1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_info.h"
20 #include "audio_policy_server.h"
21 #include "audio_policy_server_handler.h"
22 #include "audio_device_info.h"
23 using namespace std;
24
25 namespace OHOS {
26 namespace AudioStandard {
27 using namespace std;
28 const uint64_t CAPSESSION_ID = 123456;
29 static const uint8_t *RAW_DATA = nullptr;
30 static size_t g_dataSize = 0;
31 static size_t g_pos;
32 const size_t THRESHOLD = 10;
33
34 /*
35 * describe: get data from outside untrusted data(RAW_DATA) which size is according to sizeof(T)
36 * tips: only support basic type
37 */
38 template<class T>
GetData()39 T GetData()
40 {
41 T object {};
42 size_t objectSize = sizeof(object);
43 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
44 return object;
45 }
46 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
47 if (ret != EOK) {
48 return {};
49 }
50 g_pos += objectSize;
51 return object;
52 }
53
54 template<class T>
GetArrLength(T & arr)55 uint32_t GetArrLength(T& arr)
56 {
57 if (arr == nullptr) {
58 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
59 return 0;
60 }
61 return sizeof(arr) / sizeof(arr[0]);
62 }
63
AudioEffectServiceFuzzTest()64 void AudioEffectServiceFuzzTest()
65 {
66 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
67 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
68 std::shared_ptr<IAudioInterruptEventDispatcher> dispatcher = nullptr;
69 audioPolicyServerHandler->Init(dispatcher);
70
71 int32_t clientPid = GetData<int32_t>();
72 sptr<IAudioPolicyClient> cb = nullptr;
73 audioPolicyServerHandler->AddAudioPolicyClientProxyMap(clientPid, cb);
74
75 pid_t removeClientPid = GetData<pid_t>();
76 audioPolicyServerHandler->RemoveAudioPolicyClientProxyMap(removeClientPid);
77
78 int32_t clientId = GetData<int32_t>();
79 std::shared_ptr<AudioInterruptCallback> audioInterruptCallback = nullptr;
80 audioPolicyServerHandler->AddExternInterruptCbsMap(clientId, audioInterruptCallback);
81 audioPolicyServerHandler->RemoveExternInterruptCbsMap(clientId);
82
83 AudioDeviceUsage usage = GetData<AudioDeviceUsage>();
84 sptr<IStandardAudioPolicyManagerListener> audioPolicyManagerListener = nullptr;
85 audioPolicyServerHandler->AddAvailableDeviceChangeMap(clientId, usage, audioPolicyManagerListener);
86 audioPolicyServerHandler->RemoveAvailableDeviceChangeMap(clientId, usage);
87
88 sptr<IStandardAudioRoutingManagerListener> audioRoutingManagerListener = nullptr;
89 audioPolicyServerHandler->AddDistributedRoutingRoleChangeCbsMap(clientId, audioRoutingManagerListener);
90 audioPolicyServerHandler->RemoveDistributedRoutingRoleChangeCbsMap(clientId);
91 }
92
AudioSendCallbackFuzzTest()93 void AudioSendCallbackFuzzTest()
94 {
95 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
96 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
97 std::vector<std::shared_ptr<AudioDeviceDescriptor>> desc;
98 audioPolicyServerHandler->SendDeviceChangedCallback(desc, true);
99 audioPolicyServerHandler->SendDeviceChangedCallback(desc, false);
100
101 DeviceBlockStatus status = GetData<DeviceBlockStatus>();
102 audioPolicyServerHandler->SendMicrophoneBlockedCallback(desc, status);
103
104 audioPolicyServerHandler->SendAvailableDeviceChange(desc, true);
105 audioPolicyServerHandler->SendAvailableDeviceChange(desc, false);
106
107 VolumeEvent volumeEvent;
108 audioPolicyServerHandler->SendVolumeKeyEventCallback(volumeEvent);
109
110 std::pair<int32_t, AudioSessionDeactiveEvent> sessionDeactivePair;
111 audioPolicyServerHandler->SendAudioSessionDeactiveCallback(sessionDeactivePair);
112
113 int32_t callbackCategory = GetData<int32_t>();
114 AudioInterrupt audioInterrupt;
115 std::list<std::pair<AudioInterrupt, AudioFocuState>> focusInfoList;
116 audioPolicyServerHandler->SendAudioFocusInfoChangeCallback(callbackCategory, audioInterrupt, focusInfoList);
117
118 AudioRingerMode ringMode = GetData<AudioRingerMode>();
119 audioPolicyServerHandler->SendRingerModeUpdatedCallback(ringMode);
120
121 MicStateChangeEvent micStateChangeEvent;
122 int32_t clientId = GetData<int32_t>();
123 audioPolicyServerHandler->SendMicStateUpdatedCallback(micStateChangeEvent);
124 audioPolicyServerHandler->SendMicStateWithClientIdCallback(micStateChangeEvent, clientId);
125
126 InterruptEventInternal interruptEvent;
127 uint32_t sessionId = GetData<uint32_t>();
128 audioPolicyServerHandler->SendInterruptEventInternalCallback(interruptEvent);
129 audioPolicyServerHandler->SendInterruptEventWithSessionIdCallback(interruptEvent, sessionId);
130 audioPolicyServerHandler->SendInterruptEventWithClientIdCallback(interruptEvent, clientId);
131 }
132
AudioPolicyServSendFuzzTest()133 void AudioPolicyServSendFuzzTest()
