1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37
38 namespace OHOS {
39 namespace AudioStandard {
40 using namespace std;
41
42 static const uint8_t* RAW_DATA = nullptr;
43 static size_t g_dataSize = 0;
44 static size_t g_pos;
45 const size_t THRESHOLD = 10;
46 const uint8_t TESTSIZE = 15;
47
48 typedef void (*TestFuncs)();
49
50 vector<DeviceType> DeviceTypeVec = {
51 DEVICE_TYPE_NONE,
52 DEVICE_TYPE_INVALID,
53 DEVICE_TYPE_EARPIECE,
54 DEVICE_TYPE_SPEAKER,
55 DEVICE_TYPE_WIRED_HEADSET,
56 DEVICE_TYPE_WIRED_HEADPHONES,
57 DEVICE_TYPE_BLUETOOTH_SCO,
58 DEVICE_TYPE_BLUETOOTH_A2DP,
59 DEVICE_TYPE_BLUETOOTH_A2DP_IN,
60 DEVICE_TYPE_MIC,
61 DEVICE_TYPE_WAKEUP,
62 DEVICE_TYPE_USB_HEADSET,
63 DEVICE_TYPE_DP,
64 DEVICE_TYPE_REMOTE_CAST,
65 DEVICE_TYPE_USB_DEVICE,
66 DEVICE_TYPE_ACCESSORY,
67 DEVICE_TYPE_REMOTE_DAUDIO,
68 DEVICE_TYPE_HDMI,
69 DEVICE_TYPE_LINE_DIGITAL,
70 DEVICE_TYPE_NEARLINK,
71 DEVICE_TYPE_NEARLINK_IN,
72 DEVICE_TYPE_FILE_SINK,
73 DEVICE_TYPE_FILE_SOURCE,
74 DEVICE_TYPE_EXTERN_CABLE,
75 DEVICE_TYPE_DEFAULT,
76 DEVICE_TYPE_USB_ARM_HEADSET,
77 DEVICE_TYPE_MAX,
78 };
79
80 template<class T>
GetData()81 T GetData()
82 {
83 T object {};
84 size_t objectSize = sizeof(object);
85 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
86 return object;
87 }
88 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
89 if (ret != EOK) {
90 return {};
91 }
92 g_pos += objectSize;
93 return object;
94 }
95
96 template<class T>
GetArrLength(T & arr)97 uint32_t GetArrLength(T& arr)
98 {
99 if (arr == nullptr) {
100 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
101 return 0;
102 }
103 return sizeof(arr) / sizeof(arr[0]);
104 }
105
SetPreferredMediaRenderDeviceFuzzTest()106 void SetPreferredMediaRenderDeviceFuzzTest()
107 {
108 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
109 AudioStateManager::GetAudioStateManager().SetPreferredMediaRenderDevice(desc);
110 }
111
SetAndGetRecordCaptureDeviceFuzzTest()112 void SetAndGetRecordCaptureDeviceFuzzTest()
113 {
114 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
115 AudioStateManager::GetAudioStateManager().SetPreferredCallRenderDevice(desc, 0);
116 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
117 desc->deviceType_ = DeviceTypeVec[deviceTypeCount];
118 AudioStateManager::GetAudioStateManager().SetPreferredCallRenderDevice(desc, 1);
119 AudioStateManager::GetAudioStateManager().GetPreferredCallRenderDevice();
120 }
121
SetPreferredCallCaptureDeviceFuzzTest()122 void SetPreferredCallCaptureDeviceFuzzTest()
123 {
124 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
125 AudioStateManager::GetAudioStateManager().SetPreferredCallCaptureDevice(desc);
126 }
127
SetPreferredRingRenderDeviceFuzzTest()128 void SetPreferredRingRenderDeviceFuzzTest()
129 {
130 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
131 AudioStateManager::GetAudioStateManager().SetPreferredRingRenderDevice(desc);
132 }
133
SetPreferredRecordCaptureDeviceFuzzTest()134 void SetPreferredRecordCaptureDeviceFuzzTest()
135 {
136 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
137 AudioStateManager::GetAudioStateManager().SetPreferredRecordCaptureDevice(desc);
138 }
139
SetPreferredToneRenderDeviceFuzzTest()140 void SetPreferredToneRenderDeviceFuzzTest()
141 {
142 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
143 AudioStateManager::GetAudioStateManager().SetPreferredToneRenderDevice(desc);
144 }
145
UpdatePreferredMediaRenderDeviceConnectStateFuzzTest()146 void UpdatePreferredMediaRenderDeviceConnectStateFuzzTest()
147 {
148 int32_t stateCount = static_cast<int32_t>(ConnectState::DEACTIVE_CONNECTED) + 1;
149 ConnectState state = static_cast<ConnectState>(GetData<uint8_t>() % stateCount);
150 AudioStateManager::GetAudioStateManager().UpdatePreferredMediaRenderDeviceConnectState(state);
151 }
152
UpdatePreferredCallRenderDeviceConnectStateFuzzTest()153 void UpdatePreferredCallRenderDeviceConnectStateFuzzTest()
154 {
155 int32_t stateCount = static_cast<int32_t>(ConnectState::DEACTIVE_CONNECTED) + 1;
156 ConnectState state = static_cast<ConnectState>(GetData<uint8_t>() % stateCount);
157 AudioStateManager::GetAudioStateManager().UpdatePreferredCallRenderDeviceConnectState(state);
158 }
159
UpdatePreferredCallCaptureDeviceConnectStateFuzzTest()160 void UpdatePreferredCallCaptureDeviceConnectStateFuzzTest()
161 {
162 int32_t stateCount = static_cast<int32_t>(ConnectState::DEACTIVE_CONNECTED) + 1;
