1 /*
2 * Copyright (c) 2022-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_info.h"
20 #include "audio_policy_server.h"
21 #include "audio_manager_listener_stub.h"
22 #include "message_parcel.h"
23 #include "audio_policy_client.h"
24
25 using namespace std;
26
27 namespace OHOS {
28 namespace AudioStandard {
29 bool g_hasServerInit = false;
30 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
31 const int32_t SYSTEM_ABILITY_ID = 3009;
32 const bool RUN_ON_CREATE = false;
33 const int32_t LIMITSIZE = 4;
34 const uint8_t TESTSIZE = 7;
35 typedef void (*TestPtr)(const uint8_t *, size_t);
36
GetServerPtr()37 AudioPolicyServer* GetServerPtr()
38 {
39 static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
40 if (!g_hasServerInit) {
41 server.OnStart();
42 server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
43 #ifdef FEATURE_MULTIMODALINPUT_INPUT
44 server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
45 #endif
46 server.OnAddSystemAbility(DISTRIBUTED_KV_DATA_SERVICE_ABILITY_ID, "");
47 server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
48 server.OnAddSystemAbility(ACCESSIBILITY_MANAGER_SERVICE_ID, "");
49 server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
50 server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
51 server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
52 g_hasServerInit = true;
53 }
54 return &server;
55 }
56
AudioVolumeFuzzTest(const uint8_t * rawData,size_t size)57 void AudioVolumeFuzzTest(const uint8_t *rawData, size_t size)
58 {
59 if (rawData == nullptr || size < LIMITSIZE) {
60 return;
61 }
62
63 AudioStreamType streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
64 int32_t volume = *reinterpret_cast<const int32_t *>(rawData);
65 int32_t streamId = *reinterpret_cast<const int32_t *>(rawData);
66 bool mute = *reinterpret_cast<const bool *>(rawData);
67 GetServerPtr()->SetSystemVolumeLevel(streamType, volume);
68 GetServerPtr()->GetSystemVolumeLevel(streamType);
69 GetServerPtr()->SetLowPowerVolume(streamId, volume);
70 GetServerPtr()->GetLowPowerVolume(streamId);
71 GetServerPtr()->GetSingleStreamVolume(streamId);
72 GetServerPtr()->SetStreamMute(streamType, mute);
73 GetServerPtr()->GetStreamMute(streamType);
74 GetServerPtr()->IsStreamActive(streamType);
75
76 ContentType contentType = *reinterpret_cast<const ContentType *>(rawData);
77 StreamUsage streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
78 int32_t rendererFlags = *reinterpret_cast<const int32_t *>(rawData);
79 std::string sceneType(reinterpret_cast<const char*>(rawData), size - 1);
80 bool spatializationEnabled = *reinterpret_cast<const bool *>(rawData);
81 bool headTrackingEnabled = *reinterpret_cast<const bool *>(rawData);
82 int32_t originalFlag = *reinterpret_cast<const int32_t *>(rawData);
83
84 AudioRendererInfo rendererInfo = {
85 contentType,
86 streamUsage,
87 rendererFlags,
88 sceneType,
89 spatializationEnabled,
90 headTrackingEnabled,
91 originalFlag
92 };
93 GetServerPtr()->GetPreferredOutputStreamType(rendererInfo);
94
95 SourceType sourceType = *reinterpret_cast<const SourceType *>(rawData);
96 int32_t capturerFlags = *reinterpret_cast<const int32_t *>(rawData);
97 AudioCapturerInfo capturerInfo = {
98 sourceType,
99 capturerFlags
100 };
101 GetServerPtr()->GetPreferredInputStreamType(capturerInfo);
102 }
103
AudioDeviceFuzzTest(const uint8_t * rawData,size_t size)104 void AudioDeviceFuzzTest(const uint8_t *rawData, size_t size)
105 {
106 if (rawData == nullptr || size < LIMITSIZE) {
107 return;
108 }
109
110 MessageParcel data;
111 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
