1 /*
2 * Copyright (c) 2024-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "audio_log.h"
17 #include "audio_session_service.h"
18
19 using namespace std;
20
21 namespace OHOS {
22 namespace AudioStandard {
23
24 static const uint8_t* RAW_DATA = nullptr;
25 static size_t g_dataSize = 0;
26 static size_t g_pos;
27 const size_t THRESHOLD = 10;
28 typedef void (*TestPtr)();
29
30 const vector<AudioStreamType> g_testAudioStreamTypes = {
31 STREAM_DEFAULT,
32 STREAM_VOICE_CALL,
33 STREAM_MUSIC,
34 STREAM_RING,
35 STREAM_MEDIA,
36 STREAM_VOICE_ASSISTANT,
37 STREAM_SYSTEM,
38 STREAM_ALARM,
39 STREAM_NOTIFICATION,
40 STREAM_BLUETOOTH_SCO,
41 STREAM_ENFORCED_AUDIBLE,
42 STREAM_DTMF,
43 STREAM_TTS,
44 STREAM_ACCESSIBILITY,
45 STREAM_RECORDING,
46 STREAM_MOVIE,
47 STREAM_GAME,
48 STREAM_SPEECH,
49 STREAM_SYSTEM_ENFORCED,
50 STREAM_ULTRASONIC,
51 STREAM_WAKEUP,
52 STREAM_VOICE_MESSAGE,
53 STREAM_NAVIGATION,
54 STREAM_INTERNAL_FORCE_STOP,
55 STREAM_SOURCE_VOICE_CALL,
56 STREAM_VOICE_COMMUNICATION,
57 STREAM_VOICE_RING,
58 STREAM_VOICE_CALL_ASSISTANT,
59 STREAM_CAMCORDER,
60 STREAM_APP,
61 STREAM_TYPE_MAX,
62 STREAM_ALL,
63 };
64
65 template<class T>
GetArrLength(T & arr)66 uint32_t GetArrLength(T& arr)
67 {
68 if (arr == nullptr) {
69 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
70 return 0;
71 }
72 return sizeof(arr) / sizeof(arr[0]);
73 }
74
75 template<class T>
GetData()76 T GetData()
77 {
78 T object {};
79 size_t objectSize = sizeof(object);
80 if (g_dataSize < g_pos) {
81 return object;
82 }
83 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
84 return object;
85 }
86 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
87 if (ret != EOK) {
88 return {};
89 }
90 g_pos += objectSize;
91 return object;
92 }
93
AudioSessionServiceIsSameTypeForAudioSessionFuzzTest()94 void AudioSessionServiceIsSameTypeForAudioSessionFuzzTest()
95 {
96 auto audioSessionService = std::make_shared<AudioSessionService>();
97 if (g_testAudioStreamTypes.size() == 0 || audioSessionService == nullptr) {
98 return;
99 }
100 AudioStreamType incomingType = g_testAudioStreamTypes[GetData<uint32_t>() % g_testAudioStreamTypes.size()];
101 AudioStreamType existedType = g_testAudioStreamTypes[GetData<uint32_t>() % g_testAudioStreamTypes.size()];
102 audioSessionService->IsSameTypeForAudioSession(incomingType, existedType);
103 }
104
AudioSessionServiceActivateAudioSessionFuzzTest()105 void AudioSessionServiceActivateAudioSessionFuzzTest()
106 {
107 auto audioSessionService = std::make_shared<AudioSessionService>();
108 if (audioSessionService == nullptr) {
109 return;
110 }
111 int32_t callerPid = GetData<int32_t>();
112 AudioSessionStrategy strategy;
113 std::shared_ptr<AudioSessionStateMonitor> audioSessionStateMonitor = nullptr;
114 auto audioSession = std::make_shared<AudioSession>(callerPid, strategy, audioSessionStateMonitor);
115 bool ifNull = GetData<bool>();
116 if (ifNull) {
117 audioSession = nullptr;
118 }
119 audioSessionService->sessionMap_.insert(make_pair(callerPid, audioSession));
120 audioSessionService->ActivateAudioSession(callerPid, strategy);
121 }
122
AudioSessionServiceDeactivateAudioSessionFuzzTest()123 void AudioSessionServiceDeactivateAudioSessionFuzzTest()
124 {
125 auto audioSessionService = std::make_shared<AudioSessionService>();
126 if (audioSessionService == nullptr) {
127 return;
128 }
129 int32_t callerPid = GetData<int32_t>();
130 AudioSessionStrategy strategy;
131 std::shared_ptr<AudioSessionStateMonitor> audioSessionStateMonitor = nullptr;
132 auto audioSession = std::make_shared<AudioSession>(callerPid, strategy, audioSessionStateMonitor);
133 bool isAddMap = GetData<bool>();
134 if (isAddMap) {
135 audioSessionService->sessionMap_.insert(make_pair(callerPid, audioSession));
136 }
137 audioSessionService->DeactivateAudioSession(callerPid);
138 }
139
AudioSessionServiceIsAudioSessionActivatedFuzzTest()140 void AudioSessionServiceIsAudioSessionActivatedFuzzTest()
141 {
142 auto audioSessionService = std::make_shared<AudioSessionService>();
143 if (audioSessionService == nullptr) {
