1 /*
2 * Copyright (c) 2024-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <cstddef>
17 #include <cstdint>
18 #include <fuzzer/FuzzedDataProvider.h>
19
20 #include "ipc_skeleton.h"
21 #include "avsession_errors.h"
22 #include "system_ability_definition.h"
23 #include "avsession_log.h"
24 #include "audio_info.h"
25 #include "avsessionserviceext_fuzzer.h"
26 #include "avsession_service.h"
27 #include "securec.h"
28
29 using namespace std;
30 namespace OHOS::AVSession {
31 static const int32_t MAX_CODE_LEN = 512;
32 static const int32_t MIN_SIZE_NUM = 4;
33 static const uint8_t *RAW_DATA = nullptr;
34 static sptr<AVSessionService> service = nullptr;
35 static size_t g_dataSize = 0;
36 static size_t g_pos = 0;
37
38 class FuzzExtSessionListener : public SessionListener {
39 public:
OnSessionCreate(const AVSessionDescriptor & descriptor)40 void OnSessionCreate(const AVSessionDescriptor& descriptor) override
41 {
42 SLOGI("sessionId=%{public}s created", descriptor.sessionId_.c_str());
43 }
44
OnSessionRelease(const AVSessionDescriptor & descriptor)45 void OnSessionRelease(const AVSessionDescriptor& descriptor) override
46 {
47 SLOGI("sessionId=%{public}s released", descriptor.sessionId_.c_str());
48 }
49
OnTopSessionChange(const AVSessionDescriptor & descriptor)50 void OnTopSessionChange(const AVSessionDescriptor& descriptor) override
51 {
52 SLOGI("sessionId=%{public}s be top session", descriptor.sessionId_.c_str());
53 }
54
OnAudioSessionChecked(const int32_t uid)55 void OnAudioSessionChecked(const int32_t uid) override
56 {
57 SLOGI("uid=%{public}d checked", uid);
58 }
59 };
60
61 class FuzzExtHistoricalRecordListener : public HistoricalRecordListener {
62 public:
OnHistoricalRecordChange()63 void OnHistoricalRecordChange() override
64 {
65 SLOGI("OnHistoricalRecordChange called");
66 }
67 };
68
69 class FuzzExtISessionListener : public ISessionListener {
70 public:
OnSessionCreate(const AVSessionDescriptor & descriptor)71 ErrCode OnSessionCreate(const AVSessionDescriptor& descriptor) override { return AVSESSION_SUCCESS; };
OnSessionRelease(const AVSessionDescriptor & descriptor)72 ErrCode OnSessionRelease(const AVSessionDescriptor& descriptor) override { return AVSESSION_SUCCESS; };
OnTopSessionChange(const AVSessionDescriptor & descriptor)73 ErrCode OnTopSessionChange(const AVSessionDescriptor& descriptor) override { return AVSESSION_SUCCESS; };
OnAudioSessionChecked(const int32_t uid)74 ErrCode OnAudioSessionChecked(const int32_t uid) override { return AVSESSION_SUCCESS; };
OnDeviceAvailable(const OutputDeviceInfo & castOutputDeviceInfo)75 ErrCode OnDeviceAvailable(const OutputDeviceInfo& castOutputDeviceInfo) override { return AVSESSION_SUCCESS; };
OnDeviceLogEvent(const int32_t eventId,const int64_t param)76 ErrCode OnDeviceLogEvent(const int32_t eventId, const int64_t param) override { return AVSESSION_SUCCESS; };
OnDeviceOffline(const std::string & deviceId)77 ErrCode OnDeviceOffline(const std::string& deviceId) override { return AVSESSION_SUCCESS; };
OnDeviceStateChange(const DeviceState & deviceState)78 ErrCode OnDeviceStateChange(const DeviceState& deviceState) override { return AVSESSION_SUCCESS; };
OnRemoteDistributedSessionChange(const std::vector<OHOS::sptr<IRemoteObject>> & sessionControllers)79 ErrCode OnRemoteDistributedSessionChange(
80 const std::vector<OHOS::sptr<IRemoteObject>>& sessionControllers) override { return AVSESSION_SUCCESS; };
AsObject()81 OHOS::sptr<IRemoteObject> AsObject() override { return nullptr; };
82 };
83
SuperLauncherTest()84 void SuperLauncherTest()
85 {
86 FuzzedDataProvider provider(RAW_DATA, g_dataSize);
