1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_info.h"
20 #include "audio_policy_server.h"
21 #include "audio_policy_server_handler.h"
22 #include "audio_device_info.h"
23 using namespace std;
24
25 namespace OHOS {
26 namespace AudioStandard {
27 using namespace std;
28 const uint64_t CAPSESSION_ID = 123456;
29 static const uint8_t *RAW_DATA = nullptr;
30 static size_t g_dataSize = 0;
31 static size_t g_pos;
32 const size_t THRESHOLD = 10;
33
34 /*
35 * describe: get data from outside untrusted data(RAW_DATA) which size is according to sizeof(T)
36 * tips: only support basic type
37 */
38 template<class T>
GetData()39 T GetData()
40 {
41 T object {};
42 size_t objectSize = sizeof(object);
43 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
44 return object;
45 }
46 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
47 if (ret != EOK) {
48 return {};
49 }
50 g_pos += objectSize;
51 return object;
52 }
53
54 template<class T>
GetArrLength(T & arr)55 uint32_t GetArrLength(T& arr)
56 {
57 if (arr == nullptr) {
58 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
59 return 0;
60 }
61 return sizeof(arr) / sizeof(arr[0]);
62 }
63
AudioEffectServiceFuzzTest()64 void AudioEffectServiceFuzzTest()
65 {
66 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
67 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
68 std::shared_ptr<IAudioInterruptEventDispatcher> dispatcher = nullptr;
69 audioPolicyServerHandler->Init(dispatcher);
70
71 int32_t clientPid = GetData<int32_t>();
72 sptr<IAudioPolicyClient> cb = nullptr;
73 audioPolicyServerHandler->AddAudioPolicyClientProxyMap(clientPid, cb);
74
75 pid_t removeClientPid = GetData<pid_t>();
76 audioPolicyServerHandler->RemoveAudioPolicyClientProxyMap(removeClientPid);
77
78 int32_t clientId = GetData<int32_t>();
79 std::shared_ptr<AudioInterruptCallback> audioInterruptCallback = nullptr;
80 audioPolicyServerHandler->AddExternInterruptCbsMap(clientId, audioInterruptCallback);
81 audioPolicyServerHandler->RemoveExternInterruptCbsMap(clientId);
82
83 AudioDeviceUsage usage = GetData<AudioDeviceUsage>();
84 sptr<IStandardAudioPolicyManagerListener> audioPolicyManagerListener = nullptr;
85 audioPolicyServerHandler->AddAvailableDeviceChangeMap(clientId, usage, audioPolicyManagerListener);
86 audioPolicyServerHandler->RemoveAvailableDeviceChangeMap(clientId, usage);
87
88 sptr<IStandardAudioRoutingManagerListener> audioRoutingManagerListener = nullptr;
89 audioPolicyServerHandler->AddDistributedRoutingRoleChangeCbsMap(clientId, audioRoutingManagerListener);
90 audioPolicyServerHandler->RemoveDistributedRoutingRoleChangeCbsMap(clientId);
91 }
92
AudioSendCallbackFuzzTest()93 void AudioSendCallbackFuzzTest()
94 {
95 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
96 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
97 std::vector<std::shared_ptr<AudioDeviceDescriptor>> desc;
98 audioPolicyServerHandler->SendDeviceChangedCallback(desc, true);
99 audioPolicyServerHandler->SendDeviceChangedCallback(desc, false);
100
101 DeviceBlockStatus status = GetData<DeviceBlockStatus>();
102 audioPolicyServerHandler->SendMicrophoneBlockedCallback(desc, status);
103
104 audioPolicyServerHandler->SendAvailableDeviceChange(desc, true);
105 audioPolicyServerHandler->SendAvailableDeviceChange(desc, false);
106
107 VolumeEvent volumeEvent;
108 audioPolicyServerHandler->SendVolumeKeyEventCallback(volumeEvent);
109
110 std::pair<int32_t, AudioSessionDeactiveEvent> sessionDeactivePair;
111 audioPolicyServerHandler->SendAudioSessionDeactiveCallback(sessionDeactivePair);
112
113 int32_t callbackCategory = GetData<int32_t>();
114 AudioInterrupt audioInterrupt;
115 std::list<std::pair<AudioInterrupt, AudioFocuState>> focusInfoList;
116 audioPolicyServerHandler->SendAudioFocusInfoChangeCallback(callbackCategory, audioInterrupt, focusInfoList);
117
118 AudioRingerMode ringMode = GetData<AudioRingerMode>();
119 audioPolicyServerHandler->SendRingerModeUpdatedCallback(ringMode);
120
121 MicStateChangeEvent micStateChangeEvent;
122 int32_t clientId = GetData<int32_t>();
123 audioPolicyServerHandler->SendMicStateUpdatedCallback(micStateChangeEvent);
124 audioPolicyServerHandler->SendMicStateWithClientIdCallback(micStateChangeEvent, clientId);
125
126 InterruptEventInternal interruptEvent;
127 uint32_t sessionId = GetData<uint32_t>();
128 audioPolicyServerHandler->SendInterruptEventInternalCallback(interruptEvent);
129 audioPolicyServerHandler->SendInterruptEventWithSessionIdCallback(interruptEvent, sessionId);
130 audioPolicyServerHandler->SendInterruptEventWithClientIdCallback(interruptEvent, clientId);
131 }
132
AudioPolicyServSendFuzzTest()133 void AudioPolicyServSendFuzzTest()
