1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37 #include "hpae_manager.h"
38 #include "audio_info.h"
39 #include "device_status_listener.h"
40 #include "audio_policy_service.h"
41
42 namespace OHOS {
43 namespace AudioStandard {
44 using namespace std;
45
46 static const uint8_t* RAW_DATA = nullptr;
47 static size_t g_dataSize = 0;
48 static size_t g_pos;
49 const size_t THRESHOLD = 10;
50 const uint8_t TESTSIZE = 19;
51 static int32_t NUM_2 = 2;
52
53 typedef void (*TestFuncs)();
54
55 template<class T>
GetData()56 T GetData()
57 {
58 T object {};
59 size_t objectSize = sizeof(object);
60 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
61 return object;
62 }
63 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
64 if (ret != EOK) {
65 return {};
66 }
67 g_pos += objectSize;
68 return object;
69 }
70
71 template<class T>
GetArrLength(T & arr)72 uint32_t GetArrLength(T& arr)
73 {
74 if (arr == nullptr) {
75 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
76 return 0;
77 }
78 return sizeof(arr) / sizeof(arr[0]);
79 }
80
81 vector<SourceType> SourceTypeVec = {
82 SOURCE_TYPE_INVALID,
83 SOURCE_TYPE_MIC,
84 SOURCE_TYPE_VOICE_RECOGNITION,
85 SOURCE_TYPE_PLAYBACK_CAPTURE,
86 SOURCE_TYPE_WAKEUP,
87 SOURCE_TYPE_VOICE_CALL,
88 SOURCE_TYPE_VOICE_COMMUNICATION,
89 SOURCE_TYPE_ULTRASONIC,
90 SOURCE_TYPE_VIRTUAL_CAPTURE,
91 SOURCE_TYPE_VOICE_MESSAGE,
92 SOURCE_TYPE_REMOTE_CAST,
93 SOURCE_TYPE_VOICE_TRANSCRIPTION,
94 SOURCE_TYPE_CAMCORDER,
95 SOURCE_TYPE_UNPROCESSED,
96 SOURCE_TYPE_EC,
97 SOURCE_TYPE_MIC_REF,
98 SOURCE_TYPE_LIVE,
99 SOURCE_TYPE_MAX,
100 };
101
102 vector<DeviceType> DeviceTypeVec = {
103 DEVICE_TYPE_NONE,
104 DEVICE_TYPE_INVALID,
105 DEVICE_TYPE_EARPIECE,
106 DEVICE_TYPE_SPEAKER,
107 DEVICE_TYPE_WIRED_HEADSET,
108 DEVICE_TYPE_WIRED_HEADPHONES,
109 DEVICE_TYPE_BLUETOOTH_SCO,
110 DEVICE_TYPE_BLUETOOTH_A2DP,
111 DEVICE_TYPE_BLUETOOTH_A2DP_IN,
112 DEVICE_TYPE_MIC,
113 DEVICE_TYPE_WAKEUP,
114 DEVICE_TYPE_USB_HEADSET,
115 DEVICE_TYPE_DP,
116 DEVICE_TYPE_REMOTE_CAST,
117 DEVICE_TYPE_USB_DEVICE,
118 DEVICE_TYPE_ACCESSORY,
119 DEVICE_TYPE_REMOTE_DAUDIO,
120 DEVICE_TYPE_HDMI,
121 DEVICE_TYPE_LINE_DIGITAL,
122 DEVICE_TYPE_NEARLINK,
123 DEVICE_TYPE_NEARLINK_IN,
124 DEVICE_TYPE_FILE_SINK,
125 DEVICE_TYPE_FILE_SOURCE,
126 DEVICE_TYPE_EXTERN_CABLE,
127 DEVICE_TYPE_DEFAULT,
128 DEVICE_TYPE_USB_ARM_HEADSET,
129 DEVICE_TYPE_MAX,
130 };
131
132 const vector<AudioDeviceUsage> AudioDeviceUsageVec = {
133 MEDIA_OUTPUT_DEVICES,
134 MEDIA_INPUT_DEVICES,
135 ALL_MEDIA_DEVICES,
136 CALL_OUTPUT_DEVICES,
137 CALL_INPUT_DEVICES,
138 ALL_CALL_DEVICES,
139 D_ALL_DEVICES,
140 };
141
RegisterTrackerFuzzTest()142 void RegisterTrackerFuzzTest()
143 {
144 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
145 int32_t modeCount = static_cast<int32_t>(AudioMode::AUDIO_MODE_RECORD) + 1;
146 AudioMode mode = static_cast<AudioMode>(GetData<uint8_t>() % modeCount);
147 AudioStreamChangeInfo streamChangeInfo;
148 sptr<IRemoteObject> object = nullptr;
149 int32_t apiVersion = GetData<int32_t>();
150 }
151
SendA2dpConnectedWhileRunningFuzzTest()152 void SendA2dpConnectedWhileRunningFuzzTest()
153 {
154 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
155 int32_t rendererStateCount =
156 static_cast<int32_t>(RendererState::RENDERER_PAUSED - RendererState::RENDERER_INVALID) + 1;
