1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "hpaerenderermanager_add_fuzzer.h"
17
18 #include <iostream>
19 #include <cstddef>
20 #include <cstdint>
21 #include <cstring>
22 #include "audio_info.h"
23 #include "audio_policy_server.h"
24 #include "audio_policy_service.h"
25 #include "audio_device_info.h"
26 #include "audio_utils.h"
27 #include "accesstoken_kit.h"
28 #include "nativetoken_kit.h"
29 #include "token_setproc.h"
30 #include "access_token.h"
31 #include "audio_channel_blend.h"
32 #include "volume_ramp.h"
33 #include "audio_speed.h"
34
35 #include "audio_policy_utils.h"
36 #include "audio_stream_descriptor.h"
37 #include "audio_limiter_manager.h"
38 #include "dfx_msg_manager.h"
39 #include "hpae_define.h"
40 #include "hpae_renderer_manager.h"
41 #include "hpae_sink_input_node.h"
42 #include "i_hpae_renderer_manager.h"
43
44 namespace OHOS {
45 namespace AudioStandard {
46 using namespace std;
47 using namespace HPAE;
48
49 static const uint8_t* RAW_DATA = nullptr;
50 static size_t g_dataSize = 0;
51 static size_t g_pos;
52 static std::string g_rootCapturerPath = "/data/source_file_io_48000_2_s16le.pcm";
53 const char* DEFAULT_TEST_DEVICE_CLASS = "file_io";
54 const char* DEFAULT_TEST_DEVICE_NETWORKID = "LocalDevice";
55 constexpr size_t THRESHOLD = 10;
56 constexpr uint8_t TESTSIZE = 22;
57 constexpr int32_t TEST_SLEEP_TIME_20 = 20;
58 constexpr int32_t TEST_SLEEP_TIME_40 = 40;
59 constexpr int32_t FRAME_LENGTH_960 = 960;
60 constexpr int32_t TEST_STREAM_SESSION_ID = 123456;
61 constexpr int32_t DEFAULT_NODE_ID = 1;
62
63 template<class T>
GetData()64 T GetData()
65 {
66 T object {};
67 size_t objectSize = sizeof(object);
68 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
69 return object;
70 }
71 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
72 if (ret != EOK) {
73 return {};
74 }
75 g_pos += objectSize;
76 return object;
77 }
78
79 template<class T>
GetArrLength(T & arr)80 uint32_t GetArrLength(T& arr)
81 {
82 if (arr == nullptr) {
83 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
84 return 0;
85 }
86 return sizeof(arr) / sizeof(arr[0]);
87 }
88
InitHpaeSinkInfo(HpaeSinkInfo & sinkInfo)89 static void InitHpaeSinkInfo(HpaeSinkInfo &sinkInfo)
90 {
91 sinkInfo.deviceNetId = DEFAULT_TEST_DEVICE_NETWORKID;
92 sinkInfo.deviceClass = DEFAULT_TEST_DEVICE_CLASS;
93 sinkInfo.adapterName = DEFAULT_TEST_DEVICE_CLASS;
94 sinkInfo.filePath = "g_rootCapturerPath";
95 sinkInfo.frameLen = FRAME_LENGTH_960;
96 sinkInfo.samplingRate = SAMPLE_RATE_48000;
97 sinkInfo.format = SAMPLE_F32LE;
98 sinkInfo.channels = STEREO;
99 sinkInfo.deviceType = DEVICE_TYPE_SPEAKER;
100 }
101
InitRenderStreamInfo(HpaeStreamInfo & streamInfo)102 static void InitRenderStreamInfo(HpaeStreamInfo &streamInfo)
103 {
104 streamInfo.channels = STEREO;
105 streamInfo.samplingRate = SAMPLE_RATE_44100;
106 streamInfo.format = SAMPLE_S16LE;
107 streamInfo.frameLen = FRAME_LENGTH_960;
108 streamInfo.sessionId = TEST_STREAM_SESSION_ID;
109 streamInfo.streamType = STREAM_MUSIC;
110 streamInfo.streamClassType = HPAE_STREAM_CLASS_TYPE_PLAY;
111 }
112
InitNodeInfo(HpaeNodeInfo & nodeInfo)113 static void InitNodeInfo(HpaeNodeInfo &nodeInfo)
114 {
115 nodeInfo.nodeId = DEFAULT_NODE_ID;
116 nodeInfo.frameLen = FRAME_LENGTH_960;
117 nodeInfo.samplingRate = SAMPLE_RATE_48000;
118 nodeInfo.channels = STEREO;
119 nodeInfo.format = SAMPLE_S16LE;
120 nodeInfo.sceneType = HPAE_SCENE_RECORD;
