1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_policy_server.h"
20 #include "message_parcel.h"
21 #include "accesstoken_kit.h"
22 #include "nativetoken_kit.h"
23 #include "token_setproc.h"
24 #include "access_token.h"
25 using namespace std;
26
27 namespace OHOS {
28 namespace AudioStandard {
29 bool g_hasPermission = false;
30 constexpr int32_t OFFSET = 4;
31 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IAudioPolicy";
32 const int32_t SYSTEM_ABILITY_ID = 3009;
33 const bool RUN_ON_CREATE = false;
34 const int32_t LIMITSIZE = 4;
35 const int32_t SHIFT_LEFT_8 = 8;
36 const int32_t SHIFT_LEFT_16 = 16;
37 const int32_t SHIFT_LEFT_24 = 24;
38 const uint32_t LIMIT_ONE = 0;
39 const uint32_t LIMIT_TWO = 30;
40 const uint32_t LIMIT_THREE = 60;
41 const uint32_t LIMIT_FOUR = 90;
42 const uint32_t LIMIT_FIVE = 120;
43 const uint32_t LIMIT_SIX = static_cast<uint32_t>(AudioPolicyInterfaceCode::AUDIO_POLICY_MANAGER_CODE_MAX);
44 bool g_hasServerInit = false;
45 const uint8_t TESTSIZE = 5;
46 typedef void (*TestPtr)(const uint8_t *, size_t);
47
GetServerPtr()48 AudioPolicyServer* GetServerPtr()
49 {
50 static AudioPolicyServer server(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
51 if (!g_hasServerInit) {
52 server.OnStart();
53 server.OnAddSystemAbility(AUDIO_DISTRIBUTED_SERVICE_ID, "");
54 #ifdef FEATURE_MULTIMODALINPUT_INPUT
55 server.OnAddSystemAbility(MULTIMODAL_INPUT_SERVICE_ID, "");
56 #endif
57 server.OnAddSystemAbility(BLUETOOTH_HOST_SYS_ABILITY_ID, "");
58 server.OnAddSystemAbility(POWER_MANAGER_SERVICE_ID, "");
59 server.OnAddSystemAbility(SUBSYS_ACCOUNT_SYS_ABILITY_ID_BEGIN, "");
60 server.audioPolicyService_.SetDefaultDeviceLoadFlag(true);
61 g_hasServerInit = true;
62 }
63 return &server;
64 }
65
Convert2Uint32(const uint8_t * ptr)66 uint32_t Convert2Uint32(const uint8_t *ptr)
67 {
68 if (ptr == nullptr) {
69 return 0;
70 }
71 /* Move the 0th digit to the left by 24 bits, the 1st digit to the left by 16 bits,
72 the 2nd digit to the left by 8 bits, and the 3rd digit not to the left */
73 return (ptr[0] << SHIFT_LEFT_24) | (ptr[1] << SHIFT_LEFT_16) | (ptr[2] << SHIFT_LEFT_8) | (ptr[3]);
74 }
75
AudioFuzzTestGetPermission()76 void AudioFuzzTestGetPermission()
77 {
78 if (!g_hasPermission) {
79 uint64_t tokenId;
80 constexpr int perNum = 10;
81 const char *perms[perNum] = {
82 "ohos.permission.MICROPHONE",
83 "ohos.permission.MANAGE_INTELLIGENT_VOICE",
84 "ohos.permission.MANAGE_AUDIO_CONFIG",
85 "ohos.permission.MICROPHONE_CONTROL",
86 "ohos.permission.MODIFY_AUDIO_SETTINGS",
87 "ohos.permission.ACCESS_NOTIFICATION_POLICY",
88 "ohos.permission.USE_BLUETOOTH",
89 "ohos.permission.CAPTURE_VOICE_DOWNLINK_AUDIO",
90 "ohos.permission.RECORD_VOICE_CALL",
91 "ohos.permission.MANAGE_SYSTEM_AUDIO_EFFECTS",
92 };
93
94 NativeTokenInfoParams infoInstance = {
95 .dcapsNum = 0,
96 .permsNum = 10,
97 .aclsNum = 0,
98 .dcaps = nullptr,
99 .perms = perms,
100 .acls = nullptr,
101 .processName = "audiofuzztest",
102 .aplStr = "system_basic",
103 };
104 tokenId = GetAccessTokenId(&infoInstance);
105 SetSelfTokenID(tokenId);
106 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
107 g_hasPermission = true;
108 }
109 }
110
ReleaseServer()111 void ReleaseServer()
112 {
113 GetServerPtr()->OnStop();
114 g_hasServerInit = false;
115 }
116
AudioPolicyFuzzFirstLimitTest(const uint8_t * rawData,size_t size)117 void AudioPolicyFuzzFirstLimitTest(const uint8_t *rawData, size_t size)
118 {
119 if (rawData == nullptr || size < LIMITSIZE) {
120 return;
121 }
122 uint32_t code = Convert2Uint32(rawData) % (LIMIT_TWO - LIMIT_ONE + 1) + LIMIT_ONE;
123
124 rawData = rawData + OFFSET;
125 size = size - OFFSET;
126
127 MessageParcel data;
128 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
129 data.WriteBuffer(rawData, size);
130 data.RewindRead(0);
131
132 MessageParcel reply;
133 MessageOption option;
134 if (code == static_cast<uint32_t>(AudioPolicyInterfaceCode::SET_SYSTEM_VOLUMELEVEL_WITH_DEVICE)) {
135 return;
136 }
137
138 GetServerPtr()->OnRemoteRequest(code, data, reply, option);
139 ReleaseServer();
