!690 支持SIM卡短信(ril_adapter)

Merge pull request !690 from Aurora/master

interfaces/innerkits/include/hril_vendor_sms_defs.h

@@ -189,6 +189,20 @@ typedef struct {
     unsigned char bytes[HRIL_MAX_CDMA_MESSAGE_LEN];
 } HRilCdmaSmsMessageInfo;
 
+/**
+ * @brief Defines the CDMA SMS message information in a SIM card.
+ */
+typedef struct {
+    /**
+     * Status. For details, see TS 27.005 3.1
+     */
+    int32_t state;
+    /**
+     * CDMA message infomation.
+     */
+    HRilCdmaSmsMessageInfo cdmaMessageInfo;
+} HRilSmsWriteCdmaSms;
+
 typedef struct {
     void (*SendGsmSms)(const ReqDataInfo *requestInfo, const char *const *data, size_t dataLen);
     void (*SendSmsAck)(const ReqDataInfo *requestInfo, const int32_t *data, size_t dataLen);
@@ -203,7 +217,7 @@ typedef struct {
     void (*GetCBConfig)(const ReqDataInfo *requestInfo);
     void (*GetCdmaCBConfig)(const ReqDataInfo *requestInfo);
     void (*SetCdmaCBConfig)(const ReqDataInfo *requestInfo, const HRilCdmaCBConfigInfo *data, size_t dataLen);
-    void (*AddCdmaSimMessage)(const ReqDataInfo *requestInfo, const HRilSmsWriteSms *data, size_t dataLen);
+    void (*AddCdmaSimMessage)(const ReqDataInfo *requestInfo, const HRilSmsWriteCdmaSms *data, size_t dataLen);
     void (*DelCdmaSimMessage)(const ReqDataInfo *requestInfo, const int32_t *data, size_t dataLen);
     void (*UpdateCdmaSimMessage)(const ReqDataInfo *requestInfo, const HRilSmsWriteSms *data, size_t dataLen);
 } HRilSmsReq;

services/hril/include/hril_sms.h

@@ -96,6 +96,8 @@ private:
         HRilRadioResponseInfo &responseInfo, int32_t serial, const void *response, const size_t responseLen);
     void CopyToHRilCdmaCBConfigInfo(
         HRilCdmaCBConfigInfo *list, OHOS::HDI::Ril::V1_1::CdmaCBConfigInfoList cellBroadcastInfoList);
+    bool CreateCdmaMessageInfo(HRilCdmaSmsMessageInfo &cdmaSmsInfo, const std::string &pdu);
+    bool CheckCdmaPduLength(HRilCdmaSmsMessageInfo &cdmaSmsInfo, const std::string &pdu);
 
     const HRilSmsReq *smsFuncs_ = nullptr;
 };

services/hril/src/hril_sms.cpp

@@ -15,6 +15,8 @@
 
 #include "hril_sms.h"
 
+#include <regex>
+
 #include "hril_notification.h"
 #include "hril_request.h"
 
@@ -26,6 +28,13 @@ const size_t MAX_PDU_LEN = 255;
 const size_t MAX_LEN = 100;
 const size_t MAX_CHN_LEN = 50000;
 const int32_t MSG_DEFAULT_INDEX = -1;
+const int32_t BYTE_LEN = 1;
+const int32_t INT_LEN = 4;
+const int32_t NUM_2 = 2;
+const int32_t NUM_3 = 3;
+const int32_t NUM_4 = 4;
+const int32_t NUM_5 = 5;
+const int HEXADECIMAL = 16;
 } // namespace
 
