1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <iostream>
17 #include <cstddef>
18 #include <cstdint>
19 #include <vector>
20 #include <memory>
21 #include <queue>
22 #include <string>
23 #undef private
24 #include "hpae_node.h"
25 #include "hpae_pcm_buffer.h"
26 #include "source/i_audio_capture_source.h"
27 #include "common/hdi_adapter_type.h"
28 #include "common/hdi_adapter_info.h"
29 #include "manager/hdi_adapter_manager.h"
30 #include "hpae_source_input_node.h"
31 #include "hpae_source_output_node.h"
32 #include "audio_engine_log.h"
33 using namespace std;
34 using namespace OHOS::AudioStandard::HPAE;
35
36
37 namespace OHOS {
38 namespace AudioStandard {
39 using namespace std;
40 static const uint8_t *RAW_DATA = nullptr;
41 static size_t g_dataSize = 0;
42 static size_t g_pos;
43 const size_t THRESHOLD = 10;
44 const uint32_t DEFAULT_FRAME_LENGTH = 960;
45 const uint32_t DEFAULT_NODE_ID = 1243;
46 static vector<StreamManagerState> streamManagerStateMap = {
47 STREAM_MANAGER_INVALID,
48 STREAM_MANAGER_NEW,
49 STREAM_MANAGER_IDLE,
50 STREAM_MANAGER_RUNNING,
51 STREAM_MANAGER_SUSPENDED,
52 STREAM_MANAGER_RELEASED,
53 };
54
55 static vector<HpaeSourceInputNodeType> hpaeSourceInputNodeTypeMap = {
56 HPAE_SOURCE_DEFAULT,
57 HPAE_SOURCE_MIC,
58 HPAE_SOURCE_MIC_EC,
59 HPAE_SOURCE_EC,
60 HPAE_SOURCE_MICREF,
61 };
62
63 typedef void (*TestPtr)(const uint8_t *, size_t);
64
65 template<class T>
GetData()66 T GetData()
67 {
68 T object {};
69 size_t objectSize = sizeof(object);
70 if (RAW_DATA == nullptr || objectSize > g_dataSize - g_pos) {
71 return object;
72 }
73 errno_t ret = memcpy_s(&object, objectSize, RAW_DATA + g_pos, objectSize);
74 if (ret != EOK) {
75 return {};
76 }
77 g_pos += objectSize;
78 return object;
79 }
80
81 template<class T>
GetArrLength(T & arr)82 uint32_t GetArrLength(T& arr)
83 {
84 if (arr == nullptr) {
85 AUDIO_INFO_LOG("%{public}s: The array length is equal to 0", __func__);
86 return 0;
87 }
88 return sizeof(arr) / sizeof(arr[0]);
89 }
90
GetTestNodeInfo(HpaeNodeInfo & nodeInfo)91 static void GetTestNodeInfo(HpaeNodeInfo &nodeInfo)
92 {
93 nodeInfo.nodeId = DEFAULT_NODE_ID;
94 nodeInfo.frameLen = DEFAULT_FRAME_LENGTH;
95 nodeInfo.samplingRate = SAMPLE_RATE_48000;
96 nodeInfo.channels = STEREO;
97 nodeInfo.format = SAMPLE_S16LE;
98 nodeInfo.sceneType = HPAE_SCENE_RECORD;
99 nodeInfo.sourceBufferType = HPAE_SOURCE_BUFFER_TYPE_MIC;
100 }
101
DoProcessFuzzTest()102 void DoProcessFuzzTest()
103 {
104 HpaeNodeInfo nodeInfo;
105 GetTestNodeInfo(nodeInfo);
106 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
107 hpaeSourceInputNode->DoProcess();
108 }
109
ResetFuzzTest()110 void ResetFuzzTest()
111 {
112 HpaeNodeInfo nodeInfo;
113 GetTestNodeInfo(nodeInfo);
114 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
115 hpaeSourceInputNode->Reset();
116 }
117
ResetAllFuzzTest()118 void ResetAllFuzzTest()
119 {
120 HpaeNodeInfo nodeInfo;
121 GetTestNodeInfo(nodeInfo);
122 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
123 hpaeSourceInputNode->ResetAll();
124 }
125
GetSharedInstanceFuzzTest()126 void GetSharedInstanceFuzzTest()
127 {
128 HpaeNodeInfo nodeInfo;
129 GetTestNodeInfo(nodeInfo);
130 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
131 hpaeSourceInputNode->GetSharedInstance();
132 }
133
GetOutputPortBufferTypeFuzzTest()134 void GetOutputPortBufferTypeFuzzTest()
135 {
136 HpaeNodeInfo nodeInfo;
137 GetTestNodeInfo(nodeInfo);
138 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
