1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37 #include "hpae_manager.h"
38 #include "audio_info.h"
39
40 namespace OHOS {
41 namespace AudioStandard {
42 using namespace std;
43
44 static const uint8_t* RAW_DATA = nullptr;
45 static size_t g_dataSize = 0;
46 static size_t g_pos;
47 const size_t THRESHOLD = 10;
48 const uint8_t TESTSIZE = 20;
49 static int32_t NUM_2 = 2;
50
51 typedef void (*TestFuncs)();
52
53 template<class T>
GetData()54 T GetData()
55 {
56 T object {};
57 size_t objectSize = sizeof(object);
58 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
59 return object;
60 }
61 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
62 if (ret != EOK) {
63 return {};
64 }
65 g_pos += objectSize;
66 return object;
67 }
68
69 template<class T>
GetArrLength(T & arr)70 uint32_t GetArrLength(T& arr)
71 {
72 if (arr == nullptr) {
73 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
74 return 0;
75 }
76 return sizeof(arr) / sizeof(arr[0]);
77 }
78
79 vector<DeviceType> DeviceTypeVec = {
80 DEVICE_TYPE_NONE,
81 DEVICE_TYPE_INVALID,
82 DEVICE_TYPE_EARPIECE,
83 DEVICE_TYPE_SPEAKER,
84 DEVICE_TYPE_WIRED_HEADSET,
85 DEVICE_TYPE_WIRED_HEADPHONES,
86 DEVICE_TYPE_BLUETOOTH_SCO,
87 DEVICE_TYPE_BLUETOOTH_A2DP,
88 DEVICE_TYPE_BLUETOOTH_A2DP_IN,
89 DEVICE_TYPE_MIC,
90 DEVICE_TYPE_WAKEUP,
91 DEVICE_TYPE_USB_HEADSET,
92 DEVICE_TYPE_DP,
93 DEVICE_TYPE_REMOTE_CAST,
94 DEVICE_TYPE_USB_DEVICE,
95 DEVICE_TYPE_ACCESSORY,
96 DEVICE_TYPE_REMOTE_DAUDIO,
97 DEVICE_TYPE_HDMI,
98 DEVICE_TYPE_LINE_DIGITAL,
99 DEVICE_TYPE_NEARLINK,
100 DEVICE_TYPE_NEARLINK_IN,
101 DEVICE_TYPE_FILE_SINK,
102 DEVICE_TYPE_FILE_SOURCE,
103 DEVICE_TYPE_EXTERN_CABLE,
104 DEVICE_TYPE_DEFAULT,
105 DEVICE_TYPE_USB_ARM_HEADSET,
106 DEVICE_TYPE_MAX,
107 };
108
109 vector<DeviceRole> DeviceRoleVec = {
110 DEVICE_ROLE_NONE,
111 INPUT_DEVICE,
112 OUTPUT_DEVICE,
113 DEVICE_ROLE_MAX,
114 };
115
116 vector<AudioDeviceUsage> AudioDeviceUsageVec = {
117 MEDIA_OUTPUT_DEVICES,
118 MEDIA_INPUT_DEVICES,
119 ALL_MEDIA_DEVICES,
120 CALL_OUTPUT_DEVICES,
121 CALL_INPUT_DEVICES,
122 ALL_CALL_DEVICES,
123 D_ALL_DEVICES,
124 };
125
126 const vector<SourceType> g_testSourceTypes = {
127 SOURCE_TYPE_INVALID,
128 SOURCE_TYPE_MIC,
129 SOURCE_TYPE_VOICE_RECOGNITION,
130 SOURCE_TYPE_PLAYBACK_CAPTURE,
131 SOURCE_TYPE_WAKEUP,
132 SOURCE_TYPE_VOICE_CALL,
133 SOURCE_TYPE_VOICE_COMMUNICATION,
134 SOURCE_TYPE_ULTRASONIC,
135 SOURCE_TYPE_VIRTUAL_CAPTURE,
136 SOURCE_TYPE_VOICE_MESSAGE,
137 SOURCE_TYPE_REMOTE_CAST,
138 SOURCE_TYPE_VOICE_TRANSCRIPTION,
139 SOURCE_TYPE_CAMCORDER,
140 SOURCE_TYPE_UNPROCESSED,
141 SOURCE_TYPE_EC,
142 SOURCE_TYPE_MIC_REF,
143 SOURCE_TYPE_LIVE,
144 SOURCE_TYPE_MAX,
145 };
146
GetActiveA2dpDeviceStreamInfoFuzzTest()147 void GetActiveA2dpDeviceStreamInfoFuzzTest()
148 {
149 AudioStreamInfo streamInfo;
150 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
151 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
152 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
153 audioActiveDevice->GetActiveA2dpDeviceStreamInfo(deviceType, streamInfo);
154 }
155
GetMaxAmplitudeFuzzTest()156 void GetMaxAmplitudeFuzzTest()
157 {
158 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
159 int32_t deviceId = AudioActiveDevice::GetInstance().GetCurrentInputDevice().deviceId_;
160 AudioInterrupt audioInterrupt;
161 audioActiveDevice->GetMaxAmplitude(deviceId, audioInterrupt);
162 }
163
UpdateDeviceFuzzTest()164 void UpdateDeviceFuzzTest()
165 {
166 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
167 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
168 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
169 auto desc = std::make_shared<AudioDeviceDescriptor>(deviceType);
170 int32_t reasonCount = static_cast<int32_t>(AudioStreamDeviceChangeReason::OVERRODE) + 1;
171 auto reason_ = static_cast<AudioStreamDeviceChangeReason>(GetData<uint8_t>() % reasonCount);
172 AudioStreamDeviceChangeReasonExt reason(reason_);
