1/*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 *     http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16#include "telephonystateregistry_fuzzer.h"
17
18#include <cstddef>
19#include <cstdint>
20#define private public
21#define protected public
22#include "addstateregistrytoken_fuzzer.h"
23#include "if_system_ability_manager.h"
24#include "iservice_registry.h"
25#include "securec.h"
26#include "system_ability_definition.h"
27#include "telephony_observer.h"
28#include "telephony_state_registry_service.h"
29#include "telephony_state_registry_stub.h"
30
31using namespace OHOS::Telephony;
32namespace OHOS {
33static bool g_isInited = false;
34constexpr int32_t BOOL_NUM = 2;
35constexpr int32_t SLOT_NUM = 2;
36constexpr int32_t ROAMING_NUM = 4;
37constexpr int32_t REG_NUM = 6;
38constexpr int32_t CELL_NUM = 7;
39constexpr int32_t SIGNAL_NUM = 6;
40constexpr int32_t SIGNAL_PLUS = 1;
41constexpr int32_t NR_NUM = 7;
42constexpr int32_t RADIO_NUM = 13;
43
44bool IsServiceInited()
45{
46    if (!g_isInited) {
47        DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnStart();
48        if (DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->GetServiceRunningState() ==
49            static_cast<int32_t>(ServiceRunningState::STATE_RUNNING)) {
50            g_isInited = true;
51        }
52    }
53    return g_isInited;
54}
55
56void OnRemoteRequest(const uint8_t *data, size_t size)
57{
58    if (!IsServiceInited()) {
59        return;
60    }
61    MessageParcel dataMessageParcel;
62    if (!dataMessageParcel.WriteInterfaceToken(TelephonyStateRegistryStub::GetDescriptor())) {
63        return;
64    }
65    dataMessageParcel.WriteBuffer(data, size);
66    dataMessageParcel.RewindRead(0);
67    uint32_t code = static_cast<uint32_t>(size);
68    MessageParcel reply;
69    MessageOption option;
70    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnRemoteRequest(
71        code, dataMessageParcel, reply, option);
72}
73
74void CreateGsmCellInfo(std::unique_ptr<GsmCellInformation> &cell, const uint8_t *data, size_t size)
75{
76    if (cell == nullptr) {
77        return;
78    }
79    cell->lac_ = static_cast<int32_t>(size);
80    cell->bsic_ = static_cast<int32_t>(size);
81    cell->arfcn_ = static_cast<int32_t>(size);
82    std::string mcc(reinterpret_cast<const char *>(data), size);
83    cell->mcc_ = mcc;
84    std::string mnc(reinterpret_cast<const char *>(data), size);
85    cell->mnc_ = mnc;
86    cell->cellId_ = static_cast<int32_t>(size);
87    cell->timeStamp_ = static_cast<uint64_t>(size);
88    cell->signalIntensity_ = static_cast<int32_t>(size);
89    cell->signalLevel_ = static_cast<int32_t>(size);
90    cell->isCamped_ = static_cast<int32_t>(size % BOOL_NUM);
91}
92
93void CreateLteCellInfo(std::unique_ptr<LteCellInformation> &cell, const uint8_t *data, size_t size)
94{
95    if (cell == nullptr) {
96        return;
97    }
98    cell->pci_ = static_cast<int32_t>(size);
99    cell->tac_ = static_cast<int32_t>(size);
100    cell->earfcn_ = static_cast<int32_t>(size);
101    std::string mcc(reinterpret_cast<const char *>(data), size);
102    cell->mcc_ = mcc;
103    std::string mnc(reinterpret_cast<const char *>(data), size);
104    cell->mnc_ = mnc;
105    cell->cellId_ = static_cast<int32_t>(size);
106    cell->timeStamp_ = static_cast<uint64_t>(size);
107    cell->signalIntensity_ = static_cast<int32_t>(size);
108    cell->signalLevel_ = static_cast<int32_t>(size);
109    cell->isCamped_ = static_cast<int32_t>(size % BOOL_NUM);
110}
111
112void UpdateCellInfo(const uint8_t *data, size_t size)
113{
114    if (!IsServiceInited()) {
115        return;
116    }
117    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
118    int32_t loopSize = static_cast<int32_t>(size);
119    MessageParcel dataMessageParcel;
120    dataMessageParcel.WriteInt32(slotId);
121    dataMessageParcel.WriteInt32(loopSize);
122    for (int32_t i = 0; i < loopSize; i++) {
123        CellInformation::CellType type = static_cast<CellInformation::CellType>(size % CELL_NUM);
124        if (type == CellInformation::CellType::CELL_TYPE_GSM) {
125            std::unique_ptr<GsmCellInformation> cell = std::make_unique<GsmCellInformation>();
126            if (cell == nullptr) {
127                return;
128            }
129            CreateGsmCellInfo(cell, data, size);
130            cell->Marshalling(dataMessageParcel);
