1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_policy_server.h"
20 #include "message_parcel.h"
21 using namespace std;
22
23 namespace OHOS {
24 namespace AudioStandard {
25 constexpr int32_t OFFSET = 4;
26 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
27 const int32_t SYSTEM_ABILITY_ID = 3009;
28 const bool RUN_ON_CREATE = false;
29 const int32_t LIMITSIZE = 4;
30 const int32_t SHIFT_LEFT_8 = 8;
31 const int32_t SHIFT_LEFT_16 = 16;
32 const int32_t SHIFT_LEFT_24 = 24;
33 const uint32_t LIMIT_ONE = 0;
34 const uint32_t LIMIT_TWO = 30;
35 const uint32_t LIMIT_THREE = 60;
36 const uint32_t LIMIT_FOUR = 80;
37
Convert2Uint32(const uint8_t * ptr)38 uint32_t Convert2Uint32(const uint8_t *ptr)
39 {
40 if (ptr == nullptr) {
41 return 0;
42 }
43 /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits,
44 the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */
45 return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]);
46 }
47
AudioPolicyFuzzFirstLimitTest(const uint8_t * rawData,size_t size)48 void AudioPolicyFuzzFirstLimitTest(const uint8_t *rawData, size_t size)
49 {
50 if (rawData == nullptr || size < LIMITSIZE) {
51 return;
52 }
53 uint32_t code = Convert2Uint32(rawData) % (LIMIT_TWO - LIMIT_ONE + 1) + LIMIT_ONE;
54
55 rawData = rawData + OFFSET;
56 size = size - OFFSET;
57
58 MessageParcel data;
59 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
60 data.WriteBuffer(rawData, size);
61 data.RewindRead(0);
62
63 MessageParcel reply;
64 MessageOption option;
65 std::shared_ptr<AudioPolicyServer> AudioPolicyServerPtr =
66 std::make_shared<AudioPolicyServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
67
68 AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option);
69 }
70
AudioPolicyFuzzSecondLimitTest(const uint8_t * rawData,size_t size)71 void AudioPolicyFuzzSecondLimitTest(const uint8_t *rawData, size_t size)
72 {
73 if (rawData == nullptr || size < LIMITSIZE) {
74 return;
75 }
76 uint32_t code = Convert2Uint32(rawData) % (LIMIT_THREE - LIMIT_TWO + 1) + LIMIT_TWO;
77
78 rawData = rawData + OFFSET;
79 size = size - OFFSET;
80
81 MessageParcel data;
82 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
83 data.WriteBuffer(rawData, size);
84 data.RewindRead(0);
85
86 MessageParcel reply;
87 MessageOption option;
88 std::shared_ptr<AudioPolicyServer> AudioPolicyServerPtr =
89 std::make_shared<AudioPolicyServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
90
91 AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option);
92 }
93
AudioPolicyFuzzThirdLimitTest(const uint8_t * rawData,size_t size)94 void AudioPolicyFuzzThirdLimitTest(const uint8_t *rawData, size_t size)
95 {
96 if (rawData == nullptr || size < LIMITSIZE) {
97 return;
98 }
99 uint32_t code = Convert2Uint32(rawData) % (LIMIT_FOUR - LIMIT_THREE + 1) + LIMIT_THREE;
100
101 rawData = rawData + OFFSET;
102 size = size - OFFSET;
103
104 MessageParcel data;
105 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
106 data.WriteBuffer(rawData, size);
107 data.RewindRead(0);
108
109 MessageParcel reply;
110 MessageOption option;
111 std::shared_ptr<AudioPolicyServer> AudioPolicyServerPtr =
112 std::make_shared<AudioPolicyServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
113
114 AudioPolicyServerPtr->OnRemoteRequest(code, data, reply, option);
115 }
116 } // namespace AudioStandard
117 } // namesapce OHOS
118
119 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)120 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
121 {
122 /* Run your code on data */
123 OHOS::AudioStandard::AudioPolicyFuzzFirstLimitTest(data, size);
124 OHOS::AudioStandard::AudioPolicyFuzzSecondLimitTest(data, size);
125 OHOS::AudioStandard::AudioPolicyFuzzThirdLimitTest(data, size);
126 return 0;
127 }
128