1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_policy_server.h"
20 #include "message_parcel.h"
21 #include "accesstoken_kit.h"
22 #include "nativetoken_kit.h"
23 #include "token_setproc.h"
24 #include "access_token.h"
25 using namespace std;
26
27 namespace OHOS {
28 namespace AudioStandard {
29 bool g_hasPermission = false;
30 constexpr int32_t OFFSET = 4;
31 const int32_t MOD_NUM_TWO = 2;
32 const int32_t CONNECTING_NUMBER = 10;
33 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
34 const int32_t SYSTEM_ABILITY_ID = 3009;
35 const bool RUN_ON_CREATE = false;
36 const int32_t LIMITSIZE = 4;
37 const int32_t SHIFT_LEFT_8 = 8;
38 const int32_t SHIFT_LEFT_16 = 16;
39 const int32_t SHIFT_LEFT_24 = 24;
40 const uint32_t LIMIT_ONE = 0;
41 const uint32_t LIMIT_TWO = 30;
42 const uint32_t LIMIT_THREE = 60;
43 const uint32_t LIMIT_FOUR = static_cast<uint32_t>(AudioPolicyInterfaceCode::AUDIO_POLICY_MANAGER_CODE_MAX);
44 bool g_hasServerInit = false;
45 const uint8_t TESTSIZE = 6;
46 typedef void (*TestPtr)(const uint8_t *, size_t);
47
GetServerPtr()48 AudioPolicyServer* GetServerPtr()
49 {
50 static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
51 if (!g_hasServerInit) {
52 server.OnStart();
53 server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
54 #ifdef FEATURE_MULTIMODALINPUT_INPUT
55 server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
56 #endif
57 server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
58 server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
59 server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
60 server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
61 g_hasServerInit = true;
62 }
63 return &server;
64 }
65
Convert2Uint32(const uint8_t * ptr)66 uint32_t Convert2Uint32(const uint8_t *ptr)
67 {
68 if (ptr == nullptr) {
69 return 0;
70 }
71 /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits,
72 the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */
73 return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]);
74 }
75
AudioFuzzTestGetPermission()76 void AudioFuzzTestGetPermission()
77 {
78 if (!g_hasPermission) {
79 uint64_t tokenId;
80 constexpr int perNum = 10;
81 const char *perms[perNum] = {
82 "ohos.permission.MICROPHONE",
83 "ohos.permission.MANAGE_INTELLIGENT_VOICE",
84 "ohos.permission.MANAGE_AUDIO_CONFIG",
85 "ohos.permission.MICROPHONE_CONTROL",
86 "ohos.permission.MODIFY_AUDIO_SETTINGS",
87 "ohos.permission.ACCESS_NOTIFICATION_POLICY",
88 "ohos.permission.USE_BLUETOOTH",
89 "ohos.permission.CAPTURE_VOICE_DOWNLINK_AUDIO",
90 "ohos.permission.RECORD_VOICE_CALL",
91 "ohos.permission.MANAGE_SYSTEM_AUDIO_EFFECTS",
92 };
93
94 NativeTokenInfoParams infoInstance = {
95 .dcapsNum = 0,
96 .permsNum = 10,
97 .aclsNum = 0,
98 .dcaps = nullptr,
99 .perms = perms,
100 .acls = nullptr,
101 .processName = "audiofuzztest",
102 .aplStr = "system_basic",
103 };
104 tokenId = GetAccessTokenId(&infoInstance);
105 SetSelfTokenID(tokenId);
106 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
107 g_hasPermission = true;
108 }
109 }
110
AudioPolicyServiceDumpTest(const uint8_t * rawData,size_t size)111 void AudioPolicyServiceDumpTest(const uint8_t *rawData, size_t size)
