1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36
37 namespace OHOS {
38 namespace AudioStandard {
39 using namespace std;
40
41 static const uint8_t* RAW_DATA = nullptr;
42 static size_t g_dataSize = 0;
43 static size_t g_pos;
44 const size_t THRESHOLD = 10;
45 const uint8_t TESTSIZE = 12;
46 static int32_t NUM_2 = 2;
47
48 typedef void (*TestFuncs)();
49
50 template<class T>
GetData()51 T GetData()
52 {
53 T object {};
54 size_t objectSize = sizeof(object);
55 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
56 return object;
57 }
58 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
59 if (ret != EOK) {
60 return {};
61 }
62 g_pos += objectSize;
63 return object;
64 }
65
66 template<class T>
GetArrLength(T & arr)67 uint32_t GetArrLength(T& arr)
68 {
69 if (arr == nullptr) {
70 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
71 return 0;
72 }
73 return sizeof(arr) / sizeof(arr[0]);
74 }
75
76 vector<DeviceType> DeviceTypeVec = {
77 DEVICE_TYPE_NONE,
78 DEVICE_TYPE_INVALID,
79 DEVICE_TYPE_EARPIECE,
80 DEVICE_TYPE_SPEAKER,
81 DEVICE_TYPE_WIRED_HEADSET,
82 DEVICE_TYPE_WIRED_HEADPHONES,
83 DEVICE_TYPE_BLUETOOTH_SCO,
84 DEVICE_TYPE_BLUETOOTH_A2DP,
85 DEVICE_TYPE_BLUETOOTH_A2DP_IN,
86 DEVICE_TYPE_MIC,
87 DEVICE_TYPE_WAKEUP,
88 DEVICE_TYPE_USB_HEADSET,
89 DEVICE_TYPE_DP,
90 DEVICE_TYPE_REMOTE_CAST,
91 DEVICE_TYPE_USB_DEVICE,
92 DEVICE_TYPE_ACCESSORY,
93 DEVICE_TYPE_REMOTE_DAUDIO,
94 DEVICE_TYPE_HDMI,
95 DEVICE_TYPE_LINE_DIGITAL,
96 DEVICE_TYPE_NEARLINK,
97 DEVICE_TYPE_NEARLINK_IN,
98 DEVICE_TYPE_FILE_SINK,
99 DEVICE_TYPE_FILE_SOURCE,
100 DEVICE_TYPE_EXTERN_CABLE,
101 DEVICE_TYPE_DEFAULT,
102 DEVICE_TYPE_USB_ARM_HEADSET,
103 DEVICE_TYPE_MAX,
104 };
105
OffloadStartPlayingFuzzTest()106 void OffloadStartPlayingFuzzTest()
107 {
108 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
109 manager->Init();
110 constexpr int32_t stateCount = static_cast<int32_t>(BluetoothOffloadState::A2DP_OFFLOAD) + 1;
111 BluetoothOffloadState state = static_cast<BluetoothOffloadState>(GetData<int32_t>() % stateCount);
112 manager->SetA2dpOffloadFlag(state);
113 std::vector<int32_t> sessionIds = {1, 2, 3};
114 constexpr int32_t a2dpOffloadConnectionStateCount =
115 static_cast<int32_t>(A2dpOffloadConnectionState::CONNECTION_STATUS_TIMEOUT) + 1;
116 A2dpOffloadConnectionState currentOffloadConnectionState =
117 static_cast<A2dpOffloadConnectionState>(GetData<uint8_t>() % a2dpOffloadConnectionStateCount);
118 manager->audioA2dpOffloadFlag_.SetCurrentOffloadConnectedState(currentOffloadConnectionState);
119 manager->OffloadStartPlaying(sessionIds);
120 }
121
OffloadStopPlayingFuzzTest()122 void OffloadStopPlayingFuzzTest()
123 {
124 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
125 manager->Init();
126 constexpr int32_t stateCount = static_cast<int32_t>(BluetoothOffloadState::A2DP_OFFLOAD) + 1;
127 BluetoothOffloadState state = static_cast<BluetoothOffloadState>(GetData<int32_t>() % stateCount);
128 manager->SetA2dpOffloadFlag(state);
129 std::vector<int32_t> sessionIds = {1, 2, 3};
130 manager->OffloadStopPlaying(sessionIds);
