1 /*
2 * Copyright (c) 2024-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include "audio_service.h"
20 #include "ipc_stream_stub.h"
21 #include "ipc_stream_in_server.h"
22 #include "none_mix_engine.h"
23 #include "securec.h"
24 #include "audio_errors.h"
25 #include "audio_service_log.h"
26 using namespace std;
27
28 namespace OHOS {
29 namespace AudioStandard {
30 constexpr int32_t DEFAULT_STREAM_ID = 10;
31 const std::u16string FORMMGR_INTERFACE_TOKEN = u"IStandardAudioService";
32 const uint64_t COMMON_LENGTH_NUM = 2;
33 const uint32_t OPERATION_ENUM_NUM = 13;
34 const uint32_t SOURCETYPE_ENUM_NUM = 4;
35 const uint32_t NUM = 1;
36 static const uint8_t* RAW_DATA = nullptr;
37 static size_t g_dataSize = 0;
38 static size_t g_pos;
39 const size_t THRESHOLD = 10;
40
41 /*
42 * describe: get data from outside untrusted data(g_data) which size is according to sizeof(T)
43 * tips: only support basic type
44 */
45 template<class T>
GetData()46 T GetData()
47 {
48 T object {};
49 size_t objectSize = sizeof(object);
50 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
51 return object;
52 }
53 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
54 if (ret != EOK) {
55 return {};
56 }
57 g_pos += objectSize;
58 return object;
59 }
60
61 template<class T>
GetArrLength(T & arr)62 uint32_t GetArrLength(T& arr)
63 {
64 if (arr == nullptr) {
65 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
66 return 0;
67 }
68 return sizeof(arr) / sizeof(arr[0]);
69 }
70
InitProcessConfig()71 static AudioProcessConfig InitProcessConfig()
72 {
73 AudioProcessConfig config;
74 config.appInfo.appUid = DEFAULT_STREAM_ID;
75 config.appInfo.appPid = DEFAULT_STREAM_ID;
76 config.streamInfo.format = SAMPLE_S32LE;
77 config.streamInfo.samplingRate = SAMPLE_RATE_48000;
78 config.streamInfo.channels = STEREO;
79 config.streamInfo.channelLayout = AudioChannelLayout::CH_LAYOUT_STEREO;
80 config.audioMode = AudioMode::AUDIO_MODE_PLAYBACK;
81 config.streamType = AudioStreamType::STREAM_MUSIC;
82 config.deviceType = DEVICE_TYPE_USB_HEADSET;
83 return config;
84 }
85
AudioServiceMoreFuzzTest()86 void AudioServiceMoreFuzzTest()
87 {
88 AudioProcessConfig config;
89 config.appInfo.appUid = DEFAULT_STREAM_ID;
90 config.appInfo.appPid = DEFAULT_STREAM_ID;
91 config.streamInfo.format = SAMPLE_S32LE;
92 config.streamInfo.samplingRate = SAMPLE_RATE_48000;
93 config.streamInfo.channels = STEREO;
94 config.streamInfo.channelLayout = AudioChannelLayout::CH_LAYOUT_STEREO;
95 config.audioMode = AudioMode::AUDIO_MODE_RECORD;
96 config.streamType = AudioStreamType::STREAM_MUSIC;
97 config.deviceType = DEVICE_TYPE_USB_HEADSET;
98
99 AudioService *audioServicePtr = AudioService::GetInstance();
100 sptr<AudioProcessInServer> processStream = AudioProcessInServer::Create(config, audioServicePtr);
101 std::shared_ptr<AudioProcessInServer> audioProcessInServer =
102 std::make_shared<AudioProcessInServer>(config, audioServicePtr);
103 audioProcessInServer->Release(true);
104 audioProcessInServer->Release(false);
105
106 uint32_t sessionId = GetData<uint32_t>();
107 AudioPlaybackCaptureConfig newConfig;
108 audioServicePtr->UpdateMuteControlSet(sessionId, true);
109 audioServicePtr->UpdateMuteControlSet(sessionId, false);
110 audioServicePtr->EnableDualToneList(sessionId);
111 audioServicePtr->OnCapturerFilterChange(sessionId, newConfig, 1);
112 audioServicePtr->OnCapturerFilterRemove(sessionId, 1);
113
114 int32_t ret = GetData<int32_t>();
115 audioServicePtr->workingConfigs_[1];
116 audioServicePtr->GetIpcStream(config, ret);
117 #ifdef HAS_FEATURE_INNERCAPTURER
