1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fstream>
17 #include <securec.h>
18
19 #include "audio_log.h"
20 #include "audio_socket_thread.h"
21 #include "../fuzz_utils.h"
22
23 using namespace std;
24
25 namespace OHOS {
26 namespace AudioStandard {
27
28 FuzzUtils &g_fuzzUtils = FuzzUtils::GetInstance();
29 const size_t FUZZ_INPUT_SIZE_THRESHOLD = 10;
30 const uint32_t UEVENT_MSG_PADDING = 2;
31 typedef void (*TestPtr)();
32
AudioSocketThreadAudioAnahsDetectDeviceFuzzTest()33 void AudioSocketThreadAudioAnahsDetectDeviceFuzzTest()
34 {
35 AudioSocketThread audioSocketThread;
36 struct AudioPnpUevent validUeventInsert = {
37 .subSystem = UEVENT_PLATFORM,
38 .anahsName = UEVENT_INSERT
39 };
40
41 bool isNull = g_fuzzUtils.GetData<bool>();
42 if (isNull) {
43 audioSocketThread.AudioAnahsDetectDevice(nullptr);
44 } else {
45 bool isSetAnahsName = g_fuzzUtils.GetData<bool>();
46 if (isSetAnahsName) {
47 audioSocketThread.audioSocketEvent_.anahsName = UEVENT_INSERT;
48 }
49 audioSocketThread.AudioAnahsDetectDevice(&validUeventInsert);
50 }
51 }
52
AudioSocketThreadAudioAnalogHeadsetDetectDeviceFuzzTest()53 void AudioSocketThreadAudioAnalogHeadsetDetectDeviceFuzzTest()
54 {
55 AudioSocketThread audioSocketThread;
56
57 AudioPnpUevent audioPnpUevent = {
58 .action = "add",
59 .name = "TestDevice",
60 .state = "added",
61 .devType = "headset",
62 .subSystem = "switch",
63 .switchName = "h2w",
64 .switchState = "1",
65 .hidName = "hid",
66 .devName = "TestDevName",
67 .anahsName = "anahs"
68 };
69 bool isNull = g_fuzzUtils.GetData<bool>();
70 if (isNull) {
71 audioSocketThread.AudioAnalogHeadsetDetectDevice(nullptr);
72 } else {
73 audioSocketThread.AudioAnalogHeadsetDetectDevice(&audioPnpUevent);
74 }
75 }
76
AudioSocketThreadAudioHDMIDetectDeviceFuzzTest()77 void AudioSocketThreadAudioHDMIDetectDeviceFuzzTest()
78 {
79 AudioSocketThread audioSocketThread;
80 static const vector<string> testSubSystems = {
81 "switch", "invalid",
82 };
83 static const vector<string> testSwitchNames = {
84 "hdmi_mipi_audio", "invalid", "hdmi_mipi_audio,device_port=HDMI-0",
85 };
86 static const vector<string> testActions = {
87 "change", "invalid",
88 };
89 static const vector<string> testSwitchStates = {
90 "1", "0", "invalid",
91 };
92 if (testSubSystems.empty() || testSwitchNames.empty() || testActions.empty() || testSwitchStates.empty()) {
93 return;
94 }
95
96 AudioPnpUevent uevent = {
97 .subSystem = testSubSystems[g_fuzzUtils.GetData<uint32_t>() % testSubSystems.size()].c_str(),
98 .switchName = testSwitchNames[g_fuzzUtils.GetData<uint32_t>() % testSwitchNames.size()].c_str(),
99 .action = testActions[g_fuzzUtils.GetData<uint32_t>() % testActions.size()].c_str(),
100 .switchState =
101 testSwitchStates[g_fuzzUtils.GetData<uint32_t>() % testSwitchStates.size()].c_str()
102 };
103 bool isNull = g_fuzzUtils.GetData<bool>();
104 if (isNull) {
105 audioSocketThread.AudioHDMIDetectDevice(nullptr);
106 } else {
107 audioSocketThread.AudioHDMIDetectDevice(&uevent);
108 }
109 }
110
AudioSocketThreadAudioPnpUeventParseFuzzTest()111 void AudioSocketThreadAudioPnpUeventParseFuzzTest()
112 {
113 AudioSocketThread audioSocketThread;
114 static const vector<string> testMsgs = {
115 "libudev",
116 "test message",
117 "unmatched event",
118 "matched event",
119 };
120 if (testMsgs.empty()) {
121 return;
122 }
123 const char *msg = testMsgs[g_fuzzUtils.GetData<uint32_t>() % testMsgs.size()].c_str();
124 ssize_t strLength;
125 bool isInvalid = g_fuzzUtils.GetData<bool>();
126 if (isInvalid) {
127 strLength = UEVENT_MSG_LEN + UEVENT_MSG_PADDING;
128 } else {
129 strLength = strlen(msg);
130 }
131 audioSocketThread.AudioPnpUeventParse(msg, strLength);
132 }
133
AudioSocketThreadDetectAnalogHeadsetStateFuzzTest()134 void AudioSocketThreadDetectAnalogHeadsetStateFuzzTest()
135 {
136 AudioSocketThread audioSocketThread;
137 std::ofstream ofs(SWITCH_STATE_PATH);
138 ofs << '1';
139 ofs.close();
140 AudioEvent audioEvent;
141 audioEvent.eventType = g_fuzzUtils.GetData<uint32_t>();
142 audioSocketThread.DetectAnalogHeadsetState(&audioEvent);
143 }
144
AudioSocketThreadDetectDPStateFuzzTest()145 void AudioSocketThreadDetectDPStateFuzzTest()
146 {
147 AudioSocketThread audioSocketThread;
148 AudioEvent audioEvent;
149 audioEvent.eventType = g_fuzzUtils.GetData<uint32_t>();
150 audioEvent.name = "testName";
151
152 audioSocketThread.DetectDPState(&audioEvent);
153 }
154
AudioSocketThreadReadAndScanDpStateFuzzTest()155 void AudioSocketThreadReadAndScanDpStateFuzzTest()
156 {
157 AudioSocketThread audioSocketThread;
158 std::string testPath = "/tmp/test_path";
159 std::ofstream file(testPath);
160 file << '1';
161 file.close();
162 uint32_t eventType = g_fuzzUtils.GetData<uint32_t>();
163 audioSocketThread.ReadAndScanDpState(testPath, eventType);
164 }
165
166 vector<TestPtr> g_testPtrs = {
167 AudioSocketThreadAudioAnahsDetectDeviceFuzzTest,
168 AudioSocketThreadAudioAnalogHeadsetDetectDeviceFuzzTest,
169 AudioSocketThreadAudioHDMIDetectDeviceFuzzTest,
170 AudioSocketThreadAudioPnpUeventParseFuzzTest,
171 AudioSocketThreadDetectAnalogHeadsetStateFuzzTest,
172 AudioSocketThreadDetectDPStateFuzzTest,
173 AudioSocketThreadReadAndScanDpStateFuzzTest,
174 };
175
176 } // namespace AudioStandard
177 } // namesapce OHOS
178
179 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)180 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
181 {
182 if (size < OHOS::AudioStandard::FUZZ_INPUT_SIZE_THRESHOLD) {
183 return 0;
184 }
185
186 OHOS::AudioStandard::g_fuzzUtils.fuzzTest(data, size, OHOS::AudioStandard::g_testPtrs);
187 return 0;
188 }