131 }
132
UpdateA2dpOffloadFlagForAllStreamFuzzTest()133 void UpdateA2dpOffloadFlagForAllStreamFuzzTest()
134 {
135 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
136 manager->Init();
137 std::unordered_map<uint32_t, bool> sessionIDToSpatializationEnableMap = {
138 {1, true},
139 {2, false}
140 };
141
142 DeviceType deviceType = DEVICE_TYPE_BLUETOOTH_A2DP;
143 std::vector<std::shared_ptr<AudioRendererChangeInfo>> audioRendererChangeInfos;
144 auto changeInfo1 = std::make_shared<AudioRendererChangeInfo>();
145 changeInfo1->sessionId = GetData<uint32_t>();
146 constexpr int32_t rendererStateCount =
147 static_cast<int32_t>(RendererState::RENDERER_PAUSED - RendererState::RENDERER_INVALID) + 1;
148 changeInfo1->rendererState = static_cast<RendererState>(GetData<int32_t>() % rendererStateCount- 1);
149 audioRendererChangeInfos.push_back(changeInfo1);
150
151 auto changeInfo2 = std::make_shared<AudioRendererChangeInfo>();
152 changeInfo2->sessionId = GetData<uint32_t>();
153 changeInfo2->rendererState = static_cast<RendererState>(GetData<int32_t>() % rendererStateCount - 1);
154 audioRendererChangeInfos.push_back(changeInfo2);
155 manager->streamCollector_.audioRendererChangeInfos_ = audioRendererChangeInfos;
156 manager->UpdateA2dpOffloadFlagForAllStream(sessionIDToSpatializationEnableMap, deviceType);
157 }
158
UpdateA2dpOffloadFlagFuzzTest()159 void UpdateA2dpOffloadFlagFuzzTest()
160 {
161 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
162 manager->Init();
163 DeviceType deviceType = DEVICE_TYPE_BLUETOOTH_A2DP;
164 std::vector<Bluetooth::A2dpStreamInfo> allActiveSessions;
165 Bluetooth::A2dpStreamInfo a2dpStreamInfo;
166 a2dpStreamInfo.sessionId = 1;
167 a2dpStreamInfo.streamType = 1;
168 a2dpStreamInfo.isSpatialAudio = false;
169 allActiveSessions.push_back(a2dpStreamInfo);
170 constexpr int32_t stateCount = static_cast<int32_t>(BluetoothOffloadState::A2DP_OFFLOAD) + 1;
171 BluetoothOffloadState state = static_cast<BluetoothOffloadState>(GetData<int32_t>() % stateCount);
172 manager->SetA2dpOffloadFlag(state);
173 manager->UpdateA2dpOffloadFlag(allActiveSessions, deviceType);
174 }
175
HandleA2dpDeviceOutOffloadFuzzTest()176 void HandleA2dpDeviceOutOffloadFuzzTest()
177 {
178 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
179 manager->Init();
180 AudioDeviceDescriptor descriptor;
181 descriptor.deviceType_ = DEVICE_TYPE_BLUETOOTH_A2DP;
182 manager->audioActiveDevice_.SetCurrentOutputDevice(descriptor);
183 constexpr int32_t stateCount = static_cast<int32_t>(BluetoothOffloadState::A2DP_OFFLOAD) + 1;
184 BluetoothOffloadState a2dpOffloadFlag = static_cast<BluetoothOffloadState>(GetData<int32_t>() % stateCount);
185 AudioDeviceDescriptor deviceDescriptor;
186 deviceDescriptor.deviceType_ = DEVICE_TYPE_BLUETOOTH_A2DP;
187 manager->HandleA2dpDeviceOutOffload(a2dpOffloadFlag);
188 }
189
HandleA2dpDeviceInOffloadFuzzTest()190 void HandleA2dpDeviceInOffloadFuzzTest()
191 {
192 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
193 manager->Init();
194 constexpr int32_t stateCount = static_cast<int32_t>(BluetoothOffloadState::A2DP_OFFLOAD) + 1;
