->type = GetEnumRandom_CdmaTransportMsgType();
485 
486         pSendIndexer->SetIsConcat(true);
487         m_pCdmaSmsSender->SetConcact(pSendIndexer, transMsg);
488     }
TestGetOrSimpleCall()489     void TestGetOrSimpleCall()
490     {
491         bool bIsSupported;
492         m_pCdmaSmsSender->IsImsSmsSupported(g_slotId, bIsSupported);
493         m_pCdmaSmsSender->GetSeqNum();
494         m_pCdmaSmsSender->GetSubmitMsgId();
495     }
EncodeMsg()496     void EncodeMsg()
497     {
498         CdmaTransportMsg transMsg;
499         transMsg.type = GetEnumRandom_CdmaTransportMsgType();
500         m_pCdmaSmsSender->EncodeMsg(transMsg);
501     }
502 private:
503     std::unique_ptr<CdmaSmsSender> m_pCdmaSmsSender;
504 };
505 
506 class CdmaSmsReceiveHandleFuzzer final : public Fuzzer {
507 public:
508     using Fuzzer::Fuzzer;
509     ~CdmaSmsReceiveHandleFuzzer() final {}
510 public:
511     void StartFuzzerTest() override
512     {
513         if (!CreateObject()) {
514             return;
515         }
516         TestHandleSmsAndSendCBB();
517         TestTransformMessageInfo();
518         DestoryObject();
519     }
520 protected:
CreateObject()521     bool CreateObject()
522     {
523         m_pCdmaSmsReceiveHandler = std::make_unique<CdmaSmsReceiveHandler>(g_slotId);
524         return m_pCdmaSmsReceiveHandler != nullptr;
525     }
DestoryObject()526     void DestoryObject()
527     {
528         m_pCdmaSmsReceiveHandler.reset();
529     }
TestHandleSmsAndSendCBB()530     void TestHandleSmsAndSendCBB()
531     {
532         SmsTeleSvcUserData userData;
533         std::vector<UserDataHeadType> vectUserDataHeadType = {
534             UserDataHeadType::UDH_CONCAT_8BIT,
535             UserDataHeadType::UDH_CONCAT_16BIT
536         };
537 
538         GetDataRange((char*)&userData.userData.data, userData.userData.length, m_nDataRangeMin, m_nDataRangeMax);
539         userData.userData.headerCnt = 1;
540         userData.userData.header[0].udhType = GetEnumRandom(vectUserDataHeadType);
541 
542         std::shared_ptr<CdmaSmsMessage> smsBaseMessage = std::make_shared<CdmaSmsMessage>();
543         smsBaseMessage->AnalsisHeader(userData);
544         smsBaseMessage->messageId_ = 1;
545         smsBaseMessage->serviceCategory_ = 1;
546         smsBaseMessage->language_ =1;
547         smsBaseMessage-> visibleMessageBody_ ="123";
548 
549         m_pCdmaSmsReceiveHandler->HandleSmsOtherSvcid(smsBaseMessage);
550         m_pCdmaSmsReceiveHandler->HandleSmsOtherSvcid(nullptr);
551         m_pCdmaSmsReceiveHandler->SendCBBroadcast(smsBaseMessage);
552         m_pCdmaSmsReceiveHandler->SendCBBroadcast(nullptr);
553     }
TestReplySmsToSmsc()554     void TestReplySmsToSmsc()
555     {
556         int nResult = AckIncomeCause::SMS_ACK_RESULT_OK;
557         m_pCdmaSmsReceiveHandler->ReplySmsToSmsc(nResult);
558     }
TestTransformMessageInfo()559     void TestTransformMessageInfo()
560     {
561         std::shared_ptr<SmsMessageInfo> info;
562         m_pCdmaSmsReceiveHandler->TransformMessageInfo(info);
563         info = std::make_shared<SmsMessageInfo>();
564         info->pdu = GetPduVect();
565         m_pCdmaSmsReceiveHandler->TransformMessageInfo(info);
566     }
567 private:
568     std::unique_ptr<CdmaSmsReceiveHandler> m_pCdmaSmsReceiveHandler;
569     int                                    m_nDataRangeMin = 2;
570     int                                    m_nDataRangeMax = MAX_USER_DATA_LEN;
571 };
572 
573 class CdmaSmsMessageFuzzer final : public Fuzzer {
574 public:
575     using Fuzzer::Fuzzer;
576     ~CdmaSmsMessageFuzzer() final {}
577 public:
578     void StartFuzzerTest() override
579     {
580         if (!CreateObject()) {
581             return;
582         }
583         TestCovertEncodingType();
584         TestCreateMessage();
585         TestAnalysisP2pMsg();
586         TestAnalsisUserData();