112 {
113 if (rawData == nullptr || size < LIMITSIZE) {
114 return;
115 }
116 uint32_t code = Convert2Uint32(rawData) % (LIMIT_TWO - LIMIT_ONE + 1) + LIMIT_ONE;
117
118 rawData = rawData + OFFSET;
119 size = size - OFFSET;
120
121 std::string dumpStr = "";
122 GetServerPtr()->audioPolicyDump_.DevicesInfoDump(dumpStr);
123 GetServerPtr()->audioPolicyDump_.AudioModeDump(dumpStr);
124 GetServerPtr()->audioPolicyDump_.AudioPolicyParserDump(dumpStr);
125 GetServerPtr()->audioPolicyDump_.XmlParsedDataMapDump(dumpStr);
126 GetServerPtr()->audioPolicyDump_.StreamVolumesDump(dumpStr);
127 std::map<DeviceVolumeType, std::shared_ptr<DeviceVolumeInfo>> deviceVolumeInfoMap;
128 GetServerPtr()->audioPolicyDump_.DeviceVolumeInfosDump(dumpStr, deviceVolumeInfoMap);
129 GetServerPtr()->audioPolicyDump_.AudioStreamDump(dumpStr);
130 GetServerPtr()->audioPolicyDump_.GetVolumeConfigDump(dumpStr);
131 GetServerPtr()->audioPolicyDump_.GetGroupInfoDump(dumpStr);
132 GetServerPtr()->audioPolicyDump_.GetCallStatusDump(dumpStr);
133 GetServerPtr()->audioPolicyDump_.GetRingerModeDump(dumpStr);
134 GetServerPtr()->audioPolicyDump_.GetMicrophoneDescriptorsDump(dumpStr);
135 GetServerPtr()->audioPolicyDump_.GetCapturerStreamDump(dumpStr);
136 GetServerPtr()->audioPolicyDump_.GetOffloadStatusDump(dumpStr);
137 GetServerPtr()->audioPolicyDump_.EffectManagerInfoDump(dumpStr);
138 GetServerPtr()->audioPolicyDump_.MicrophoneMuteInfoDump(dumpStr);
139 GetServerPtr()->audioPolicyDump_.GetVolumeConfigDump(dumpStr);
140 GetServerPtr()->audioPolicyDump_.GetVolumeConfigDump(dumpStr);
141 GetServerPtr()->audioPolicyDump_.GetVolumeConfigDump(dumpStr);
142
143 GetServerPtr()->interruptService_->AudioInterruptZoneDump(dumpStr);
144 }
145
AudioPolicyServiceDeviceTest(const uint8_t * rawData,size_t size)146 void AudioPolicyServiceDeviceTest(const uint8_t *rawData, size_t size)
147 {
148 if (rawData == nullptr || size < LIMITSIZE) {
149 return;
150 }
151 uint8_t num = *reinterpret_cast<const uint8_t *>(rawData);
152 DeviceType deviceType = static_cast<DeviceType>(num % DEVICE_TYPE_FILE_SOURCE);
153 bool isConnected = static_cast<bool>(num % MOD_NUM_TWO);
154 AudioDeviceDescriptor audioDeviceDescriptor;
155 GetServerPtr()->audioPolicyService_.OnPnpDeviceStatusUpdated(audioDeviceDescriptor, isConnected);
156
157 GetServerPtr()->audioPolicyService_.IsA2dpOffloadConnected();
158 int32_t state = (num % MOD_NUM_TWO) + CONNECTING_NUMBER; // DATA_LINK_CONNECTING = 10, DATA_LINK_CONNECTED = 11;
159 GetServerPtr()->audioPolicyService_.audioDeviceLock_.UpdateSessionConnectionState(num, state);
160
161 std::string macAddress = "11:22:33:44:55:66";
162 GetServerPtr()->audioPolicyService_.SetCallDeviceActive(deviceType, isConnected, macAddress);
163
164 GetServerPtr()->audioPolicyService_.audioA2dpOffloadManager_->UpdateOffloadWhenActiveDeviceSwitchFromA2dp();
165 GetServerPtr()->audioPolicyService_.audioA2dpOffloadManager_->GetA2dpOffloadCodecAndSendToDsp();
166 GetServerPtr()->audioPolicyService_.audioMicrophoneDescriptor_.UpdateAudioCapturerMicrophoneDescriptor(deviceType);
167
168 // the max value of BluetoothOffloadState is A2DP_OFFLOAD.