157 RendererState rendererState = static_cast<RendererState>(GetData<uint8_t>() % rendererStateCount - 1);
158 uint32_t sessionId = GetData<uint32_t>();
159 audioDeviceLock->audioA2dpOffloadManager_ = std::make_shared<AudioA2dpOffloadManager>();
160 }
161
HandleAudioCaptureStateFuzzTest()162 void HandleAudioCaptureStateFuzzTest()
163 {
164 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
165 int32_t modeCount = static_cast<int32_t>(AudioMode::AUDIO_MODE_RECORD) + 1;
166 AudioMode mode = static_cast<AudioMode>(GetData<uint8_t>() % modeCount);
167 AudioStreamChangeInfo streamChangeInfo;
168 int32_t capturerStateCount = static_cast<int32_t>(CapturerState::CAPTURER_PAUSED) + 1;
169 streamChangeInfo.audioCapturerChangeInfo.capturerState =
170 static_cast<CapturerState>(GetData<uint8_t>() % capturerStateCount);
171 uint32_t sourceTypeCount = GetData<uint32_t>() % SourceTypeVec.size();
172 streamChangeInfo.audioCapturerChangeInfo.capturerInfo.sourceType = SourceTypeVec[sourceTypeCount];
173 }
174
UpdateTrackerFuzzTest()175 void UpdateTrackerFuzzTest()
176 {
177 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
178 int32_t modeCount = static_cast<int32_t>(AudioMode::AUDIO_MODE_RECORD) + 1;
179 AudioMode mode = static_cast<AudioMode>(GetData<uint8_t>() % modeCount);
180 AudioStreamChangeInfo streamChangeInfo;
181 int32_t rendererStateCount =
182 static_cast<int32_t>(RendererState::RENDERER_PAUSED - RendererState::RENDERER_INVALID) + 1;
183 streamChangeInfo.audioRendererChangeInfo.rendererState =
184 static_cast<RendererState>(GetData<uint8_t>() % rendererStateCount - 1);
185 }
186
RegisteredTrackerClientDiedFuzzTest()187 void RegisteredTrackerClientDiedFuzzTest()
188 {
189 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
190 int32_t uidCount = static_cast<int32_t>(AudioPipeType::PIPE_TYPE_DIRECT_VOIP) + 1;
191 pid_t uid = static_cast<pid_t>(GetData<uint8_t>() % uidCount);
192 }
193
OnDeviceStatusUpdatedFuzzTest()194 void OnDeviceStatusUpdatedFuzzTest()
195 {
196 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
197 AudioDeviceDescriptor updatedDesc;
198 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
199 updatedDesc.deviceType_ = DeviceTypeVec[deviceTypeCount];
200 int32_t connectStateCount = static_cast<int32_t>(ConnectState::DEACTIVE_CONNECTED) + 1;
201 updatedDesc.connectState_ = static_cast<ConnectState>(GetData<uint8_t>() % connectStateCount);
202 bool isConnected = GetData<uint32_t>() % NUM_2;
203 audioDeviceLock->OnDeviceStatusUpdated(updatedDesc, isConnected);
204 }
205
GetCurrentRendererChangeInfosFuzzTest()206 void GetCurrentRendererChangeInfosFuzzTest()
207 {
208 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
209 std::vector<std::shared_ptr<AudioRendererChangeInfo>> audioRendererChangeInfos = {
210 std::make_shared<AudioRendererChangeInfo>()
211 };
212 bool hasBTPermission = GetData<uint32_t>() % NUM_2;
213 bool hasSystemPermission = GetData<uint32_t>() % NUM_2;
214 }
215
GetVolumeGroupInfosFuzzTest()216 void GetVolumeGroupInfosFuzzTest()
217 {
218 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
219 audioDeviceLock->audioVolumeManager_.isPrimaryMicModuleInfoLoaded_.store(GetData<uint32_t>() % NUM_2);
220 }
221
SetAudioSceneFuzzTest()222 void SetAudioSceneFuzzTest()
223 {
224 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