 HRilSms::HRilSms(int32_t slotId, IHRilReporter &hrilReporter) : HRilBase(slotId, hrilReporter)
@@ -119,7 +128,7 @@ int32_t HRilSms::DelSimMessage(int32_t serialId, int32_t index)
     }
     int32_t *pBuff = nullptr;
     RequestWithInts(&pBuff, requestInfo, 1, index);
-    smsFuncs_->DelSimMessage(requestInfo, pBuff, 1);
+    smsFuncs_->DelSimMessage(requestInfo, pBuff, sizeof(int32_t));
     if (pBuff != nullptr) {
         SafeFrees(pBuff);
     }
@@ -250,24 +259,98 @@ int32_t HRilSms::SendSmsAck(int32_t serialId, const OHOS::HDI::Ril::V1_1::ModeDa
 
 int32_t HRilSms::AddCdmaSimMessage(int32_t serialId, const OHOS::HDI::Ril::V1_1::SmsMessageIOInfo &message)
 {
-    HRilSmsWriteSms msg = {};
-    int32_t pduLen = 0;
-    const int32_t MSG_INDEX = -1;
+    HRilSmsWriteCdmaSms msg = {};
     msg.state = message.state;
-    msg.index = MSG_INDEX;
-    pduLen = message.pdu.length();
-    int32_t len = pduLen + 1;
-    if (len <= 0) {
+    if (!CreateCdmaMessageInfo(msg.cdmaMessageInfo, message.pdu)) {
+        TELEPHONY_LOGE("CreateCdmaMessageInfo failed");
         return HRIL_ERR_INVALID_PARAMETER;
     }
-    CopyToCharPoint(&msg.pdu, message.pdu);
     int32_t result = RequestVendor(serialId, HREQ_SMS_ADD_CDMA_SIM_MESSAGE, smsFuncs_, &HRilSmsReq::AddCdmaSimMessage,
-        &msg, sizeof(HRilSmsWriteSms));
+        &msg, sizeof(HRilSmsWriteCdmaSms));
     TELEPHONY_LOGI("AddCdmaSimMessage result is: %{public}d", result);
-    SafeFrees(msg.pdu);
     return result;
 }
 
