1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37
38 #include "audio_source_clock.h"
39 #include "capturer_clock_manager.h"
40 #include "hpae_policy_manager.h"
41 #include "audio_policy_state_monitor.h"
42 #include "audio_device_info.h"
43 #include "audio_server.h"
44 #include "audio_effect_volume.h"
45 #include "futex_tool.h"
46 #include "format_converter.h"
47 #include "audio_dump_pcm.h"
48 #include "audio_dump_pcm_private.h"
49 #include "audio_zone_service.h"
50
51 namespace OHOS {
52 namespace AudioStandard {
53 using namespace std;
54
55 static const uint8_t* RAW_DATA = nullptr;
56 static size_t g_dataSize = 0;
57 static size_t g_pos;
58 const size_t THRESHOLD = 10;
59 const uint8_t TESTSIZE = 14;
60
61 typedef void (*TestFuncs)();
62
63 template<class T>
GetData()64 T GetData()
65 {
66 T object {};
67 size_t objectSize = sizeof(object);
68 if (g_dataSize < g_pos) {
69 return object;
70 }
71 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
72 return object;
73 }
74 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
75 if (ret != EOK) {
76 return {};
77 }
78 g_pos += objectSize;
79 return object;
80 }
81
82 template<class T>
GetArrLength(T & arr)83 uint32_t GetArrLength(T& arr)
84 {
85 if (arr == nullptr) {
86 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
87 return 0;
88 }
89 return sizeof(arr) / sizeof(arr[0]);
90 }
91
MarshallingFuzzTest()92 void MarshallingFuzzTest()
93 {
94 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
95 if (streamDesc == nullptr) {
96 return;
97 }
98 Parcel parcel;
99 streamDesc->Marshalling(parcel);
100 }
101
UnmarshallingFuzzTest()102 void UnmarshallingFuzzTest()
103 {
104 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
105 if (streamDesc == nullptr) {
106 return;
107 }
108 Parcel parcel;
109 streamDesc->Marshalling(parcel);
110 std::shared_ptr<AudioStreamDescriptor> filter(AudioStreamDescriptor::Unmarshalling(parcel));
111 }
112
WriteDeviceDescVectorToParcelFuzzTest()113 void WriteDeviceDescVectorToParcelFuzzTest()
114 {
115 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
116 if (streamDesc == nullptr) {
117 return;
118 }
119 Parcel parcel;
120 std::shared_ptr<AudioDeviceDescriptor> fuzzAudioDeviceDescriptorSptr = std::make_shared<AudioDeviceDescriptor>();
121 if (fuzzAudioDeviceDescriptorSptr == nullptr) {
122 return;
123 }
124 std::vector<std::shared_ptr<AudioDeviceDescriptor>> descs = {};
125 descs.push_back(fuzzAudioDeviceDescriptorSptr);
126 streamDesc->WriteDeviceDescVectorToParcel(parcel, descs);
127 }
128
UnmarshallingDeviceDescVectorFuzzTest()129 void UnmarshallingDeviceDescVectorFuzzTest()
130 {
131 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
132 if (streamDesc == nullptr) {
133 return;
134 }
135 Parcel parcel;
136 std::shared_ptr<AudioDeviceDescriptor> fuzzAudioDeviceDescriptorSptr = std::make_shared<AudioDeviceDescriptor>();
137 if (fuzzAudioDeviceDescriptorSptr == nullptr) {
138 return;
139 }
140 std::vector<std::shared_ptr<AudioDeviceDescriptor>> descs = {};
141 descs.push_back(fuzzAudioDeviceDescriptorSptr);
142 streamDesc->UnmarshallingDeviceDescVector(parcel, descs);
143 }
144
SetBunduleNameFuzzTest()145 void SetBunduleNameFuzzTest()
146 {
147 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
148 if (streamDesc == nullptr) {
149 return;
150 }
151 std::string bundleName = "abc";
152 streamDesc->SetBunduleName(bundleName);
153 }
154
DumpFuzzTest()155 void DumpFuzzTest()
156 {
157 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
158 if (streamDesc == nullptr) {
159 return;
160 }
161 std::string bundleName = "abc";
162 streamDesc->Dump(bundleName);
163 }
164
DumpCommonAttrsFuzzTest()165 void DumpCommonAttrsFuzzTest()
166 {
167 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
