1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37
38 #include "audio_source_clock.h"
39 #include "capturer_clock_manager.h"
40 #include "hpae_policy_manager.h"
41 #include "audio_policy_state_monitor.h"
42 #include "audio_device_info.h"
43 #include "audio_server.h"
44 #include "pulseaudio_ipc_interface_code.h"
45
46 namespace OHOS {
47 namespace AudioStandard {
48 using namespace std;
49
50 static const uint8_t* RAW_DATA = nullptr;
51 static size_t g_dataSize = 0;
52 static size_t g_pos;
53 const size_t THRESHOLD = 10;
54 const uint8_t TESTSIZE = 1;
55 bool g_hasPermission = false;
56 const int32_t SYSTEM_ABILITY_ID = 3001;
57 const bool RUN_ON_CREATE = false;
58
59 typedef void (*TestFuncs)();
60
61 template<class T>
GetData()62 T GetData()
63 {
64 T object {};
65 size_t objectSize = sizeof(object);
66 if (g_dataSize < g_pos) {
67 return object;
68 }
69 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
70 return object;
71 }
72 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
73 if (ret != EOK) {
74 return {};
75 }
76 g_pos += objectSize;
77 return object;
78 }
79
80 template<class T>
GetArrLength(T & arr)81 uint32_t GetArrLength(T& arr)
82 {
83 if (arr == nullptr) {
84 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
85 return 0;
86 }
87 return sizeof(arr) / sizeof(arr[0]);
88 }
89
90 vector<AudioServerInterfaceCode> AudioServerInterfaceCodeVec = {
91 AudioServerInterfaceCode::GET_AUDIO_PARAMETER,
92 AudioServerInterfaceCode::SET_AUDIO_PARAMETER,
93 AudioServerInterfaceCode::GET_EXTRA_AUDIO_PARAMETERS,
94 AudioServerInterfaceCode::SET_EXTRA_AUDIO_PARAMETERS,
95 AudioServerInterfaceCode::SET_MICROPHONE_MUTE,
96 AudioServerInterfaceCode::SET_AUDIO_SCENE,
97 AudioServerInterfaceCode::UPDATE_ROUTE_REQ,
98 AudioServerInterfaceCode::UPDATE_ROUTES_REQ,
99 AudioServerInterfaceCode::UPDATE_DUAL_TONE_REQ,
100 AudioServerInterfaceCode::GET_TRANSACTION_ID,
101 AudioServerInterfaceCode::SET_PARAMETER_CALLBACK,
102 AudioServerInterfaceCode::GET_REMOTE_AUDIO_PARAMETER,
103 AudioServerInterfaceCode::SET_REMOTE_AUDIO_PARAMETER,
104 AudioServerInterfaceCode::NOTIFY_DEVICE_INFO,
105 AudioServerInterfaceCode::CHECK_REMOTE_DEVICE_STATE,
106 AudioServerInterfaceCode::SET_VOICE_VOLUME,
107 AudioServerInterfaceCode::SET_AUDIO_MONO_STATE,
108 AudioServerInterfaceCode::SET_AUDIO_BALANCE_VALUE,
109 AudioServerInterfaceCode::CREATE_AUDIOPROCESS,
110 AudioServerInterfaceCode::LOAD_AUDIO_EFFECT_LIBRARIES,
111 AudioServerInterfaceCode::CREATE_AUDIO_EFFECT_CHAIN_MANAGER,
112 AudioServerInterfaceCode::SET_OUTPUT_DEVICE_SINK,
113 AudioServerInterfaceCode::SET_ACTIVE_OUTPUT_DEVICE,
114 AudioServerInterfaceCode::CREATE_PLAYBACK_CAPTURER_MANAGER,
115 AudioServerInterfaceCode::REGISET_POLICY_PROVIDER,
116 AudioServerInterfaceCode::REGISET_CORE_SERVICE_PROVIDER,
117 AudioServerInterfaceCode::SET_WAKEUP_CLOSE_CALLBACK,
118 AudioServerInterfaceCode::UPDATE_SPATIALIZATION_STATE,
119 AudioServerInterfaceCode::UPDATE_SPATIAL_DEVICE_TYPE,
120 AudioServerInterfaceCode::OFFLOAD_SET_VOLUME,
121 AudioServerInterfaceCode::NOTIFY_STREAM_VOLUME_CHANGED,
122 AudioServerInterfaceCode::SET_SPATIALIZATION_SCENE_TYPE,
123 AudioServerInterfaceCode::GET_MAX_AMPLITUDE,
124 AudioServerInterfaceCode::RESET_AUDIO_ENDPOINT,