121 nodeInfo.sourceBufferType = HPAE_SOURCE_BUFFER_TYPE_MIC;
122 }
123
WaitForMsgProcessing(std::shared_ptr<IHpaeRendererManager> & hpaeRendererManager)124 void WaitForMsgProcessing(std::shared_ptr<IHpaeRendererManager> &hpaeRendererManager)
125 {
126 while (hpaeRendererManager->IsMsgProcessing()) {
127 std::this_thread::sleep_for(std::chrono::milliseconds(TEST_SLEEP_TIME_20));
128 }
129 std::this_thread::sleep_for(std::chrono::milliseconds(TEST_SLEEP_TIME_40));
130 }
131
OnStreamData(AudioCallBackStreamInfo & callBackStremInfo)132 int32_t WriteFixedDataCb::OnStreamData(AudioCallBackStreamInfo& callBackStremInfo)
133 {
134 return SUCCESS;
135 }
136
ReadDataCb(const std::string & fileName)137 ReadDataCb::ReadDataCb(const std::string &fileName)
138 {
139 testFile_ = fopen(fileName.c_str(), "ab");
140 if (testFile_ == nullptr) {
141 AUDIO_ERR_LOG("Open file failed");
142 }
143 }
144
~ReadDataCb()145 ReadDataCb::~ReadDataCb()
146 {
147 if (testFile_) {
148 fclose(testFile_);
149 testFile_ = nullptr;
150 }
151 }
152
OnStreamData(AudioCallBackCapturerStreamInfo & callBackStreamInfo)153 int32_t ReadDataCb::OnStreamData(AudioCallBackCapturerStreamInfo &callBackStreamInfo)
154 {
155 return SUCCESS;
156 }
157
HpaeRendererManagerSetPrivacyTypeFuzzTest()158 void HpaeRendererManagerSetPrivacyTypeFuzzTest()
159 {
160 HpaeSinkInfo sinkInfo;
161 InitHpaeSinkInfo(sinkInfo);
162 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
163 rendererManager->Init();
164 uint32_t sessionId = GetData<uint32_t>();
165 int32_t privacyType = GetData<int32_t>();
166 rendererManager->SetPrivacyType(sessionId, privacyType);
167 WaitForMsgProcessing(rendererManager);
168 rendererManager->DeInit();
169 }
170
HpaeRendererManagerGetPrivacyTypeFuzzTest()171 void HpaeRendererManagerGetPrivacyTypeFuzzTest()
172 {
173 HpaeSinkInfo sinkInfo;
174 InitHpaeSinkInfo(sinkInfo);
175 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
176 rendererManager->Init();
177 uint32_t sessionId = GetData<uint32_t>();
178 int32_t privacyType = GetData<int32_t>();
179 rendererManager->GetPrivacyType(sessionId, privacyType);
180 WaitForMsgProcessing(rendererManager);
181 rendererManager->DeInit();
182 }
183
HpaeRendererManagerGetWritableSizeFuzzTest()184 void HpaeRendererManagerGetWritableSizeFuzzTest()
185 {
186 HpaeSinkInfo sinkInfo;
187 InitHpaeSinkInfo(sinkInfo);
188 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
189 rendererManager->Init();
190 uint32_t sessionId = GetData<uint32_t>();
191 rendererManager->GetWritableSize(sessionId);
192 WaitForMsgProcessing(rendererManager);
193 rendererManager->DeInit();
194 }
195
HpaeRendererManagerUpdateSpatializationStateFuzzTest()196 void HpaeRendererManagerUpdateSpatializationStateFuzzTest()
197 {
198 HpaeSinkInfo sinkInfo;
199 InitHpaeSinkInfo(sinkInfo);
200 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
201 rendererManager->Init();
202 uint32_t sessionId = GetData<uint32_t>();
203 bool spatializationEnabled = false;
204 bool headTrackingEnabled = false;
205 rendererManager->UpdateSpatializationState(sessionId, spatializationEnabled, headTrackingEnabled);
206 WaitForMsgProcessing(rendererManager);
207 rendererManager->DeInit();
208 }
209
HpaeRendererManagerUpdateMaxLengthFuzzTest()210 void HpaeRendererManagerUpdateMaxLengthFuzzTest()
211 {
212 HpaeSinkInfo sinkInfo;
213 InitHpaeSinkInfo(sinkInfo);
214 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
