1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hpae_capturer_stream_impl_fuzzer.h"
17 #include <memory>
18 #include <string>
19 #include "i_hpae_manager.h"
20
21 namespace OHOS {
22 namespace AudioStandard {
23 using namespace OHOS::AudioStandard::HPAE;
24 static const uint8_t *RAW_DATA = nullptr;
25 static size_t g_dataSize = 0;
26 static size_t g_pos;
27 static const size_t THRESHOLD = 10;
28
29 typedef void (*TestFuncs)();
30
31 template<class T>
GetData()32 T GetData()
33 {
34 T object {};
35 size_t objectSize = sizeof(object);
36
37 if (g_dataSize <= g_pos) {
38 return object;
39 }
40
41 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
42 return object;
43 }
44 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
45 if (ret != EOK) {
46 return {};
47 }
48 g_pos += objectSize;
49 return object;
50 }
51
52 template<class T>
GetArrLength(T & arr)53 uint32_t GetArrLength(T& arr)
54 {
55 if (arr == nullptr) {
56 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
57 return 0;
58 }
59 return sizeof(arr) / sizeof(arr[0]);
60 }
61
StartFuzzTest()62 void StartFuzzTest()
63 {
64 AudioProcessConfig config = {};
65 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
66 stream->Start();
67 }
68
PauseFuzzTest()69 void PauseFuzzTest()
70 {
71 AudioProcessConfig config = {};
72 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
73 stream->Pause();
74 }
75
FlushFuzzTest()76 void FlushFuzzTest()
77 {
78 AudioProcessConfig config = {};
79 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
80 stream->Flush();
81 }
82
StopFuzzTest()83 void StopFuzzTest()
84 {
85 AudioProcessConfig config = {};
86 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
87 stream->Stop();
88 }
89
ReleaseFuzzTest()90 void ReleaseFuzzTest()
91 {
92 AudioProcessConfig config = {};
93 config.capturerInfo.sourceType = SOURCE_TYPE_WAKEUP;
94 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
95 stream->Start();
96 stream->Release();
97 }
98
GetStreamFrameReadFuzzTest()99 void GetStreamFrameReadFuzzTest()
100 {
101 AudioProcessConfig config = {};
102 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
103 uint64_t frameRead = 0;
104 stream->GetStreamFramesRead(frameRead);
105 }
106
GetCurrentTimeStampFuzzTest()107 void GetCurrentTimeStampFuzzTest()
108 {
109 AudioProcessConfig config = {};
110 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
111 uint64_t timeStamp = 0;
112 stream->GetCurrentTimeStamp(timeStamp);
113 }
114
GetLatencyFuzzTest()115 void GetLatencyFuzzTest()
116 {
117 AudioProcessConfig config = {};
118 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
119 uint64_t latency = 0;
120 stream->GetLatency(latency);
121 }
122
OnStreamDataFuzzTest()123 void OnStreamDataFuzzTest()
124 {
125 AudioProcessConfig config = {};
126 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
127 auto readCallback = std::make_shared<IIReadCallback>();
128 stream->RegisterReadCallback(readCallback);
129 AudioCallBackCapturerStreamInfo streamInfo;
130 stream->OnStreamData(streamInfo);
131 }
132
OnStatusUpdateFuzzTest()133 void OnStatusUpdateFuzzTest()
134 {
135 AudioProcessConfig config = {};
136 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
137 auto statusCallback = std::make_shared<IIStatusCallback>();
138 stream->RegisterStatusCallback(statusCallback);
139 stream->OnStatusUpdate(OPERATION_INVALID, 0);
140 }
141
BufferOperationFuzzTest()142 void BufferOperationFuzzTest()
143 {
144 AudioProcessConfig config = {};
145 auto stream = std::make_shared<HpaeCapturerStreamImpl>(config);
146 stream->DequeueBuffer(0);
147 BufferDesc bufferDesc;
148 stream->EnqueueBuffer(bufferDesc);
149 stream->DropBuffer();
150 stream->AbortCallback(0);
151 }
152
153 TestFuncs g_testFuncs[11] = {
154 StartFuzzTest,
155 PauseFuzzTest,
156 FlushFuzzTest,
157 StopFuzzTest,
158 ReleaseFuzzTest,
159 GetStreamFrameReadFuzzTest,
160 GetCurrentTimeStampFuzzTest,
161 GetLatencyFuzzTest,
162 OnStreamDataFuzzTest,
163 OnStatusUpdateFuzzTest,
164 BufferOperationFuzzTest,
165 };
166
FuzzTest(const uint8_t * rawData,size_t size)167 bool FuzzTest(const uint8_t* rawData, size_t size)
168 {
169 if (rawData == nullptr) {
170 return false;
171 }
172
173 // initialize data
174 RAW_DATA = rawData;
175 g_dataSize = size;
176 g_pos = 0;
177
178 uint32_t code = GetData<uint32_t>();
179 uint32_t len = GetArrLength(g_testFuncs);
180 if (len > 0) {
181 g_testFuncs[code % len]();
182 } else {
183 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
184 }
185
186 return true;
187 }
188 } // namespace AudioStandard
189 } // namespace OHOS
190
191 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)192 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
193 {
194 if (size < OHOS::AudioStandard::THRESHOLD) {
195 return 0;
196 }
197
198 OHOS::AudioStandard::FuzzTest(data, size);
199 return 0;
200 }
201