131        }
132        if (type == CellInformation::CellType::CELL_TYPE_LTE) {
133            std::unique_ptr<LteCellInformation> cell = std::make_unique<LteCellInformation>();
134            if (cell == nullptr) {
135                return;
136            }
137            CreateLteCellInfo(cell, data, size);
138            cell->Marshalling(dataMessageParcel);
139        }
140    }
141    dataMessageParcel.RewindRead(0);
142    MessageParcel reply;
143    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellInfo(dataMessageParcel, reply);
144}
145
146void UpdateCallState(const uint8_t *data, size_t size)
147{
148    if (!IsServiceInited()) {
149        return;
150    }
151    int32_t callState = static_cast<int32_t>(size);
152    std::string phoneNumber(reinterpret_cast<const char *>(data), size);
153    MessageParcel dataMessageParcel;
154    dataMessageParcel.WriteInt32(callState);
155    dataMessageParcel.WriteString16(Str8ToStr16(phoneNumber));
156    dataMessageParcel.RewindRead(0);
157    MessageParcel reply;
158    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCallState(dataMessageParcel, reply);
159}
160
161void UpdateCallStateForSlotId(const uint8_t *data, size_t size)
162{
163    if (!IsServiceInited()) {
164        return;
165    }
166    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
167    int32_t callState = static_cast<int32_t>(size);
168    std::string incomingNumber(reinterpret_cast<const char *>(data), size);
169    MessageParcel dataMessageParcel;
170    dataMessageParcel.WriteInt32(slotId);
171    dataMessageParcel.WriteInt32(callState);
172    dataMessageParcel.WriteString16(Str8ToStr16(incomingNumber));
173    dataMessageParcel.RewindRead(0);
174    MessageParcel reply;
175    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCallStateForSlotId(
176        dataMessageParcel, reply);
177}
178
179void CreateGsmSignalInfo(std::unique_ptr<GsmSignalInformation> &signal, const uint8_t *data, size_t size)
180{
181    if (signal == nullptr) {
182        return;
183    }
184    int32_t offset = 0;
185    signal->signalBar_ = static_cast<int32_t>(*data + offset);
186    offset += sizeof(int32_t);
187    signal->gsmRxlev_ = static_cast<int32_t>(*data + offset);
188    offset += sizeof(int32_t);
189    signal->gsmBer_ = static_cast<int32_t>(*data + offset);
190}
191
192void CreateCDMASignalInfo(std::unique_ptr<CdmaSignalInformation> &signal, const uint8_t *data, size_t size)
193{
194    if (signal == nullptr) {
195        return;
196    }
197    int32_t offset = 0;
198    signal->signalBar_ = static_cast<int32_t>(*data + offset);
199    offset += sizeof(int32_t);
200    signal->cdmaRssi_ = static_cast<int32_t>(*data + offset);
201    offset += sizeof(int32_t);
202    signal->cdmaEcno_ = static_cast<int32_t>(*data + offset);
203}
204
205void CreateLTESignalInfo(std::unique_ptr<LteSignalInformation> &signal, const uint8_t *data, size_t size)
206{
207    if (signal == nullptr) {
208        return;
209    }
210    int32_t offset = 0;
211    signal->signalBar_ = static_cast<int32_t>(*data + offset);
212    offset += sizeof(int32_t);
213    signal->rxlev_ = static_cast<int32_t>(*data + offset);
214    offset += sizeof(int32_t);
215    signal->lteRsrp_ = static_cast<int32_t>(*data + offset);
216    offset += sizeof(int32_t);
217    signal->lteRsrq_ = static_cast<int32_t>(*data + offset);
218    offset += sizeof(int32_t);
219    signal->lteSnr_ = static_cast<int32_t>(*data + offset);
220}
221
222void CreateWCDMASignalInfo(std::unique_ptr<WcdmaSignalInformation> &signal, const uint8_t *data, size_t size)
223{
224    if (signal == nullptr) {
225        return;
226    }
227    int32_t offset = 0;
228    signal->signalBar_ = static_cast<int32_t>(*data + offset);
229    offset += sizeof(int32_t);
230    signal->wcdmaRxlev_ = static_cast<int32_t>(*data + offset);
231    offset += sizeof(int32_t);
232    signal->wcdmaRscp_ = static_cast<int32_t>(*data + offset);
233    offset += sizeof(int32_t);
234    signal->wcdmaEcio_ = static_cast<int32_t>(*data + offset);
235    offset += sizeof(int32_t);
236    signal->wcdmaBer_ = static_cast<int32_t>(*data + offset);
237}
238
239void CreateNRSignalInfo(std::unique_ptr<NrSignalInformation> &signal, const uint8_t *data, size_t size)
240{
241    if (signal == nullptr) {
242        return;
243    }
244    int32_t offset = 0;