169 BluetoothOffloadState flag = static_cast<BluetoothOffloadState>(num % (A2DP_OFFLOAD + 1));
170 GetServerPtr()->audioPolicyService_.audioA2dpOffloadManager_->HandleA2dpDeviceInOffload(flag);
171 GetServerPtr()->audioPolicyService_.audioA2dpOffloadManager_->HandleA2dpDeviceOutOffload(flag);
172
173 uint32_t sessionId = static_cast<uint32_t>(num);
174 // the max value of AudioPipeType is PIPE_TYPE_DIRECT_VOIP.
175 AudioPipeType pipeType = static_cast<AudioPipeType>(num % (PIPE_TYPE_DIRECT_VOIP + 1));
176 GetServerPtr()->audioPolicyService_.audioOffloadStream_.MoveToNewPipeInner(sessionId, pipeType);
177
178 GetServerPtr()->audioPolicyService_.audioOffloadStream_.LoadMchModule();
179 GetServerPtr()->audioPolicyService_.audioOffloadStream_.ConstructMchAudioModuleInfo(deviceType);
180 GetServerPtr()->audioPolicyService_.audioOffloadStream_.LoadOffloadModule();
181 GetServerPtr()->audioPolicyService_.audioOffloadStream_.UnloadOffloadModule();
182 GetServerPtr()->audioPolicyService_.audioOffloadStream_.ConstructOffloadAudioModuleInfo(deviceType);
183 }
184
AudioPolicyServiceAccountTest(const uint8_t * rawData,size_t size)185 void AudioPolicyServiceAccountTest(const uint8_t *rawData, size_t size)
186 {
187 if (rawData == nullptr || size < LIMITSIZE) {
188 return;
189 }
190
191 uint8_t num = *reinterpret_cast<const uint8_t *>(rawData);
192 GetServerPtr()->audioPolicyService_.GetCurActivateCount();
193 GetServerPtr()->audioPolicyService_.NotifyAccountsChanged(num);
194 }
195
AudioPolicyServiceSafeVolumeTest(const uint8_t * rawData,size_t size)196 void AudioPolicyServiceSafeVolumeTest(const uint8_t *rawData, size_t size)
197 {
198 if (rawData == nullptr || size < LIMITSIZE) {
199 return;
200 }
201 uint32_t code = Convert2Uint32(rawData) % (LIMIT_TWO - LIMIT_ONE + 1) + LIMIT_ONE;
202
203 rawData = rawData + OFFSET;
204 size = size - OFFSET;
205
206 GetServerPtr()->audioPolicyService_.audioVolumeManager_.SetDeviceSafeVolumeStatus();
207 GetServerPtr()->audioPolicyService_.DisableSafeMediaVolume();
208 }
209
AudioPolicyServiceInterfaceTest(const uint8_t * rawData,size_t size)210 void AudioPolicyServiceInterfaceTest(const uint8_t *rawData, size_t size)
211 {
212 if (rawData == nullptr || size < LIMITSIZE) {
213 return;
214 }
215
216 bool fuzzBool = *reinterpret_cast<const bool *>(rawData);
217 int32_t fuzzInt32One = *reinterpret_cast<const int8_t *>(rawData);
218 int32_t fuzzInt32Two = *reinterpret_cast<const int8_t *>(rawData);
219 int32_t fuzzInt32Three = *reinterpret_cast<const int8_t *>(rawData);
220 int32_t fuzzFloat = *reinterpret_cast<const float *>(rawData);
221 std::string fuzzNetworkId = "FUZZNETWORKID";
222 std::string fuzzString(reinterpret_cast<const char*>(rawData), size - 1);
223
224 AudioStreamType fuzzAudioStreamType = *reinterpret_cast<const AudioStreamType *>(rawData);
225 DeviceType fuzzDeviceType = *reinterpret_cast<const DeviceType *>(rawData);
226 DeviceRole fuzzDeviceRole = *reinterpret_cast<const DeviceRole *>(rawData);
227 StreamUsage fuzzStreamUsage = *reinterpret_cast<const StreamUsage *>(rawData);
228
229 AudioDeviceDescriptor fuzzAudioDeviceDescriptor;