125 AudioServerInterfaceCode::RESET_ROUTE_FOR_DISCONNECT,
126 AudioServerInterfaceCode::GET_EFFECT_LATENCY,
127 AudioServerInterfaceCode::UPDATE_LATENCY_TIMESTAMP,
128 AudioServerInterfaceCode::SET_ASR_AEC_MODE,
129 AudioServerInterfaceCode::GET_ASR_AEC_MODE,
130 AudioServerInterfaceCode::SET_ASR_NOISE_SUPPRESSION_MODE,
131 AudioServerInterfaceCode::SET_OFFLOAD_MODE,
132 AudioServerInterfaceCode::UNSET_OFFLOAD_MODE,
133 AudioServerInterfaceCode::CHECK_HIBERNATE_STATE,
134 AudioServerInterfaceCode::GET_ASR_NOISE_SUPPRESSION_MODE,
135 AudioServerInterfaceCode::SET_ASR_WHISPER_DETECTION_MODE,
136 AudioServerInterfaceCode::GET_ASR_WHISPER_DETECTION_MODE,
137 AudioServerInterfaceCode::SET_ASR_VOICE_CONTROL_MODE,
138 AudioServerInterfaceCode::SET_ASR_VOICE_MUTE_MODE,
139 AudioServerInterfaceCode::IS_WHISPERING,
140 AudioServerInterfaceCode::GET_EFFECT_OFFLOAD_ENABLED,
141 AudioServerInterfaceCode::GET_AUDIO_EFFECT_PROPERTY_V3,
142 AudioServerInterfaceCode::SET_AUDIO_EFFECT_PROPERTY_V3,
143 AudioServerInterfaceCode::GET_AUDIO_ENHANCE_PROPERTY,
144 AudioServerInterfaceCode::GET_AUDIO_EFFECT_PROPERTY,
145 AudioServerInterfaceCode::SET_AUDIO_ENHANCE_PROPERTY,
146 AudioServerInterfaceCode::SET_AUDIO_EFFECT_PROPERTY,
147 AudioServerInterfaceCode::SUSPEND_RENDERSINK,
148 AudioServerInterfaceCode::RESTORE_RENDERSINK,
149 AudioServerInterfaceCode::LOAD_HDI_EFFECT_MODEL,
150 AudioServerInterfaceCode::UPDATE_EFFECT_BT_OFFLOAD_SUPPORTED,
151 AudioServerInterfaceCode::SET_SINK_MUTE_FOR_SWITCH_DEVICE,
152 AudioServerInterfaceCode::SET_ROTATION_TO_EFFECT,
153 AudioServerInterfaceCode::UPDATE_SESSION_CONNECTION_STATE,
154 AudioServerInterfaceCode::SET_SINGLE_STREAM_MUTE,
155 AudioServerInterfaceCode::RESTORE_SESSION,
156 AudioServerInterfaceCode::CREATE_IPC_OFFLINE_STREAM,
157 AudioServerInterfaceCode::GET_OFFLINE_AUDIO_EFFECT_CHAINS,
158 AudioServerInterfaceCode::GET_STANDBY_STATUS,
159 AudioServerInterfaceCode::GENERATE_SESSION_ID,
160 AudioServerInterfaceCode::GET_ALL_SINK_INPUTS,
161 AudioServerInterfaceCode::SET_DEFAULT_ADAPTER_ENABLE,
162 AudioServerInterfaceCode::NOTIFY_ACCOUNTS_CHANGED,
163 AudioServerInterfaceCode::NOTIFY_AUDIO_POLICY_READY,
164 AudioServerInterfaceCode::SET_CAPTURE_LIMIT,
165 AudioServerInterfaceCode::LOAD_HDI_ADAPTER,
166 AudioServerInterfaceCode::UNLOAD_HDI_ADAPTER,
167 AudioServerInterfaceCode::CHECK_CAPTURE_LIMIT,
168 AudioServerInterfaceCode::RELEASE_CAPTURE_LIMIT,
169 AudioServerInterfaceCode::CREATE_HDI_SINK_PORT,
170 AudioServerInterfaceCode::CREATE_SINK_PORT,
171 AudioServerInterfaceCode::CREATE_HDI_SOURCE_PORT,
172 AudioServerInterfaceCode::CREATE_SOURCE_PORT,
173 AudioServerInterfaceCode::DESTROY_HDI_PORT,
174 AudioServerInterfaceCode::DEVICE_CONNECTED_FLAG,
175 AudioServerInterfaceCode::SET_DM_DEVICE_TYPE,
176 AudioServerInterfaceCode::REGISTER_DATATRANSFER_STATE_PARAM,
177 AudioServerInterfaceCode::UNREGISTER_DATATRANSFER_STATE_PARAM,
178 AudioServerInterfaceCode::REGISTER_DATATRANSFER_CALLBACK,
179 AudioServerInterfaceCode::NOTIFY_SETTINGS_DATA_READY,
180 AudioServerInterfaceCode::IS_ACOSTIC_ECHO_CAMCELER_SUPPORTED,
181 AudioServerInterfaceCode::SET_SESSION_MUTE_STATE,
182 AudioServerInterfaceCode::NOTIFY_MUTE_STATE_CHANGE,