195 BluetoothOffloadState state = static_cast<BluetoothOffloadState>(GetData<int32_t>() % stateCount);
196 manager->SetA2dpOffloadFlag(state);
197 AudioDeviceDescriptor deviceDescriptor;
198 deviceDescriptor.deviceType_ = DEVICE_TYPE_BLUETOOTH_A2DP;
199 manager->audioActiveDevice_.SetCurrentOutputDevice(deviceDescriptor);
200 constexpr int32_t currentOffloadConnectionStateCount =
201 static_cast<int32_t>(A2dpOffloadConnectionState::CONNECTION_STATUS_TIMEOUT) + 1;
202 A2dpOffloadConnectionState currentOffloadConnectionState =
203 static_cast<A2dpOffloadConnectionState>(GetData<int32_t>() % currentOffloadConnectionStateCount);
204 manager->audioA2dpOffloadFlag_.SetCurrentOffloadConnectedState(currentOffloadConnectionState);
205 constexpr int32_t a2dpOffloadFlagCount = static_cast<int32_t>(BluetoothOffloadState::A2DP_OFFLOAD) + 1;
206 BluetoothOffloadState a2dpOffloadFlag =
207 static_cast<BluetoothOffloadState>(GetData<int32_t>() % a2dpOffloadFlagCount);
208 manager->HandleA2dpDeviceInOffload(a2dpOffloadFlag);
209 }
210
GetA2dpOffloadCodecAndSendToDspFuzzTest()211 void GetA2dpOffloadCodecAndSendToDspFuzzTest()
212 {
213 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
214 manager->Init();
215 AudioDeviceDescriptor deviceDescriptor;
216 deviceDescriptor.deviceType_ = DEVICE_TYPE_SPEAKER;
217 manager->audioActiveDevice_.SetCurrentOutputDevice(deviceDescriptor);
218 manager->GetA2dpOffloadCodecAndSendToDsp();
219 }
220
FetchStreamForA2dpOffloadFuzzTest()221 void FetchStreamForA2dpOffloadFuzzTest()
222 {
223 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
224 manager->Init();
225 std::vector<std::shared_ptr<AudioRendererChangeInfo>> rendererChangeInfos;
226 auto changeInfo = std::make_shared<AudioRendererChangeInfo>();
227 constexpr int32_t streamUsageCount = static_cast<int32_t>(StreamUsage::STREAM_USAGE_VOICE_CALL_ASSISTANT) + 1;
228 StreamUsage streamUsage = static_cast<StreamUsage>(GetData<int32_t>() % streamUsageCount - 1);
229 changeInfo->rendererInfo.streamUsage = streamUsage;
230 changeInfo->clientUID = GetData<uint32_t>();
231 changeInfo->rendererInfo.rendererFlags = STREAM_USAGE_UNKNOWN;
232 rendererChangeInfos.push_back(changeInfo);
233 manager->streamCollector_.audioRendererChangeInfos_ = rendererChangeInfos;
234 bool requireReset = GetData<uint32_t>() % NUM_2;
235 manager->FetchStreamForA2dpOffload(requireReset);
236 }
237
GetVolumeGroupTypeFuzzTest()238 void GetVolumeGroupTypeFuzzTest()
239 {
240 std::shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
241 manager->Init();
242
243 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
244 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
245 manager->GetVolumeGroupType(deviceType);
246 }
247
OnA2dpPlayingStateChangedFuzzTest()248 void OnA2dpPlayingStateChangedFuzzTest()
249 {
250 shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
251 manager->Init();
252 const std::string deviceAddress = manager->a2dpOffloadDeviceAddress_;
253 int32_t playingState = GetData<uint32_t>();
254 constexpr int32_t currentOffloadConnectionStateCount =
