1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37
38 #include "audio_source_clock.h"
39 #include "capturer_clock_manager.h"
40 #include "hpae_policy_manager.h"
41 #include "audio_policy_state_monitor.h"
42 #include "audio_device_info.h"
43 #include "audio_server.h"
44 #include "audio_effect_volume.h"
45 #include "futex_tool.h"
46 #include "format_converter.h"
47
48 namespace OHOS {
49 namespace AudioStandard {
50 using namespace std;
51
52 static const uint8_t* RAW_DATA = nullptr;
53 static size_t g_dataSize = 0;
54 static size_t g_pos;
55 const size_t THRESHOLD = 10;
56 const uint8_t TESTSIZE = 6;
57 static int32_t NUM_2 = 2;
58 const int32_t NUM_4 = 2;
59 const int32_t NUM_8 = 2;
60
61 typedef void (*TestFuncs)();
62
63 template<class T>
GetData()64 T GetData()
65 {
66 T object {};
67 size_t objectSize = sizeof(object);
68 if (g_dataSize < g_pos) {
69 return object;
70 }
71 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
72 return object;
73 }
74 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
75 if (ret != EOK) {
76 return {};
77 }
78 g_pos += objectSize;
79 return object;
80 }
81
82 template<class T>
GetArrLength(T & arr)83 uint32_t GetArrLength(T& arr)
84 {
85 if (arr == nullptr) {
86 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
87 return 0;
88 }
89 return sizeof(arr) / sizeof(arr[0]);
90 }
91
S16StereoToF32StereoFuzzTest()92 void S16StereoToF32StereoFuzzTest()
93 {
94 BufferDesc srcDesc;
95 BufferDesc dstDesc;
96 uint8_t srcBuffer[NUM_4] = {0};
97 uint8_t dstBuffer[NUM_8] = {0};
98 srcDesc.bufLength = NUM_4;
99 srcDesc.buffer = srcBuffer;
100 dstDesc.bufLength = NUM_2;
101 dstDesc.buffer = dstBuffer;
102 FormatConverter::S16StereoToF32Stereo(srcDesc, dstDesc);
103 dstDesc.bufLength = NUM_8;
104 FormatConverter::S16StereoToF32Stereo(srcDesc, dstDesc);
105 }
106
S16StereoToF32MonoFuzzTest()107 void S16StereoToF32MonoFuzzTest()
108 {
109 BufferDesc srcDesc;
110 BufferDesc dstDesc;
111 uint8_t srcBuffer[NUM_4] = {0};
112 uint8_t dstBuffer[NUM_4] = {0};
113 srcDesc.bufLength = NUM_4;
114 srcDesc.buffer = srcBuffer;
115 dstDesc.bufLength = NUM_2;
116 dstDesc.buffer = dstBuffer;
117 FormatConverter::S16StereoToF32Mono(srcDesc, dstDesc);
118 dstDesc.bufLength = NUM_4;
119 FormatConverter::S16StereoToF32Mono(srcDesc, dstDesc);
120 }
121
F32MonoToS16StereoFuzzTest()122 void F32MonoToS16StereoFuzzTest()
123 {
124 BufferDesc srcDesc;
125 BufferDesc dstDesc;
126 uint8_t srcBuffer[NUM_4] = {0};
127 uint8_t dstBuffer[NUM_4] = {0};
128 srcDesc.bufLength = NUM_4;
129 srcDesc.buffer = srcBuffer;
130 dstDesc.bufLength = NUM_2;
131 dstDesc.buffer = dstBuffer;
132 FormatConverter::F32MonoToS16Stereo(srcDesc, dstDesc);
133 dstDesc.bufLength = NUM_4;
134 FormatConverter::F32MonoToS16Stereo(srcDesc, dstDesc);
135 }
136
F32StereoToS16StereoFuzzTest()137 void F32StereoToS16StereoFuzzTest()
138 {
139 BufferDesc srcDesc;
140 BufferDesc dstDesc;
141 uint8_t srcBuffer[NUM_8] = {0};
142 uint8_t dstBuffer[NUM_4] = {0};
143 srcDesc.bufLength = NUM_8;
144 srcDesc.buffer = srcBuffer;
145 dstDesc.bufLength = NUM_2;
146 dstDesc.buffer = dstBuffer;
147 FormatConverter::F32StereoToS16Stereo(srcDesc, dstDesc);
148 dstDesc.bufLength = NUM_4;
149 FormatConverter::F32StereoToS16Stereo(srcDesc, dstDesc);
150 }
151
S16MonoToS16StereoFuzzTest()152 void S16MonoToS16StereoFuzzTest()
153 {
154 BufferDesc srcDesc;
155 BufferDesc dstDesc;
156 uint8_t srcBuffer[NUM_8] = {0};
157 uint8_t dstBuffer[NUM_4] = {0};
158 srcDesc.bufLength = NUM_2;
159 srcDesc.buffer = srcBuffer;
160 dstDesc.bufLength = NUM_8;
161 dstDesc.buffer = dstBuffer;
162 FormatConverter::S16MonoToS16Stereo(srcDesc, dstDesc);
163 srcDesc.bufLength = NUM_4;
164 FormatConverter::S16MonoToS16Stereo(srcDesc, dstDesc);
165 }
166
DataAccumulationFromVolumeFuzzTest()167 void DataAccumulationFromVolumeFuzzTest()
168 {
169 uint8_t srcBuffer[NUM_8] = {0};
170 BufferDesc srcDesc = {srcBuffer, NUM_8, NUM_8};
171 AudioStreamData srcData;
172 srcData.streamInfo = {SAMPLE_RATE_48000, ENCODING_PCM, SAMPLE_S32LE, STEREO};
173 srcData.bufferDesc = srcDesc;
174 std::vector<AudioStreamData> srcDataList = {srcData};
175 uint8_t dstBuffer[NUM_8] = {0};
176 BufferDesc dstDesc = {dstBuffer, NUM_8, NUM_8};
177 AudioStreamData dstData;
178 dstData.streamInfo = {SAMPLE_RATE_48000, ENCODING_PCM, SAMPLE_S32LE, STEREO};
179 dstData.bufferDesc = dstDesc;
180 FormatConverter::DataAccumulationFromVolume(srcDataList, dstData);
181 }
182
183 TestFuncs g_testFuncs[TESTSIZE] = {
184 S16StereoToF32StereoFuzzTest,
185 S16StereoToF32MonoFuzzTest,
186 F32MonoToS16StereoFuzzTest,
187 F32StereoToS16StereoFuzzTest,
188 S16MonoToS16StereoFuzzTest,
189 DataAccumulationFromVolumeFuzzTest,
190 };
191
FuzzTest(const uint8_t * rawData,size_t size)192 void FuzzTest(const uint8_t* rawData, size_t size)
193 {
194 if (rawData == nullptr) {
195 return;
196 }
197
198 // initialize data
199 RAW_DATA = rawData;
200 g_dataSize = size;
201 g_pos = 0;
202
203 uint32_t code = GetData<uint32_t>();
204 uint32_t len = GetArrLength(g_testFuncs);
205 if (len > 0) {
206 g_testFuncs[code % len]();
207 } else {
208 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
209 }
210
211 return;
212 }
213 } // namespace AudioStandard
214 } // namesapce OHOS
215
216 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)217 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
218 {
219 if (size < OHOS::AudioStandard::THRESHOLD) {
220 return 0;
221 }
222
223 OHOS::AudioStandard::FuzzTest(data, size);
224 return 0;
225 }
226