87
88 vector<string> states { "UNKNOWN", "IDLE", "CONNECTING" };
89 vector<string> serviceNames { "Unknown", "SuperLauncher-Dual", "HuaweiCast" };
90 vector<string> deviceIds { " ", "1234567", "7654321" };
91 vector<string> extraInfos { "nothings", "reason", "others" };
92 std::string state = states[provider.ConsumeIntegral<uint32_t>() % states.size()];
93 std::string serviceName = serviceNames[provider.ConsumeIntegral<uint32_t>() % serviceNames.size()];
94 std::string deviceId = deviceIds[provider.ConsumeIntegral<uint32_t>() % deviceIds.size()];
95 std::string extraInfo = extraInfos[provider.ConsumeIntegral<uint32_t>() % extraInfos.size()];
96 service->SuperLauncher(deviceId, serviceName, extraInfo, state);
97 }
98
AVSessionServiceExtFuzzTest001()99 void AVSessionServiceExtFuzzTest001()
100 {
101 FuzzedDataProvider provider(RAW_DATA, g_dataSize);
102
103 FuzzExtSessionListener listener;
104 service->AddInnerSessionListener(&listener);
105 service->RemoveInnerSessionListener(&listener);
106
107 std::string bundleName = provider.ConsumeRandomLengthString();
108 int32_t userId = provider.ConsumeIntegral<int32_t>();
109 FuzzExtHistoricalRecordListener historicalListener;
110 service->AddHistoricalRecordListener(&historicalListener);
111 service->NotifyHistoricalRecordChange(bundleName, userId);
112 service->RemoveHistoricalRecordListener(&historicalListener);
113
114 std::string deviceId = provider.ConsumeRandomLengthString();
115 service->NotifyMigrateStop(deviceId);
116 }
117
AVSessionServiceExtFuzzTest002()118 void AVSessionServiceExtFuzzTest002()
119 {
120 FuzzedDataProvider provider(RAW_DATA, g_dataSize);
121
122 std::vector<DistributedHardware::DmDeviceType> deviceTypes {
123 DistributedHardware::DmDeviceType::DEVICE_TYPE_PHONE,
124 DistributedHardware::DmDeviceType::DEVICE_TYPE_TV,
125 DistributedHardware::DmDeviceType::DEVICE_TYPE_WIFI_CAMERA,
126 DistributedHardware::DmDeviceType::DEVICE_TYPE_CAR
127 };
128 uint32_t randomIndex = provider.ConsumeIntegral<uint32_t>() % deviceTypes.size();
129 service->localDeviceType_ = deviceTypes[randomIndex];
130 bool isOnline = provider.ConsumeBool();
131 OHOS::DistributedHardware::DmDeviceInfo deviceInfo;
132 memset_s(&deviceInfo, sizeof(deviceInfo), 0, sizeof(deviceInfo));
133 std::string deviceId = provider.ConsumeRandomLengthString(DM_MAX_DEVICE_ID_LEN);
134 strncpy_s(deviceInfo.deviceId, sizeof(deviceInfo.deviceId),
135 deviceId.c_str(), deviceId.length());
136 std::string deviceName = provider.ConsumeRandomLengthString(DM_MAX_DEVICE_NAME_LEN);
137 strncpy_s(deviceInfo.deviceName, sizeof(deviceInfo.deviceName),
138 deviceName.c_str(), deviceName.length());
139 deviceInfo.deviceTypeId = provider.ConsumeIntegral<uint16_t>();
140 std::string networkId = provider.ConsumeRandomLengthString(DM_MAX_DEVICE_ID_LEN);
141 strncpy_s(deviceInfo.networkId, sizeof(deviceInfo.networkId),
142 networkId.c_str(), networkId.length());
143 deviceInfo.range = provider.ConsumeIntegral<int32_t>();
144 deviceInfo.networkType = provider.ConsumeIntegral<int32_t>();
145 deviceInfo.authForm = static_cast<OHOS::DistributedHardware::DmAuthForm>(
146 provider.ConsumeIntegralInRange<int32_t>(OHOS::DistributedHardware::DmAuthForm::INVALID_TYPE,
147 OHOS::DistributedHardware::DmAuthForm::SHARE));
148 deviceInfo.extraData = provider.ConsumeRandomLengthString();
149 std::string localFrontSessionId = provider.ConsumeRandomLengthString(DM_MAX_DEVICE_ID_LEN);
150
151 service->OnAddSystemAbility(DISTRIBUTED_HARDWARE_DEVICEMANAGER_SA_ID,
152 deviceInfo.deviceId);
153 service->ProcessTargetMigrate(isOnline, deviceInfo);