+bool HRilSms::CreateCdmaMessageInfo(HRilCdmaSmsMessageInfo &cdmaSmsInfo, const std::string &pdu)
+{
+    if (!CheckCdmaPduLength(cdmaSmsInfo, pdu)) {
+        TELEPHONY_LOGE("pdu is invalid");
+        return false;
+    }
+    cdmaSmsInfo.serviceId = stoi(pdu.substr(0, INT_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.isExist = stoi(pdu.substr(INT_LEN + BYTE_LEN * NUM_3, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.type = stoi(pdu.substr(INT_LEN + INT_LEN, INT_LEN), 0, HEXADECIMAL);
+    int32_t index = INT_LEN * NUM_3;
+    // adress
+    cdmaSmsInfo.address.digitMode = stoi(pdu.substr(index, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.address.mode = stoi(pdu.substr(index + BYTE_LEN, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.address.type = stoi(pdu.substr(index + BYTE_LEN * NUM_2, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.address.plan = stoi(pdu.substr(index + BYTE_LEN * NUM_3, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.address.number = stoi(pdu.substr(index + BYTE_LEN * NUM_4, BYTE_LEN), 0, HEXADECIMAL);
+    std::string addByte = pdu.substr(index + BYTE_LEN * NUM_5, BYTE_LEN * cdmaSmsInfo.address.number);
+    char *addressByte = reinterpret_cast<char *>(cdmaSmsInfo.address.bytes);
+    if (strcpy_s(addressByte, cdmaSmsInfo.address.number + 1, addByte.c_str()) != EOK) {
+        TELEPHONY_LOGE("strcpy_s fail.");
+        return false;
+    }
+    index += BYTE_LEN * NUM_5 + BYTE_LEN * cdmaSmsInfo.address.number;
+    // subAdress
+    cdmaSmsInfo.subAddress.type = stoi(pdu.substr(index, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.subAddress.odd = stoi(pdu.substr(index + BYTE_LEN, BYTE_LEN), 0, HEXADECIMAL);
+    cdmaSmsInfo.subAddress.number = stoi(pdu.substr(index + BYTE_LEN * NUM_2, BYTE_LEN), 0, HEXADECIMAL);
+    std::string subAddByte = pdu.substr(index + BYTE_LEN * NUM_3, BYTE_LEN * cdmaSmsInfo.subAddress.number);
+    char *subAddressByte = reinterpret_cast<char *>(cdmaSmsInfo.subAddress.bytes);
+    if (strcpy_s(subAddressByte, cdmaSmsInfo.subAddress.number + 1, subAddByte.c_str()) != EOK) {
+        TELEPHONY_LOGE("strcpy_s fail.");
+        return false;
+    }
+    index += BYTE_LEN * NUM_3 + BYTE_LEN * cdmaSmsInfo.subAddress.number;
+    // bearer Data
+    cdmaSmsInfo.size = stoi(pdu.substr(index, BYTE_LEN), 0, HEXADECIMAL);
+    std::string byte = pdu.substr(index + BYTE_LEN, BYTE_LEN * cdmaSmsInfo.size);
+    char *byteInfo = reinterpret_cast<char *>(cdmaSmsInfo.bytes);
+    if (strcpy_s(byteInfo, cdmaSmsInfo.size + 1, byte.c_str()) != EOK) {
+        TELEPHONY_LOGE("strcpy_s fail.");
+        return false;
+    }
+    return true;
+}
+
+bool HRilSms::CheckCdmaPduLength(HRilCdmaSmsMessageInfo &cdmaSmsInfo, const std::string &pdu)
+{
+    int32_t index = INT_LEN * NUM_3 + BYTE_LEN * NUM_5;
+    // adress
+    if (pdu.length() < index) {
+        TELEPHONY_LOGE("pdu length invalid.");
+        return false;
+    }
+    if (!regex_match(pdu, std::regex("[0-9a-fA-F]+"))) {
+        TELEPHONY_LOGE("pdu invalid.");
+        return false;
+    }
+    cdmaSmsInfo.address.number = stoi(pdu.substr(index - BYTE_LEN, BYTE_LEN), 0, HEXADECIMAL);
+    index += BYTE_LEN * cdmaSmsInfo.address.number + BYTE_LEN * NUM_3;
+    if (pdu.length() < index) {
+        TELEPHONY_LOGE("pdu length invalid.");
+        return false;
+    }
+    // subAdress
+    cdmaSmsInfo.subAddress.number = stoi(pdu.substr(index - BYTE_LEN, BYTE_LEN), 0, HEXADECIMAL);
+    index += BYTE_LEN * cdmaSmsInfo.subAddress.number + BYTE_LEN;
+    if (pdu.length() < index) {
+        TELEPHONY_LOGE("pdu length invalid.");
+        return false;
+    }
+    // bearer Data
+    cdmaSmsInfo.size = stoi(pdu.substr(index - BYTE_LEN, BYTE_LEN), 0, HEXADECIMAL);
+    index += BYTE_LEN * cdmaSmsInfo.size;
+    if (pdu.length() < index) {
+        TELEPHONY_LOGE("pdu length invalid.");
+        return false;
+    }
+    return true;
+}
+
 int32_t HRilSms::DelCdmaSimMessage(int32_t serialId, int32_t index)
 {
     if ((smsFuncs_ == nullptr) || (smsFuncs_->DelCdmaSimMessage == nullptr)) {
@@ -280,7 +363,7 @@ int32_t HRilSms::DelCdmaSimMessage(int32_t serialId, int32_t index)
     }
     int32_t *pBuff = nullptr;
     RequestWithInts(&pBuff, requestInfo, 1, index);
-    smsFuncs_->DelCdmaSimMessage(requestInfo, pBuff, 1);
+    smsFuncs_->DelCdmaSimMessage(requestInfo, pBuff, sizeof(int32_t));
     if (pBuff != nullptr) {
         SafeFrees(pBuff);
     }
@@ -323,6 +406,7 @@ int32_t HRilSms::SendCdmaSmsResponse(
 int32_t HRilSms::AddSimMessageResponse(
     int32_t requestNum, HRilRadioResponseInfo &responseInfo, const void *response, size_t responseLen)
 {
+    TELEPHONY_LOGI("AddSimMessageResponse send");
     return Response(responseInfo, &HDI::Ril::V1_1::IRilCallback::AddSimMessageResponse);
 }
 