230 std::shared_ptr<AudioDeviceDescriptor> fuzzAudioDeviceDescriptorSptr = std::make_shared<AudioDeviceDescriptor>();
231 std::vector<std::shared_ptr<AudioDeviceDescriptor>> fuzzAudioDeviceDescriptorSptrVector;
232 fuzzAudioDeviceDescriptorSptrVector.push_back(fuzzAudioDeviceDescriptorSptr);
233 sptr<AudioRendererFilter> fuzzAudioRendererFilter = new AudioRendererFilter();
234
235 // set offload support on for covery
236 GetServerPtr()->audioPolicyService_.audioOffloadStream_.isOffloadAvailable_ = true;
237 GetServerPtr()->audioPolicyService_.audioRecoveryDevice_.HandleRecoveryPreferredDevices(fuzzInt32One,
238 fuzzInt32Two, fuzzInt32Three);
239 GetServerPtr()->audioPolicyService_.audioA2dpOffloadManager_->GetVolumeGroupType(fuzzDeviceType);
240 GetServerPtr()->audioPolicyService_.GetSystemVolumeDb(fuzzAudioStreamType);
241 GetServerPtr()->audioPolicyService_.SetLowPowerVolume(fuzzInt32One, fuzzFloat);
242 GetServerPtr()->audioPolicyService_.audioOffloadStream_.SetOffloadMode();
243 GetServerPtr()->audioPolicyService_.audioOffloadStream_.ResetOffloadMode(fuzzInt32One);
244 GetServerPtr()->audioPolicyService_.audioOffloadStream_.OffloadStreamReleaseCheck(fuzzInt32One);
245 GetServerPtr()->audioPolicyService_.audioOffloadStream_.RemoteOffloadStreamRelease(fuzzInt32One);
246 GetServerPtr()->audioPolicyService_.audioActiveDevice_.CheckActiveOutputDeviceSupportOffload();
247 GetServerPtr()->audioPolicyService_.audioOffloadStream_.GetOffloadAvailableFromXml();
248 GetServerPtr()->audioPolicyService_.SetSourceOutputStreamMute(fuzzInt32One, fuzzBool);
249 GetServerPtr()->audioPolicyService_.NotifyRemoteRenderState(fuzzNetworkId, fuzzString, fuzzString);
250 GetServerPtr()->audioPolicyService_.IsArmUsbDevice(fuzzAudioDeviceDescriptor);
251 GetServerPtr()->audioPolicyService_.audioDeviceCommon_.IsDeviceConnected(fuzzAudioDeviceDescriptorSptr);
252 GetServerPtr()->audioPolicyService_.audioDeviceCommon_.DeviceParamsCheck(fuzzDeviceRole,
253 fuzzAudioDeviceDescriptorSptrVector);
254 GetServerPtr()->audioPolicyService_.audioActiveDevice_.NotifyUserSelectionEventToBt(fuzzAudioDeviceDescriptorSptr);
255 GetServerPtr()->audioPolicyService_.audioRecoveryDevice_.SetRenderDeviceForUsage(fuzzStreamUsage,
256 fuzzAudioDeviceDescriptorSptr);
257 GetServerPtr()->audioPolicyService_.audioRecoveryDevice_.SelectOutputDevice(
258 fuzzAudioRendererFilter, fuzzAudioDeviceDescriptorSptrVector);
259 GetServerPtr()->audioPolicyService_.audioRecoveryDevice_.WriteSelectOutputSysEvents(
260 fuzzAudioDeviceDescriptorSptrVector, fuzzStreamUsage);
261 GetServerPtr()->audioPolicyService_.audioRecoveryDevice_.SelectFastOutputDevice(
262 fuzzAudioRendererFilter, fuzzAudioDeviceDescriptorSptr);
263 GetServerPtr()->audioPolicyService_.audioDeviceCommon_.FilterSourceOutputs(fuzzInt32One);
264 GetServerPtr()->audioPolicyService_.OnPnpDeviceStatusUpdated(fuzzAudioDeviceDescriptor, fuzzBool);
265 }
266
AudioDeviceConnectTest(const uint8_t * rawData,size_t size)267 void AudioDeviceConnectTest(const uint8_t *rawData, size_t size)
268 {
269 if (rawData == nullptr || size < LIMITSIZE) {
270 return;
271 }
272
273 // Coverage first
274 AudioStreamInfo streamInfo;
