1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #undef private
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_interrupt_service.h"
23 using namespace std;
24
25 namespace OHOS {
26 namespace AudioStandard {
27 using namespace std;
28 const int32_t LIMITSIZE = 4;
29 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
30 const uint8_t TESTSIZE = 18;
31 typedef void (*TestPtr)(const uint8_t *, size_t);
32
InitFuzzTest(const uint8_t * rawData,size_t size)33 void InitFuzzTest(const uint8_t *rawData, size_t size)
34 {
35 if (rawData == nullptr || size < LIMITSIZE) {
36 return;
37 }
38 sptr<AudioPolicyServer> server = nullptr;
39 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
40
41 interruptService->Init(server);
42 }
43
AddDumpInfoFuzzTest(const uint8_t * rawData,size_t size)44 void AddDumpInfoFuzzTest(const uint8_t *rawData, size_t size)
45 {
46 if (rawData == nullptr || size < LIMITSIZE) {
47 return;
48 }
49
50 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
51 std::unordered_map<int32_t, std::shared_ptr<AudioInterruptZone>> audioInterruptZonesMapDump;
52
53 interruptService->AddDumpInfo(audioInterruptZonesMapDump);
54 }
55
SetCallbackHandlerFuzzTest(const uint8_t * rawData,size_t size)56 void SetCallbackHandlerFuzzTest(const uint8_t *rawData, size_t size)
57 {
58 if (rawData == nullptr || size < LIMITSIZE) {
59 return;
60 }
61
62 std::shared_ptr<AudioPolicyServerHandler> handler = DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
63 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
64
65 interruptService->SetCallbackHandler(handler);
66 }
67
SetAudioManagerInterruptCallbackFuzzTest(const uint8_t * rawData,size_t size)68 void SetAudioManagerInterruptCallbackFuzzTest(const uint8_t *rawData, size_t size)
69 {
70 if (rawData == nullptr || size < LIMITSIZE) {
71 return;
72 }
73
74 MessageParcel data;
75 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
76 data.WriteBuffer(rawData, size);
77 data.RewindRead(0);
78
79 sptr<IRemoteObject> object = data.ReadRemoteObject();
80 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
81
82 interruptService->SetAudioManagerInterruptCallback(object);
83 }
84
ActivateAudioInterruptFuzzTest(const uint8_t * rawData,size_t size)85 void ActivateAudioInterruptFuzzTest(const uint8_t *rawData, size_t size)
86 {
87 if (rawData == nullptr || size < LIMITSIZE) {
88 return;
89 }
90
91 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
92
93 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
94 AudioInterrupt audioInterrupt;
95 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
96 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
97 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
98
99 interruptService->ActivateAudioInterrupt(zoneId, audioInterrupt);
100 }
101
DeactivateAudioInterruptFuzzTest(const uint8_t * rawData,size_t size)102 void DeactivateAudioInterruptFuzzTest(const uint8_t *rawData, size_t size)
103 {
104 if (rawData == nullptr || size < LIMITSIZE) {
105 return;
106 }
107
108 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
109
110 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
111 AudioInterrupt audioInterrupt;
112 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
113 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
114 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
115
116 interruptService->DeactivateAudioInterrupt(zoneId, audioInterrupt);
117 }
118
CreateAudioInterruptZoneFuzzTest(const uint8_t * rawData,size_t size)119 void CreateAudioInterruptZoneFuzzTest(const uint8_t *rawData, size_t size)
120 {
121 if (rawData == nullptr || size < LIMITSIZE) {
122 return;
123 }
124
125 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
126
127 MessageParcel data;
128 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
129 data.WriteBuffer(rawData, size);
130 data.RewindRead(0);
131 std::set<int32_t> pids;
132 pids.insert(data.ReadInt32());
133 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
134
135 interruptService->CreateAudioInterruptZone(zoneId);
136 }
137
ReleaseAudioInterruptZoneFuzzTest(const uint8_t * rawData,size_t size)138 void ReleaseAudioInterruptZoneFuzzTest(const uint8_t *rawData, size_t size)
139 {
140 if (rawData == nullptr || size < LIMITSIZE) {
141 return;
142 }
143
144 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