225 int32_t audioSceneCount = static_cast<int32_t>(AudioScene::AUDIO_SCENE_MAX - AudioScene::AUDIO_SCENE_INVALID) + 1;
226 AudioScene audioScene = static_cast<AudioScene>(GetData<uint8_t>() % audioSceneCount - 1);
227 }
228
AudioDeviceLockGetDevicesFuzzTest()229 void AudioDeviceLockGetDevicesFuzzTest()
230 {
231 vector<DeviceFlag> testDeviceFlags = {
232 NONE_DEVICES_FLAG,
233 OUTPUT_DEVICES_FLAG,
234 INPUT_DEVICES_FLAG,
235 ALL_DEVICES_FLAG,
236 DISTRIBUTED_OUTPUT_DEVICES_FLAG,
237 DISTRIBUTED_INPUT_DEVICES_FLAG,
238 ALL_DISTRIBUTED_DEVICES_FLAG,
239 ALL_L_D_DEVICES_FLAG,
240 DEVICE_FLAG_MAX,
241 };
242 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
243 if (audioDeviceLock == nullptr || testDeviceFlags.size() == 0) {
244 return;
245 }
246 DeviceFlag deviceFlag = testDeviceFlags[GetData<uint32_t>() % testDeviceFlags.size()];
247 audioDeviceLock->GetDevices(deviceFlag);
248 }
249
AudioDeviceLockGetPreferredOutputDeviceDescriptorsFuzzTest()250 void AudioDeviceLockGetPreferredOutputDeviceDescriptorsFuzzTest()
251 {
252 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
253 if (audioDeviceLock == nullptr) {
254 return;
255 }
256 AudioRendererInfo rendererInfo;
257 std::string networkId = "test_network_id";
258 audioDeviceLock->GetPreferredOutputDeviceDescriptors(rendererInfo, networkId);
259 }
260
AudioDeviceLockGetPreferredInputDeviceDescriptorsFuzzTest()261 void AudioDeviceLockGetPreferredInputDeviceDescriptorsFuzzTest()
262 {
263 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
264 if (audioDeviceLock == nullptr) {
265 return;
266 }
267 AudioCapturerInfo captureInfo;
268 std::string networkId = "test_network_id";
269 audioDeviceLock->GetPreferredInputDeviceDescriptors(captureInfo, networkId);
270 }
271
AudioDeviceLockUpdateAppVolumeFuzzTest()272 void AudioDeviceLockUpdateAppVolumeFuzzTest()
273 {
274 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
275 if (audioDeviceLock == nullptr) {
276 return;
277 }
278 int32_t appUid = GetData<int32_t>();
279 int32_t volume = GetData<int32_t>();
280 audioDeviceLock->UpdateAppVolume(appUid, volume);
281 }
282
AudioDeviceLockOnDeviceInfoUpdatedFuzzTest()283 void AudioDeviceLockOnDeviceInfoUpdatedFuzzTest()
284 {
285 static const vector<DeviceInfoUpdateCommand> testDeviceInfoUpdateCommands = {
286 CATEGORY_UPDATE,
287 CONNECTSTATE_UPDATE,
288 ENABLE_UPDATE,
289 EXCEPTION_FLAG_UPDATE,
290 };
291 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
292 if (audioDeviceLock == nullptr || testDeviceInfoUpdateCommands.size() == 0) {
293 return;
294 }
295 AudioDeviceDescriptor desc;
296 DeviceInfoUpdateCommand command =
297 testDeviceInfoUpdateCommands[GetData<uint32_t>() % testDeviceInfoUpdateCommands.size()];
298 audioDeviceLock->OnDeviceInfoUpdated(desc, command);
299 }
300
AudioDeviceLockOnDeviceStatusUpdatedFuzzTest()301 void AudioDeviceLockOnDeviceStatusUpdatedFuzzTest()
302 {
303 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
304 if (audioDeviceLock == nullptr) {
305 return;
306 }
307
308 DStatusInfo statusInfo;
309 bool isStop = GetData<uint32_t>() % NUM_2;
310 audioDeviceLock->OnDeviceStatusUpdated(statusInfo, isStop);
311 }
312
AudioDeviceLockGetExcludedDevicesFuzzTest()313 void AudioDeviceLockGetExcludedDevicesFuzzTest()
314 {
315 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
316 if (audioDeviceLock == nullptr || AudioDeviceUsageVec.size() == 0) {
317 return;