275 streamInfo.samplingRate = AudioSamplingRate::SAMPLE_RATE_48000;
276 streamInfo.channels = AudioChannel::STEREO;
277 streamInfo.format = AudioSampleFormat::SAMPLE_S16LE;
278 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_WIRED_HEADSET, true,
279 "", "fuzzDevice", streamInfo);
280 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_WIRED_HEADSET, false,
281 "", "fuzzDevice", streamInfo);
282
283 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_USB_HEADSET, true,
284 "", "fuzzDevice", streamInfo);
285 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_USB_HEADSET, false,
286 "", "fuzzDevice", streamInfo);
287
288 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_DP, true,
289 "", "fuzzDevice", streamInfo);
290 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_DP, false,
291 "", "fuzzDevice", streamInfo);
292
293 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_BLUETOOTH_A2DP, true,
294 "08:00:20:0A:8C:6D", "fuzzBtDevice", streamInfo);
295 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_BLUETOOTH_A2DP, false,
296 "08:00:20:0A:8C:6D", "fuzzBtDevice", streamInfo);
297
298 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_BLUETOOTH_SCO, true,
299 "08:00:20:0A:8C:6D", "fuzzBtDevice", streamInfo);
300 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(DeviceType::DEVICE_TYPE_BLUETOOTH_SCO, false,
301 "08:00:20:0A:8C:6D", "fuzzBtDevice", streamInfo);
302
303 bool fuzzBool = *reinterpret_cast<const bool *>(rawData);
304 std::string fuzzString(reinterpret_cast<const char*>(rawData), size - 1);
305 DeviceType fuzzDeviceType = *reinterpret_cast<const DeviceType *>(rawData);
306 AudioSamplingRate fuzzAudioSamplingRate = *reinterpret_cast<const AudioSamplingRate *>(rawData);
307 AudioChannel fuzzAudioChannel = *reinterpret_cast<const AudioChannel *>(rawData);
308 AudioSampleFormat fuzzAudioSampleFormat = *reinterpret_cast<const AudioSampleFormat *>(rawData);
309 streamInfo.samplingRate = fuzzAudioSamplingRate;
310 streamInfo.channels = fuzzAudioChannel;
311 streamInfo.format = fuzzAudioSampleFormat;
312
313 GetServerPtr()->audioPolicyService_.OnDeviceStatusUpdated(fuzzDeviceType, fuzzBool, fuzzString,
314 "fuzzDevice", streamInfo);
315 }
316 } // namespace AudioStandard
317 } // namesapce OHOS
318
319 OHOS::AudioStandard::TestPtr g_testPtrs[OHOS::AudioStandard::TESTSIZE] = {
320 OHOS::AudioStandard::AudioPolicyServiceDumpTest,
321 OHOS::AudioStandard::AudioPolicyServiceDeviceTest,
322 OHOS::AudioStandard::AudioPolicyServiceAccountTest,
323 OHOS::AudioStandard::AudioPolicyServiceSafeVolumeTest,
324 OHOS::AudioStandard::AudioPolicyServiceInterfaceTest,
325 OHOS::AudioStandard::AudioDeviceConnectTest
326 };
327
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)328 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
329 {
330 /* Run your code on data */
331 if (data == nullptr || size <= 1) {
332 return 0;
333 }
334 uint8_t firstByte = *data % OHOS::AudioStandard::TESTSIZE;
335 if (firstByte >= OHOS::AudioStandard::TESTSIZE) {
336 return 0;
337 }
338 data = data + 1;
339 size = size - 1;
340 g_testPtrs[firstByte](data, size);
341 return 0;
342 }