163 ConnectState state = static_cast<ConnectState>(GetData<uint8_t>() % stateCount);
164 AudioStateManager::GetAudioStateManager().UpdatePreferredCallCaptureDeviceConnectState(state);
165 }
166
UpdatePreferredRecordCaptureDeviceConnectStateFuzzTest()167 void UpdatePreferredRecordCaptureDeviceConnectStateFuzzTest()
168 {
169 int32_t stateCount = static_cast<int32_t>(ConnectState::DEACTIVE_CONNECTED) + 1;
170 ConnectState state = static_cast<ConnectState>(GetData<uint8_t>() % stateCount);
171 AudioStateManager::GetAudioStateManager().UpdatePreferredRecordCaptureDeviceConnectState(state);
172 }
173
SetAndGetPreferredRingRenderDeviceFuzzTest()174 void SetAndGetPreferredRingRenderDeviceFuzzTest()
175 {
176 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
177 if (desc == nullptr) {
178 return;
179 }
180 AudioStateManager::GetAudioStateManager().SetPreferredRingRenderDevice(desc);
181 AudioStateManager::GetAudioStateManager().GetPreferredRingRenderDevice();
182 }
183
SetAndGetPreferredToneRenderDeviceFuzzTest()184 void SetAndGetPreferredToneRenderDeviceFuzzTest()
185 {
186 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
187 AudioStateManager::GetAudioStateManager().SetPreferredToneRenderDevice(desc);
188 AudioStateManager::GetAudioStateManager().GetPreferredToneRenderDevice();
189 }
190
SetAudioClientInfoMgrCallbackFuzzTest()191 void SetAudioClientInfoMgrCallbackFuzzTest()
192 {
193 sptr<IStandardAudioPolicyManagerListener> desc = sptr<IStandardAudioPolicyManagerListener>();
194 AudioStateManager::GetAudioStateManager().SetAudioClientInfoMgrCallback(desc);
195 }
196
SetPreferredCallRenderDeviceAudioClinetInfoMgrCallbackHasValueFuzzTest()197 void SetPreferredCallRenderDeviceAudioClinetInfoMgrCallbackHasValueFuzzTest()
198 {
199 sptr<IStandardAudioPolicyManagerListener> desc = sptr<IStandardAudioPolicyManagerListener>();
200 AudioStateManager::GetAudioStateManager().SetAudioClientInfoMgrCallback(desc);
201 shared_ptr<AudioDeviceDescriptor> desc_ = std::make_shared<AudioDeviceDescriptor>();
202 int32_t uid = GetData<int32_t>();
203 AudioStateManager::GetAudioStateManager().SetPreferredCallRenderDevice(desc_, uid);
204 }
205
SetAndGetPreferredCallRenderDeviceTypeNotEqTypeNoneFuzzTest()206 void SetAndGetPreferredCallRenderDeviceTypeNotEqTypeNoneFuzzTest()
207 {
208 shared_ptr<AudioDeviceDescriptor> desc = std::make_shared<AudioDeviceDescriptor>();
209 uint32_t deviceTypeCount = GetData<uint32_t>() % DeviceTypeVec.size();
210 desc->deviceType_ = DeviceTypeVec[deviceTypeCount];
211 int32_t uid = GetData<int32_t>();
212 AudioStateManager::GetAudioStateManager().SetAudioSceneOwnerUid(uid);
213 AudioStateManager::GetAudioStateManager().SetPreferredCallRenderDevice(desc, 1);
214 AudioStateManager::GetAudioStateManager().GetPreferredCallRenderDevice();
215 }
216
217
218 TestFuncs g_testFuncs[TESTSIZE] = {
219 SetPreferredMediaRenderDeviceFuzzTest,
220 SetAndGetRecordCaptureDeviceFuzzTest,
221 SetPreferredCallCaptureDeviceFuzzTest,
222 SetPreferredRingRenderDeviceFuzzTest,
223 SetPreferredRecordCaptureDeviceFuzzTest,
224 SetPreferredToneRenderDeviceFuzzTest,
225 UpdatePreferredMediaRenderDeviceConnectStateFuzzTest,
226 UpdatePreferredCallRenderDeviceConnectStateFuzzTest,
227 UpdatePreferredCallCaptureDeviceConnectStateFuzzTest,
228 UpdatePreferredRecordCaptureDeviceConnectStateFuzzTest,
229 SetAndGetPreferredRingRenderDeviceFuzzTest,
230 SetAndGetPreferredToneRenderDeviceFuzzTest,
231 SetAudioClientInfoMgrCallbackFuzzTest,
232 SetPreferredCallRenderDeviceAudioClinetInfoMgrCallbackHasValueFuzzTest,
233 SetAndGetPreferredCallRenderDeviceTypeNotEqTypeNoneFuzzTest,
234 };
235
FuzzTest(const uint8_t * rawData,size_t size)236 bool FuzzTest(const uint8_t* rawData, size_t size)
237 {
238 if (rawData == nullptr) {
239 return false;
240 }
241
242 // initialize data
243 RAW_DATA = rawData;
244 g_dataSize = size;
245 g_pos = 0;
246
247 uint32_t code = GetData<uint32_t>();
248 uint32_t len = GetArrLength(g_testFuncs);
249 if (len > 0) {
250 g_testFuncs[code % len]();
251 } else {
252 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
253 }
254
255 return true;
256 }
257 } // namespace AudioStandard
258 } // namesapce OHOS
259
260 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)261 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
262 {
263 if (size < OHOS::AudioStandard::THRESHOLD) {
264 return 0;
265 }
266
267 OHOS::AudioStandard::FuzzTest(data, size);
268 return 0;
269 }
270