1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "playerapi_fuzzer.h"
17 #include <iostream>
18 #include <unistd.h>
19 #include "stub_common.h"
20 #include "media_server.h"
21 #include "media_parcel.h"
22 #include "i_standard_player_service.h"
23 #include <fcntl.h>
24 #include "i_standard_player_listener.h"
25 #include "player.h"
26 #include "meta/media_types.h"
27 #include "common/media_core.h"
28 #include "fuzzer/FuzzedDataProvider.h"
29
30 using namespace std;
31 using namespace OHOS;
32 using namespace OHOS::Media;
33
34 namespace OHOS {
35 namespace Media {
36 const char *DATA_PATH = "/data/test/fuzz_create.mp4";
37 const int32_t SYSTEM_ABILITY_ID = 3002;
38 const bool RUN_ON_CREATE = false;
39 const int32_t PLAY_TIME_1_SEC = 1;
40 int32_t g_duration = 0;
41
PlayerApiFuzzer()42 PlayerApiFuzzer::PlayerApiFuzzer()
43 {
44 }
45
~PlayerApiFuzzer()46 PlayerApiFuzzer::~PlayerApiFuzzer()
47 {
48 }
49
SelectTrack(const sptr<IRemoteStub<IStandardPlayerService>> & playerStub)50 void PlayerApiFuzzer::SelectTrack(const sptr<IRemoteStub<IStandardPlayerService>> &playerStub)
51 {
52 std::vector<Format> audioTrack;
53 std::vector<int32_t> audioTrackIds;
54 int32_t currentAudioTrackIndex = -1;
55 playerStub->GetAudioTrackInfo(audioTrack);
56 playerStub->GetCurrentTrack(MediaType::MEDIA_TYPE_AUD, currentAudioTrackIndex);
57 for (Format audioTrackFormat: audioTrack) {
58 int32_t trackIndex = -1;
59 audioTrackFormat.GetIntValue("track_index", trackIndex);
60 audioTrackIds.push_back(trackIndex);
61 }
62 for (int32_t trackIndex: audioTrackIds) {
63 if (trackIndex != currentAudioTrackIndex) {
64 playerStub->SelectTrack(trackIndex, PlayerSwitchMode::SWITCH_SMOOTH);
65 playerStub->GetCurrentTrack(MediaType::MEDIA_TYPE_AUD, currentAudioTrackIndex);
66 sleep(PLAY_TIME_1_SEC);
67 playerStub->DeselectTrack(currentAudioTrackIndex);
68 playerStub->GetCurrentTrack(MediaType::MEDIA_TYPE_AUD, currentAudioTrackIndex);
69 sleep(PLAY_TIME_1_SEC);
70 }
71 }
72 return;
73 }
74
GetPlayStub()75 sptr<IRemoteStub<IStandardPlayerService>> PlayerApiFuzzer::GetPlayStub()
76 {
77 std::shared_ptr<MediaServer> mediaServer =
78 std::make_shared<MediaServer>(SYSTEM_ABILITY_ID, RUN_ON_CREATE);
79 sptr<IRemoteObject> listener = new(std::nothrow) MediaListenerStubFuzzer();
80 sptr<IRemoteObject> player = mediaServer->GetSubSystemAbility(
81 IStandardMediaService::MediaSystemAbility::MEDIA_PLAYER, listener);
82 if (player == nullptr) {
83 return nullptr;
84 }
85 sptr<IRemoteStub<IStandardPlayerService>> playerStub = iface_cast<IRemoteStub<IStandardPlayerService>>(player);
86 return playerStub;
87 }
88
RunFuzz(uint8_t * data,size_t size)89 bool PlayerApiFuzzer::RunFuzz(uint8_t *data, size_t size)
90 {
91 int32_t fd = open(DATA_PATH, O_RDONLY);
92 sptr<IRemoteStub<IStandardPlayerService>> playerStub = GetPlayStub();
93 if (playerStub == nullptr) {
94 return false;
95 }
96 playerStub->SetSource(fd, 0, size);
97 sleep(PLAY_TIME_1_SEC);
98 playerStub->SetRenderFirstFrame(false);
99 AVPlayStrategy playbackStrategy = {.mutedMediaType = OHOS::Media::MediaType::MEDIA_TYPE_AUD};
100 playerStub->SetPlaybackStrategy(playbackStrategy);
101 sleep(PLAY_TIME_1_SEC);
102 playerStub->Prepare();
103 sleep(PLAY_TIME_1_SEC);
104 playerStub->SelectBitRate(0);
105 sleep(PLAY_TIME_1_SEC);
106 playerStub->SetVolume(1, 1);
107 sleep(PLAY_TIME_1_SEC);
108 playerStub->SetPlaybackSpeed(SPEED_FORWARD_0_50_X);
109 sleep(PLAY_TIME_1_SEC);
110 playerStub->GetDuration(g_duration);
111 if (g_duration == 0) {
112 playerStub->Release();
113 sleep(PLAY_TIME_1_SEC);
114 return false;
115 }
116 playerStub->SetPlayRange(0, g_duration);
117 sleep(PLAY_TIME_1_SEC);
118 playerStub->SetMediaMuted(OHOS::Media::MediaType::MEDIA_TYPE_AUD, true);
119 sleep(PLAY_TIME_1_SEC);
120 SelectTrack(playerStub);
121 FuzzedDataProvider fdp(data, size);
122 int seekTime = abs(fdp.ConsumeIntegral<int32_t>())%g_duration;
123 playerStub->Seek(seekTime, SEEK_NEXT_SYNC);
124 sleep(PLAY_TIME_1_SEC);
125 playerStub->Play();
126 sleep(PLAY_TIME_1_SEC);
127 playerStub->Pause();
128 sleep(PLAY_TIME_1_SEC);
129 playerStub->Play();
130 sleep(PLAY_TIME_1_SEC);
131 playerStub->SetLooping(true);
132 sleep(PLAY_TIME_1_SEC);
133 playerStub->Stop();
134 sleep(PLAY_TIME_1_SEC);
135 playerStub->Release();
136 sleep(PLAY_TIME_1_SEC);
137 close(fd);
138 return true;
139 }
140 }
141 }
142
143 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(uint8_t * data,size_t size)144 extern "C" int LLVMFuzzerTestOneInput(uint8_t* data, size_t size)
145 {
146 if (size < sizeof(int64_t)) {
147 return false;
148 }
149 int32_t fd = open(DATA_PATH, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
150 if (fd < 0) {
151 return false;
152 }
153 int len = write(fd, data, size);
154 if (len <= 0) {
155 close(fd);
156 return false;
157 }
158 close(fd);
159 PlayerApiFuzzer player;
160 player.RunFuzz(data, size);
161 unlink(DATA_PATH);
162 return 0;
163 }
164
165