1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "audiorender_fuzzer.h"
16 #include "hdi_service_common.h"
17 using namespace std;
18 namespace OHOS {
19 namespace Audio {
20 constexpr size_t THRESHOLD = 10;
21 constexpr int32_t OFFSET = 4;
22 struct AudioSceneDescriptor g_scene;
23 enum RenderCmdId {
24 AUDIO_RENDER_SET_SAMPLE_ATTR,
25 AUDIO_RENDER_CHECK_SCENE_CAPABILITY,
26 AUDIO_RENDER_SELECT_SCENE,
27 AUDIO_RENDER_SET_VOLUME,
28 AUDIO_RENDER_SET_GAIN,
29 AUDIO_RENDER_RENDER_FRAME,
30 AUDIO_RENDER_SET_EXTRA_PARAMS,
31 AUDIO_RENDER_REQ_MMAP_BUFFER,
32 AUDIO_RENDER_SET_CHANNEL_MODE,
33 AUDIO_RENDER_DEV_DUMP,
34 };
35
Convert2Uint32(const uint8_t * ptr)36 static uint32_t Convert2Uint32(const uint8_t *ptr)
37 {
38 if (ptr == nullptr) {
39 return 0;
40 }
41 /*
42 * Move the 0th digit 24 to the left, the first digit 16 to the left, the second digit 8 to the left,
43 * and the third digit no left
44 */
45 return (ptr[BUFFER_INDEX_ZERO] << PCM_24_BIT) | (ptr[BUFFER_INDEX_ONE] << PCM_16_BIT) |
46 (ptr[BUFFER_INDEX_TWO] << PCM_8_BIT) | (ptr[BUFFER_INDEX_THREE]);
47 }
48
InitScene(const struct AudioSceneDescriptor * scene)49 static int32_t InitScene(const struct AudioSceneDescriptor *scene)
50 {
51 if (scene == nullptr) {
52 return HDF_FAILURE;
53 }
54
55 g_scene.scene = {0};
56 g_scene.desc.portId = scene->desc.portId;
57 g_scene.desc.pins = scene->desc.pins;
58 g_scene.desc.desc = NULL;
59 return HDF_SUCCESS;
60 }
61
AudioRenderReqMmapBuffer(struct IAudioRender * & render,uint8_t * & data)62 void AudioRenderReqMmapBuffer(struct IAudioRender *&render, uint8_t *&data)
63 {
64 int32_t temp = *(reinterpret_cast<int32_t *>(data));
65 struct AudioMmapBufferDescriptor desc = {
66 .memoryAddress = reinterpret_cast<int8_t *>(data),
67 .memoryAddressLen = *(reinterpret_cast<uint32_t *>(data)),
68 .memoryFd = temp,
69 .totalBufferFrames = temp,
70 .transferFrameSize = temp,
71 .isShareable = temp,
72 .offset = temp,
73 .filePath = reinterpret_cast<char *>(data),
74 };
75 render->ReqMmapBuffer(render, temp, &desc);
76 }
77
RenderFucSwitch(struct IAudioRender * & render,uint32_t cmd,const uint8_t * & rawData,size_t size)78 void RenderFucSwitch(struct IAudioRender *&render, uint32_t cmd, const uint8_t *&rawData, size_t size)
79 {
80 uint8_t *data = const_cast<uint8_t *>(rawData);
81 switch (cmd) {
82 case AUDIO_RENDER_SET_SAMPLE_ATTR:
83 render->SetSampleAttributes(render, reinterpret_cast<const struct AudioSampleAttributes *>(rawData));
84 break;
85 case AUDIO_RENDER_CHECK_SCENE_CAPABILITY: {
86 bool supported = false;
87 InitScene((const struct AudioSceneDescriptor *)(rawData));
88 render->CheckSceneCapability(render, &g_scene, &supported);
89 break;
90 }
91 case AUDIO_RENDER_SELECT_SCENE:
92 InitScene((const struct AudioSceneDescriptor *)(rawData));
93 render->SelectScene(render, &g_scene);
94 break;
95 case AUDIO_RENDER_SET_VOLUME:
96 render->SetVolume(render, *(reinterpret_cast<float *>(data)));
97 break;
98 case AUDIO_RENDER_SET_GAIN:
99 render->SetGain(render, *(reinterpret_cast<float *>(data)));
100 break;
101 case AUDIO_RENDER_RENDER_FRAME: {
102 uint64_t replyBytes = 0;
103 render->RenderFrame(render, reinterpret_cast<const int8_t *>(rawData), size, &replyBytes);
104 break;
105 }
106 case AUDIO_RENDER_SET_EXTRA_PARAMS:
107 render->SetExtraParams(render, reinterpret_cast<const char *>(rawData));
108 break;
109 case AUDIO_RENDER_REQ_MMAP_BUFFER: {
110 AudioRenderReqMmapBuffer(render, data);
111 break;
112 }
113 case AUDIO_RENDER_SET_CHANNEL_MODE:
114 render->SetChannelMode(render, *(reinterpret_cast<AudioChannelMode *>(data)));
115 break;
116 case AUDIO_RENDER_DEV_DUMP: {
117 int32_t temp = *(reinterpret_cast<uint32_t *>(data));
118 render->AudioDevDump(render, temp, temp);
119 break;
120 }
121 default:
122 return;
123 }
124 }
125
DoSomethingInterestingWithMyAPI(const uint8_t * rawData,size_t size)126 bool DoSomethingInterestingWithMyAPI(const uint8_t *rawData, size_t size)
127 {
128 if (rawData == nullptr) {
129 return false;
130 }
131 struct IAudioAdapter *adapter = nullptr;
132 struct IAudioRender *render = nullptr;
133 uint32_t cmd = Convert2Uint32(rawData);
134 uint32_t renderId = 0;
135
136 rawData = rawData + OFFSET;
137 size = size - OFFSET;
138 struct IAudioManager *manager = IAudioManagerGet(false);
139 if (manager == nullptr) {
140 return false;
141 }
142 int32_t ret = AudioCreateRender(manager, PIN_OUT_SPEAKER, ADAPTER_NAME, &adapter, &render, &renderId);
143 if (ret != HDF_SUCCESS) {
144 return false;
145 }
146 RenderFucSwitch(render, cmd, rawData, size);
147 adapter->DestroyRender(adapter, renderId);
148 manager->UnloadAdapter(manager, ADAPTER_NAME.c_str());
149 IAudioManagerRelease(manager, false);
150 return true;
151 }
152 }
153 }
154
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)155 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
156 {
157 if (size < OHOS::Audio::THRESHOLD) {
158 return 0;
159 }
160 OHOS::Audio::DoSomethingInterestingWithMyAPI(data, size);
161 return 0;
162 }