144 return;
145 }
146 int32_t callerPid = GetData<int32_t>();
147 AudioSessionStrategy strategy;
148 std::shared_ptr<AudioSessionStateMonitor> audioSessionStateMonitor = nullptr;
149 auto audioSession = std::make_shared<AudioSession>(callerPid, strategy, audioSessionStateMonitor);
150 bool isAddMap = GetData<bool>();
151 if (isAddMap) {
152 audioSessionService->sessionMap_.insert(make_pair(callerPid, audioSession));
153 }
154 audioSessionService->IsAudioSessionActivated(callerPid);
155 }
156
AudioSessionServiceSetSessionTimeOutCallbackFuzzTest()157 void AudioSessionServiceSetSessionTimeOutCallbackFuzzTest()
158 {
159 auto audioSessionService = std::make_shared<AudioSessionService>();
160 if (audioSessionService == nullptr) {
161 return;
162 }
163
164 std::shared_ptr<SessionTimeOutCallback> timeOutCallback = nullptr;
165 audioSessionService->SetSessionTimeOutCallback(timeOutCallback);
166 }
167
AudioSessionServiceGetAudioSessionByPidFuzzTest()168 void AudioSessionServiceGetAudioSessionByPidFuzzTest()
169 {
170 auto audioSessionService = std::make_shared<AudioSessionService>();
171 if (audioSessionService == nullptr) {
172 return;
173 }
174 int32_t callerPid = GetData<int32_t>();
175 AudioSessionStrategy strategy;
176 std::shared_ptr<AudioSessionStateMonitor> audioSessionStateMonitor = nullptr;
177 auto audioSession = std::make_shared<AudioSession>(callerPid, strategy, audioSessionStateMonitor);
178 bool isAddMap = GetData<bool>();
179 if (isAddMap) {
180 audioSessionService->sessionMap_.insert(make_pair(callerPid, audioSession));
181 }
182
183 audioSessionService->GetAudioSessionByPid(callerPid);
184 }
185
AudioSessionServiceOnAudioSessionTimeOutFuzzTest()186 void AudioSessionServiceOnAudioSessionTimeOutFuzzTest()
187 {
188 auto audioSessionService = std::make_shared<AudioSessionService>();
189 if (audioSessionService == nullptr) {
190 return;
191 }
192 int32_t callerPid = GetData<int32_t>();
193
194 audioSessionService->OnAudioSessionTimeOut(callerPid);
195 }
196
AudioSessionServiceAudioSessionInfoDumpFuzzTest()197 void AudioSessionServiceAudioSessionInfoDumpFuzzTest()
198 {
199 auto audioSessionService = std::make_shared<AudioSessionService>();
200 if (audioSessionService == nullptr) {
201 return;
202 }
203 int32_t callerPid = GetData<int32_t>();
204 std::string dumpString = "test";
205 AudioSessionStrategy strategy;
206 std::shared_ptr<AudioSessionStateMonitor> audioSessionStateMonitor = nullptr;
207 auto audioSession = std::make_shared<AudioSession>(callerPid, strategy, audioSessionStateMonitor);
208 bool isNull = GetData<bool>();
209 if (isNull) {
210 audioSession = nullptr;
211 }
212 audioSessionService->sessionMap_.insert(make_pair(callerPid, audioSession));
213 audioSessionService->AudioSessionInfoDump(dumpString);
214 }
215
216 TestPtr g_testPtrs[] = {
217 AudioSessionServiceIsSameTypeForAudioSessionFuzzTest,
218 AudioSessionServiceActivateAudioSessionFuzzTest,
219 AudioSessionServiceDeactivateAudioSessionFuzzTest,
220 AudioSessionServiceIsAudioSessionActivatedFuzzTest,
221 AudioSessionServiceSetSessionTimeOutCallbackFuzzTest,
222 AudioSessionServiceGetAudioSessionByPidFuzzTest,
223 AudioSessionServiceOnAudioSessionTimeOutFuzzTest,
224 AudioSessionServiceAudioSessionInfoDumpFuzzTest,
225 };
226
FuzzTest(const uint8_t * rawData,size_t size)227 void FuzzTest(const uint8_t* rawData, size_t size)
228 {
229 if (rawData == nullptr) {
230 return;
231 }
232
233 RAW_DATA = rawData;
234 g_dataSize = size;
235 g_pos = 0;
236
237 uint32_t code = GetData<uint32_t>();
238 uint32_t len = GetArrLength(g_testPtrs);
239 if (len > 0) {
240 g_testPtrs[code % len]();
241 } else {
242 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
243 }
244 return;
245 }
246
247 } // namespace AudioStandard
248 } // namesapce OHOS
249
250 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)251 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
252 {
253 if (size < OHOS::AudioStandard::THRESHOLD) {
254 return 0;
255 }
256 OHOS::AudioStandard::FuzzTest(data, size);
257 return 0;
258 }