183 AudioServerInterfaceCode::FORCE_STOP_AUDIO_STREAM,
184 AudioServerInterfaceCode::CREATE_AUDIOWORKGROUP,
185 AudioServerInterfaceCode::RELEASE_AUDIOWORKGROUP,
186 AudioServerInterfaceCode::ADD_THREAD_TO_AUDIOWORKGROUP,
187 AudioServerInterfaceCode::REMOVE_THREAD_FROM_AUDIOWORKGROUP,
188 AudioServerInterfaceCode::START_AUDIOWORKGROUP,
189 AudioServerInterfaceCode::STOP_AUDIOWORKGROUP,
190 AudioServerInterfaceCode::SET_BT_HDI_INVALID_STATE,
191 AudioServerInterfaceCode::SET_KARAOKE_PARAMETERS,
192 AudioServerInterfaceCode::IS_AUDIO_LOOPBACK_SUPPORTED,
193 AudioServerInterfaceCode::AUDIO_SERVER_CODE_MAX,
194 };
195
GetPermission()196 void GetPermission()
197 {
198 if (!g_hasPermission) {
199 uint64_t tokenId;
200 constexpr int perNum = 10;
201 const char *perms[perNum] = {
202 "ohos.permission.MICROPHONE",
203 "ohos.permission.MANAGE_INTELLIGENT_VOICE",
204 "ohos.permission.MANAGE_AUDIO_CONFIG",
205 "ohos.permission.MICROPHONE_CONTROL",
206 "ohos.permission.MODIFY_AUDIO_SETTINGS",
207 "ohos.permission.ACCESS_NOTIFICATION_POLICY",
208 "ohos.permission.USE_BLUETOOTH",
209 "ohos.permission.CAPTURE_VOICE_DOWNLINK_AUDIO",
210 "ohos.permission.RECORD_VOICE_CALL",
211 "ohos.permission.MANAGE_SYSTEM_AUDIO_EFFECTS",
212 };
213
214 NativeTokenInfoParams infoInstance = {
215 .dcapsNum = 0,
216 .permsNum = 10,
217 .aclsNum = 0,
218 .dcaps = nullptr,
219 .perms = perms,
220 .acls = nullptr,
221 .processName = "audiofuzztest",
222 .aplStr = "system_basic",
223 };
224 tokenId = GetAccessTokenId(&infoInstance);
225 SetSelfTokenID(tokenId);
226 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
227 g_hasPermission = true;
228 }
229 }
230
OnRemoteRequestFuzzTest()231 void OnRemoteRequestFuzzTest()
232 {
233 GetPermission();
234 std::shared_ptr<AudioServer> audioServer = std::make_shared<AudioServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
235 uint32_t audioServerInterfaceCodeCount = GetData<uint32_t>() % AudioServerInterfaceCodeVec.size();
236 AudioServerInterfaceCode audioServerInterfaceCode = AudioServerInterfaceCodeVec[audioServerInterfaceCodeCount];
237 uint32_t format = static_cast<uint32_t>(audioServerInterfaceCode);
238 MessageParcel data;
239 MessageParcel reply;
240 MessageOption option;
241 audioServer->SetAsrNoiseSuppressionMode(0);
242 audioServer->OnRemoteRequest(format, data, reply, option);
243 }
244
245 TestFuncs g_testFuncs[TESTSIZE] = {
246 OnRemoteRequestFuzzTest,
247 };
248
FuzzTest(const uint8_t * rawData,size_t size)249 void FuzzTest(const uint8_t* rawData, size_t size)
250 {
251 if (rawData == nullptr) {
252 return;
253 }
254
255 // initialize data
256 RAW_DATA = rawData;
257 g_dataSize = size;
258 g_pos = 0;
259
260 uint32_t code = GetData<uint32_t>();
261 uint32_t len = GetArrLength(g_testFuncs);
262 if (len > 0) {
263 g_testFuncs[code % len]();
264 } else {
265 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
266 }
267
268 return;
269 }
270 } // namespace AudioStandard
271 } // namesapce OHOS
272
273 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)274 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
275 {
276 if (size < OHOS::AudioStandard::THRESHOLD) {
277 return 0;
278 }
279
280 OHOS::AudioStandard::FuzzTest(data, size);
281 return 0;
282 }
283