139 hpaeSourceInputNode->GetOutputPortBufferType(nodeInfo);
140 }
141
GetCapturerSourceInstanceFuzzTest()142 void GetCapturerSourceInstanceFuzzTest()
143 {
144 HpaeNodeInfo nodeInfo;
145 GetTestNodeInfo(nodeInfo);
146 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
147 std::string deviceClass = "file_io";
148 std::string deviceNetId = "LocalDevice";
149 SourceType sourceType = SOURCE_TYPE_MIC;
150 std::string sourceName = "mic";
151 hpaeSourceInputNode->GetCapturerSourceInstance(deviceClass, deviceNetId, sourceType, sourceName);
152 }
153
CapturerSourceInitFuzzTest()154 void CapturerSourceInitFuzzTest()
155 {
156 HpaeNodeInfo nodeInfo;
157 GetTestNodeInfo(nodeInfo);
158 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
159 IAudioSourceAttr attr;
160 hpaeSourceInputNode->CapturerSourceInit(attr);
161 }
162
CapturerSourceDeInitFuzzTest()163 void CapturerSourceDeInitFuzzTest()
164 {
165 HpaeNodeInfo nodeInfo;
166 GetTestNodeInfo(nodeInfo);
167 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
168 hpaeSourceInputNode->CapturerSourceDeInit();
169 }
170
CapturerSourceFlushFuzzTest()171 void CapturerSourceFlushFuzzTest()
172 {
173 HpaeNodeInfo nodeInfo;
174 GetTestNodeInfo(nodeInfo);
175 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
176 hpaeSourceInputNode->CapturerSourceFlush();
177 }
178
CapturerSourcePauseFuzzTest()179 void CapturerSourcePauseFuzzTest()
180 {
181 HpaeNodeInfo nodeInfo;
182 GetTestNodeInfo(nodeInfo);
183 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
184 hpaeSourceInputNode->CapturerSourcePause();
185 }
186
CapturerSourceResetFuzzTest()187 void CapturerSourceResetFuzzTest()
188 {
189 HpaeNodeInfo nodeInfo;
190 GetTestNodeInfo(nodeInfo);
191 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
192 hpaeSourceInputNode->CapturerSourceReset();
193 }
194
CapturerSourceResumeFuzzTest()195 void CapturerSourceResumeFuzzTest()
196 {
197 HpaeNodeInfo nodeInfo;
198 GetTestNodeInfo(nodeInfo);
199 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
200 hpaeSourceInputNode->CapturerSourceResume();
201 }
202
CapturerSourceStartFuzzTest()203 void CapturerSourceStartFuzzTest()
204 {
205 HpaeNodeInfo nodeInfo;
206 GetTestNodeInfo(nodeInfo);
207 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
208 hpaeSourceInputNode->CapturerSourceStart();
209 }
210
CapturerSourceStopFuzzTest()211 void CapturerSourceStopFuzzTest()
212 {
213 HpaeNodeInfo nodeInfo;
214 GetTestNodeInfo(nodeInfo);
215 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
216 hpaeSourceInputNode->CapturerSourceStop();
217 }
218
GetSourceStateFuzzTest()219 void GetSourceStateFuzzTest()
220 {
221 HpaeNodeInfo nodeInfo;
222 GetTestNodeInfo(nodeInfo);
223 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
224 hpaeSourceInputNode->GetSourceState();
225 }
226
SetSourceStateFuzzTest()227 void SetSourceStateFuzzTest()
228 {
229 HpaeNodeInfo nodeInfo;
230 GetTestNodeInfo(nodeInfo);
231 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
232 uint32_t index = GetData<uint32_t>() % streamManagerStateMap.size();
233 StreamManagerState sourceState = streamManagerStateMap[index];
234 hpaeSourceInputNode->SetSourceState(sourceState);
235 }
236
WriteCapturerDataFuzzTest()237 void WriteCapturerDataFuzzTest()
238 {
239 HpaeNodeInfo nodeInfo;
240 GetTestNodeInfo(nodeInfo);
241 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
242 uint32_t dataSize = static_cast<uint32_t>(GetData<uint16_t>()) + 1;
243 std::vector<char> testData(dataSize);
244 hpaeSourceInputNode->WriteCapturerData(testData.data(), dataSize);