173 std::shared_ptr<AudioRendererChangeInfo> rendererChangeInfo = make_shared<AudioRendererChangeInfo>();
174 rendererChangeInfo->clientUID = GetData<int32_t>();
175 rendererChangeInfo->createrUID = GetData<int32_t>();
176 rendererChangeInfo->sessionId = GetData<int32_t>();
177 audioActiveDevice->UpdateDevice(desc, reason, rendererChangeInfo);
178 }
179
HandleActiveBtFuzzTest()180 void HandleActiveBtFuzzTest()
181 {
182 std::string macAddress = "test";
183 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
184 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
185 AudioDeviceDescriptor deviceDescriptor;
186 deviceDescriptor.deviceType_ = DeviceTypeVec[deviceTypeCount];
187 audioActiveDevice->SetCurrentOutputDevice(deviceDescriptor);
188 deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
189 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
190 audioActiveDevice->HandleActiveBt(deviceType, macAddress);
191 }
192
HandleNegtiveBtFuzzTest()193 void HandleNegtiveBtFuzzTest()
194 {
195 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
196 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
197 AudioDeviceDescriptor deviceDescriptor;
198 deviceDescriptor.deviceType_ = DeviceTypeVec[deviceTypeCount];
199 audioActiveDevice->SetCurrentOutputDevice(deviceDescriptor);
200 deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
201 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
202 audioActiveDevice->HandleNegtiveBt(deviceType);
203 }
204
SetDeviceActiveFuzzTest()205 void SetDeviceActiveFuzzTest()
206 {
207 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
208 uint32_t usageCount = GetData<uint32_t>() % AudioDeviceUsageVec.size();
209 AudioDeviceUsage usage = AudioDeviceUsageVec[usageCount];
210 std::vector<std::shared_ptr<AudioDeviceDescriptor>> callDevices =
211 AudioPolicyUtils::GetInstance().GetAvailableDevicesInner(usage);
212 for (const auto &desc : callDevices) {
213 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
214 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
215 bool active = GetData<uint32_t>() % NUM_2;
216 int32_t uid = GetData<int32_t>();
217 audioActiveDevice->SetDeviceActive(deviceType, active, uid);
218 }
219 }
220
SetCallDeviceActiveFuzzTest()221 void SetCallDeviceActiveFuzzTest()
222 {
223 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
224 uint32_t usageCount = GetData<uint32_t>() % AudioDeviceUsageVec.size();
225 AudioDeviceUsage usage = AudioDeviceUsageVec[usageCount];
226 std::vector<std::shared_ptr<AudioDeviceDescriptor>> callDevices =
227 AudioPolicyUtils::GetInstance().GetAvailableDevicesInner(usage);
228 for (const auto &desc : callDevices) {
229 bool active = GetData<uint32_t>() % NUM_2;
230 audioActiveDevice->SetCallDeviceActive(desc->deviceType_, active, desc->macAddress_);
231 }
232 }
233
CheckActiveOutputDeviceSupportOffloadFuzzTest()234 void CheckActiveOutputDeviceSupportOffloadFuzzTest()
235 {
236 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
237 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
238 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
239 uint32_t roleCount = GetData<uint32_t>() % DeviceRoleVec.size();
240 DeviceRole role = DeviceRoleVec[roleCount];
241 AudioDeviceDescriptor audioDeviceDescriptor(deviceType, role);
242 audioActiveDevice->SetCurrentOutputDevice(audioDeviceDescriptor);
243 audioActiveDevice->CheckActiveOutputDeviceSupportOffload();
244 }
245
IsDirectSupportedDeviceFuzzTest()246 void IsDirectSupportedDeviceFuzzTest()
247 {
248 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
249 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
250 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
251 uint32_t roleCount = GetData<uint32_t>() % DeviceRoleVec.size();
252 DeviceRole role = DeviceRoleVec[roleCount];
253 AudioDeviceDescriptor audioDeviceDescriptor(deviceType, role);
254 audioActiveDevice->SetCurrentOutputDevice(audioDeviceDescriptor);