145
146 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
147
148 auto getZoneFunc = [](int32_t uid, const std::string &deviceTag,
149 const std::string &streamTag)->int32_t {
150 return 0;
151 };
152 interruptService->ReleaseAudioInterruptZone(zoneId, getZoneFunc);
153 }
154
RemoveAudioInterruptZonePidsFuzzTest(const uint8_t * rawData,size_t size)155 void RemoveAudioInterruptZonePidsFuzzTest(const uint8_t *rawData, size_t size)
156 {
157 if (rawData == nullptr || size < LIMITSIZE) {
158 return;
159 }
160
161 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
162
163 MessageParcel data;
164 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
165 data.WriteBuffer(rawData, size);
166 data.RewindRead(0);
167 std::set<int32_t> pids;
168 pids.insert(data.ReadInt32());
169 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
170
171 auto getZoneFunc = [](int32_t uid, const std::string &deviceTag,
172 const std::string &streamTag)->int32_t {
173 return 0;
174 };
175 interruptService->MigrateAudioInterruptZone(zoneId, getZoneFunc);
176 }
177
GetStreamInFocusFuzzTest(const uint8_t * rawData,size_t size)178 void GetStreamInFocusFuzzTest(const uint8_t *rawData, size_t size)
179 {
180 if (rawData == nullptr || size < LIMITSIZE) {
181 return;
182 }
183
184 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
185
186 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
187
188 interruptService->GetStreamInFocus(zoneId);
189 }
190
GetSessionInfoInFocusFuzzTest(const uint8_t * rawData,size_t size)191 void GetSessionInfoInFocusFuzzTest(const uint8_t *rawData, size_t size)
192 {
193 if (rawData == nullptr || size < LIMITSIZE) {
194 return;
195 }
196
197 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
198
199 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
200 AudioInterrupt audioInterrupt;
201 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
202 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
203 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
204
205 interruptService->GetSessionInfoInFocus(audioInterrupt, zoneId);
206 }
207
DispatchInterruptEventWithStreamIdFuzzTest(const uint8_t * rawData,size_t size)208 void DispatchInterruptEventWithStreamIdFuzzTest(const uint8_t *rawData, size_t size)
209 {
210 if (rawData == nullptr || size < LIMITSIZE) {
211 return;
212 }
213
214 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
215
216 uint32_t sessionId = *reinterpret_cast<const uint32_t *>(rawData);
217 InterruptEventInternal interruptEvent = {};
218 interruptEvent.eventType = *reinterpret_cast<const InterruptType *>(rawData);
219 interruptEvent.forceType = *reinterpret_cast<const InterruptForceType *>(rawData);
220 interruptEvent.hintType = *reinterpret_cast<const InterruptHint *>(rawData);
221 interruptEvent.duckVolume = 0;
222
223 interruptService->DispatchInterruptEventWithStreamId(sessionId, interruptEvent);
224 }
225
RequestAudioFocusFuzzTest(const uint8_t * rawData,size_t size)226 void RequestAudioFocusFuzzTest(const uint8_t *rawData, size_t size)
227 {
228 if (rawData == nullptr || size < LIMITSIZE) {
229 return;
230 }
231
232 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
233
234 int32_t clientId = *reinterpret_cast<const int32_t *>(rawData);
235 AudioInterrupt audioInterrupt;
236 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
237 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
238 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
239
240 interruptService->RequestAudioFocus(clientId, audioInterrupt);
241 }
242
AbandonAudioFocusFuzzTest(const uint8_t * rawData,size_t size)243 void AbandonAudioFocusFuzzTest(const uint8_t *rawData, size_t size)
244 {
245 if (rawData == nullptr || size < LIMITSIZE) {
246 return;
247 }
248
249 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
250
251 int32_t clientId = *reinterpret_cast<const int32_t *>(rawData);
252 AudioInterrupt audioInterrupt;
253 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
254 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
255 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
256
257 interruptService->AbandonAudioFocus(clientId, audioInterrupt);
258 }
259
SetAudioInterruptCallbackFuzzTest(const uint8_t * rawData,size_t size)260 void SetAudioInterruptCallbackFuzzTest(const uint8_t *rawData, size_t size)
