1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37
38 #include "audio_source_clock.h"
39 #include "capturer_clock_manager.h"
40 #include "hpae_policy_manager.h"
41 #include "audio_policy_state_monitor.h"
42 #include "audio_device_info.h"
43 #include "audio_server.h"
44 #include "audio_effect_volume.h"
45 #include "futex_tool.h"
46 #include "format_converter.h"
47 #include "audio_dump_pcm.h"
48 #include "audio_dump_pcm_private.h"
49
50 namespace OHOS {
51 namespace AudioStandard {
52 using namespace std;
53
54 static const uint8_t* RAW_DATA = nullptr;
55 static size_t g_dataSize = 0;
56 static size_t g_pos;
57 const size_t THRESHOLD = 10;
58 const uint8_t TESTSIZE = 14;
59 static int32_t NUM_2 = 2;
60
61 typedef void (*TestFuncs)();
62
63 template<class T>
GetData()64 T GetData()
65 {
66 T object {};
67 size_t objectSize = sizeof(object);
68 if (g_dataSize < g_pos) {
69 return object;
70 }
71 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
72 return object;
73 }
74 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
75 if (ret != EOK) {
76 return {};
77 }
78 g_pos += objectSize;
79 return object;
80 }
81
82 template<class T>
GetArrLength(T & arr)83 uint32_t GetArrLength(T& arr)
84 {
85 if (arr == nullptr) {
86 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
87 return 0;
88 }
89 return sizeof(arr) / sizeof(arr[0]);
90 }
91
InitFuzzTest()92 void InitFuzzTest()
93 {
94 AudioCacheMgrInner audioCacheMgrInner;
95 audioCacheMgrInner.isInited_ = GetData<uint32_t>() % NUM_2;
96 audioCacheMgrInner.Init();
97 }
98
DeInitFuzzTest()99 void DeInitFuzzTest()
100 {
101 AudioCacheMgrInner audioCacheMgrInner;
102 audioCacheMgrInner.DeInit();
103 audioCacheMgrInner.InitCallbackHandler();
104 audioCacheMgrInner.DeInit();
105 }
106
DumpAllMemBlockFuzzTest()107 void DumpAllMemBlockFuzzTest()
108 {
109 AudioCacheMgrInner audioCacheMgrInner;
110 std::shared_ptr<MemChunk> memChunk = std::make_shared<MemChunk>();
111 audioCacheMgrInner.isInited_ = GetData<uint32_t>() % NUM_2;
112 audioCacheMgrInner.memChunkDeque_.push_back(memChunk);
113 audioCacheMgrInner.DumpAllMemBlock();
114 }
115
CacheDataFuzzTest()116 void CacheDataFuzzTest()
117 {
118 std::string dumpFileName;
119 void* srcDataPointer;
120 size_t dataLength;
121 uint8_t srcBuffer[THRESHOLD] = {0};
122 auto audioCacheMgrInner = std::make_shared<AudioCacheMgrInner>();
123 if (audioCacheMgrInner == nullptr) {
124 return;
125 }
126 dumpFileName = "test.txt";
127 srcDataPointer = static_cast<void *>(srcBuffer);
128 dataLength = TESTSIZE;
129 audioCacheMgrInner->isInited_ = GetData<uint32_t>() % NUM_2;
130 audioCacheMgrInner->CacheData(dumpFileName, srcDataPointer, dataLength);
131 audioCacheMgrInner->isDumpingData_ = GetData<uint32_t>() % NUM_2;
132 audioCacheMgrInner->CacheData(dumpFileName, srcDataPointer, dataLength);
133 audioCacheMgrInner->totalMemChunkNums_ = (GetData<uint32_t>() % NUM_2) * NUM_2 - 1;
134 audioCacheMgrInner->CacheData(dumpFileName, srcDataPointer, dataLength);
135 }
136
GetCachedDurationFuzzTest()137 void GetCachedDurationFuzzTest()
138 {
139 int64_t startTime = 0;
140 int64_t endTime = 0;
141 std::shared_ptr<MemChunk> memChunk = std::make_shared<MemChunk>();
142 if (memChunk == nullptr) {
143 return;
144 }
145 AudioCacheMgrInner audioCacheMgrInner;
146 audioCacheMgrInner.isInited_ = GetData<uint32_t>() % NUM_2;
147 audioCacheMgrInner.GetCachedDuration(startTime, endTime);
148 audioCacheMgrInner.memChunkDeque_.push_back(memChunk);
149 audioCacheMgrInner.memChunkDeque_.push_back(memChunk);
150 audioCacheMgrInner.GetCachedDuration(startTime, endTime);
151 }
152
GetDumpParameterFuzzTest()153 void GetDumpParameterFuzzTest()
154 {
155 std::vector<std::string> subKeys;
156 std::vector<std::pair<std::string, std::string>> result;
157 AudioCacheMgrInner audioCacheMgrInner;
158 std::vector<std::string> roleList = {"STATUS", "TIME", "MEMORY", "test"};
159 uint32_t roleListCount = GetData<uint32_t>() % roleList.size();
160 subKeys.push_back(roleList[roleListCount]);