112 data.WriteBuffer(rawData, size);
113 data.RewindRead(0);
114
115 InternalDeviceType deviceType = *reinterpret_cast<const InternalDeviceType *>(rawData);
116 bool active = *reinterpret_cast<const bool *>(rawData);
117 GetServerPtr()->SetDeviceActive(deviceType, active);
118 GetServerPtr()->IsDeviceActive(deviceType);
119
120 AudioRingerMode ringMode = *reinterpret_cast<const AudioRingerMode *>(rawData);
121 GetServerPtr()->SetRingerMode(ringMode);
122
123 #ifdef FEATURE_DTMF_TONE
124 int32_t ltonetype = *reinterpret_cast<const int32_t *>(rawData);
125 std::string countryCode(reinterpret_cast<const char*>(rawData), size - 1);
126 GetServerPtr()->GetToneConfig(ltonetype, countryCode);
127 #endif
128
129 AudioScene audioScene = *reinterpret_cast<const AudioScene *>(rawData);
130 GetServerPtr()->SetAudioScene(audioScene);
131
132 bool mute = *reinterpret_cast<const bool *>(rawData);
133 GetServerPtr()->SetMicrophoneMute(mute);
134 GetServerPtr()->SetMicrophoneMutePersistent(mute, PolicyType::PRIVACY_POLCIY_TYPE);
135 GetServerPtr()->GetPersistentMicMuteState();
136
137 const std::shared_ptr<AudioStandard::AudioDeviceDescriptor> deviceDescriptor =
138 std::make_shared<AudioStandard::AudioDeviceDescriptor>();
139 CastType type = *reinterpret_cast<const CastType *>(rawData);
140 sptr<IRemoteObject> object = data.ReadRemoteObject();
141 GetServerPtr()->ConfigDistributedRoutingRole(deviceDescriptor, type);
142 GetServerPtr()->SetDistributedRoutingRoleCallback(object);
143 GetServerPtr()->UnsetDistributedRoutingRoleCallback();
144 GetServerPtr()->SetAudioDeviceRefinerCallback(object);
145 GetServerPtr()->UnsetAudioDeviceRefinerCallback();
146 GetServerPtr()->TriggerFetchDevice();
147 }
148
AudioInterruptFuzzTest(const uint8_t * rawData,size_t size)149 void AudioInterruptFuzzTest(const uint8_t *rawData, size_t size)
150 {
151 if (rawData == nullptr || size < LIMITSIZE) {
152 return;
153 }
154
155 MessageParcel data;
156 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
157 data.WriteBuffer(rawData, size);
158 data.RewindRead(0);
159
160 sptr<IRemoteObject> object = data.ReadRemoteObject();
161 uint32_t sessionID = *reinterpret_cast<const uint32_t *>(rawData);
162 uint32_t clientUid = *reinterpret_cast<const uint32_t *>(rawData);
163 GetServerPtr()->SetAudioInterruptCallback(sessionID, object, clientUid);
164 GetServerPtr()->UnsetAudioInterruptCallback(sessionID);
165
166 int32_t clientId = *reinterpret_cast<const uint32_t *>(rawData);
167 GetServerPtr()->SetAudioManagerInterruptCallback(clientId, object);
168
169 AudioInterrupt audioInterrupt;
170 audioInterrupt.contentType = *reinterpret_cast<const ContentType *>(rawData);
171 audioInterrupt.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
172 audioInterrupt.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
173 GetServerPtr()->RequestAudioFocus(clientId, audioInterrupt);
174 GetServerPtr()->AbandonAudioFocus(clientId, audioInterrupt);
175
176 std::list<std::pair<AudioInterrupt, AudioFocuState>> focusInfoList = {};
177 std::pair<AudioInterrupt, AudioFocuState> focusInfo = {};
178 focusInfo.first.streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
179 focusInfo.first.contentType = *reinterpret_cast<const ContentType *>(rawData);
180 focusInfo.first.audioFocusType.streamType = *reinterpret_cast<const AudioStreamType *>(rawData);
181 focusInfo.first.audioFocusType.sourceType = *reinterpret_cast<const SourceType *>(rawData);
182 focusInfo.first.audioFocusType.isPlay = *reinterpret_cast<const bool *>(rawData);
183 focusInfo.first.sessionId = *reinterpret_cast<const int32_t *>(rawData);