@@ -449,6 +533,7 @@ int32_t HRilSms::SendSmsAckResponse(
 int32_t HRilSms::AddCdmaSimMessageResponse(
     int32_t requestNum, HRilRadioResponseInfo &responseInfo, const void *response, size_t responseLen)
 {
+    TELEPHONY_LOGI("receive response");
     return Response(responseInfo, &HDI::Ril::V1_1::IRilCallback::AddCdmaSimMessageResponse);
 }
 

services/vendor/include/at_sms.h

@@ -31,10 +31,11 @@ void ReqSetCBConfig(const ReqDataInfo *requestInfo, const HRilCBConfigInfo *data
 void ReqGetCBConfig(const ReqDataInfo *requestInfo);
 void ReqGetCdmaCBConfig(const ReqDataInfo *requestInfo);
 void ReqSetCdmaCBConfig(const ReqDataInfo *requestInfo, const HRilCdmaCBConfigInfo *data, size_t dataLen);
-void ReqAddCdmaSimMessage(const ReqDataInfo *requestInfo, const HRilSmsWriteSms *data, size_t dataLen);
+void ReqAddCdmaSimMessage(const ReqDataInfo *requestInfo, const HRilSmsWriteCdmaSms *data, size_t dataLen);
 void ReqDelCdmaSimMessage(const ReqDataInfo *requestInfo, const int32_t *data, size_t dataLen);
 void ReqUpdateCdmaSimMessage(const ReqDataInfo *requestInfo, const HRilSmsWriteSms *data, size_t dataLen);
 int32_t ProcessCellBroadcast(char *pBuff, HRilCBConfigReportInfo *response);
 bool CheckSimMessageValid(
     const ReqDataInfo *requestInfo, const HRilSmsWriteSms *data, size_t dataLen, HRilSmsWriteSms *msg);
+void CreateCdmaPdu(char *pdu, size_t dataLen, const HRilCdmaSmsMessageInfo *cdmaMsg);
 #endif // OHOS_AT_SMS_H

services/vendor/src/at_sms.c

@@ -395,11 +395,7 @@ void ReqWriteSimMessage(const ReqDataInfo *requestInfo, const HRilSmsWriteSms *d
 
 void ReqDelSimMessage(const ReqDataInfo *requestInfo, const int32_t *data, size_t dataLen)
 {
-    char cmd[MAX_CMD_LENGTH] = {0};
-    int32_t err;
-    int32_t index;
     ResponseInfo *responseInfo = NULL;
-
     if (data == NULL || dataLen == 0) {
         TELEPHONY_LOGE("data error");
         struct ReportInfo reportInfo = CreateReportInfo(requestInfo, HRIL_ERR_GENERIC_FAILURE, HRIL_RESPONSE, 0);
@@ -407,8 +403,16 @@ void ReqDelSimMessage(const ReqDataInfo *requestInfo, const int32_t *data, size_
         FreeResponseInfo(responseInfo);
         return;
     }
-    index = ((int32_t *)data)[0];
-    err = GenerateCommand(cmd, MAX_CMD_LENGTH, "AT+CMGD=%d", index);
+    int32_t index = ((int32_t *)data)[0] - 1;
+    if (index < 0) {
+        TELEPHONY_LOGE("invalid index:%d", index);
+        struct ReportInfo reportInfo = CreateReportInfo(requestInfo, HRIL_ERR_GENERIC_FAILURE, HRIL_RESPONSE, 0);
+        OnSmsReport(GetSlotId(requestInfo), reportInfo, NULL, 0);
+        FreeResponseInfo(responseInfo);
+        return;
+    }
+    char cmd[MAX_CMD_LENGTH] = { 0 };
+    int32_t err = GenerateCommand(cmd, MAX_CMD_LENGTH, "AT+CMGD=%d", index);
     if (err < 0) {
         TELEPHONY_LOGE("GenerateCommand failed, err = %{public}d\n", err);
         struct ReportInfo reportInfo = CreateReportInfo(requestInfo, err, HRIL_RESPONSE, 0);
@@ -678,37 +682,24 @@ void ReqSetCdmaCBConfig(const ReqDataInfo *requestInfo, const HRilCdmaCBConfigIn
     FreeResponseInfo(responseInfo);
 }
 