140 }
141
AudioPolicyFuzzSecondLimitTest(const uint8_t * rawData,size_t size)142 void AudioPolicyFuzzSecondLimitTest(const uint8_t *rawData, size_t size)
143 {
144 if (rawData == nullptr || size < LIMITSIZE) {
145 return;
146 }
147 uint32_t code = Convert2Uint32(rawData) % (LIMIT_THREE - LIMIT_TWO + 1) + LIMIT_TWO;
148
149 rawData = rawData + OFFSET;
150 size = size - OFFSET;
151
152 MessageParcel data;
153 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
154 data.WriteBuffer(rawData, size);
155 data.RewindRead(0);
156
157 MessageParcel reply;
158 MessageOption option;
159
160 GetServerPtr()->OnRemoteRequest(code, data, reply, option);
161 ReleaseServer();
162 }
163
AudioPolicyFuzzThirdLimitTest(const uint8_t * rawData,size_t size)164 void AudioPolicyFuzzThirdLimitTest(const uint8_t *rawData, size_t size)
165 {
166 if (rawData == nullptr || size < LIMITSIZE) {
167 return;
168 }
169 uint32_t code = Convert2Uint32(rawData) % (LIMIT_FOUR - LIMIT_THREE + 1) + LIMIT_THREE;
170
171 rawData = rawData + OFFSET;
172 size = size - OFFSET;
173
174 MessageParcel data;
175 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
176 data.WriteBuffer(rawData, size);
177 data.RewindRead(0);
178
179 MessageParcel reply;
180 MessageOption option;
181 if (code == static_cast<uint32_t>(AudioPolicyInterfaceCode::ADD_AUDIO_INTERRUPT_ZONE_PIDS)) {
182 return;
183 }
184
185 GetServerPtr()->OnRemoteRequest(code, data, reply, option);
186 ReleaseServer();
187 }
188
AudioPolicyFuzzFouthLimitTest(const uint8_t * rawData,size_t size)189 void AudioPolicyFuzzFouthLimitTest(const uint8_t *rawData, size_t size)
190 {
191 if (rawData == nullptr || size < LIMITSIZE) {
192 return;
193 }
194 uint32_t code = Convert2Uint32(rawData) % (LIMIT_FIVE - LIMIT_FOUR + 1) + LIMIT_FOUR;
195
196 rawData = rawData + OFFSET;
197 size = size - OFFSET;
198
199 MessageParcel data;
200 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
201 data.WriteBuffer(rawData, size);
202 data.RewindRead(0);
203
204 MessageParcel reply;
205 MessageOption option;
206
207 GetServerPtr()->OnRemoteRequest(code, data, reply, option);
208 ReleaseServer();
209 }
210
AudioPolicyFuzzFifthLimitTest(const uint8_t * rawData,size_t size)211 void AudioPolicyFuzzFifthLimitTest(const uint8_t *rawData, size_t size)
212 {
213 if (rawData == nullptr || size < LIMITSIZE) {
214 return;
215 }
216 uint32_t code = Convert2Uint32(rawData) % (LIMIT_SIX - LIMIT_FIVE + 1) + LIMIT_FIVE;
217
218 rawData = rawData + OFFSET;
219 size = size - OFFSET;
220
221 MessageParcel data;
222 data.WriteInterfaceToken(FORMMGR_INTERFACE_TOKEN);
223 data.WriteBuffer(rawData, size);
224 data.RewindRead(0);
225
226 MessageParcel reply;
227 MessageOption option;
228 if (code == static_cast<uint32_t>(AudioPolicyInterfaceCode::EXCLUDE_OUTPUT_DEVICES) ||
229 code == static_cast<uint32_t>(AudioPolicyInterfaceCode::UNEXCLUDE_OUTPUT_DEVICES)) {
230 return;
231 }
232
233 GetServerPtr()->OnRemoteRequest(code, data, reply, option);
234 ReleaseServer();
235 }
236 } // namespace AudioStandard
237 } // namesapce OHOS
238
LLVMFuzzerInitialize(int * argc,char *** argv)239 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
240 {
241 OHOS::AudioStandard::AudioFuzzTestGetPermission();
242 return 0;
243 }
244
245 OHOS::AudioStandard::TestPtr g_testPtrs[OHOS::AudioStandard::TESTSIZE] = {
246 OHOS::AudioStandard::AudioPolicyFuzzFirstLimitTest,
247 OHOS::AudioStandard::AudioPolicyFuzzSecondLimitTest,
248 OHOS::AudioStandard::AudioPolicyFuzzThirdLimitTest,
249 OHOS::AudioStandard::AudioPolicyFuzzFouthLimitTest,
250 OHOS::AudioStandard::AudioPolicyFuzzFifthLimitTest
251 };
252
253 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)254 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
255 {
256 /* Run your code on data */
257 if (data == nullptr || size <= 1) {
258 return 0;
259 }
260 uint8_t firstByte = *data % OHOS::AudioStandard::TESTSIZE;
261 if (firstByte >= OHOS::AudioStandard::TESTSIZE) {
262 return 0;
263 }
264 data = data + 1;
265 size = size - 1;
266 g_testPtrs[firstByte](data, size);
267 return 0;
268 }
269