184 focusInfo.first.pauseWhenDucked = *reinterpret_cast<const bool *>(rawData);
185 focusInfo.first.pid = *reinterpret_cast<const int32_t *>(rawData);
186 focusInfo.first.mode = *reinterpret_cast<const InterruptMode *>(rawData);
187 focusInfo.second = *reinterpret_cast<const AudioFocuState *>(rawData);
188 focusInfoList.push_back(focusInfo);
189 GetServerPtr()->GetAudioFocusInfoList(focusInfoList);
190 }
191
AudioPolicyFuzzTest(const uint8_t * rawData,size_t size)192 void AudioPolicyFuzzTest(const uint8_t *rawData, size_t size)
193 {
194 if (rawData == nullptr || size < LIMITSIZE) {
195 return;
196 }
197
198 MessageParcel data;
199 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
200 data.WriteBuffer(rawData, size);
201 data.RewindRead(0);
202
203 sptr<IRemoteObject> object = data.ReadRemoteObject();
204 GetServerPtr()->RegisterPolicyCallbackClient(object);
205
206 uint32_t sessionID = *reinterpret_cast<const uint32_t *>(rawData);
207 GetServerPtr()->OnAudioStreamRemoved(sessionID);
208
209 AudioPolicyServer::DeathRecipientId id =
210 *reinterpret_cast<const AudioPolicyServer::DeathRecipientId *>(rawData);
211 GetServerPtr()->RegisterClientDeathRecipient(object, id);
212 }
213
AudioPolicyOtherFuzzTest(const uint8_t * rawData,size_t size)214 void AudioPolicyOtherFuzzTest(const uint8_t *rawData, size_t size)
215 {
216 if (rawData == nullptr || size < LIMITSIZE) {
217 return;
218 }
219
220 int pid = *reinterpret_cast<const int *>(rawData);
221 GetServerPtr()->RegisteredTrackerClientDied(pid, 0);
222
223 int32_t clientUid = *reinterpret_cast<const int32_t *>(rawData);
224 StreamSetState streamSetState = *reinterpret_cast<const StreamSetState *>(rawData);
225 StreamUsage streamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
226 GetServerPtr()->UpdateStreamState(clientUid, streamSetState, streamUsage);
227
228 int32_t sessionId = *reinterpret_cast<const int32_t *>(rawData);
229 GetServerPtr()->GetAudioCapturerMicrophoneDescriptors(sessionId);
230
231 AudioPipeType type = *reinterpret_cast<const AudioPipeType *>(rawData);
232 GetServerPtr()->MoveToNewPipe(sessionId, type);
233
234 std::shared_ptr<AudioStandard::AudioDeviceDescriptor> deviceDescriptor =
235 std::make_shared<AudioStandard::AudioDeviceDescriptor>();
236 deviceDescriptor->deviceType_ = *reinterpret_cast<const DeviceType *>(rawData);
237 deviceDescriptor->deviceRole_ = *reinterpret_cast<const DeviceRole *>(rawData);
238 GetServerPtr()->GetHardwareOutputSamplingRate(deviceDescriptor);
239
240 GetServerPtr()->GetAvailableMicrophones();
241
242 std::string macAddress(reinterpret_cast<const char*>(rawData), size - 1);
243 bool support = *reinterpret_cast<const bool *>(rawData);
244 int32_t volume = *reinterpret_cast<const int32_t *>(rawData);
245 bool updateUi = *reinterpret_cast<const bool *>(rawData);
246 GetServerPtr()->SetDeviceAbsVolumeSupported(macAddress, support);
247 GetServerPtr()->SetA2dpDeviceVolume(macAddress, volume, updateUi);
248
249 GetServerPtr()->IsHighResolutionExist();
250 bool highResExist = *reinterpret_cast<const bool *>(rawData);
251 GetServerPtr()->SetHighResolutionExist(highResExist);
252
253 std::string networkId(reinterpret_cast<const char*>(rawData), size - 1);
254 InterruptEvent event = {};
255 event.eventType = *reinterpret_cast<const InterruptType *>(rawData);
256 event.forceType = *reinterpret_cast<const InterruptForceType *>(rawData);
257 event.hintType = *reinterpret_cast<const InterruptHint *>(rawData);
258 GetServerPtr()->InjectInterruption(networkId, event);
259 }
260
AudioSessionFuzzTest(const uint8_t * rawData,size_t size)261 void AudioSessionFuzzTest(const uint8_t *rawData, size_t size)