318 }
319
320 AudioDeviceUsage audioDevUsage = AudioDeviceUsageVec[GetData<uint32_t>() % AudioDeviceUsageVec.size()];
321 audioDeviceLock->GetExcludedDevices(audioDevUsage);
322 }
323
AudioDeviceLockOnPnpDeviceStatusUpdatedFuzzTest()324 void AudioDeviceLockOnPnpDeviceStatusUpdatedFuzzTest()
325 {
326 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
327 if (audioDeviceLock == nullptr) {
328 return;
329 }
330
331 AudioDeviceDescriptor desc;
332 bool isConnected = GetData<uint32_t>() % NUM_2;
333 audioDeviceLock->OnPnpDeviceStatusUpdated(desc, isConnected);
334 }
335
AudioDeviceLockUpdateSpatializationSupportedFuzzTest()336 void AudioDeviceLockUpdateSpatializationSupportedFuzzTest()
337 {
338 auto audioDeviceLock = std::make_shared<AudioDeviceLock>();
339 if (audioDeviceLock == nullptr) {
340 return;
341 }
342
343 std::string macAddress = "test_mac_address";
344 bool support = GetData<uint32_t>() % NUM_2;
345 audioDeviceLock->UpdateSpatializationSupported(macAddress, support);
346 }
347
AudioDeviceDescriptorMarshallingToDeviceInfoFuzzTest()348 void AudioDeviceDescriptorMarshallingToDeviceInfoFuzzTest()
349 {
350 Parcel parcel;
351 std::shared_ptr<AudioDeviceDescriptor> audioDeviceDescriptor = std::make_shared<AudioDeviceDescriptor>();
352 if (audioDeviceDescriptor == nullptr) {
353 return;
354 }
355 audioDeviceDescriptor->deviceType_ = GetData<DeviceType>();
356 bool hasBTPermission = GetData<bool>();
357 bool hasSystemPermission = GetData<bool>();
358 int32_t apiVersion = GetData<int32_t>();
359 audioDeviceDescriptor->MarshallingToDeviceInfo(parcel, hasBTPermission, hasSystemPermission, apiVersion);
360 }
361
362 TestFuncs g_testFuncs[TESTSIZE] = {
363 RegisterTrackerFuzzTest,
364 SendA2dpConnectedWhileRunningFuzzTest,
365 HandleAudioCaptureStateFuzzTest,
366 UpdateTrackerFuzzTest,
367 RegisteredTrackerClientDiedFuzzTest,
368 OnDeviceStatusUpdatedFuzzTest,
369 GetCurrentRendererChangeInfosFuzzTest,
370 GetVolumeGroupInfosFuzzTest,
371 SetAudioSceneFuzzTest,
372 AudioDeviceLockGetDevicesFuzzTest,
373 AudioDeviceLockGetPreferredOutputDeviceDescriptorsFuzzTest,
374 AudioDeviceLockGetPreferredInputDeviceDescriptorsFuzzTest,
375 AudioDeviceLockUpdateAppVolumeFuzzTest,
376 AudioDeviceLockOnDeviceInfoUpdatedFuzzTest,
377 AudioDeviceLockOnDeviceStatusUpdatedFuzzTest,
378 AudioDeviceLockGetExcludedDevicesFuzzTest,
379 AudioDeviceLockOnPnpDeviceStatusUpdatedFuzzTest,
380 AudioDeviceLockUpdateSpatializationSupportedFuzzTest,
381 AudioDeviceDescriptorMarshallingToDeviceInfoFuzzTest
382 };
383
FuzzTest(const uint8_t * rawData,size_t size)384 bool FuzzTest(const uint8_t* rawData, size_t size)
385 {
386 if (rawData == nullptr) {
387 return false;
388 }
389
390 // initialize data
391 RAW_DATA = rawData;
392 g_dataSize = size;
393 g_pos = 0;
394
395 uint32_t code = GetData<uint32_t>();
396 uint32_t len = GetArrLength(g_testFuncs);
397 if (len > 0) {
398 g_testFuncs[code % len]();
399 } else {
400 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
401 }
402
403 return true;
404 }
405 } // namespace AudioStandard
406 } // namesapce OHOS
407
408 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)409 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
410 {
411 if (size < OHOS::AudioStandard::THRESHOLD) {
412 return 0;
413 }
414
415 OHOS::AudioStandard::FuzzTest(data, size);
416 return 0;
417 }
418