134 {
135 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
136 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
137
138 audioPolicyServerHandler->SendPreferredOutputDeviceUpdated();
139 audioPolicyServerHandler->SendPreferredInputDeviceUpdated();
140
141 std::shared_ptr<AudioDeviceDescriptor> descriptor;
142 CastType type = GetData<CastType>();
143 audioPolicyServerHandler->SendDistributedRoutingRoleChange(descriptor, type);
144
145 std::vector<std::shared_ptr<AudioRendererChangeInfo>> audioRendererChangeInfos;
146 audioPolicyServerHandler->SendRendererInfoEvent(audioRendererChangeInfos);
147
148 std::vector<std::shared_ptr<AudioCapturerChangeInfo>> audioCapturerChangeInfos;
149 audioPolicyServerHandler->SendCapturerInfoEvent(audioCapturerChangeInfos);
150
151 int32_t clientPid = GetData<int32_t>();
152 uint32_t sessionId = GetData<uint32_t>();
153 int32_t streamFlag = GetData<int32_t>();
154 AudioDeviceDescriptor outputDeviceInfo(AudioDeviceDescriptor::DEVICE_INFO);
155 AudioStreamDeviceChangeReasonExt reason = AudioStreamDeviceChangeReasonExt::ExtEnum::UNKNOWN;
156 audioPolicyServerHandler->SendRendererDeviceChangeEvent(clientPid, sessionId, outputDeviceInfo, reason);
157 audioPolicyServerHandler->SendRecreateRendererStreamEvent(clientPid, sessionId, streamFlag, reason);
158 audioPolicyServerHandler->SendRecreateCapturerStreamEvent(clientPid, sessionId, streamFlag, reason);
159
160 AudioCapturerInfo capturerInfo;
161 AudioStreamInfo streamInfo;
162 uint64_t sendCapturerSessionId = CAPSESSION_ID;
163 int32_t error = GetData<int32_t>();
164 audioPolicyServerHandler->SendCapturerCreateEvent(capturerInfo, streamInfo, sendCapturerSessionId, true, error);
165 audioPolicyServerHandler->SendCapturerCreateEvent(capturerInfo, streamInfo, sendCapturerSessionId, false, error);
166 audioPolicyServerHandler->SendCapturerRemovedEvent(sendCapturerSessionId, true);
167 audioPolicyServerHandler->SendCapturerRemovedEvent(sendCapturerSessionId, false);
168 audioPolicyServerHandler->SendWakeupCloseEvent(true);
169 audioPolicyServerHandler->SendWakeupCloseEvent(false);
170
171 std::unordered_map<std::string, bool> changeInfo;
172 audioPolicyServerHandler->SendHeadTrackingDeviceChangeEvent(changeInfo);
173 audioPolicyServerHandler->SendSpatializatonEnabledChangeEvent(true);
174 audioPolicyServerHandler->SendSpatializatonEnabledChangeEvent(false);
175
176 std::shared_ptr<AudioDeviceDescriptor> selectedAudioDevice;
177 audioPolicyServerHandler->SendSpatializatonEnabledChangeForAnyDeviceEvent(selectedAudioDevice, true);
178 audioPolicyServerHandler->SendSpatializatonEnabledChangeForAnyDeviceEvent(selectedAudioDevice, false);
179 audioPolicyServerHandler->SendHeadTrackingEnabledChangeEvent(true);
180 audioPolicyServerHandler->SendHeadTrackingEnabledChangeEvent(false);
181 audioPolicyServerHandler->SendHeadTrackingEnabledChangeForAnyDeviceEvent(selectedAudioDevice, true);
182 audioPolicyServerHandler->SendHeadTrackingEnabledChangeForAnyDeviceEvent(selectedAudioDevice, false);
183
184 AudioPipeType pipeType = GetData<AudioPipeType>();
185 audioPolicyServerHandler->SendPipeStreamCleanEvent(pipeType);
186 }
187
AudioPolicyServHandleFuzzTest()188 void AudioPolicyServHandleFuzzTest()
189 {
190 std::shared_ptr<AudioPolicyServerHandler> audioPolicyServerHandler =
191 DelayedSingleton<AudioPolicyServerHandler>::GetInstance();
192
193 CallbackChange callbackchange = GetData<CallbackChange>();
194 audioPolicyServerHandler->SetClientCallbacksEnable(callbackchange, true);
195 audioPolicyServerHandler->SetClientCallbacksEnable(callbackchange, false);
196 }
197
198 typedef void (*TestFuncs[4])();
199
200 TestFuncs g_testFuncs = {
201 AudioEffectServiceFuzzTest,
202 AudioSendCallbackFuzzTest,
203 AudioPolicyServSendFuzzTest,
204 AudioPolicyServHandleFuzzTest,
205 };
206
FuzzTest(const uint8_t * rawData,size_t size)207 bool FuzzTest(const uint8_t* rawData, size_t size)
208 {
209 if (rawData == nullptr) {
210 return false;
211 }
212
213 // initialize data
214 RAW_DATA = rawData;
215 g_dataSize = size;
216 g_pos = 0;
217
218 uint32_t code = GetData<uint32_t>();
219 uint32_t len = GetArrLength(g_testFuncs);
220 if (len > 0) {
221 g_testFuncs[code % len]();
222 } else {
223 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
224 }
225
226 return true;
227 }
228 } // namespace AudioStandard
229 } // namesapce OHOS
230
231 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)232 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
233 {
234 if (size < OHOS::AudioStandard::THRESHOLD) {
235 return 0;
236 }
237
238 OHOS::AudioStandard::FuzzTest(data, size);
239 return 0;
240 }