245    signal->signalBar_ = static_cast<int32_t>(*data + offset);
246    offset += sizeof(int32_t);
247    signal->nrRsrp_ = static_cast<int32_t>(*data + offset);
248    offset += sizeof(int32_t);
249    signal->nrRsrq_ = static_cast<int32_t>(*data + offset);
250    offset += sizeof(int32_t);
251    signal->nrSinr_ = static_cast<int32_t>(*data + offset);
252}
253
254void UpdateLteNrSignalInfo(const uint8_t *data, size_t size, MessageParcel &dataMessageParcel,
255    SignalInformation::NetworkType type)
256{
257    if (type == SignalInformation::NetworkType::LTE) {
258        std::unique_ptr<LteSignalInformation> signal = std::make_unique<LteSignalInformation>();
259        if (signal == nullptr) {
260            return;
261        }
262        CreateLTESignalInfo(signal, data, size);
263        signal->Marshalling(dataMessageParcel);
264    }
265    if (type == SignalInformation::NetworkType::NR) {
266        std::unique_ptr<NrSignalInformation> signal = std::make_unique<NrSignalInformation>();
267        if (signal == nullptr) {
268            return;
269        }
270        CreateNRSignalInfo(signal, data, size);
271        signal->Marshalling(dataMessageParcel);
272    }
273}
274
275void UpdateSignalInfo(const uint8_t *data, size_t size)
276{
277    if (!IsServiceInited()) {
278        return;
279    }
280    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
281    int32_t loopSize = static_cast<int32_t>(size);
282    MessageParcel dataMessageParcel;
283    dataMessageParcel.WriteInt32(slotId);
284    dataMessageParcel.WriteInt32(loopSize);
285    for (int32_t i = 0; i < loopSize; i++) {
286        SignalInformation::NetworkType type =
287            static_cast<SignalInformation::NetworkType>(size % SIGNAL_NUM + SIGNAL_PLUS);
288        if (type == SignalInformation::NetworkType::GSM) {
289            std::unique_ptr<GsmSignalInformation> signal = std::make_unique<GsmSignalInformation>();
290            if (signal == nullptr) {
291                return;
292            }
293            CreateGsmSignalInfo(signal, data, size);
294            signal->Marshalling(dataMessageParcel);
295        }
296        if (type == SignalInformation::NetworkType::CDMA) {
297            std::unique_ptr<CdmaSignalInformation> signal = std::make_unique<CdmaSignalInformation>();
298            if (signal == nullptr) {
299                return;
300            }
301            CreateCDMASignalInfo(signal, data, size);
302            signal->Marshalling(dataMessageParcel);
303        }
304        if (type == SignalInformation::NetworkType::LTE || type == SignalInformation::NetworkType::NR) {
305            UpdateLteNrSignalInfo(data, size, dataMessageParcel, type);
306        }
307        if (type == SignalInformation::NetworkType::WCDMA) {
308            std::unique_ptr<WcdmaSignalInformation> signal = std::make_unique<WcdmaSignalInformation>();
309            if (signal == nullptr) {
310                return;
311            }
312            CreateWCDMASignalInfo(signal, data, size);
313            signal->Marshalling(dataMessageParcel);
314        }
315    }
316    dataMessageParcel.RewindRead(0);
317    MessageParcel reply;
318    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateSignalInfo(dataMessageParcel, reply);
319}
320
321void UpdateNetworkState(const uint8_t *data, size_t size)
322{
323    if (!IsServiceInited()) {
324        return;
325    }
326    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
327    MessageParcel dataMessageParcel;
328    dataMessageParcel.WriteInt32(slotId);
329    auto networkState = std::make_unique<NetworkState>();
330    if (networkState == nullptr) {
331        return;
332    }
333    networkState->isEmergency_ = static_cast<int32_t>(size % BOOL_NUM);
334    std::string mOperatorNumeric(reinterpret_cast<const char *>(data), size);
335    std::string mFullName(reinterpret_cast<const char *>(data), size);
336    std::string mShortName(reinterpret_cast<const char *>(data), size);
337    networkState->psOperatorInfo_.operatorNumeric = mOperatorNumeric;
338    networkState->psOperatorInfo_.fullName = mFullName;
339    networkState->psOperatorInfo_.shortName = mShortName;
340    networkState->csOperatorInfo_.operatorNumeric = mOperatorNumeric;
341    networkState->csOperatorInfo_.fullName = mFullName;
342    networkState->csOperatorInfo_.shortName = mShortName;
