1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "audiocapturereqmmapbuffercapture_fuzzer.h"
17 #include "audio_hdi_fuzzer_common.h"
18
19 using namespace OHOS::Audio;
20 namespace OHOS {
21 namespace Audio {
AudioCaptureReqmmapbufferCaptureFuzzTest(const uint8_t * data,size_t size)22 bool AudioCaptureReqmmapbufferCaptureFuzzTest(const uint8_t *data, size_t size)
23 {
24 bool result = false;
25 TestAudioManager *mmapBufferFuzzManager = nullptr;
26 struct AudioAdapter *mmapBufferFuzzAdapter = nullptr;
27 struct AudioCapture *mmapBufferFuzzCapture = nullptr;
28 int32_t ret = AudioGetManagerCreateCapture(mmapBufferFuzzManager,
29 &mmapBufferFuzzAdapter, &mmapBufferFuzzCapture);
30 if (ret < 0 || mmapBufferFuzzAdapter == nullptr ||
31 mmapBufferFuzzCapture == nullptr || mmapBufferFuzzManager == nullptr) {
32 HDF_LOGE("%{public}s: AudioGetManagerCreateCapture failed \n", __func__);
33 return false;
34 }
35 FILE *fp = fopen(AUDIO_LOW_LATENCY_CAPTURE_FILE.c_str(), "wb+");
36 if (fp == nullptr) {
37 mmapBufferFuzzAdapter->DestroyCapture(mmapBufferFuzzAdapter, mmapBufferFuzzCapture);
38 mmapBufferFuzzManager->UnloadAdapter(mmapBufferFuzzManager, mmapBufferFuzzAdapter);
39 HDF_LOGE("%{public}s: fopen failed \n", __func__);
40 return false;
41 }
42 ret = mmapBufferFuzzCapture->control.Start((AudioHandle)mmapBufferFuzzCapture);
43 if (ret < 0) {
44 mmapBufferFuzzAdapter->DestroyCapture(mmapBufferFuzzAdapter, mmapBufferFuzzCapture);
45 mmapBufferFuzzManager->UnloadAdapter(mmapBufferFuzzManager, mmapBufferFuzzAdapter);
46 fclose(fp);
47 HDF_LOGE("%{public}s: Start failed \n", __func__);
48 return false;
49 }
50 bool isRender = true;
51 int32_t reqSize = 0;
52 struct AudioMmapBufferDescripter desc = {};
53 ret = InitMmapDesc(fp, desc, reqSize, isRender);
54 if (ret < 0) {
55 mmapBufferFuzzAdapter->DestroyCapture(mmapBufferFuzzAdapter, mmapBufferFuzzCapture);
56 mmapBufferFuzzManager->UnloadAdapter(mmapBufferFuzzManager, mmapBufferFuzzAdapter);
57 (void)fclose(fp);
58 HDF_LOGE("%{public}s: InitMmapDesc failed \n", __func__);
59 return false;
60 }
61
62 struct AudioCapture *captureFuzz = reinterpret_cast<struct AudioCapture *>(const_cast<uint8_t *>(data));
63 ret = mmapBufferFuzzCapture->attr.ReqMmapBuffer((AudioHandle)captureFuzz, reqSize, &desc);
64 if (ret == HDF_SUCCESS) {
65 (void)munmap(desc.memoryAddress, reqSize);
66 result = true;
67 }
68 mmapBufferFuzzAdapter->DestroyCapture(mmapBufferFuzzAdapter, mmapBufferFuzzCapture);
69 mmapBufferFuzzManager->UnloadAdapter(mmapBufferFuzzManager, mmapBufferFuzzAdapter);
70 (void)fclose(fp);
71 return result;
72 }
73 }
74 }
75
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)76 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
77 {
78 OHOS::Audio::AudioCaptureReqmmapbufferCaptureFuzzTest(data, size);
79 return 0;
80 }