587         TestIsOrGet();
588         DestoryObject();
589     }
590 protected:
CreateObject()591     bool CreateObject()
592     {
593         m_pCdmaSmsMessage = std::make_unique<CdmaSmsMessage>();
594         return m_pCdmaSmsMessage != nullptr;
595     }
DestoryObject()596     void DestoryObject()
597     {
598         m_pCdmaSmsMessage.reset();
599     }
TestCovertEncodingType()600     void TestCovertEncodingType()
601     {
602         DataCodingScheme data = GetEnumRandom_DataCodingScheme();
603         m_pCdmaSmsMessage->CovertEncodingType(data);
604     }
TestCreateMessage()605     void TestCreateMessage()
606     {
607         std::vector<uint8_t> vectUint8 = GetPduVect();
608         std::string pduHex = StringUtils::StringToHex(vectUint8);
609         m_pCdmaSmsMessage->CreateMessage(pduHex);
610     }
TestAnalysisP2pMsg()611     void TestAnalysisP2pMsg()
612     {
613         CdmaP2PMsg p2pMsg;
614 
615         p2pMsg.teleserviceId = static_cast<uint16_t>(GetEnumRandom_SmsTransTelsvcId());
616         p2pMsg.telesvcMsg.type = GetEnumRandom_TeleserviceMsgType();
617         m_pCdmaSmsMessage->AnalysisP2pMsg(p2pMsg);
618     }
TestAnalsisUserData()619     void TestAnalsisUserData()
620     {
621         SmsTeleSvcUserData userData;
622         userData.encodeType = GetEnumRandom_SmsEncodingType();
623         GetDataRange(userData.userData.data, userData.userData.length, 0, nMaxSmsUDPackageDataLen);
624         m_pCdmaSmsMessage->AnalsisUserData(userData);
625     }
TestIsOrGet()626     void TestIsOrGet()
627     {
628         m_pCdmaSmsMessage->GetTransTeleService();
629         m_pCdmaSmsMessage->GetProtocolId();
630         m_pCdmaSmsMessage->IsReplaceMessage();
631         m_pCdmaSmsMessage->IsCphsMwi();
632         m_pCdmaSmsMessage->IsWapPushMsg();
633         m_pCdmaSmsMessage->GetSpecialSmsInd();
634         m_pCdmaSmsMessage->GetDestPort();
635         m_pCdmaSmsMessage->IsBroadcastMsg();
636         m_pCdmaSmsMessage->GetCMASCategory();
637         m_pCdmaSmsMessage->GetCMASResponseType();
638         m_pCdmaSmsMessage->GetCMASSeverity();
639         m_pCdmaSmsMessage->GetCMASUrgency();
640         m_pCdmaSmsMessage->GetCMASCertainty();
641         m_pCdmaSmsMessage->GetCMASMessageClass();
642         m_pCdmaSmsMessage->IsCMAS();
643         m_pCdmaSmsMessage->GetMessageId();
644         m_pCdmaSmsMessage->GetFormat();
645         m_pCdmaSmsMessage->GetLanguage();
646         m_pCdmaSmsMessage->GetCbInfo();
647         m_pCdmaSmsMessage->GetPriority();
648         m_pCdmaSmsMessage->IsEmergencyMsg();
649         m_pCdmaSmsMessage->GetServiceCategoty();
650         m_pCdmaSmsMessage->GetGeoScope();
651         m_pCdmaSmsMessage->GetReceTime();
652     }
653 private:
654     const int nMaxSmsUDPackageDataLen = MAX_USER_DATA_LEN;
655     std::unique_ptr<CdmaSmsMessage> m_pCdmaSmsMessage;
656 };
657 }  // namespace OHOS
658 
659 template<typename TY>
RunFuzzer(const uint8_t* data, size_t size)660 void RunFuzzer(const uint8_t* data, size_t size)
661 {
662     if (data == nullptr || size == 0) {
663         return;
664     }
665     std::unique_ptr<OHOS::Fuzzer> p = std::make_unique<TY>(data, size);
666     p->StartFuzzerTest();
667 }
668 
669 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)670 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
671 {
672     /* Run your code on data */
673     OHOS::AddSmsTokenFuzzer token;
674 
675     RunFuzzer<OHOS::MmsApnInfoFuzzer>(data, size);
676     RunFuzzer<OHOS::MmsNetworkClientFuzzer>(data, size);
677     RunFuzzer<OHOS::MmsPersistHelperFuzzer>(data, size);
678     RunFuzzer<OHOS::MmsConnCallbackStubFuzzer>(data, size);
679     RunFuzzer<OHOS::CdmaSmsMessageFuzzer>(data, size);
680     RunFuzzer<OHOS::CdmaSmsSenderFuzzer>(data, size);
681     RunFuzzer<OHOS::CdmaSmsReceiveHandleFuzzer>(data, size);
682     return 0;
683 }