343    networkState->csRoaming_ = static_cast<RoamingType>(size % ROAMING_NUM);
344    networkState->psRoaming_ = static_cast<RoamingType>(size % ROAMING_NUM);
345    networkState->psRegStatus_ = static_cast<RegServiceState>(size % REG_NUM);
346    networkState->csRegStatus_ = static_cast<RegServiceState>(size % REG_NUM);
347    networkState->psRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
348    networkState->lastPsRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
349    networkState->lastCfgTech_ = static_cast<RadioTech>(size % RADIO_NUM);
350    networkState->csRadioTech_ = static_cast<RadioTech>(size % RADIO_NUM);
351    networkState->cfgTech_ = static_cast<RadioTech>(size % RADIO_NUM);
352    networkState->nrState_ = static_cast<NrState>(size % NR_NUM);
353    networkState->Marshalling(dataMessageParcel);
354    dataMessageParcel.RewindRead(0);
355    MessageParcel reply;
356    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateNetworkState(dataMessageParcel, reply);
357}
358
359void UpdateCellularDataConnectState(const uint8_t *data, size_t size)
360{
361    if (!IsServiceInited()) {
362        return;
363    }
364    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
365    int32_t offset = 0;
366    int32_t dataState = static_cast<int32_t>(*data + offset);
367    offset += sizeof(int32_t);
368    int32_t networkType = static_cast<int32_t>(*data + offset);
369    MessageParcel dataMessageParcel;
370    dataMessageParcel.WriteInt32(slotId);
371    dataMessageParcel.WriteInt32(dataState);
372    dataMessageParcel.WriteInt32(networkType);
373    dataMessageParcel.RewindRead(0);
374    MessageParcel reply;
375    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellularDataConnectState(
376        dataMessageParcel, reply);
377}
378
379void UpdateCellularDataFlow(const uint8_t *data, size_t size)
380{
381    if (!IsServiceInited()) {
382        return;
383    }
384    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
385    int32_t flowData = static_cast<int32_t>(size);
386    MessageParcel dataMessageParcel;
387    dataMessageParcel.WriteInt32(slotId);
388    dataMessageParcel.WriteInt32(flowData);
389    dataMessageParcel.RewindRead(0);
390    MessageParcel reply;
391    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCellularDataFlow(dataMessageParcel, reply);
392}
393
394void UpdateCfuIndicator(const uint8_t *data, size_t size)
395{
396    if (!IsServiceInited()) {
397        return;
398    }
399    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
400    bool cfuResult = static_cast<bool>(size % BOOL_NUM);
401    MessageParcel dataMessageParcel;
402    dataMessageParcel.WriteInt32(slotId);
403    dataMessageParcel.WriteBool(cfuResult);
404    dataMessageParcel.RewindRead(0);
405    MessageParcel reply;
406    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateCfuIndicator(dataMessageParcel, reply);
407}
408
409void UpdateVoiceMailMsgIndicator(const uint8_t *data, size_t size)
410{
411    if (!IsServiceInited()) {
412        return;
413    }
414    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
415    bool voiceMailMsgResult = static_cast<bool>(size % BOOL_NUM);
416    MessageParcel dataMessageParcel;
417    dataMessageParcel.WriteInt32(slotId);
418    dataMessageParcel.WriteBool(voiceMailMsgResult);
419    dataMessageParcel.RewindRead(0);
420    MessageParcel reply;
421    DelayedSingleton<TelephonyStateRegistryService>::GetInstance()->OnUpdateVoiceMailMsgIndicator(
422        dataMessageParcel, reply);
423}
424
425void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
426{
427    if (data == nullptr || size == 0) {
428        return;
429    }
430    OnRemoteRequest(data, size);
431    UpdateCellInfo(data, size);
432    UpdateCallState(data, size);
433    UpdateCallStateForSlotId(data, size);
434    UpdateSignalInfo(data, size);
435    UpdateNetworkState(data, size);
436    UpdateCellularDataConnectState(data, size);
437    UpdateCellularDataFlow(data, size);
438    UpdateCfuIndicator(data, size);
439    UpdateVoiceMailMsgIndicator(data, size);
440    return;
441}
442} // namespace OHOS
443
444/* Fuzzer entry point */
445extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
446{
447    OHOS::AddStateRegistryTokenFuzzer token;
448    /* Run your code on data */
449    OHOS::DoSomethingInterestingWithMyAPI(data, size);
450    return 0;
451}
452
453