245 }
246
GetOutputPortNumFuzzTest()247 void GetOutputPortNumFuzzTest()
248 {
249 HpaeNodeInfo nodeInfo;
250 GetTestNodeInfo(nodeInfo);
251 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
252 hpaeSourceInputNode->GetOutputPortNum();
253 }
254
GetSourceInputNodeTypeFuzzTest()255 void GetSourceInputNodeTypeFuzzTest()
256 {
257 HpaeNodeInfo nodeInfo;
258 GetTestNodeInfo(nodeInfo);
259 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
260 hpaeSourceInputNode->GetSourceInputNodeType();
261 }
262
SetSourceInputNodeTypeFuzzTest()263 void SetSourceInputNodeTypeFuzzTest()
264 {
265 HpaeNodeInfo nodeInfo;
266 GetTestNodeInfo(nodeInfo);
267 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
268 uint32_t index = GetData<uint32_t>() % hpaeSourceInputNodeTypeMap.size();
269 HpaeSourceInputNodeType type = hpaeSourceInputNodeTypeMap[index];
270 hpaeSourceInputNode->SetSourceInputNodeType(type);
271 }
272
GetNodeInfoWithInfoFuzzTest()273 void GetNodeInfoWithInfoFuzzTest()
274 {
275 HpaeNodeInfo nodeInfo;
276 GetTestNodeInfo(nodeInfo);
277 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
278 HpaeSourceBufferType type;
279 hpaeSourceInputNode->GetNodeInfoWithInfo(type);
280 }
281
UpdateAppsUidAndSessionIdFuzzTest()282 void UpdateAppsUidAndSessionIdFuzzTest()
283 {
284 HpaeNodeInfo nodeInfo;
285 GetTestNodeInfo(nodeInfo);
286 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
287 std::vector<int32_t> appsUid = {GetData<int32_t>()};
288 std::vector<int32_t> sessionsId = {GetData<int32_t>()};
289 hpaeSourceInputNode->UpdateAppsUidAndSessionId(appsUid, sessionsId);
290 }
291
GetCaptureIdFuzzTest()292 void GetCaptureIdFuzzTest()
293 {
294 HpaeNodeInfo nodeInfo;
295 GetTestNodeInfo(nodeInfo);
296 auto hpaeSourceInputNode = std::make_shared<HpaeSourceInputNode>(nodeInfo);
297 hpaeSourceInputNode->GetCaptureId();
298 }
299
300 typedef void (*TestFuncs[23])();
301
302 TestFuncs g_testFuncs = {
303 DoProcessFuzzTest,
304 ResetFuzzTest,
305 ResetAllFuzzTest,
306 GetSharedInstanceFuzzTest,
307 GetOutputPortBufferTypeFuzzTest,
308 GetCapturerSourceInstanceFuzzTest,
309 CapturerSourceInitFuzzTest,
310 CapturerSourceDeInitFuzzTest,
311 CapturerSourceFlushFuzzTest,
312 CapturerSourcePauseFuzzTest,
313 CapturerSourceResetFuzzTest,
314 CapturerSourceResumeFuzzTest,
315 CapturerSourceStartFuzzTest,
316 CapturerSourceStopFuzzTest,
317 GetSourceStateFuzzTest,
318 SetSourceStateFuzzTest,
319 WriteCapturerDataFuzzTest,
320 GetOutputPortNumFuzzTest,
321 GetSourceInputNodeTypeFuzzTest,
322 SetSourceInputNodeTypeFuzzTest,
323 GetNodeInfoWithInfoFuzzTest,
324 UpdateAppsUidAndSessionIdFuzzTest,
325 GetCaptureIdFuzzTest,
326 };
327
FuzzTest(const uint8_t * rawData,size_t size)328 bool FuzzTest(const uint8_t* rawData, size_t size)
329 {
330 if (rawData == nullptr) {
331 return false;
332 }
333
334 // initialize data
335 RAW_DATA = rawData;
336 g_dataSize = size;
337 g_pos = 0;
338
339 uint32_t code = GetData<uint32_t>();
340 uint32_t len = GetArrLength(g_testFuncs);
341 if (len > 0) {
342 g_testFuncs[code % len]();
343 } else {
344 AUDIO_INFO_LOG("%{public}s: The len length is equal to 0", __func__);
345 }
346
347 return true;
348 }
349
350 } // namespace AudioStandard
351 } // namesapce OHOS
352
353 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)354 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
355 {
356 if (size < OHOS::AudioStandard::THRESHOLD) {
357 return 0;
358 }
359
360 OHOS::AudioStandard::FuzzTest(data, size);
361 return 0;
362 }
363