1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19
20 #include "i_audio_renderer_sink.h"
21 #include "audio_manager_base.h"
22 #include "audio_policy_manager_listener_stub.h"
23 #include "audio_server.h"
24 #include "message_parcel.h"
25 using namespace std;
26
27 namespace OHOS {
28 namespace AudioStandard {
29 constexpr int32_t OFFSET = 4;
30 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStandardAudioService";
31 const int32_t SYSTEM_ABILITY_ID = 3001;
32 const bool RUN_ON_CREATE = false;
33 const int32_t LIMITSIZE = 4;
34 const int32_t SHIFT_LEFT_8 = 8;
35 const int32_t SHIFT_LEFT_16 = 16;
36 const int32_t SHIFT_LEFT_24 = 24;
37 const uint32_t LIMIT_MIN = 0;
38 const uint32_t LIMIT_MAX = 30;
39
Convert2Uint32(const uint8_t * ptr)40 uint32_t Convert2Uint32(const uint8_t *ptr)
41 {
42 if (ptr == nullptr) {
43 return 0;
44 }
45 /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits,
46 the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */
47 return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]);
48 }
49
AudioServerFuzzTest(const uint8_t * rawData,size_t size)50 void AudioServerFuzzTest(const uint8_t *rawData, size_t size)
51 {
52 if (rawData == nullptr || size < LIMITSIZE) {
53 return;
54 }
55 uint32_t code = Convert2Uint32(rawData) % (LIMIT_MAX - LIMIT_MIN + 1) + LIMIT_MIN;
56 rawData = rawData + OFFSET;
57 size = size - OFFSET;
58
59 MessageParcel data;
60 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
61 data.WriteBuffer(rawData, size);
62 data.RewindRead(0);
63 MessageParcel reply;
64 MessageOption option;
65
66 std::shared_ptr<AudioServer> AudioServerPtr =
67 std::make_shared<AudioServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
68
69 if (code == static_cast<uint32_t>(AudioServerInterfaceCode::SET_PARAMETER_CALLBACK)) {
70 sptr<AudioPolicyManagerListenerStub> focusListenerStub = new(std::nothrow) AudioPolicyManagerListenerStub();
71 sptr<IRemoteObject> object = focusListenerStub->AsObject();
72 AudioServerPtr->SetParameterCallback(object);
73 return;
74 }
75 AudioServerPtr->OnRemoteRequest(code, data, reply, option);
76
77 if (size < LIMITSIZE) {
78 return;
79 }
80 std::string netWorkId(reinterpret_cast<const char*>(rawData), size - 1);
81 AudioParamKey key = *reinterpret_cast<const AudioParamKey *>(rawData);
82 std::string condition(reinterpret_cast<const char*>(rawData), size - 1);
83 std::string value(reinterpret_cast<const char*>(rawData), size - 1);
84 AudioServerPtr->OnAudioParameterChange(netWorkId, key, condition, value);
85 }
86
AudioServerCaptureSilentlyFuzzTest(const uint8_t * rawData,size_t size)87 void AudioServerCaptureSilentlyFuzzTest(const uint8_t *rawData, size_t size)
88 {
89 if (rawData == nullptr || size < LIMITSIZE) {
90 return;
91 }
92
93 MessageParcel data;
94 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
95 data.WriteBuffer(rawData, size);
96 data.RewindRead(0);
97 MessageParcel reply;
98 MessageOption option;
99
100 std::shared_ptr<AudioServer> AudioServerPtr = std::make_shared<AudioServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
101 AudioServerPtr->OnRemoteRequest(static_cast<uint32_t>(AudioServerInterfaceCode::SET_CAPTURE_SILENT_STATE),
102 data, reply, option);
103 }
104
105 } // namespace AudioStandard
106 } // namesapce OHOS
107
108 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)109 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
110 {
111 /* Run your code on data */
112 OHOS::AudioStandard::AudioServerFuzzTest(data, size);
113 OHOS::AudioStandard::AudioServerCaptureSilentlyFuzzTest(data, size);
114 return 0;
115 }