1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18
19 #include "ipc_skeleton.h"
20 #include "avsession_errors.h"
21 #include "system_ability_definition.h"
22 #include "avsession_log.h"
23 #include "audio_info.h"
24 #include "avsessionserviceext_fuzzer.h"
25 #include "avsession_service.h"
26 #include "securec.h"
27
28 using namespace std;
29 namespace OHOS::AVSession {
30 static const int32_t MAX_CODE_LEN = 512;
31 static const int32_t MIN_SIZE_NUM = 4;
32
33 static const uint8_t *RAW_DATA = nullptr;
34 static size_t g_dataSize = 0;
35 static size_t g_pos = 0;
36
37 class FuzzExtSessionListener : public SessionListener {
38 public:
OnSessionCreate(const AVSessionDescriptor & descriptor)39 void OnSessionCreate(const AVSessionDescriptor& descriptor) override
40 {
41 SLOGI("sessionId=%{public}s created", descriptor.sessionId_.c_str());
42 }
43
OnSessionRelease(const AVSessionDescriptor & descriptor)44 void OnSessionRelease(const AVSessionDescriptor& descriptor) override
45 {
46 SLOGI("sessionId=%{public}s released", descriptor.sessionId_.c_str());
47 }
48
OnTopSessionChange(const AVSessionDescriptor & descriptor)49 void OnTopSessionChange(const AVSessionDescriptor& descriptor) override
50 {
51 SLOGI("sessionId=%{public}s be top session", descriptor.sessionId_.c_str());
52 }
53
OnAudioSessionChecked(const int32_t uid)54 void OnAudioSessionChecked(const int32_t uid) override
55 {
56 SLOGI("uid=%{public}d checked", uid);
57 }
58 };
59
60 template<class T>
GetData()61 T GetData()
62 {
63 T object {};
64 size_t objectSize = sizeof(object);
65 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
66 return object;
67 }
68 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
69 if (ret != EOK) {
70 return {};
71 }
72 g_pos += objectSize;
73 return object;
74 }
75
AVSessionServiceExtFuzzTest(uint8_t * data,size_t size)76 void AVSessionServiceExtFuzzer::AVSessionServiceExtFuzzTest(uint8_t* data, size_t size)
77 {
78 if ((data == nullptr) || (size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
79 return;
80 }
81
82 vector<string> states { "UNKNOWN", "IDLE", "CONNECTING" };
83 vector<string> serviceNames { "Unknown", "SuperLauncher-Dual", "HuaweiCast" };
84 vector<string> deviceIds { " ", "1234567", "7654321" };
85 vector<string> extraInfos { "nothings", "reason", "others" };
86 std::string state = states[GetData<uint8_t>() % states.size()];
87 std::string serviceName = serviceNames[GetData<uint8_t>() % serviceNames.size()];
88 std::string deviceId = deviceIds[GetData<uint8_t>() % deviceIds.size()];
89 std::string extraInfo = extraInfos[GetData<uint8_t>() % extraInfos.size()];
90
91 static sptr<AVSessionService> service = new AVSessionService(GetData<uint8_t>());
92 service->SuperLauncher(deviceId, serviceName, extraInfo, state);
93 }
94
AVSessionServiceExtRemoteRequest(uint8_t * data,size_t size)95 void AVSessionServiceExtRemoteRequest(uint8_t* data, size_t size)
96 {
97 auto avSessionServiceExt = std::make_unique<AVSessionServiceExtFuzzer>();
98 if (avSessionServiceExt == nullptr) {
99 SLOGI("avSessionServiceExt is null");
100 return;
101 }
102 avSessionServiceExt->AVSessionServiceExtFuzzTest(data, size);
103 }
104
105 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)106 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
107 {
108 RAW_DATA = data;
109 g_dataSize = size;
110 g_pos = 0;
111 /* Run your code on data */
112 AVSessionServiceExtRemoteRequest(data, size);
113 return 0;
114 }
115 }