1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_info.h"
20 #include "audio_interrupt_service.h"
21 #include "audio_policy_server.h"
22 #include "audio_session_info.h"
23 using namespace std;
24
25 namespace OHOS {
26 namespace AudioStandard {
27 using namespace std;
28 bool g_hasServerInit = false;
29 const int32_t SYSTEM_ABILITY_ID = 3009;
30 const bool RUN_ON_CREATE = false;
31 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
32 static const uint8_t *RAW_DATA = nullptr;
33 static size_t g_dataSize = 0;
34 static size_t g_pos;
35 const size_t THRESHOLD = 10;
36
37 /*
38 * describe: get data from outside untrusted data(RAW_DATA) which size is according to sizeof(T)
39 * tips: only support basic type
40 */
41 template<class T>
GetData()42 T GetData()
43 {
44 T object {};
45 size_t objectSize = sizeof(object);
46 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
47 return object;
48 }
49 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
50 if (ret != EOK) {
51 return {};
52 }
53 g_pos += objectSize;
54 return object;
55 }
56
57 template<class T>
GetArrLength(T & arr)58 uint32_t GetArrLength(T& arr)
59 {
60 if (arr == nullptr) {
61 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
62 return 0;
63 }
64 return sizeof(arr) / sizeof(arr[0]);
65 }
66
GetServerPtr()67 AudioPolicyServer* GetServerPtr()
68 {
69 static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
70 if (!g_hasServerInit) {
71 server.OnStart();
72 server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
73 #ifdef FEATURE_MULTIMODALINPUT_INPUT
74 server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
75 #endif
76 server.OnAddSystemAbility(DISTRIBUTED_KV_DATA_SERVICE_ABILITY_ID, "");
77 server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
78 server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
79 server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
80 server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
81 g_hasServerInit = true;
82 }
83 return &server;
84 }
85
MoreFuzzTest()86 void MoreFuzzTest()
87 {
88 GetServerPtr()->interruptService_->GetAudioServerProxy();
89 GetServerPtr()->interruptService_->WriteServiceStartupError();
90
91 int32_t pid = GetData<int32_t>();
92 GetServerPtr()->interruptService_->OnSessionTimeout(pid);
93 GetServerPtr()->interruptService_->HandleSessionTimeOutEvent(pid);
94 }
95
AddAudioSessionFuzzTest()96 void AddAudioSessionFuzzTest()
97 {
98 AudioSessionStrategy sessionStrategy;
99 sessionStrategy.concurrencyMode = AudioConcurrencyMode::MIX_WITH_OTHERS;
100 GetServerPtr()->ActivateAudioSession(sessionStrategy);
101
102 AudioInterrupt incomingInterrupt;
103 incomingInterrupt.audioFocusType.streamType = STREAM_MUSIC;
104 incomingInterrupt.audioFocusType.sourceType = SOURCE_TYPE_VOICE_COMMUNICATION;
105 AudioInterrupt activeInterrupt;
106 activeInterrupt.audioFocusType.streamType = STREAM_MUSIC;
107 AudioFocusEntry focusEntry;
108 focusEntry.isReject = false;
109
110 GetServerPtr()->interruptService_->CanMixForSession(incomingInterrupt, activeInterrupt, focusEntry);
111 GetServerPtr()->interruptService_->CanMixForIncomingSession(incomingInterrupt, activeInterrupt, focusEntry);
112 GetServerPtr()->interruptService_->CanMixForActiveSession(incomingInterrupt, activeInterrupt, focusEntry);
113 GetServerPtr()->interruptService_->IsIncomingStreamLowPriority(focusEntry);
114 GetServerPtr()->interruptService_->IsActiveStreamLowPriority(focusEntry);
115 }
116
AddSetAudioManagerInterruptCallbackFuzzTest()117 void AddSetAudioManagerInterruptCallbackFuzzTest()
118 {
119 MessageParcel data;
120 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
121 data.WriteBuffer(RAW_DATA, g_dataSize);
122 data.RewindRead(0);
123 sptr<IRemoteObject> object = data.ReadRemoteObject();
124 GetServerPtr()->interruptService_->GetAudioServerProxy();
125 if (object == nullptr) {
126 return;
127 }
128 GetServerPtr()->interruptService_->SetAudioManagerInterruptCallback(object);
129
130 int32_t zoneId = GetData<int32_t>();
131 uint32_t sessionId = GetData<uint32_t>();
132 uint32_t uid = GetData<uint32_t>();
133 GetServerPtr()->interruptService_->SetAudioInterruptCallback(zoneId, sessionId, object, uid);
134 }
135
ResetNonInterruptControlFuzzTest()136 void ResetNonInterruptControlFuzzTest() //build.gn 未添加宏定义defines
137 {
138 uint32_t sessionId = GetData<uint32_t>();
139 GetServerPtr()->interruptService_->GetClientTypeByStreamId(sessionId);
140 GetServerPtr()->interruptService_->ResetNonInterruptControl(sessionId);
141 }
142
ClearAudioFocusInfoListOnAccountsChangedFuzzTest()143 void ClearAudioFocusInfoListOnAccountsChangedFuzzTest()
144 {
145 int id = GetData<int>();
146 GetServerPtr()->interruptService_->ClearAudioFocusInfoListOnAccountsChanged(id);
147 }
148
149 typedef void (*TestFuncs[5])();
150
151 TestFuncs g_testFuncs = {
152 MoreFuzzTest,
153 AddAudioSessionFuzzTest,
154 AddSetAudioManagerInterruptCallbackFuzzTest,
155 ResetNonInterruptControlFuzzTest,
156 ClearAudioFocusInfoListOnAccountsChangedFuzzTest,
157 };
158
FuzzTest(const uint8_t * rawData,size_t size)159 bool FuzzTest(const uint8_t* rawData, size_t size)
160 {
161 if (rawData == nullptr) {
162 return false;
163 }
164
165 // initialize data
166 RAW_DATA = rawData;
167 g_dataSize = size;
168 g_pos = 0;
169
170 uint32_t code = GetData<uint32_t>();
171 uint32_t len = GetArrLength(g_testFuncs);
172 if (len > 0) {
173 g_testFuncs[code % len]();
174 } else {
175 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
176 }
177
178 return true;
179 }
180 } // namespace AudioStandard
181 } // namesapce OHOS
182
183 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)184 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
185 {
186 if (size < OHOS::AudioStandard::THRESHOLD) {
187 return 0;
188 }
189
190 OHOS::AudioStandard::FuzzTest(data, size);
191 return 0;
192 }