255 audioActiveDevice->IsDirectSupportedDevice();
256 }
257
IsDeviceActiveFuzzTest()258 void IsDeviceActiveFuzzTest()
259 {
260 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
261 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
262 DeviceType deviceType = DeviceTypeVec[deviceTypeCount];
263 uint32_t roleCount = GetData<uint32_t>() % DeviceRoleVec.size();
264 DeviceRole role = DeviceRoleVec[roleCount];
265 AudioDeviceDescriptor audioDeviceDescriptor(deviceType, role);
266 audioActiveDevice->SetCurrentOutputDevice(audioDeviceDescriptor);
267 deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
268 deviceType = DeviceTypeVec[deviceTypeCount];
269 audioActiveDevice->IsDeviceActive(deviceType);
270 }
271
AudioActiveDeviceGetCurrentOutputDeviceCategoryFuzzTest()272 void AudioActiveDeviceGetCurrentOutputDeviceCategoryFuzzTest()
273 {
274 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
275 if (audioActiveDevice == nullptr) {
276 return;
277 }
278 audioActiveDevice->GetCurrentInputDeviceMacAddr();
279 audioActiveDevice->GetCurrentOutputDeviceCategory();
280 }
281
AudioActiveDeviceNotifyUserSelectionEventToBtFuzzTest()282 void AudioActiveDeviceNotifyUserSelectionEventToBtFuzzTest()
283 {
284 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
285 std::shared_ptr<AudioDeviceDescriptor> audioDeviceDescriptor = std::make_shared<AudioDeviceDescriptor>();
286 if (audioActiveDevice == nullptr || audioDeviceDescriptor == nullptr || DeviceTypeVec.size() == 0) {
287 return;
288 }
289 audioDeviceDescriptor->deviceType_ = DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
290 audioActiveDevice->currentActiveInputDevice_.deviceType_ =
291 DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
292 StreamUsage streamUsage = STREAM_USAGE_ALARM;
293 audioActiveDevice->NotifyUserSelectionEventToBt(audioDeviceDescriptor, streamUsage);
294 }
295
AudioActiveDeviceNotifyUserDisSelectionEventToBtFuzzTest()296 void AudioActiveDeviceNotifyUserDisSelectionEventToBtFuzzTest()
297 {
298 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
299 std::shared_ptr<AudioDeviceDescriptor> audioDeviceDescriptor = std::make_shared<AudioDeviceDescriptor>();
300 if (audioActiveDevice == nullptr || audioDeviceDescriptor == nullptr || DeviceTypeVec.size() == 0) {
301 return;
302 }
303 audioDeviceDescriptor->deviceType_ = DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
304 audioActiveDevice->currentActiveInputDevice_.deviceType_ =
305 DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
306 audioActiveDevice->NotifyUserDisSelectionEventToBt(audioDeviceDescriptor);
307 }
308
AudioActiveDeviceNotifyUserSelectionEventForInputFuzzTest()309 void AudioActiveDeviceNotifyUserSelectionEventForInputFuzzTest()
310 {
311 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
312 std::shared_ptr<AudioDeviceDescriptor> audioDeviceDescriptor = std::make_shared<AudioDeviceDescriptor>();
313 if (audioActiveDevice == nullptr || audioDeviceDescriptor == nullptr || DeviceTypeVec.size() == 0
314 || g_testSourceTypes.size() == 0) {
315 return;
316 }
317 audioDeviceDescriptor->deviceType_ = DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
318 audioActiveDevice->currentActiveInputDevice_.deviceType_ =
319 DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
320 SourceType sourceType = g_testSourceTypes[GetData<uint32_t>() % g_testSourceTypes.size()];
321 audioActiveDevice->NotifyUserSelectionEventForInput(audioDeviceDescriptor, sourceType);
322 }
323
AudioActiveDeviceSetDeviceActiveFuzzTest()324 void AudioActiveDeviceSetDeviceActiveFuzzTest()
325 {
326 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
327 if (audioActiveDevice == nullptr || DeviceTypeVec.size() == 0) {
328 return;
329 }
330 DeviceType deviceType = DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
331 bool active = GetData<uint32_t>() % NUM_2;
332 int32_t uid = GetData<int32_t>();