161 audioCacheMgrInner.GetDumpParameter(subKeys, result);
162 }
163
SetDumpParameterFuzzTest()164 void SetDumpParameterFuzzTest()
165 {
166 std::vector<std::pair<std::string, std::string>> params;
167 AudioCacheMgrInner audioCacheMgrInner;
168 std::vector<std::string> roleList = {"OPEN", "CLOSE", "UPLOAD", "test1"};
169 uint32_t roleListCount = GetData<uint32_t>() % roleList.size();
170 params.push_back(std::make_pair(roleList[roleListCount], "test"));
171 audioCacheMgrInner.SetDumpParameter(params);
172 }
173
OnHandleFuzzTest()174 void OnHandleFuzzTest()
175 {
176 int64_t data = 0;
177 auto audioCacheMgrInner = std::make_shared<AudioCacheMgrInner>();
178 if (audioCacheMgrInner == nullptr) {
179 return;
180 }
181 uint32_t code = GetData<uint32_t>() % (AudioCacheMgrInner::RAISE_PRIORITY + 1);
182 audioCacheMgrInner->OnHandle(code, data);
183 }
184
GetMemBlockFuzzTest()185 void GetMemBlockFuzzTest()
186 {
187 size_t dataLength = GetData<size_t>();
188 std::string dumpFileName = "abc";
189 MemBlock curMemBlock;
190 std::shared_ptr<MemChunk> memChunk = std::make_shared<MemChunk>();
191 if (memChunk == nullptr) {
192 return;
193 }
194 memChunk->GetMemBlock(dataLength, dumpFileName, curMemBlock);
195 }
196
GetMemChunkDurationFuzzTest()197 void GetMemChunkDurationFuzzTest()
198 {
199 int64_t startTime = GetData<int64_t>();
200 int64_t endTime = GetData<int64_t>();
201 std::shared_ptr<MemChunk> memChunk = std::make_shared<MemChunk>();
202 if (memChunk == nullptr) {
203 return;
204 }
205 memChunk->GetMemChunkDuration(startTime, endTime);
206 }
207
GetCurUsedMemoryFuzzTest()208 void GetCurUsedMemoryFuzzTest()
209 {
210 size_t dataLength = GetData<size_t>();
211 size_t bufferLength = GetData<size_t>();
212 size_t structLength = GetData<size_t>();
213 std::shared_ptr<MemChunk> memChunk = std::make_shared<MemChunk>();
214 if (memChunk == nullptr) {
215 return;
216 }
217 memChunk->GetCurUsedMemory(dataLength, bufferLength, structLength);
218 }
219
ResetFuzzTest()220 void ResetFuzzTest()
221 {
222 std::shared_ptr<MemChunk> memChunk = std::make_shared<MemChunk>();
223 if (memChunk == nullptr) {
224 return;
225 }
226 memChunk->Reset();
227 }
228
GetCurMemoryConditionFuzzTest()229 void GetCurMemoryConditionFuzzTest()
230 {
231 auto audioCacheMgrInner = std::make_shared<AudioCacheMgrInner>();
232 if (audioCacheMgrInner == nullptr) {
233 return;
234 }
235 size_t dataLength = GetData<size_t>();
236 size_t bufferLength = GetData<size_t>();
237 size_t structLength = GetData<size_t>();
238 audioCacheMgrInner->GetCurMemoryCondition(dataLength, bufferLength, structLength);
239 }
240
PrintCurMemoryConditionFuzzTest()241 void PrintCurMemoryConditionFuzzTest()
242 {
243 AudioCacheMgrInner audioCacheMgrInner;
244 audioCacheMgrInner.PrintCurMemoryCondition();
245 }
246
247 TestFuncs g_testFuncs[TESTSIZE] = {
248 InitFuzzTest,
249 DeInitFuzzTest,
250 DumpAllMemBlockFuzzTest,
251 CacheDataFuzzTest,
252 GetCachedDurationFuzzTest,
253 GetDumpParameterFuzzTest,
254 SetDumpParameterFuzzTest,
255 OnHandleFuzzTest,
256 GetMemBlockFuzzTest,
257 GetMemChunkDurationFuzzTest,
258 GetCurUsedMemoryFuzzTest,
259 ResetFuzzTest,
260 GetCurMemoryConditionFuzzTest,
261 PrintCurMemoryConditionFuzzTest,
262 };
263
FuzzTest(const uint8_t * rawData,size_t size)264 void FuzzTest(const uint8_t* rawData, size_t size)
265 {
266 if (rawData == nullptr) {
267 return;
268 }
269
270 // initialize data
271 RAW_DATA = rawData;
272 g_dataSize = size;
273 g_pos = 0;
274
275 uint32_t code = GetData<uint32_t>();
276 uint32_t len = GetArrLength(g_testFuncs);
277 if (len > 0) {
278 g_testFuncs[code % len]();
279 } else {
280 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
281 }
282
283 return;
284 }
285 } // namespace AudioStandard
286 } // namesapce OHOS
287
288 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)289 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
290 {
291 if (size < OHOS::AudioStandard::THRESHOLD) {
292 return 0;
293 }
294
295 OHOS::AudioStandard::FuzzTest(data, size);
296 return 0;
297 }
298