215 rendererManager->Init();
216 uint32_t sessionId = GetData<uint32_t>();
217 uint32_t maxLength = GetData<uint32_t>();
218 rendererManager->UpdateMaxLength(sessionId, maxLength);
219 WaitForMsgProcessing(rendererManager);
220 rendererManager->DeInit();
221 }
222
HpaeRendererManagerGetAllSinkInputsInfoFuzzTest()223 void HpaeRendererManagerGetAllSinkInputsInfoFuzzTest()
224 {
225 HpaeSinkInfo sinkInfo;
226 InitHpaeSinkInfo(sinkInfo);
227 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
228 rendererManager->Init();
229 rendererManager->GetAllSinkInputsInfo();
230 WaitForMsgProcessing(rendererManager);
231 rendererManager->DeInit();
232 }
233
HpaeRendererManagerGetSinkInfoFuzzTest()234 void HpaeRendererManagerGetSinkInfoFuzzTest()
235 {
236 HpaeSinkInfo sinkInfo;
237 InitHpaeSinkInfo(sinkInfo);
238 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
239 rendererManager->Init();
240 rendererManager->GetSinkInfo();
241 WaitForMsgProcessing(rendererManager);
242 rendererManager->DeInit();
243 }
244
HpaeRendererManagerAddNodeToSinkFuzzTest()245 void HpaeRendererManagerAddNodeToSinkFuzzTest()
246 {
247 HpaeSinkInfo sinkInfo;
248 InitHpaeSinkInfo(sinkInfo);
249 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
250 rendererManager->Init();
251 HpaeNodeInfo nodeInfo;
252 InitNodeInfo(nodeInfo);
253 auto node = std::make_shared<HpaeSinkInputNode>(nodeInfo);
254 rendererManager->AddNodeToSink(node);
255 WaitForMsgProcessing(rendererManager);
256 rendererManager->DeInit();
257 }
258
HpaeRendererManagerAddAllNodesToSinkFuzzTest()259 void HpaeRendererManagerAddAllNodesToSinkFuzzTest()
260 {
261 HpaeSinkInfo sinkInfo;
262 InitHpaeSinkInfo(sinkInfo);
263 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
264 rendererManager->Init();
265 HpaeNodeInfo nodeInfo;
266 InitNodeInfo(nodeInfo);
267 auto node = std::make_shared<HpaeSinkInputNode>(nodeInfo);
268 vector<std::shared_ptr<HpaeSinkInputNode>> sinkInputs;
269 sinkInputs.emplace_back(node);
270 bool isConnect = false;
271 rendererManager->AddAllNodesToSink(sinkInputs, isConnect);
272 WaitForMsgProcessing(rendererManager);
273 rendererManager->DeInit();
274 }
275
HpaeRendererManagerRegisterReadCallbackFuzzTest()276 void HpaeRendererManagerRegisterReadCallbackFuzzTest()
277 {
278 HpaeSinkInfo sinkInfo;
279 InitHpaeSinkInfo(sinkInfo);
280 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
281 rendererManager->Init();
282 uint32_t sessionId = GetData<uint32_t>();
283 std::shared_ptr<ReadDataCb> readDataCb = std::make_shared<ReadDataCb>(g_rootCapturerPath);
284 rendererManager->RegisterReadCallback(sessionId, readDataCb);
285 WaitForMsgProcessing(rendererManager);
286 rendererManager->DeInit();
287 }
288
HpaeRendererManagerOnNodeStatusUpdateFuzzTest()289 void HpaeRendererManagerOnNodeStatusUpdateFuzzTest()
290 {
291 HpaeSinkInfo sinkInfo;
292 InitHpaeSinkInfo(sinkInfo);
293 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
294 rendererManager->Init();
295 uint32_t sessionId = GetData<uint32_t>();
296 IOperation operation = OPERATION_INVALID;
297 rendererManager->OnNodeStatusUpdate(sessionId, operation);
298 WaitForMsgProcessing(rendererManager);
299 rendererManager->DeInit();
300 }
301
HpaeRendererManagerOnFadeDoneFuzzTest()302 void HpaeRendererManagerOnFadeDoneFuzzTest()
303 {
304 HpaeSinkInfo sinkInfo;
305 InitHpaeSinkInfo(sinkInfo);
306 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
307 rendererManager->Init();
