1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <cstring>
20 #include "audio_info.h"
21 #include "audio_policy_server.h"
22 #include "audio_policy_service.h"
23 #include "audio_device_info.h"
24 #include "audio_utils.h"
25 #include "accesstoken_kit.h"
26 #include "nativetoken_kit.h"
27 #include "token_setproc.h"
28 #include "access_token.h"
29 #include "audio_channel_blend.h"
30 #include "volume_ramp.h"
31 #include "audio_speed.h"
32
33 #include "audio_policy_utils.h"
34 #include "audio_stream_descriptor.h"
35 #include "audio_limiter_manager.h"
36 #include "dfx_msg_manager.h"
37
38 #include "audio_source_clock.h"
39 #include "capturer_clock_manager.h"
40 #include "hpae_policy_manager.h"
41 #include "audio_policy_state_monitor.h"
42 #include "audio_device_info.h"
43 #include "audio_server.h"
44 #include "audio_effect_volume.h"
45 #include "futex_tool.h"
46 #include "format_converter.h"
47
48 namespace OHOS {
49 namespace AudioStandard {
50 using namespace std;
51
52 static const uint8_t* RAW_DATA = nullptr;
53 static size_t g_dataSize = 0;
54 static size_t g_pos;
55 const size_t THRESHOLD = 10;
56 const uint8_t TESTSIZE = 2;
57 static int32_t NUM_2 = 2;
58 static constexpr int64_t TIMEOUT_IN_NS = 300000000;
59 static constexpr uint32_t CYCLES_TIMES = 500;
60
61 typedef void (*TestFuncs)();
62
63 template<class T>
GetData()64 T GetData()
65 {
66 T object {};
67 size_t objectSize = sizeof(object);
68 if (g_dataSize < g_pos) {
69 return object;
70 }
71 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
72 return object;
73 }
74 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
75 if (ret != EOK) {
76 return {};
77 }
78 g_pos += objectSize;
79 return object;
80 }
81
82 template<class T>
GetArrLength(T & arr)83 uint32_t GetArrLength(T& arr)
84 {
85 if (arr == nullptr) {
86 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
87 return 0;
88 }
89 return sizeof(arr) / sizeof(arr[0]);
90 }
91
FutexWakeFuzzTest()92 void FutexWakeFuzzTest()
93 {
94 std::atomic<uint32_t> futexVar = GetData<uint32_t>() % NUM_2 == 0 ? IS_READY : IS_NOT_READY;
95 std::atomic<uint32_t> readIndex = 0;
96 std::atomic<uint32_t> writeIndex = 0;
97 std::thread threadWrite([&futexVar, &writeIndex] () {
98 writeIndex++;
99 FutexTool::FutexWake(&futexVar, IS_READY);
100 });
101 FutexTool::FutexWait(&futexVar, TIMEOUT_IN_NS, [&] () {
102 return writeIndex > readIndex;
103 });
104 threadWrite.join();
105 }
106
FutexWaitFuzzTest()107 void FutexWaitFuzzTest()
108 {
109 std::atomic<uint32_t> futexVar = GetData<uint32_t>() % NUM_2 == 0 ? IS_READY : IS_NOT_READY;
110 std::atomic<uint32_t> writeIndex = 0;
111 std::thread threadWrite([&futexVar, &writeIndex] () {
112 while (writeIndex++ < CYCLES_TIMES) {
113 if (writeIndex >= CYCLES_TIMES) {
114 break;
115 }
116 }
117 FutexTool::FutexWake(&futexVar, IS_READY);
118 });
119 FutexTool::FutexWait(&futexVar, TIMEOUT_IN_NS, [&] () {
120 return writeIndex >= CYCLES_TIMES;
121 });
122 threadWrite.join();
123 }
124
125 TestFuncs g_testFuncs[TESTSIZE] = {
126 FutexWakeFuzzTest,
127 FutexWaitFuzzTest,
128 };
129
FuzzTest(const uint8_t * rawData,size_t size)130 void FuzzTest(const uint8_t* rawData, size_t size)
131 {
132 if (rawData == nullptr) {
133 return;
134 }
135
136 // initialize data
137 RAW_DATA = rawData;
138 g_dataSize = size;
139 g_pos = 0;
140
141 uint32_t code = GetData<uint32_t>();
142 uint32_t len = GetArrLength(g_testFuncs);
143 if (len > 0) {
144 g_testFuncs[code % len]();
145 } else {
146 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
147 }
148
149 return;
150 }
151 } // namespace AudioStandard
152 } // namesapce OHOS
153
154 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)155 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
156 {
157 if (size < OHOS::AudioStandard::THRESHOLD) {
158 return 0;
159 }
160
161 OHOS::AudioStandard::FuzzTest(data, size);
162 return 0;
163 }
164