-void ReqAddCdmaSimMessage(const ReqDataInfo *requestInfo, const HRilSmsWriteSms *data, size_t dataLen)
+void ReqAddCdmaSimMessage(const ReqDataInfo *requestInfo, const HRilSmsWriteCdmaSms *data, size_t dataLen)
 {
-    char cmd[MAX_CMD_LENGTH] = {0};
-    int32_t err;
-    HRilSmsWriteSms *cdmaMsg = NULL;
-    ResponseInfo *responseInfo = NULL;
     struct ReportInfo reportInfo = {0};
     if (data == NULL) {
         reportInfo = CreateReportInfo(requestInfo, HRIL_ERR_GENERIC_FAILURE, HRIL_RESPONSE, 0);
         OnSmsReport(GetSlotId(requestInfo), reportInfo, NULL, 0);
-        FreeResponseInfo(responseInfo);
-        return;
-    }
-    cdmaMsg = ((HRilSmsWriteSms *)data);
-    err = GenerateCommand(cmd, MAX_CMD_LENGTH, "AT+CPMS=%d,%d%s", cdmaMsg->index, cdmaMsg->state, cdmaMsg->pdu);
-    if (err < 0) {
-        TELEPHONY_LOGE("GenerateCommand failed, err = %{public}d\n", err);
-        reportInfo = CreateReportInfo(requestInfo, err, HRIL_RESPONSE, 0);
-        OnSmsReport(GetSlotId(requestInfo), reportInfo, NULL, 0);
-        FreeResponseInfo(responseInfo);
-        return;
-    }
-    err = SendCommandLock(cmd, "+CPMS:", 0, &responseInfo);
-    if (err != 0 || (responseInfo != NULL && !responseInfo->success)) {
-        err = HRIL_ERR_GENERIC_FAILURE;
-        SimMessageError(&reportInfo, requestInfo, &err, responseInfo);
         return;
     }
+    HRilSmsWriteCdmaSms *cdmaSms = (HRilSmsWriteCdmaSms *)data;
+    HRilCdmaSmsMessageInfo *cdmaMsg = &cdmaSms->cdmaMessageInfo;
+    TELEPHONY_LOGD(
+        "CreateCdmaPdu = %{public}x, %{public}x, %{public}x", cdmaMsg->serviceId, cdmaMsg->isExist, cdmaMsg->type);
+    TELEPHONY_LOGD("CreateCdmaPdu2 = %{public}x, %{public}x, %{public}x", cdmaMsg->address.digitMode,
+        cdmaMsg->address.mode, cdmaMsg->address.type);
+    TELEPHONY_LOGD("CreateCdmaPdu3 = %{public}x, %{public}x, %{public}s", cdmaMsg->address.plan,
+        cdmaMsg->address.number, cdmaMsg->address.bytes);
     reportInfo = CreateReportInfo(requestInfo, HRIL_ERR_SUCCESS, HRIL_RESPONSE, 0);
     OnSmsReport(GetSlotId(requestInfo), reportInfo, NULL, 0);
-    FreeResponseInfo(responseInfo);
 }
 
 void ReqDelCdmaSimMessage(const ReqDataInfo *requestInfo, const int32_t *data, size_t dataLen)
@@ -724,7 +715,14 @@ void ReqDelCdmaSimMessage(const ReqDataInfo *requestInfo, const int32_t *data, s
         FreeResponseInfo(responseInfo);
         return;
     }
-    index = ((int32_t *)data)[0];
+    index = ((int32_t *)data)[0] - 1;
+    if (index < 0) {
+        TELEPHONY_LOGE("invalid index:%d", index);
+        struct ReportInfo reportInfo = CreateReportInfo(requestInfo, HRIL_ERR_GENERIC_FAILURE, HRIL_RESPONSE, 0);
+        OnSmsReport(GetSlotId(requestInfo), reportInfo, NULL, 0);
+        FreeResponseInfo(responseInfo);
+        return;
+    }
     err = GenerateCommand(cmd, MAX_CMD_LENGTH, "AT+CMGD=%d", index);
     if (err < 0) {
         TELEPHONY_LOGE("GenerateCommand failed, err = %{public}d\n", err);