308 uint32_t sessionId = GetData<uint32_t>();
309 IOperation operation = OPERATION_INVALID;
310 rendererManager->OnFadeDone(sessionId, operation);
311 WaitForMsgProcessing(rendererManager);
312 rendererManager->DeInit();
313 }
314
HpaeRendererManagerOnRequestLatencyFuzzTest()315 void HpaeRendererManagerOnRequestLatencyFuzzTest()
316 {
317 HpaeSinkInfo sinkInfo;
318 InitHpaeSinkInfo(sinkInfo);
319 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
320 rendererManager->Init();
321 uint32_t sessionId = GetData<uint32_t>();
322 uint64_t latency = GetData<uint64_t>();
323 rendererManager->OnRequestLatency(sessionId, latency);
324 WaitForMsgProcessing(rendererManager);
325 rendererManager->DeInit();
326 }
327
HpaeRendererManagerOnNotifyQueueFuzzTest()328 void HpaeRendererManagerOnNotifyQueueFuzzTest()
329 {
330 HpaeSinkInfo sinkInfo;
331 InitHpaeSinkInfo(sinkInfo);
332 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
333 rendererManager->Init();
334 rendererManager->OnNotifyQueue();
335 WaitForMsgProcessing(rendererManager);
336 rendererManager->DeInit();
337 }
338
HpaeRendererManagerGetThreadNameFuzzTest()339 void HpaeRendererManagerGetThreadNameFuzzTest()
340 {
341 HpaeSinkInfo sinkInfo;
342 InitHpaeSinkInfo(sinkInfo);
343 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
344 rendererManager->Init();
345 rendererManager->GetThreadName();
346 WaitForMsgProcessing(rendererManager);
347 rendererManager->DeInit();
348 }
349
HpaeRendererManagerDumpSinkInfoFuzzTest()350 void HpaeRendererManagerDumpSinkInfoFuzzTest()
351 {
352 HpaeSinkInfo sinkInfo;
353 InitHpaeSinkInfo(sinkInfo);
354 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
355 rendererManager->Init();
356 rendererManager->DumpSinkInfo();
357 WaitForMsgProcessing(rendererManager);
358 rendererManager->DeInit();
359 }
360
HpaeRendererManagerGetDeviceHDFDumpInfoFuzzTest()361 void HpaeRendererManagerGetDeviceHDFDumpInfoFuzzTest()
362 {
363 HpaeSinkInfo sinkInfo;
364 InitHpaeSinkInfo(sinkInfo);
365 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
366 rendererManager->Init();
367 rendererManager->GetDeviceHDFDumpInfo();
368 WaitForMsgProcessing(rendererManager);
369 rendererManager->DeInit();
370 }
371
HpaeRendererManagerOnDisConnectProcessClusterFuzzTest()372 void HpaeRendererManagerOnDisConnectProcessClusterFuzzTest()
373 {
374 HpaeSinkInfo sinkInfo;
375 InitHpaeSinkInfo(sinkInfo);
376 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
377 rendererManager->Init();
378 HpaeProcessorType sceneType = HPAE_SCENE_DEFAULT;
379 rendererManager->OnDisConnectProcessCluster(sceneType);
380 WaitForMsgProcessing(rendererManager);
381 rendererManager->DeInit();
382 }
383
HpaeRendererManagerSetLoudnessGainFuzzTest()384 void HpaeRendererManagerSetLoudnessGainFuzzTest()
385 {
386 HpaeSinkInfo sinkInfo;
387 InitHpaeSinkInfo(sinkInfo);
388 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
389 rendererManager->Init();
390 uint32_t sessionId = GetData<uint32_t>();
391 float loudnessGain = GetData<float>();
392 rendererManager->SetLoudnessGain(sessionId, loudnessGain);
393 WaitForMsgProcessing(rendererManager);
394 rendererManager->DeInit();
395 }
396
HpaeRendererManagerConnectCoBufferNodeFuzzTest()397 void HpaeRendererManagerConnectCoBufferNodeFuzzTest()
398 {
399 HpaeSinkInfo sinkInfo;
400 InitHpaeSinkInfo(sinkInfo);
401 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
402 rendererManager->Init();