261 {
262 if (rawData == nullptr || size < LIMITSIZE) {
263 return;
264 }
265
266 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
267
268 MessageParcel data;
269 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
270 data.WriteBuffer(rawData, size);
271 data.RewindRead(0);
272 sptr<IRemoteObject> object = data.ReadRemoteObject();
273
274 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
275 uint32_t sessionId = *reinterpret_cast<const uint32_t *>(rawData);
276 uint32_t uid = *reinterpret_cast<const uint32_t *>(rawData);
277
278 interruptService->SetAudioInterruptCallback(zoneId, sessionId, object, uid);
279 }
280
UnsetAudioInterruptCallbackFuzzTest(const uint8_t * rawData,size_t size)281 void UnsetAudioInterruptCallbackFuzzTest(const uint8_t *rawData, size_t size)
282 {
283 if (rawData == nullptr || size < LIMITSIZE) {
284 return;
285 }
286
287 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
288
289 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
290 uint32_t sessionId = *reinterpret_cast<const uint32_t *>(rawData);
291
292 interruptService->UnsetAudioInterruptCallback(zoneId, sessionId);
293 }
294
AddAudioInterruptZonePidsFuzzTest(const uint8_t * rawData,size_t size)295 void AddAudioInterruptZonePidsFuzzTest(const uint8_t *rawData, size_t size)
296 {
297 if (rawData == nullptr || size < LIMITSIZE) {
298 return;
299 }
300
301 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
302
303 int32_t zoneId = *reinterpret_cast<const int32_t *>(rawData);
304 MessageParcel data;
305 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
306 data.WriteBuffer(rawData, size);
307 data.RewindRead(0);
308 std::set<int32_t> pids;
309 pids.insert(data.ReadInt32());
310
311 auto getZoneFunc = [](int32_t uid, const std::string &deviceTag,
312 const std::string &streamTag)->int32_t {
313 return 0;
314 };
315 interruptService->MigrateAudioInterruptZone(zoneId, getZoneFunc);
316 }
317
UpdateAudioSceneFromInterruptFuzzTest(const uint8_t * rawData,size_t size)318 void UpdateAudioSceneFromInterruptFuzzTest(const uint8_t *rawData, size_t size)
319 {
320 if (rawData == nullptr || size < LIMITSIZE) {
321 return;
322 }
323
324 MessageParcel data;
325 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
326 data.WriteBuffer(rawData, size);
327 data.RewindRead(0);
328 AudioScene audioScene = *reinterpret_cast<const AudioScene *>(rawData);
329 AudioInterruptChangeType changeType = *reinterpret_cast<const AudioInterruptChangeType *>(rawData);
330
331 std::shared_ptr<AudioInterruptService> interruptService = std::make_shared<AudioInterruptService>();
332
333 interruptService->UpdateAudioSceneFromInterrupt(audioScene, changeType);
334 }
335 } // namespace AudioStandard
336 } // namesapce OHOS
337
338 OHOS::AudioStandard::TestPtr g_testPtrs[OHOS::AudioStandard::TESTSIZE] = {
339 OHOS::AudioStandard::InitFuzzTest,
340 OHOS::AudioStandard::AddDumpInfoFuzzTest,
341 OHOS::AudioStandard::SetCallbackHandlerFuzzTest,
342 OHOS::AudioStandard::SetAudioManagerInterruptCallbackFuzzTest,
343 OHOS::AudioStandard::ActivateAudioInterruptFuzzTest,
344 OHOS::AudioStandard::DeactivateAudioInterruptFuzzTest,
345 OHOS::AudioStandard::CreateAudioInterruptZoneFuzzTest,
346 OHOS::AudioStandard::ReleaseAudioInterruptZoneFuzzTest,
347 OHOS::AudioStandard::RemoveAudioInterruptZonePidsFuzzTest,
348 OHOS::AudioStandard::GetStreamInFocusFuzzTest,
349 OHOS::AudioStandard::GetSessionInfoInFocusFuzzTest,
350 OHOS::AudioStandard::DispatchInterruptEventWithStreamIdFuzzTest,
351 OHOS::AudioStandard::RequestAudioFocusFuzzTest,
352 OHOS::AudioStandard::AbandonAudioFocusFuzzTest,
353 OHOS::AudioStandard::SetAudioInterruptCallbackFuzzTest,
354 OHOS::AudioStandard::UnsetAudioInterruptCallbackFuzzTest,
355 OHOS::AudioStandard::AddAudioInterruptZonePidsFuzzTest,
356 OHOS::AudioStandard::UpdateAudioSceneFromInterruptFuzzTest
357 };
358
359 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)360 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
361 {
362 /* Run your code on data */
363 if (data == nullptr || size <= 1) {
364 return 0;
365 }
366 uint8_t firstByte = *data % OHOS::AudioStandard::TESTSIZE;
367 if (firstByte >= OHOS::AudioStandard::TESTSIZE) {
368 return 0;
369 }
370 data = data + 1;
371 size = size - 1;
372 g_testPtrs[firstByte](data, size);
373 return 0;
374 }