255 static_cast<int32_t>(A2dpOffloadConnectionState::CONNECTION_STATUS_TIMEOUT) + 1;
256 A2dpOffloadConnectionState currentOffloadConnectionState =
257 static_cast<A2dpOffloadConnectionState>(GetData<uint8_t>() % currentOffloadConnectionStateCount);
258 manager->audioA2dpOffloadFlag_.SetCurrentOffloadConnectedState(currentOffloadConnectionState);
259 manager->OnA2dpPlayingStateChanged(deviceAddress, playingState);
260 }
261
IsA2dpOffloadConnectingFuzzTest()262 void IsA2dpOffloadConnectingFuzzTest()
263 {
264 shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
265 manager->Init();
266 manager->connectionTriggerSessionIds_ = {123};
267 constexpr int32_t currentOffloadConnectionStateCount =
268 static_cast<int32_t>(A2dpOffloadConnectionState::CONNECTION_STATUS_TIMEOUT) + 1;
269 A2dpOffloadConnectionState currentOffloadConnectionState =
270 static_cast<A2dpOffloadConnectionState>(GetData<uint8_t>() % currentOffloadConnectionStateCount);
271 manager->audioA2dpOffloadFlag_.SetCurrentOffloadConnectedState(currentOffloadConnectionState);
272 manager->IsA2dpOffloadConnecting(GetData<uint32_t>());
273 }
274
HandleActiveDeviceFuzzTest()275 void HandleActiveDeviceFuzzTest()
276 {
277 shared_ptr<AudioA2dpOffloadManager> manager = std::make_shared<AudioA2dpOffloadManager>();
278 manager->Init();
279 AudioDeviceDescriptor deviceDescriptor;
280 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
281 deviceDescriptor.deviceType_ = DeviceTypeVec[deviceTypeCount];
282 deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
283 manager->audioActiveDevice_.SetCurrentOutputDevice(deviceDescriptor);
284 manager->audioConfigManager_.isUpdateRouteSupported_ = GetData<uint32_t>() % NUM_2;
285 manager->HandleActiveDevice(deviceDescriptor);
286 }
287
288 TestFuncs g_testFuncs[TESTSIZE] = {
289 OffloadStartPlayingFuzzTest,
290 OffloadStopPlayingFuzzTest,
291 UpdateA2dpOffloadFlagForAllStreamFuzzTest,
292 UpdateA2dpOffloadFlagFuzzTest,
293 HandleA2dpDeviceOutOffloadFuzzTest,
294 HandleA2dpDeviceInOffloadFuzzTest,
295 GetA2dpOffloadCodecAndSendToDspFuzzTest,
296 FetchStreamForA2dpOffloadFuzzTest,
297 GetVolumeGroupTypeFuzzTest,
298 OnA2dpPlayingStateChangedFuzzTest,
299 IsA2dpOffloadConnectingFuzzTest,
300 HandleActiveDeviceFuzzTest,
301 };
302
FuzzTest(const uint8_t * rawData,size_t size)303 bool FuzzTest(const uint8_t* rawData, size_t size)
304 {
305 if (rawData == nullptr) {
306 return false;
307 }
308
309 // initialize data
310 RAW_DATA = rawData;
311 g_dataSize = size;
312 g_pos = 0;
313
314 uint32_t code = GetData<uint32_t>();
315 uint32_t len = GetArrLength(g_testFuncs);
316 if (len > 0) {
317 g_testFuncs[code % len]();
318 } else {
319 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
320 }
321
322 return true;
323 }
324 } // namespace AudioStandard
325 } // namesapce OHOS
326
327 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)328 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
329 {
330 if (size < OHOS::AudioStandard::THRESHOLD) {
331 return 0;
332 }
333
334 OHOS::AudioStandard::FuzzTest(data, size);
335 return 0;
336 }
337