154 service->DoConnectProcessWithMigrate(deviceInfo);
155 service->DoConnectProcessWithMigrateServer(deviceInfo);
156 service->NotifyLocalFrontSessionChangeForMigrate(localFrontSessionId);
157 service->DoHisMigrateServerTransform(networkId);
158 service->DoDisconnectProcessWithMigrate(deviceInfo);
159 service->DoDisconnectProcessWithMigrateServer(deviceInfo);
160 service->DoRemoteAVSessionLoad(deviceId);
161 }
162
AVSessionServiceExtFuzzTest003()163 void AVSessionServiceExtFuzzTest003()
164 {
165 FuzzedDataProvider provider(RAW_DATA, g_dataSize);
166
167 #ifdef CASTPLUS_CAST_ENGINE_ENABLE
168 std::string info = "";
169 bool isSupportMirrorToStream = provider.ConsumeBool();
170 auto deviceId = provider.ConsumeIntegral<int32_t>();
171 std::string deviceName = provider.ConsumeRandomLengthString();
172 auto deviceType = provider.ConsumeIntegral<int32_t>();
173 info = "\"SUPPORT_MIRROR_TO_STREAM\"" + std::string(" : ") + (isSupportMirrorToStream ? "\"true\"" : "\"false\"") +
174 ", " + "\"deviceId\"" + std::string(" : ") + std::to_string(deviceId) +
175 ", " + "\"deviceName\"" + std::string(" : ") + "\"" + deviceName + "\"" +
176 ", " + "\"deviceType\"" + std::string(" : ") + std::to_string(deviceType);
177 service->SplitExtraInfo(info);
178 #endif
179 }
180
AVSessionSystemAbilityLoadCallbackTest()181 void AVSessionSystemAbilityLoadCallbackTest()
182 {
183 FuzzedDataProvider provider(RAW_DATA, g_dataSize);
184
185 AVSessionSystemAbilityLoadCallback callback(service);
186 std::string deviceId = provider.ConsumeRandomLengthString();
187 sptr<IRemoteObject> remoteObject = nullptr;
188 callback.OnLoadSACompleteForRemote(deviceId, AVSESSION_SERVICE_ID, remoteObject);
189 }
190
AVSessionDeviceStateCallbackTest()191 void AVSessionDeviceStateCallbackTest()
192 {
193 FuzzedDataProvider provider(RAW_DATA, g_dataSize);
194
195 AVSessionDeviceStateCallback callback(service);
196 OHOS::DistributedHardware::DmDeviceInfo deviceInfo;
197 deviceInfo.deviceTypeId = provider.ConsumeIntegral<int32_t>();
198 callback.OnDeviceOnline(deviceInfo);
199 callback.OnDeviceReady(deviceInfo);
200 callback.OnDeviceOffline(deviceInfo);
201 callback.OnDeviceChanged(deviceInfo);
202 }
203
AVSessionServiceExtFuzzTest(uint8_t * data,size_t size)204 void AVSessionServiceExtFuzzer::AVSessionServiceExtFuzzTest(uint8_t* data, size_t size)
205 {
206 if ((size > MAX_CODE_LEN) || (size < MIN_SIZE_NUM)) {
207 return;
208 }
209 if (service == nullptr) {
210 SLOGI("check service null, try create");
211 service = new AVSessionService(AVSESSION_SERVICE_ID);
212 }
213 if (service == nullptr) {
214 SLOGE("service is null, return");
215 return;
216 }
217 SuperLauncherTest();
218 AVSessionServiceExtFuzzTest001();
219 AVSessionServiceExtFuzzTest002();
220 AVSessionServiceExtFuzzTest003();
221 AVSessionSystemAbilityLoadCallbackTest();
222 AVSessionDeviceStateCallbackTest();
223 }
224
AVSessionServiceExtRemoteRequest(uint8_t * data,size_t size)225 void AVSessionServiceExtRemoteRequest(uint8_t* data, size_t size)
226 {
227 auto avSessionServiceExt = std::make_unique<AVSessionServiceExtFuzzer>();
228 if (avSessionServiceExt == nullptr) {
229 SLOGI("avSessionServiceExt is null");
230 return;
231 }
232 avSessionServiceExt->AVSessionServiceExtFuzzTest(data, size);
233 }
234
235 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)236 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
237 {
238 if (data == nullptr) {
239 return 0;
240 }
241
242 RAW_DATA = data;
243 g_dataSize = size;
244 g_pos = 0;
245 /* Run your code on data */
246 AVSessionServiceExtRemoteRequest(data, size);
247 return 0;
248 }
249 }
250