1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <iostream>
19 #include <memory>
20
21 #include "avsession_item.h"
22 #include "iav_session.h"
23 #include "iremote_stub.h"
24 #include "avsession_stub.h"
25 #include "avsession_callback_proxy.h"
26 #include "avsession_controller_stub.h"
27 #include "avsession_service.h"
28 #include "avsession_errors.h"
29 #include "system_ability_definition.h"
30 #include "avcontrol_command.h"
31 #include "avsessionitem_fuzzer.h"
32
33 using namespace std;
34 using namespace OHOS;
35 using namespace OHOS::AVSession;
36
37 const int32_t MAX_CODE_TEST = 14;
38 const int32_t MAX_CODE_LEN = 512;
39 const int32_t MIN_SIZE_NUM = 4;
40
AvSessionItemFuzzerTest(uint8_t * data,size_t size)41 void AvSessionItemFuzzer::AvSessionItemFuzzerTest(uint8_t* data, size_t size)
42 {
43 if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
44 return;
45 }
46 uint32_t code = *(reinterpret_cast<const uint32_t*>(data));
47 if (code >= MAX_CODE_TEST) {
48 return;
49 }
50 std::string tag(reinterpret_cast<const char*>(data), size);
51 int32_t type = *reinterpret_cast<const int32_t*>(data);
52 std::string bundleName(reinterpret_cast<const char*>(data), size);
53 std::string abilityName(reinterpret_cast<const char*>(data), size);
54
55 OHOS::AppExecFwk::ElementName elementName;
56 elementName.SetBundleName(bundleName);
57 elementName.SetAbilityName(abilityName);
58
59 sptr<AVSessionService> service = new AVSessionService(AVSESSION_SERVICE_ID);
60 if (!service) {
61 SLOGI("service is null");
62 return;
63 }
64 sptr<IRemoteObject> avSessionItemObj = service->CreateSessionInner(tag, type, elementName);
65 sptr<AVSessionItem> avSessionItem = (sptr<AVSessionItem>&)avSessionItemObj;
66 if (!avSessionItem) {
67 SLOGI("avSessionItem is null");
68 return;
69 }
70 MessageParcel dataMessageParcel;
71 MessageParcel reply;
72 MessageOption option;
73 if (!dataMessageParcel.WriteInterfaceToken(IAVSession::GetDescriptor())) {
74 return;
75 }
76 size -= sizeof(uint32_t);
77 dataMessageParcel.WriteBuffer(data + sizeof(uint32_t), size);
78 dataMessageParcel.RewindRead(0);
79 avSessionItem->OnRemoteRequest(code, dataMessageParcel, reply, option);
80 }
81
AvSessionItemTest(uint8_t * data,size_t size)82 void OHOS::AVSession::AvSessionItemTest(uint8_t *data, size_t size)
83 {
84 if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
85 return;
86 }
87
88 AVPlaybackState avState;
89 int32_t state = *(reinterpret_cast<const int32_t *>(data));
90 avState.SetState(state);
91
92 AVMetaData metaData;
93 std::string assetId(reinterpret_cast<const char *>(data), size);
94 metaData.SetAssetId(assetId);
95
96 std::vector<int32_t> cmds;
97 int32_t _cmds = *(reinterpret_cast<const int32_t *>(data));
98 cmds.push_back(_cmds);
99
100 bool top = *(reinterpret_cast<const bool *>(data));
101
102 AVControlCommand controlCommand;
103 int32_t cmd = *(reinterpret_cast<const int32_t *>(data));
104 if ((cmd < AVControlCommand::SESSION_CMD_INVALID) || (cmd > AVControlCommand::SESSION_CMD_MAX)) {
105 return;
106 }
107 controlCommand.SetCommand(cmd);
108
109 OutputDeviceInfo info;
110 info.isRemote_ = true;
111 std::string deviceIds(reinterpret_cast<const char *>(data), size);
112 info.deviceIds_.push_back(deviceIds);
113 std::string deviceNames(reinterpret_cast<const char *>(data), size);
114 info.deviceNames_.push_back(deviceNames);
115
116 AVSessionDescriptor descriptor;
117 AVSessionItem avSessionItem(descriptor);
118
119 avSessionItem.GetSessionId();
120 avSessionItem.GetAVMetaData(metaData);
121 avSessionItem.SetAVMetaData(metaData);
122 avSessionItem.GetAVPlaybackState(avState);
123 avSessionItem.Activate();
124 avSessionItem.Deactivate();
125 avSessionItem.IsActive();
126 avSessionItem.Destroy();
127 avSessionItem.AddSupportCommand(cmd);
128 avSessionItem.DeleteSupportCommand(cmd);
129 avSessionItem.SetAVPlaybackState(avState);
130 avSessionItem.GetPlaybackState();
131 avSessionItem.GetMetaData();
132 avSessionItem.GetSupportCommand();
133 avSessionItem.ExecuteControllerCommand(controlCommand);
134 avSessionItem.GetPid();
135 avSessionItem.GetUid();
136 avSessionItem.GetAbilityName();
137 avSessionItem.SetTop(top);
138 avSessionItem.SetOutputDevice(info);
139 avSessionItem.GetOutputDevice(info);
140 avSessionItem.GetRemoteSource();
141 }
142
AvSessionItemOnRemoteRequest(uint8_t * data,size_t size)143 void OHOS::AVSession::AvSessionItemOnRemoteRequest(uint8_t *data, size_t size)
144 {
145 auto avSessionItem = std::make_unique<AvSessionItemFuzzer>();
146 if (avSessionItem == nullptr) {
147 SLOGI("avSessionItem is null");
148 return;
149 }
150 avSessionItem->AvSessionItemFuzzerTest(data, size);
151 }
152
153 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)154 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
155 {
156 /* Run your code on data */
157 OHOS::AVSession::AvSessionItemOnRemoteRequest(const_cast<uint8_t*>(data), size);
158 OHOS::AVSession::AvSessionItemTest(const_cast<uint8_t*>(data), size);
159 return 0;
160 }