262 {
263 if (rawData == nullptr || size < LIMITSIZE) {
264 return;
265 }
266
267 AudioSessionStrategy sessionStrategy;
268 sessionStrategy.concurrencyMode = *reinterpret_cast<const AudioConcurrencyMode *>(rawData);
269 GetServerPtr()->ActivateAudioSession(sessionStrategy);
270 GetServerPtr()->IsAudioSessionActivated();
271 GetServerPtr()->DeactivateAudioSession();
272 }
273
AudioConcurrencyFuzzTest(const uint8_t * rawData,size_t size)274 void AudioConcurrencyFuzzTest(const uint8_t *rawData, size_t size)
275 {
276 if (rawData == nullptr || size < LIMITSIZE) {
277 return;
278 }
279
280 MessageParcel data;
281 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
282 data.WriteBuffer(rawData, size);
283 data.RewindRead(0);
284
285 sptr<IRemoteObject> object = data.ReadRemoteObject();
286 uint32_t sessionID = *reinterpret_cast<const uint32_t *>(rawData);
287 GetServerPtr()->SetAudioConcurrencyCallback(sessionID, object);
288 GetServerPtr()->UnsetAudioConcurrencyCallback(sessionID);
289 AudioPipeType pipeType = *reinterpret_cast<const AudioPipeType *>(rawData);
290 GetServerPtr()->ActivateAudioConcurrency(pipeType);
291 }
292
AudioVolumeKeyCallbackStub(const uint8_t * rawData,size_t size)293 void AudioVolumeKeyCallbackStub(const uint8_t *rawData, size_t size)
294 {
295 if (rawData == nullptr || size < LIMITSIZE) {
296 return;
297 }
298 sptr<AudioPolicyClientStub> listener =
299 static_cast<sptr<AudioPolicyClientStub>>(new(std::nothrow) AudioPolicyClientStubImpl());
300 VolumeEvent volumeEvent = {};
301 volumeEvent.volumeType = *reinterpret_cast<const AudioStreamType *>(rawData);
302 volumeEvent.volume = *reinterpret_cast<const int32_t *>(rawData);
303 volumeEvent.updateUi = *reinterpret_cast<const bool *>(rawData);
304 volumeEvent.volumeGroupId = *reinterpret_cast<const int32_t *>(rawData);
305 std::string id(reinterpret_cast<const char*>(rawData), size - 1);
306 volumeEvent.networkId = id;
307
308 MessageParcel data;
309 data.WriteInt32(static_cast<int32_t>(AudioPolicyClientCode::ON_VOLUME_KEY_EVENT));
310 data.WriteInt32(static_cast<int32_t>(volumeEvent.volumeType));
311 data.WriteInt32(volumeEvent.volume);
312 data.WriteBool(volumeEvent.updateUi);
313 data.WriteInt32(volumeEvent.volumeGroupId);
314 data.WriteString(volumeEvent.networkId);
315 MessageParcel reply;
316 MessageOption option;
317 listener->OnRemoteRequest(static_cast<uint32_t>(UPDATE_CALLBACK_CLIENT), data, reply, option);
318 }
319 } // namespace AudioStandard
320 } // namesapce OHOS
321
LLVMFuzzerInitialize(int * argc,char *** argv)322 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
323 {
324 OHOS::AudioStandard::GetServerPtr();
325 return 0;
326 }
327
328 OHOS::AudioStandard::TestPtr g_testPtrs[OHOS::AudioStandard::TESTSIZE] = {
329 OHOS::AudioStandard::AudioVolumeFuzzTest,
330 OHOS::AudioStandard::AudioDeviceFuzzTest,
331 OHOS::AudioStandard::AudioInterruptFuzzTest,
332 OHOS::AudioStandard::AudioPolicyFuzzTest,
333 OHOS::AudioStandard::AudioPolicyOtherFuzzTest,
334 OHOS::AudioStandard::AudioVolumeKeyCallbackStub,
335 OHOS::AudioStandard::AudioSessionFuzzTest
336 };
337
338 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)339 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
340 {
341 /* Run your code on data */
342 if (data == nullptr || size <= 1) {
343 return 0;
344 }
345 uint8_t firstByte = *data % OHOS::AudioStandard::TESTSIZE;
346 if (firstByte >= OHOS::AudioStandard::TESTSIZE) {
347 return 0;
348 }
349 data = data + 1;
350 size = size - 1;
351 g_testPtrs[firstByte](data, size);
352 return 0;
353 }