168 if (streamDesc == nullptr) {
169 return;
170 }
171 std::string bundleName = "abc";
172 streamDesc->DumpCommonAttrs(bundleName);
173 }
174
DumpRendererStreamAttrsFuzzTest()175 void DumpRendererStreamAttrsFuzzTest()
176 {
177 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
178 if (streamDesc == nullptr) {
179 return;
180 }
181 std::string bundleName = "abc";
182 streamDesc->DumpRendererStreamAttrs(bundleName);
183 }
184
DumpCapturerStreamAttrsFuzzTest()185 void DumpCapturerStreamAttrsFuzzTest()
186 {
187 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
188 if (streamDesc == nullptr) {
189 return;
190 }
191 std::string bundleName = "abc";
192 streamDesc->DumpCapturerStreamAttrs(bundleName);
193 }
194
DumpDeviceAttrsFuzzTest()195 void DumpDeviceAttrsFuzzTest()
196 {
197 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
198 if (streamDesc == nullptr) {
199 return;
200 }
201 std::string bundleName = "abc";
202 streamDesc->DumpDeviceAttrs(bundleName);
203 }
204
GetNewDevicesTypeStringFuzzTest()205 void GetNewDevicesTypeStringFuzzTest()
206 {
207 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
208 if (streamDesc == nullptr) {
209 return;
210 }
211 streamDesc->GetNewDevicesTypeString();
212 }
213
StreamStatusToStringFuzzTest()214 void StreamStatusToStringFuzzTest()
215 {
216 static const vector<AudioStreamStatus> testAudioStreamStatuses = {
217 STREAM_STATUS_NEW,
218 STREAM_STATUS_STARTED,
219 STREAM_STATUS_PAUSED,
220 STREAM_STATUS_STOPPED,
221 STREAM_STATUS_RELEASED,
222 };
223 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
224 if (streamDesc == nullptr) {
225 return;
226 }
227 streamDesc->streamStatus_ = testAudioStreamStatuses[GetData<uint32_t>() % testAudioStreamStatuses.size()];
228 std::string bundleName = "abc";
229 streamDesc->DumpCommonAttrs(bundleName);
230 }
231
GetDeviceInfoFuzzTest()232 void GetDeviceInfoFuzzTest()
233 {
234 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
235 if (streamDesc == nullptr) {
236 return;
237 }
238 std::shared_ptr<AudioDeviceDescriptor> fuzzAudioDeviceDescriptorSptr = std::make_shared<AudioDeviceDescriptor>();
239 streamDesc->GetDeviceInfo(fuzzAudioDeviceDescriptorSptr);
240 }
241
GetNewDevicesInfoFuzzTest()242 void GetNewDevicesInfoFuzzTest()
243 {
244 std::shared_ptr<AudioStreamDescriptor> streamDesc = std::make_shared<AudioStreamDescriptor>();
245 if (streamDesc == nullptr) {
246 return;
247 }
248 streamDesc->GetNewDevicesInfo();
249 }
250
251 TestFuncs g_testFuncs[TESTSIZE] = {
252 MarshallingFuzzTest,
253 UnmarshallingFuzzTest,
254 WriteDeviceDescVectorToParcelFuzzTest,
255 UnmarshallingDeviceDescVectorFuzzTest,
256 SetBunduleNameFuzzTest,
257 DumpFuzzTest,
258 DumpCommonAttrsFuzzTest,
259 DumpRendererStreamAttrsFuzzTest,
260 DumpCapturerStreamAttrsFuzzTest,
261 DumpDeviceAttrsFuzzTest,
262 GetNewDevicesTypeStringFuzzTest,
263 StreamStatusToStringFuzzTest,
264 GetDeviceInfoFuzzTest,
265 GetNewDevicesInfoFuzzTest,
266 };
267
FuzzTest(const uint8_t * rawData,size_t size)268 void FuzzTest(const uint8_t* rawData, size_t size)
269 {
270 if (rawData == nullptr) {
271 return;
272 }
273
274 // initialize data
275 RAW_DATA = rawData;
276 g_dataSize = size;
277 g_pos = 0;
278
279 uint32_t code = GetData<uint32_t>();
280 uint32_t len = GetArrLength(g_testFuncs);
281 if (len > 0) {
282 g_testFuncs[code % len]();
283 } else {
284 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
285 }
286
287 return;
288 }
289 } // namespace AudioStandard
290 } // namesapce OHOS
291
292 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)293 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
294 {
295 if (size < OHOS::AudioStandard::THRESHOLD) {
296 return 0;
297 }
298
299 OHOS::AudioStandard::FuzzTest(data, size);
300 return 0;
301 }
302