1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "lowpoweraudiosink_fuzzer.h"
17 #include <unistd.h>
18 #include <fcntl.h>
19 #include "fuzzer/FuzzedDataProvider.h"
20 #include <cstddef>
21 #include <cstdint>
22 #include <fcntl.h>
23 #include <fstream>
24 #include <avcodec_mime_type.h>
25 #include "buffer/avbuffer.h"
26
27 using namespace std;
28 using namespace OHOS;
29 using namespace OHOS::Media;
30
31 namespace {
32 const char *DATA_PATH = "/data/test/input.mp4";
33 const int32_t SYSTEM_ABILITY_ID = 3002;
34 const bool RUN_ON_CREATE = false;
35 constexpr int32_t AUDIO_MIME_TYPES_SIZE = 13;
36 constexpr int32_t STREAM_LENGTH = 13;
37 constexpr uint32_t SLEEP_TIME = 1;
38
39 constexpr std::array<std::string_view, AUDIO_MIME_TYPES_SIZE> AUDIO_MIME_TYPES = {
40 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_AAC,
41 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_FLAC,
42 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_VORBIS,
43 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_AMRNB,
44 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_OPUS,
45 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_MPEG,
46 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_AMRWB,
47 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_VIVID,
48 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_G711MU,
49 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_APE,
50 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_LBVC,
51 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_COOK,
52 MediaAVCodec::AVCodecMimeType::MEDIA_MIMETYPE_AUDIO_AC3
53 };
54 }
55
56 namespace OHOS {
57 namespace Media {
58
LowPowerAudioSinkFuzz()59 LowPowerAudioSinkFuzz::LowPowerAudioSinkFuzz()
60 {
61 }
62
~LowPowerAudioSinkFuzz()63 LowPowerAudioSinkFuzz::~LowPowerAudioSinkFuzz()
64 {
65 }
66
GetAudioSinkStub()67 sptr<IRemoteStub<IStandardLppAudioStreamerService>> LowPowerAudioSinkFuzz::GetAudioSinkStub()
68 {
69 std::shared_ptr<MediaServer> mediaServer =
70 std::make_shared<MediaServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
71 sptr<IRemoteObject> listener = new(std::nothrow) MediaListenerStubFuzzer();
72 sptr<IRemoteObject> lowPowerAudioSink = mediaServer->GetSubSystemAbility(
73 IStandardMediaService::MediaSystemAbility::MEDIA_LPP_AUDIO_PLAYER, listener);
74 if (lowPowerAudioSink == nullptr) {
75 return nullptr;
76 }
77 sptr<IRemoteStub<IStandardLppAudioStreamerService>> lowPowerAudioSinkStub =
78 iface_cast<IRemoteStub<IStandardLppAudioStreamerService>>(lowPowerAudioSink);
79 return lowPowerAudioSinkStub;
80 }
81
ReadAVBufferFromLocalFile(int32_t start,int32_t size)82 std::shared_ptr<AVBuffer> LowPowerAudioSinkFuzz::ReadAVBufferFromLocalFile(int32_t start, int32_t size)
83 {
84 std::ifstream inputFile(DATA_PATH, std::ios::binary);
85 if (!inputFile.is_open()) {
86 return nullptr;
87 }
88 inputFile.seekg(0, std::ios::end);
89
90 inputFile.seekg(start, std::ios::beg);
91
92 auto allocator = AVAllocatorFactory::CreateSharedAllocator(MemoryFlag::MEMORY_READ_WRITE);
93 std::shared_ptr<AVBuffer> avBuffer = AVBuffer::CreateAVBuffer(allocator, size);
94 if (avBuffer == nullptr || avBuffer->memory_ == nullptr || avBuffer->memory_->GetAddr() == nullptr) {
95 return nullptr;
96 }
97 inputFile.read(reinterpret_cast<char *>(avBuffer->memory_->GetAddr()), size);
98 avBuffer->memory_->SetSize(size);
99 return avBuffer;
100 }
101
RunFuzz(uint8_t * data,size_t size)102 bool LowPowerAudioSinkFuzz::RunFuzz(uint8_t *data, size_t size)
103 {
104 FuzzedDataProvider fdp(data, size);
105 sptr<IRemoteStub<IStandardLppAudioStreamerService>> lowPowerAudioSinkStub = GetAudioSinkStub();
106 if (lowPowerAudioSinkStub == nullptr) {
107 return false;
108 }
109 std::string mime = AUDIO_MIME_TYPES[abs(fdp.ConsumeIntegral<int32_t>())%AUDIO_MIME_TYPES_SIZE].data();
110 lowPowerAudioSinkStub->Init(mime);
111 Format format;
112 lowPowerAudioSinkStub->SetParameter(format);
113 lowPowerAudioSinkStub->Configure(format);
114 lowPowerAudioSinkStub->RegisterCallback();
115 lowPowerAudioSinkStub->SetLppAudioStreamerCallback();
116 lowPowerAudioSinkStub->GetStreamerId();
117 lowPowerAudioSinkStub->Prepare();
118 lowPowerAudioSinkStub->Start();
119 lowPowerAudioSinkStub->Pause();
120 lowPowerAudioSinkStub->Resume();
121 lowPowerAudioSinkStub->Flush();
122 lowPowerAudioSinkStub->SetVolume(fdp.ConsumeFloatingPoint<float>());
123 lowPowerAudioSinkStub->SetPlaybackSpeed(fdp.ConsumeFloatingPoint<float>());
124 lowPowerAudioSinkStub->ReturnFrames(nullptr);
125 lowPowerAudioSinkStub->SetLppVideoStreamerId(fdp.ConsumeRandomLengthString(STREAM_LENGTH));
126 lowPowerAudioSinkStub->Stop();
127 lowPowerAudioSinkStub->Reset();
128 lowPowerAudioSinkStub->Release();
129 sleep(SLEEP_TIME);
130 return true;
131 }
132 }
133 }
134
135 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)136 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
137 {
138 if (size < sizeof(int64_t)) {
139 return false;
140 }
141 int32_t fd = open(DATA_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
142 if (fd < 0) {
143 return false;
144 }
145 int len = write(fd, data, size);
146 if (len <= 0) {
147 close(fd);
148 return false;
149 }
150 close(fd);
151 LowPowerAudioSinkFuzz audioSink;
152 audioSink.RunFuzz(data, size);
153 unlink(DATA_PATH);
154 return 0;
155 }
156