118 audioServicePtr->ShouldBeInnerCap(config, 1);
119 audioServicePtr->ShouldBeDualTone(config);
120
121 audioServicePtr->OnInitInnerCapList(1);
122 audioServicePtr->OnUpdateInnerCapList(1);
123 audioServicePtr->ResetAudioEndpoint();
124 #endif
125 uint32_t sourceTypeInt = GetData<uint32_t>();
126 sourceTypeInt = (sourceTypeInt % SOURCETYPE_ENUM_NUM) - NUM;
127 SourceType sourceType = static_cast<SourceType>(sourceTypeInt);
128 audioServicePtr->UpdateSourceType(sourceType);
129 }
130
AudioCapturerInServerMoreFuzzTest()131 void AudioCapturerInServerMoreFuzzTest()
132 {
133 AudioProcessConfig config = InitProcessConfig();
134 std::weak_ptr<IStreamListener> innerListener;
135 std::shared_ptr<CapturerInServer> capturerInServer = std::make_shared<CapturerInServer>(config, innerListener);
136 if (capturerInServer == nullptr) {
137 return;
138 }
139
140 RestoreInfo restoreInfo;
141 restoreInfo.restoreReason = static_cast<RestoreReason>(GetData<int32_t>());
142 restoreInfo.targetStreamFlag = GetData<int32_t>();
143 uint32_t operationInt = GetData<uint32_t>();
144 operationInt = (operationInt % OPERATION_ENUM_NUM) - NUM;
145 IOperation operation = static_cast<IOperation>(operationInt);
146 capturerInServer->OnStatusUpdate(operation);
147
148 size_t length = COMMON_LENGTH_NUM;
149 capturerInServer->ReadData(length);
150 #ifdef HAS_FEATURE_INNERCAPTURER
151 AudioPlaybackCaptureConfig captureconfig;
152 capturerInServer->UpdatePlaybackCaptureConfig(captureconfig);
153 #endif
154 capturerInServer->SetNonInterruptMute(true);
155 if (capturerInServer->isInited_ == true) {
156 capturerInServer->RestoreSession(restoreInfo);
157 }
158 }
159
AudioNoneMixEngineMoreFuzzTest()160 void AudioNoneMixEngineMoreFuzzTest()
161 {
162 std::shared_ptr<NoneMixEngine> noneMixEngine = std::make_shared<NoneMixEngine>();
163 noneMixEngine->isInit_ = true;
164 AudioDeviceDescriptor type(AudioDeviceDescriptor::DEVICE_INFO);
165 type.deviceType_ = DEVICE_TYPE_USB_HEADSET;
166 noneMixEngine->Init(type, true);
167 noneMixEngine->Start();
168
169 noneMixEngine->isStart_ = true;
170 noneMixEngine->Stop();
171 noneMixEngine->PauseAsync();
172
173 noneMixEngine->MixStreams();
174 noneMixEngine->IsPlaybackEngineRunning();
175 noneMixEngine->StandbySleep();
176
177 std::vector<AudioSamplingRate> audioSamplingRate = {
178 SAMPLE_RATE_16000,
179 SAMPLE_RATE_48000,
180 };
181 uint32_t sourceTypeInt = GetData<uint32_t>();
182 sourceTypeInt = sourceTypeInt % audioSamplingRate.size();
183 AudioSamplingRate samplingRate = audioSamplingRate[sourceTypeInt];
184 noneMixEngine->GetDirectVoipSampleRate(samplingRate);
185 }
186
187 typedef void (*TestFuncs[3])();
188
189 TestFuncs g_testFuncs = {
190 AudioServiceMoreFuzzTest,
191 AudioCapturerInServerMoreFuzzTest,
192 AudioNoneMixEngineMoreFuzzTest,
193 };
194
FuzzTest(const uint8_t * rawData,size_t size)195 bool FuzzTest(const uint8_t* rawData, size_t size)
196 {
197 if (rawData == nullptr) {
198 return false;
199 }
200
201 // initialize data
202 RAW_DATA = rawData;
203 g_dataSize = size;
204 g_pos = 0;
205
206 uint32_t code = GetData<uint32_t>();
207 uint32_t len = GetArrLength(g_testFuncs);
208 if (len > 0) {
209 g_testFuncs[code % len]();
210 } else {
211 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
212 }
213
214 return true;
215 }
216 } // namespace AudioStandard
217 } // namesapce OHOS
218
219 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)220 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
221 {
222 if (size < OHOS::AudioStandard::THRESHOLD) {
223 return 0;
224 }
225
226 OHOS::AudioStandard::FuzzTest(data, size);
227 return 0;
228 }