333 audioActiveDevice->SetDeviceActive(deviceType, active, uid);
334 }
335
AudioActiveDeviceSetCallDeviceActiveFuzzTest()336 void AudioActiveDeviceSetCallDeviceActiveFuzzTest()
337 {
338 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
339 if (audioActiveDevice == nullptr || DeviceTypeVec.size() == 0) {
340 return;
341 }
342 DeviceType deviceType = DeviceTypeVec[GetData<uint32_t>() % DeviceTypeVec.size()];
343 bool active = GetData<uint32_t>() % NUM_2;
344 int32_t uid = GetData<int32_t>();
345 std::string address = "testAddress";
346 audioActiveDevice->SetCallDeviceActive(deviceType, active, address, uid);
347 }
348
AudioActiveDeviceIsDeviceInVectorFuzzTest()349 void AudioActiveDeviceIsDeviceInVectorFuzzTest()
350 {
351 auto audioActiveDevice = std::make_shared<AudioActiveDevice>();
352 if (audioActiveDevice == nullptr) {
353 return;
354 }
355 std::shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
356 std::vector<std::shared_ptr<AudioDeviceDescriptor>> descs;
357 descs.push_back(desc);
358 audioActiveDevice->IsDeviceInVector(desc, descs);
359 }
360
AudioDeviceDescriptorSetClientInfoFuzzTest()361 void AudioDeviceDescriptorSetClientInfoFuzzTest()
362 {
363 AudioDeviceDescriptor deviceDescriptor;
364 std::shared_ptr<AudioDeviceDescriptor::ClientInfo> clientInfo =
365 std::make_shared<AudioDeviceDescriptor::ClientInfo>();
366 deviceDescriptor.GetDeviceCategory();
367 deviceDescriptor.SetClientInfo(clientInfo);
368 }
369
AudioDeviceDescriptorFixApiCompatibilityFuzzTest()370 void AudioDeviceDescriptorFixApiCompatibilityFuzzTest()
371 {
372 AudioDeviceDescriptor deviceDescriptor;
373 int apiVersion = GetData<int>();
374 DeviceRole deviceRole = GetData<DeviceRole>();
375 DeviceType deviceType = GetData<DeviceType>();
376 int32_t deviceId = GetData<int32_t>();
377 DeviceStreamInfo streamInfo;
378 std::list<DeviceStreamInfo> streamInfos;
379 streamInfos.push_back(streamInfo);
380 deviceDescriptor.FixApiCompatibility(apiVersion, deviceRole, deviceType, deviceId, streamInfos);
381 }
382
AudioDeviceDescriptorGetKeyFuzzTest()383 void AudioDeviceDescriptorGetKeyFuzzTest()
384 {
385 AudioDeviceDescriptor deviceDescriptor;
386 deviceDescriptor.GetKey();
387 }
388
389 TestFuncs g_testFuncs[TESTSIZE] = {
390 GetActiveA2dpDeviceStreamInfoFuzzTest,
391 GetMaxAmplitudeFuzzTest,
392 UpdateDeviceFuzzTest,
393 HandleActiveBtFuzzTest,
394 HandleNegtiveBtFuzzTest,
395 SetDeviceActiveFuzzTest,
396 SetCallDeviceActiveFuzzTest,
397 CheckActiveOutputDeviceSupportOffloadFuzzTest,
398 IsDirectSupportedDeviceFuzzTest,
399 IsDeviceActiveFuzzTest,
400 AudioActiveDeviceGetCurrentOutputDeviceCategoryFuzzTest,
401 AudioActiveDeviceNotifyUserSelectionEventToBtFuzzTest,
402 AudioActiveDeviceNotifyUserDisSelectionEventToBtFuzzTest,
403 AudioActiveDeviceNotifyUserSelectionEventForInputFuzzTest,
404 AudioActiveDeviceSetDeviceActiveFuzzTest,
405 AudioActiveDeviceSetCallDeviceActiveFuzzTest,
406 AudioActiveDeviceIsDeviceInVectorFuzzTest,
407 AudioDeviceDescriptorSetClientInfoFuzzTest,
408 AudioDeviceDescriptorFixApiCompatibilityFuzzTest,
409 AudioDeviceDescriptorGetKeyFuzzTest,
410 };
411
FuzzTest(const uint8_t * rawData,size_t size)412 bool FuzzTest(const uint8_t* rawData, size_t size)
413 {
414 if (rawData == nullptr) {
415 return false;
416 }
417
418 // initialize data
419 RAW_DATA = rawData;
420 g_dataSize = size;
421 g_pos = 0;
422
423 uint32_t code = GetData<uint32_t>();
424 uint32_t len = GetArrLength(g_testFuncs);
425 if (len > 0) {
426 g_testFuncs[code % len]();
427 } else {
428 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
429 }
430
431 return true;
432 }
433 } // namespace AudioStandard
434 } // namesapce OHOS
435
436 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)437 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
438 {
439 if (size < OHOS::AudioStandard::THRESHOLD) {
440 return 0;
441 }
442
443 OHOS::AudioStandard::FuzzTest(data, size);
444 return 0;
445 }
446