134 {
135 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
136 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
137
138 audioPolicyServerHandler->SendPreferredOutputDeviceUpdated();
139 audioPolicyServerHandler->SendPreferredInputDeviceUpdated();
140
141 std::shared_ptr<AudioDeviceDescriptor> descriptor;
142 CastType type = GetData<CastType>();
143 audioPolicyServerHandler->SendDistributedRoutingRoleChange(descriptor, type);
144
145 std::vector<std::shared_ptr<AudioRendererChangeInfo>> audioRendererChangeInfos;
146 audioPolicyServerHandler->SendRendererInfoEvent(audioRendererChangeInfos);
147
148 std::vector<std::shared_ptr<AudioCapturerChangeInfo>> audioCapturerChangeInfos;
149 audioPolicyServerHandler->SendCapturerInfoEvent(audioCapturerChangeInfos);
150
151 int32_t clientPid = GetData<int32_t>();
152 uint32_t sessionId = GetData<uint32_t>();
153 int32_t streamFlag = GetData<int32_t>();
154 AudioDeviceDescriptor outputDeviceInfo(AudioDeviceDescriptor::DEVICE_INFO);
155 AudioStreamDeviceChangeReasonExt reason = AudioStreamDeviceChangeReasonExt::ExtEnum::UNKNOWN;
156 audioPolicyServerHandler->SendRendererDeviceChangeEvent(clientPid, sessionId, outputDeviceInfo, reason);
157 audioPolicyServerHandler->SendRecreateRendererStreamEvent(clientPid, sessionId, streamFlag, reason);
158 audioPolicyServerHandler->SendRecreateCapturerStreamEvent(clientPid, sessionId, streamFlag, reason);
159 audioPolicyServerHandler->SendConcurrencyEventWithSessionIDCallback(sessionId);
160
161 AudioCapturerInfo capturerInfo;
162 AudioStreamInfo streamInfo;
163 uint64_t sendCapturerSessionId = CAPSESSION_ID;
164 int32_t error = GetData<int32_t>();
165 audioPolicyServerHandler->SendCapturerCreateEvent(capturerInfo, streamInfo, sendCapturerSessionId, true, error);
166 audioPolicyServerHandler->SendCapturerCreateEvent(capturerInfo, streamInfo, sendCapturerSessionId, false, error);
167 audioPolicyServerHandler->SendCapturerRemovedEvent(sendCapturerSessionId, true);
168 audioPolicyServerHandler->SendCapturerRemovedEvent(sendCapturerSessionId, false);
169 audioPolicyServerHandler->SendWakeupCloseEvent(true);
170 audioPolicyServerHandler->SendWakeupCloseEvent(false);
171
172 std::unordered_map<std::string, bool> changeInfo;
173 audioPolicyServerHandler->SendHeadTrackingDeviceChangeEvent(changeInfo);
174 audioPolicyServerHandler->SendSpatializatonEnabledChangeEvent(true);
175 audioPolicyServerHandler->SendSpatializatonEnabledChangeEvent(false);
176
177 std::shared_ptr<AudioDeviceDescriptor> selectedAudioDevice;
178 audioPolicyServerHandler->SendSpatializatonEnabledChangeForAnyDeviceEvent(selectedAudioDevice, true);
179 audioPolicyServerHandler->SendSpatializatonEnabledChangeForAnyDeviceEvent(selectedAudioDevice, false);
180 audioPolicyServerHandler->SendHeadTrackingEnabledChangeEvent(true);
181 audioPolicyServerHandler->SendHeadTrackingEnabledChangeEvent(false);
182 audioPolicyServerHandler->SendHeadTrackingEnabledChangeForAnyDeviceEvent(selectedAudioDevice, true);
183 audioPolicyServerHandler->SendHeadTrackingEnabledChangeForAnyDeviceEvent(selectedAudioDevice, false);
184
185 AudioPipeType pipeType = GetData<AudioPipeType>();
186 audioPolicyServerHandler->SendPipeStreamCleanEvent(pipeType);
187 }
188
AudioPolicyServHandleFuzzTest()189 void AudioPolicyServHandleFuzzTest()
190 {
191 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
192 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
193
194 CallbackChange callbackchange = GetData<CallbackChange>();
195 audioPolicyServerHandler->SetClientCallbacksEnable(callbackchange, true);
196 audioPolicyServerHandler->SetClientCallbacksEnable(callbackchange, false);
197 }
198
199 typedef void (*TestFuncs[4])();
200
201 TestFuncs g_testFuncs = {
202 AudioEffectServiceFuzzTest,
203 AudioSendCallbackFuzzTest,
204 AudioPolicyServSendFuzzTest,
205 AudioPolicyServHandleFuzzTest,
206 };
207
FuzzTest(const uint8_t * rawData,size_t size)208 bool FuzzTest(const uint8_t* rawData, size_t size)
209 {
210 if (rawData == nullptr) {
211 return false;
212 }
213
214 // initialize data
215 RAW_DATA = rawData;
216 g_dataSize = size;
217 g_pos = 0;
218
219 uint32_t code = GetData<uint32_t>();
220 uint32_t len = GetArrLength(g_testFuncs);
221 if (len > 0) {
222 g_testFuncs[code % len]();
223 } else {
224 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
225 }
226
227 return true;
228 }
229 } // namespace AudioStandard
230 } // namesapce OHOS
231
232 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)233 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
234 {
235 if (size < OHOS::AudioStandard::THRESHOLD) {
236 return 0;
237 }
238
239 OHOS::AudioStandard::FuzzTest(data, size);
240 return 0;
241 }