test/fuzztest/BUILD.gn

@@ -23,4 +23,5 @@ group("fuzztest") {
   deps += [ "callemergencynotice_fuzzer:fuzztest" ]
   deps += [ "pdpcontextlistupdated_fuzzer:fuzztest" ]
   deps += [ "simstkproactivenotify_fuzzer:fuzztest" ]
+  deps += [ "createcdmasms_fuzzer:fuzztest" ]
 }

test/fuzztest/createcdmasms_fuzzer/BUILD.gn

@@ -0,0 +1,67 @@
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+SUBSYSTEM_DIR = "../../../.."
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("CreateCdmaSmsFuzzTest") {
+  module_output_path = "ril_adapter/ril_adapter"
+  module_out_path = module_output_path
+  fuzz_config_file =
+      "$SUBSYSTEM_DIR/ril_adapter/test/fuzztest/createcdmasms_fuzzer"
+  include_dirs = [ "$SUBSYSTEM_DIR/ril_adapter/services/hril/include" ]
+
+  configs = [ "$SUBSYSTEM_DIR/ril_adapter/utils:utils_config" ]
+
+  deps = [
+    "$SUBSYSTEM_DIR/ril_adapter/interfaces/innerkits:hril_innerkits",
+    "$SUBSYSTEM_DIR/ril_adapter/services/hril:hril",
+  ]
+
+  external_deps = [
+    "drivers_interface_power:libpower_proxy_1.1",
+    "drivers_interface_ril:ril_idl_headers",
+    "hdf_core:libhdf_host",
+    "hdf_core:libhdf_ipc_adapter",
+    "hdf_core:libpub_utils",
+    "hilog:libhilog",
+    "ipc:ipc_single",
+    "samgr:samgr_proxy",
+  ]
+  defines = [
+    "TELEPHONY_LOG_TAG = \"RilAdapterFuzzTest\"",
+    "LOG_DOMAIN = 0xD000F00",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "createcdmasms_fuzzer.cpp" ]
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":CreateCdmaSmsFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/createcdmasms_fuzzer/corpus/init

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * corpus is necessary
+ */
+FUZZ

test/fuzztest/createcdmasms_fuzzer/createcdmasms_fuzzer.cpp

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "createcdmasms_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+
+#include "hril_manager.h"
+#include "hril_sms.h"
+#include "system_ability_definition.h"
+
+using namespace OHOS::Telephony;
+namespace OHOS {
+constexpr int32_t SLOT_NUM = 2;
+
+void DoSomethingInterestingWithMyAPI(const uint8_t *data, size_t size)
+{
+    if (data == nullptr || size == 0) {
+        return;
+    }
+    int32_t slotId = static_cast<int32_t>(size % SLOT_NUM);
+    OHOS::HDI::Ril::V1_1::SmsMessageIOInfo message;
+    std::string pdu(reinterpret_cast<const char *>(data), size);
+    message.pdu = pdu;
+    HRilManager hrilManager;
+    std::shared_ptr<HRilSms> hrilSms = std::make_shared<HRilSms>(slotId, hrilManager);
+    hrilSms->AddCdmaSimMessage(size, message);
+    return;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    OHOS::DoSomethingInterestingWithMyAPI(data, size);
+    return 0;
+}

test/fuzztest/createcdmasms_fuzzer/createcdmasms_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef CREATECDMASMS_FUZZER_H
+#define CREATECDMASMS_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "createcdmasms_fuzzer"
+
+#endif // CREATECDMASMS_FUZZER_H

test/fuzztest/createcdmasms_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2023 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>