403 HpaeNodeInfo nodeInfo;
404 InitNodeInfo(nodeInfo);
405 std::shared_ptr<HpaeCoBufferNode> coBufferNode = std::make_shared<HpaeCoBufferNode>();
406 coBufferNode->SetNodeInfo(nodeInfo);
407 rendererManager->ConnectCoBufferNode(coBufferNode);
408 WaitForMsgProcessing(rendererManager);
409 rendererManager->DeInit();
410 }
411
HpaeRendererManagerDisConnectCoBufferNodeFuzzTest()412 void HpaeRendererManagerDisConnectCoBufferNodeFuzzTest()
413 {
414 HpaeSinkInfo sinkInfo;
415 InitHpaeSinkInfo(sinkInfo);
416 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
417 rendererManager->Init();
418 HpaeNodeInfo nodeInfo;
419 InitNodeInfo(nodeInfo);
420 std::shared_ptr<HpaeCoBufferNode> coBufferNode = std::make_shared<HpaeCoBufferNode>();
421 coBufferNode->SetNodeInfo(nodeInfo);
422 rendererManager->DisConnectCoBufferNode(coBufferNode);
423 WaitForMsgProcessing(rendererManager);
424 rendererManager->DeInit();
425 }
426
HpaeRendererManagerStartWithSyncIdFuzzTest()427 void HpaeRendererManagerStartWithSyncIdFuzzTest()
428 {
429 HpaeSinkInfo sinkInfo;
430 InitHpaeSinkInfo(sinkInfo);
431 auto rendererManager = IHpaeRendererManager::CreateRendererManager(sinkInfo);
432 rendererManager->Init();
433 uint32_t sessionId = GetData<uint32_t>();
434 int32_t syncId = GetData<int32_t>();
435 rendererManager->StartWithSyncId(sessionId, syncId);
436 WaitForMsgProcessing(rendererManager);
437 rendererManager->DeInit();
438 }
439
440 typedef void (*TestFuncs)();
441 TestFuncs g_testFuncs[TESTSIZE] = {
442 HpaeRendererManagerSetPrivacyTypeFuzzTest,
443 HpaeRendererManagerGetPrivacyTypeFuzzTest,
444 HpaeRendererManagerGetWritableSizeFuzzTest,
445 HpaeRendererManagerUpdateSpatializationStateFuzzTest,
446 HpaeRendererManagerUpdateMaxLengthFuzzTest,
447 HpaeRendererManagerGetAllSinkInputsInfoFuzzTest,
448 HpaeRendererManagerGetSinkInfoFuzzTest,
449 HpaeRendererManagerAddNodeToSinkFuzzTest,
450 HpaeRendererManagerAddAllNodesToSinkFuzzTest,
451 HpaeRendererManagerRegisterReadCallbackFuzzTest,
452 HpaeRendererManagerOnNodeStatusUpdateFuzzTest,
453 HpaeRendererManagerOnFadeDoneFuzzTest,
454 HpaeRendererManagerOnRequestLatencyFuzzTest,
455 HpaeRendererManagerOnNotifyQueueFuzzTest,
456 HpaeRendererManagerGetThreadNameFuzzTest,
457 HpaeRendererManagerDumpSinkInfoFuzzTest,
458 HpaeRendererManagerGetDeviceHDFDumpInfoFuzzTest,
459 HpaeRendererManagerOnDisConnectProcessClusterFuzzTest,
460 HpaeRendererManagerSetLoudnessGainFuzzTest,
461 HpaeRendererManagerConnectCoBufferNodeFuzzTest,
462 HpaeRendererManagerDisConnectCoBufferNodeFuzzTest,
463 HpaeRendererManagerStartWithSyncIdFuzzTest,
464 };
465
FuzzTest(const uint8_t * rawData,size_t size)466 bool FuzzTest(const uint8_t* rawData, size_t size)
467 {
468 if (rawData == nullptr) {
469 return false;
470 }
471
472 // initialize data
473 RAW_DATA = rawData;
474 g_dataSize = size;
475 g_pos = 0;
476
477 uint32_t code = GetData<uint32_t>();
478 uint32_t len = GetArrLength(g_testFuncs);
479 if (len > 0) {
480 g_testFuncs[code % len]();
481 } else {
482 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
483 }
484
485 return true;
486 }
487 } // namespace AudioStandard
488 } // namesapce OHOS
489
490 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)491 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
492 {
493 if (size < OHOS::AudioStandard::THRESHOLD) {
494 return 0;
495 }
496
497 OHOS::AudioStandard::FuzzTest(data, size);
498 return 0;
499 }
500